create-ailk 0.5.0 → 0.6.1

package/templates/apps/api/src/services/__tests__/dunning-policy.test.ts

@@ -0,0 +1,368 @@
+/**
+ * @file dunning-policy.test.ts
+ * @description Unit tests for the per-tenant dunning grace policy (#6034
+ * §§ D4, D5) — the § D4 resolution table row by row, the key form, the
+ * rejecting query, and both exported predicates across every recorded
+ * state.
+ *
+ * External dependency boundaries mocked:
+ *   - @working-theory/database (via moduleNameMapper → prisma-client.js mock; prisma singleton via __mocks__/prisma.ts)
+ *   - @working-theory/observability logger
+ *
+ * `isModuleEnabled` reads `process.env.AILK_ENABLED_MODULES` directly — the
+ * REAL env boundary, set/restored per `lead-promotion.test.ts`'s convention,
+ * rather than a `jest.mock` of the internal `../../config/modules.js` module
+ * (CONTRIBUTING.md § Test code quality forbids mocking an internal module).
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
+jest.mock("../../lib/prisma.js");
+
+const mockLoggerInfo = jest.fn();
+const mockLoggerWarn = jest.fn();
+const mockLoggerError = jest.fn();
+jest.mock("@working-theory/observability", () => ({
+  logger: {
+    info: (...args: unknown[]) => mockLoggerInfo(...args),
+    warn: (...args: unknown[]) => mockLoggerWarn(...args),
+    error: (...args: unknown[]) => mockLoggerError(...args),
+    debug: jest.fn(),
+  },
+}));
+
+import {
+  mockNoWorkspace,
+  mockSentinelWorkspaceExists,
+  mockWorkspaceExists,
+  SENTINEL_WORKSPACE_ID,
+} from "../../lib/__mocks__/prisma.js";
+import { prisma } from "../../lib/prisma.js";
+import {
+  DUNNING_GRACE_DAYS_MAX,
+  DUNNING_POLICY_DEFAULTS,
+  dunningPolicyFor,
+  isSubscriberActionRequired,
+  isSubscriberRevoked,
+  type DunningEntry,
+} from "../dunning-policy.js";
+
+const SITE_ID = "site-abc";
+const EXPECTED_KEY = `commerce.dunning_policy:${SITE_ID}`;
+
+const priorEnabledModules = process.env.AILK_ENABLED_MODULES;
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  delete process.env.AILK_ENABLED_MODULES;
+  // #6335 — the shared prisma mock no longer resolves a workspace for any id
+  // asked of it, so this suite states the one it expects. Every case below
+  // reaches `dunningPolicyFor(SITE_ID)`, which resolves the alias before it
+  // reads `site_settings`; without this the resolution returns null and the
+  // read never happens, so the § D4 table would assert nothing.
+  mockWorkspaceExists(prisma, SITE_ID);
+});
+
+afterAll(() => {
+  if (priorEnabledModules === undefined) {
+    delete process.env.AILK_ENABLED_MODULES;
+  } else {
+    process.env.AILK_ENABLED_MODULES = priorEnabledModules;
+  }
+});
+
+// ── § D4's resolution table, row by row ────────────────────────────────────
+
+describe("dunningPolicyFor — the resolution table (§ D4)", () => {
+  it("no row → the platform default, logged info 'no_policy_row'", async () => {
+    (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const policy = await dunningPolicyFor(SITE_ID);
+
+    expect(policy).toEqual(DUNNING_POLICY_DEFAULTS);
+    expect(mockLoggerInfo).toHaveBeenCalledWith(
+      expect.objectContaining({ outcome: "no_policy_row", key: EXPECTED_KEY }),
+      expect.any(String),
+    );
+    expect(mockLoggerError).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ["a string", "not-json"],
+    ["an array", [1, 2, 3]],
+    ["a number", 5],
+    ["null", null],
+  ])(
+    "stored value is %s (not a JSON object) → default, error 'malformed'",
+    async (_label, value) => {
+      (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue({ value });
+
+      const policy = await dunningPolicyFor(SITE_ID);
+
+      expect(policy).toEqual(DUNNING_POLICY_DEFAULTS);
+      expect(mockLoggerError).toHaveBeenCalledWith(
+        expect.objectContaining({ outcome: "malformed" }),
+        expect.any(String),
+      );
+    },
+  );
+
+  it("graceDays absent → default, error 'malformed'", async () => {
+    (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue({
+      value: {},
+    });
+
+    const policy = await dunningPolicyFor(SITE_ID);
+
+    expect(policy).toEqual(DUNNING_POLICY_DEFAULTS);
+    expect(mockLoggerError).toHaveBeenCalledWith(
+      expect.objectContaining({ outcome: "malformed" }),
+      expect.any(String),
+    );
+  });
+
+  it.each([
+    ["a string", "14"],
+    ["null", null],
+    ["a bool", true],
+    ["an array", [14]],
