create-ailk 0.5.0 → 0.6.1

package/templates/apps/api/src/services/consent.ts

@@ -56,6 +56,15 @@ export interface ConsentWriteClient {
 
 interface ConsentGrantRow {
   siteId: string;
+  /**
+   * #6374 — the tenancy fence's isolation key, equal to `siteId` by
+   * construction. Non-optional on purpose: `consent_grants.workspace_id` is
+   * NOT NULL as of
+   * database/migrations/20260922120000_tenancy_fence, so a row builder that
+   * forgot it would fail at runtime; declaring it required here makes the
+   * type checker say so instead.
+   */
+  workspaceId: string;
   subjectType: string;
   subjectId: string;
   purposeId: string;
@@ -169,6 +178,12 @@ export async function recordConsent(
     const { statement, locale } = resolveConsentStatement(purpose, input.locale);
     rows.push({
       siteId: input.siteId,
+      // #6374 — the isolation key, equal to `siteId` by construction.
+      // `input.siteId` is the caller's already-resolved site id; the
+      // `consent_grants_workspace_site_agree` CHECK makes a disagreement
+      // unstorable, and `consent_grants_workspace_id_format` rejects a raw
+      // alias loudly. Never read from a request body (AC-6).
+      workspaceId: input.siteId,
       subjectType: input.subjectType,
       subjectId: input.subjectId,
       purposeId,
@@ -222,6 +237,9 @@ export async function recordLegacyConsent(
     data: [
       {
         siteId: input.siteId,
+        // #6374 — the isolation key, equal to `siteId` by construction; the
+        // same stamp the D10 path's row builder above applies.
+        workspaceId: input.siteId,
         subjectType: input.subjectType,
         subjectId: input.subjectId,
         purposeId: purpose.id,

package/templates/apps/api/src/services/default-tenant.ts

@@ -38,13 +38,15 @@
  */
 import {
   DEFAULT_ORG_ID,
-  DEFAULT_WORKSPACE_ID,
   OPERATOR_MEMBERSHIP_ID,
+  resolveDefaultWorkspaceRow as resolveDefaultWorkspaceRowShared,
 } from "@working-theory/database/tenancy";
-import { isSentinel, type Id } from "@working-theory/ids";
+import type { Id } from "@working-theory/ids";
 
 import { prisma } from "../lib/prisma.js";
 
+import { findVerifiedEmail } from "./verified-email.js";
+
 export type MembershipRole = "owner" | "admin" | "member";
 
 /**
@@ -93,9 +95,11 @@ export function isUniqueViolation(error: unknown): boolean {
  * multi-tenant state (`count > 1`).
  *
  * When `AILK_OPERATOR_EMAIL` is set (spec D4 — trimmed + lowercased before
- * comparison), the bind is attempted ONLY for the caller whose `User.email`
- * matches it; every other caller returns without writing and is denied
- * downstream. An empty/whitespace-only `AILK_OPERATOR_EMAIL` normalizes to
+ * comparison), the bind is attempted ONLY for the caller whose VERIFIED
+ * `User.email` matches it (#5701 AC-2 — the read goes through
+ * `findVerifiedEmail`, so an unverified address is refused here and not only
+ * at the base-build entry above); every other caller returns without writing
+ * and is denied downstream. An empty/whitespace-only `AILK_OPERATOR_EMAIL` normalizes to
  * `""`, which is falsy — treated as unset (pure TOFU), so a blank pin can
  * never "match" a blank `User.email`. When unset, the bind is pure TOFU —
  * first caller wins.
@@ -103,11 +107,18 @@ export function isUniqueViolation(error: unknown): boolean {
 async function bindOperatorMembership(userId: Id<"user">): Promise<void> {
   const pinnedEmail = process.env.AILK_OPERATOR_EMAIL?.trim().toLowerCase();
   if (pinnedEmail) {
-    const user = await prisma.user.findUnique({
-      where: { id: userId },
-      select: { email: true },
-    });
-    if (!user || user.email.trim().toLowerCase() !== pinnedEmail) {
+    // The verified-email read is `services/verified-email.ts` (#5701 D4) — the
+    // same one `resolveDefaultTenantForOperator` uses. It returns the address
+    // only when `emailVerified === true`, so an address that merely CLAIMS to
+    // be the pin can no longer mint `OPERATOR_MEMBERSHIP_ID`. Both refusals
+    // (`user_not_found`, `email_unverified`) take the branch's existing early
+    // return — the caller is then unbound and denied by the
+    // `membership.findUnique` that follows.
+    const verified = await findVerifiedEmail(userId);
+    if (!verified.ok) {
+      return;
+    }
+    if (verified.value.email.trim().toLowerCase() !== pinnedEmail) {
       return;
     }
   }
@@ -185,23 +196,60 @@ export async function resolveDefaultTenantForOperator(
   if (!pinnedEmail) {
     return null;
   }
-  const user = await prisma.user.findUnique({
-    where: { id: userId },
-    select: { email: true, emailVerified: true },
-  });
-  // `emailVerified` is load-bearing wherever this codebase joins an identity
-  // to data by email — the respondent reads (