+    ["an object", { days: 14 }],
+  ])(
+    "graceDays is %s → default, error 'malformed'",
+    async (_label, graceDays) => {
+      (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue({
+        value: { graceDays },
+      });
+
+      const policy = await dunningPolicyFor(SITE_ID);
+
+      expect(policy).toEqual(DUNNING_POLICY_DEFAULTS);
+      expect(mockLoggerError).toHaveBeenCalledWith(
+        expect.objectContaining({ outcome: "malformed" }),
+        expect.any(String),
+      );
+    },
+  );
+
+  it("graceDays is a magnitude JSON can hold but JS cannot (1e999 → Infinity) → default, error 'non_finite'", async () => {
+    // `1e999` is the real-world value (a magnitude `JSON.parse` overflows to
+    // `Infinity`); `Number.POSITIVE_INFINITY` is used directly here so the
+    // literal itself doesn't trip `no-loss-of-precision` — both reach the
+    // exact same `Number.isFinite()` guard.
+    (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue({
+      value: { graceDays: Number.POSITIVE_INFINITY },
+    });
+
+    const policy = await dunningPolicyFor(SITE_ID);
+
+    expect(policy).toEqual(DUNNING_POLICY_DEFAULTS);
+    expect(mockLoggerError).toHaveBeenCalledWith(
+      expect.objectContaining({ outcome: "non_finite" }),
+      expect.any(String),
+    );
+  });
+
+  it("graceDays negative and finite → clamped to 0, error 'clamped_low'", async () => {
+    (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue({
+      value: { graceDays: -5 },
+    });
+
+    const policy = await dunningPolicyFor(SITE_ID);
+
+    expect(policy).toEqual({ graceDays: 0 });
+    expect(mockLoggerError).toHaveBeenCalledWith(
+      expect.objectContaining({ outcome: "clamped_low", stored: -5 }),
+      expect.any(String),
+    );
+  });
+
+  it("graceDays finite and > the ceiling → clamped to the ceiling, error 'clamped_high'", async () => {
+    (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue({
+      value: { graceDays: 365 },
+    });
+
+    const policy = await dunningPolicyFor(SITE_ID);
+
+    expect(policy).toEqual({ graceDays: DUNNING_GRACE_DAYS_MAX });
+    expect(mockLoggerError).toHaveBeenCalledWith(
+      expect.objectContaining({ outcome: "clamped_high", stored: 365 }),
+      expect.any(String),
+    );
+  });
+
+  it("graceDays non-integer (e.g. 7.5) → floored, warn 'floored'", async () => {
+    (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue({
+      value: { graceDays: 7.5 },
+    });
+
+    const policy = await dunningPolicyFor(SITE_ID);
+
+    expect(policy).toEqual({ graceDays: 7 });
+    expect(mockLoggerWarn).toHaveBeenCalledWith(
+      expect.objectContaining({ outcome: "floored", stored: 7.5 }),
+      expect.any(String),
+    );
+    expect(mockLoggerError).not.toHaveBeenCalled();
+  });
+
+  it("the query itself throws → default, error 'read_failed'", async () => {
+    (prisma.siteSetting.findUnique as jest.Mock).mockRejectedValue(
+      new Error("connection reset"),
+    );
+
+    const policy = await dunningPolicyFor(SITE_ID);
+
+    expect(policy).toEqual(DUNNING_POLICY_DEFAULTS);
+    expect(mockLoggerError).toHaveBeenCalledWith(
+      expect.objectContaining({ outcome: "read_failed" }),
+      expect.any(String),
+    );
+  });
+
+  it("a valid integer in [0, DUNNING_GRACE_DAYS_MAX] → that value, no log", async () => {
+    (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue({
+      value: { graceDays: 21 },
+    });
+
+    const policy = await dunningPolicyFor(SITE_ID);
+
+    expect(policy).toEqual({ graceDays: 21 });
+    expect(mockLoggerInfo).not.toHaveBeenCalled();
+    expect(mockLoggerWarn).not.toHaveBeenCalled();
+    expect(mockLoggerError).not.toHaveBeenCalled();
+  });
+});
+
+// ── The key form ────────────────────────────────────────────────────────────
+
+describe("dunningPolicyFor — the key form", () => {
+  it("queries exactly commerce.dunning_policy:<siteId>, never an unsuffixed key", async () => {
+    (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue({
+      value: { graceDays: 14 },
+    });
+
+    await dunningPolicyFor(SITE_ID);
+
+    expect(prisma.siteSetting.findUnique).toHaveBeenCalledTimes(1);
+    const call = (prisma.siteSetting.findUnique as jest.Mock).mock.calls[0][0];
+    // #6374 D3 — `site_settings` is now unique on (workspace_id, key), so
+    // the selector is the COMPOUND `workspaceId_key`, not a bare `key`.
+    expect(call).toEqual({
+      where: { workspaceId_key: { workspaceId: SITE_ID, key: EXPECTED_KEY } },
+      select: { value: true },
+    });
+    expect(call.where.workspaceId_key.key).not.toBe("commerce.dunning_policy");
+  });
+
+  // ── #6374 AC-7 — the key is built from the UNRESOLVED siteId ─────────────
+  it("builds `key` from the UNRESOLVED siteId parameter, even when the alias resolves to something else", async () => {
+    // The alias `"default"` resolves to the sentinel workspace id. The KEY
+    // must still read `commerce.dunning_policy:default` — the alias is
+    // embedded in the key STRING because `site_settings` never had a
+    // `site_id` column, and the migration's backfill leaves every key
+    // verbatim. Rebuilding the key from the RESOLVED id would match no row
+    // and hand every seller the built-in default policy, silently. Only the
+    // WORKSPACE half is resolved.
+    mockSentinelWorkspaceExists(prisma);
+    (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue({
+      value: { graceDays: 14 },
+    });
+
+    await dunningPolicyFor("default");
+
+    const call = (prisma.siteSetting.findUnique as jest.Mock).mock.calls[0][0];
+    expect(call.where.workspaceId_key.key).toBe(
+      "commerce.dunning_policy:default",
+    );
+    expect(call.where.workspaceId_key.workspaceId).toBe(SENTINEL_WORKSPACE_ID);
+  });
+
+  it("an alias that resolves to no workspace returns the platform default and reads nothing", async () => {
+    mockNoWorkspace(prisma);
+
+    const policy = await dunningPolicyFor("no-such-site");
+
+    expect(policy).toEqual(DUNNING_POLICY_DEFAULTS);
+    expect(prisma.siteSetting.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("multi-tenant deployments log the deployment-wide-policy warning once per process", async () => {
+    process.env.AILK_ENABLED_MODULES = "multi-tenant";
+    (prisma.siteSetting.findUnique as jest.Mock).mockResolvedValue({
+      value: { graceDays: 14 },
+    });
+
+    await dunningPolicyFor(SITE_ID);
+    await dunningPolicyFor(SITE_ID);
+
+    const deploymentWideCalls = mockLoggerWarn.mock.calls.filter(
+      ([fields]) => fields?.outcome === "deployment_wide_policy",
+    );
+    expect(deploymentWideCalls).toHaveLength(1);
+  });
+});
+
+// ── The two exported predicates, across every recorded state ───────────────
+
+function entry(overrides: Partial<DunningEntry> = {}): DunningEntry {
+  return {
+    status: "active",
+    accessState: "granted",
+    dunningArmedAt: null,
+    accessRevokesAt: null,
+    lastEventAt: 1_700_000_000,
+    lastEventId: "evt_base",
+    ...overrides,
+  };
+}
+
+const NOW = Date.parse("2026-09-18T00:00:00.000Z");
+
+describe("isSubscriberRevoked / isSubscriberActionRequired — every recorded state", () => {
+  it("active — not revoked, no action required", () => {
+    const e = entry({ status: "active", accessState: "granted" });
+    expect(isSubscriberRevoked(e, NOW)).toBe(false);
+    expect(isSubscriberActionRequired(e, NOW)).toBe(false);
+  });
+
+  it("past_due — not revoked, action required", () => {
+    const e = entry({
+      status: "past_due",
+      accessState: "granted",
+      dunningArmedAt: "2026-09-10T00:00:00.000Z",
+    });
+    expect(isSubscriberRevoked(e, NOW)).toBe(false);
+    expect(isSubscriberActionRequired(e, NOW)).toBe(true);
+  });
+
+  it("in-grace canceled — not yet revoked, but action IS required (§ 9 SEC-09)", () => {
+    const e = entry({
+      status: "canceled",
+      accessState: "granted",
+      dunningArmedAt: "2026-09-10T00:00:00.000Z",
+      accessRevokesAt: "2026-09-24T00:00:00.000Z", // in the future relative to NOW
+    });
+    expect(isSubscriberRevoked(e, NOW)).toBe(false);
+    expect(isSubscriberActionRequired(e, NOW)).toBe(true);
+  });
+
+  it("expired canceled — revoked, no further action predicate (already gone)", () => {
+    const e = entry({
+      status: "canceled",
+      accessState: "revoked",
+      dunningArmedAt: "2026-08-01T00:00:00.000Z",
+      accessRevokesAt: "2026-08-15T00:00:00.000Z", // in the past relative to NOW
+    });
+    expect(isSubscriberRevoked(e, NOW)).toBe(true);
+    expect(isSubscriberActionRequired(e, NOW)).toBe(false);
+  });
+
+  it("accessRevokesAt exactly at `now` is revoked (>=, not >)", () => {
+    const revokesAt = "2026-09-18T00:00:00.000Z";
+    const e = entry({
+      status: "canceled",
+      accessState: "granted",
+      accessRevokesAt: revokesAt,
+    });
+    expect(isSubscriberRevoked(e, Date.parse(revokesAt))).toBe(true);
+  });
+});

package/templates/apps/api/src/services/__tests__/lead-routing.test.ts

@@ -392,4 +392,164 @@ describe("routeLead", () => {
     expect(result.error.kind).toBe("invalid_input");
     expect(prisma.subscriber.create).not.toHaveBeenCalled();
   });
+
+  // ── #6203/#6254 — the workspaceId stamp is ALWAYS a copy of siteId ────────
+  //
+  // routeLead(kind: "submit") has FOUR callers in this repo, and as of
+  // #6254 ALL FOUR resolve `siteId` to a real `wksp_<uuidv7>` workspace id
+  // before calling in — the three that once passed an unresolved alias
+  // (flow-engine.ts, recommender-capture.ts, project-listings.ts's
+  // submitProjectListingDraft) now resolve it themselves
+  // (`resolveSiteWorkspaceId()` / `resolveWorkspaceIdForAlias()`,
+  // `apps/api/src/lib/site.ts`). `workspaceId` is NOT NULL as of
+  // database/migrations/20260922120000_tenancy_fence, so `persistToDb` can
+  // no longer stamp `null` for an unresolved alias the way #6203 once did —
+  // it copies `siteId` unconditionally, and a caller that still somehow
+  // passed an unresolved alias hits the pre-existing
+  // `leads_workspace_id_format` CHECK loudly (via the AC-11 re-raise this
+  // file's other describe block proves) instead of landing a
+  // silently-unfenced row.
+  describe("the workspaceId stamp copies siteId unconditionally (#6203, #6254)", () => {
+    it("workspaceId is always the SAME value as siteId, whatever shape siteId carries", async () => {
+      await routeLead(leadInput, sourceMeta); // leadInput.siteId === "site-abc"
+
+      expect(prisma.lead.create).toHaveBeenCalledTimes(1);
+      const { data } = (prisma.lead.create as jest.Mock).mock.calls[0]![0];
+      expect(data.siteId).toBe("site-abc");
+      expect(data.workspaceId).toBe("site-abc");
+    });
+
+    it("a workspace-shaped siteId (the routes/leads/index.ts path) stamps workspaceId to the SAME value", async () => {
+      const resolvedInput = {
+        ...leadInput,
+        siteId: "wksp_00000000-0000-7000-8000-000000000001",
+      };
+
+      await routeLead(resolvedInput, sourceMeta);
+
+      const { data } = (prisma.lead.create as jest.Mock).mock.calls[0]![0];
+      expect(data.siteId).toBe("wksp_00000000-0000-7000-8000-000000000001");
+      expect(data.workspaceId).toBe("wksp_00000000-0000-7000-8000-000000000001");
+    });
+  });
+
+  // #6254 AC-11 (spec D6, SEC-02) — a constraint violation (the new
+  // `leads_workspace_site_agree` CHECK, or the pre-existing NOT NULL) must
+  // never be swallowed into the file fallback and a silent `ok:true`: it
+  // means OUR OWN derivation produced a row Postgres itself refuses, which
+  // is a bug to surface, not an outage to degrade through. A GENUINE
+  // infrastructure failure (the existing "DB down → file fallback" test
+  // above, a plain `Error("connection refused")` that carries none of the
+  // signals below) must still take the file fallback, unchanged.
+  describe("a constraint violation re-raises as a deliberate error, never a silent success (#6254 AC-11)", () => {
+    const listTmpDirFiles = () => fs.readdir(tmpDir);
+
+    it("a Prisma-mapped class-23 code (e.g. P2011, null constraint) returns ok:false persist_failed WITHOUT engaging the file fallback", async () => {
+      const before = await listTmpDirFiles();
+      const constraintErr = Object.assign(
+        new Error("Null constraint violation on the field: (`workspace_id`)"),
+        { code: "P2011" },
+      );
+      (prisma.lead.create as jest.Mock).mockRejectedValue(constraintErr);
+
+      const result = (await routeLead(
+        leadInput,
+        sourceMeta,
+      )) as Extract<RouteLeadResult, { ok: false }>;
+
+      expect(result.ok).toBe(false);
+      expect(result.error.kind).toBe("persist_failed");
+      // No file was written — the fallback was never attempted.
+      const after = await listTmpDirFiles();
+      expect(after).toEqual(before);
+    });
+
+    it("a raw SQLSTATE the message carries (no Prisma-mapped code — the new CHECK constraint's own shape) returns ok:false persist_failed WITHOUT engaging the file fallback", async () => {
+      const before = await listTmpDirFiles();
+      const checkErr = new Error(
+        'new row for relation "leads" violates check constraint "leads_workspace_site_agree"',
+      );
+      (prisma.lead.create as jest.Mock).mockRejectedValue(checkErr);
+
+      const result = (await routeLead(
+        leadInput,
+        sourceMeta,
+      )) as Extract<RouteLeadResult, { ok: false }>;
+
+      expect(result.ok).toBe(false);
+      expect(result.error.kind).toBe("persist_failed");
+      const after = await listTmpDirFiles();
+      expect(after).toEqual(before);
+    });
+
+    it("a bare SQLSTATE 23502 in the error message also re-raises as persist_failed", async () => {
+      const before = await listTmpDirFiles();
+      const notNullErr = Object.assign(
+        new Error("null value in column \"workspace_id\" violates not-null constraint (23502)"),
+        {},
+      );
+      (prisma.lead.create as jest.Mock).mockRejectedValue(notNullErr);
+
+      const result = (await routeLead(
+        leadInput,
+        sourceMeta,
+      )) as Extract<RouteLeadResult, { ok: false }>;
+
+      expect(result.ok).toBe(false);
+      expect(result.error.kind).toBe("persist_failed");
+      const after = await listTmpDirFiles();
+      expect(after).toEqual(before);
+    });
+
+    it("a genuine outage (no class-23 signal) still takes the file fallback — persisted:file, not persist_failed", async () => {
+      // Regression guard for the branch above: an ordinary connection error
+      // must not be misclassified as a constraint violation.
+      (prisma.lead.create as jest.Mock).mockRejectedValue(
+        new Error("connection refused"),
+      );
+
+      const result = (await routeLead(
+        leadInput,
+        sourceMeta,
+      )) as Extract<RouteLeadResult, { ok: true }>;
+
+      expect(result.ok).toBe(true);
+      expect(result.persisted).toBe("file");
+    });
+  });
+});
+
+// ─── #6257 — the fence: every fenced read carries workspaceId ───────────────
+
+/**
+ * Unit C2's contract for this service (#6257 AC-1/AC-2). `routeLead`'s one
+ * READ is the duplicate-subscriber lookup on the P2002 arm. `input.siteId` is
+ * the resolved workspace id at every caller (the same guarantee the three
+ * `create` sites above stamp on), so the lookup is scoped by it rather than
+ * resolving a second time.
+ */
+describe("#6257 — the duplicate-subscriber lookup carries workspaceId", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.DATABASE_URL = "postgres://test";
+  });
+
+  it("scopes the existing-subscriber read by the caller's resolved workspace id", async () => {
+    (prisma.subscriber.create as jest.Mock).mockRejectedValue(
+      Object.assign(new Error("Unique constraint failed"), { code: "P2002" }),
+    );
+    (prisma.subscriber.findUnique as jest.Mock).mockResolvedValue({ id: "sub_1" });
+
+    await routeLead(
+      { ...subscribeInput, email: "dupe@example.com" },
+      sourceMeta,
+    );
+
+    const { where } = (prisma.subscriber.findUnique as jest.Mock).mock.calls[0][0];
+    expect(where.workspaceId).toBe(subscribeInput.siteId);
+    expect(where.siteId_email).toEqual({
+      siteId: subscribeInput.siteId,
+      email: "dupe@example.com",
+    });
+  });
 });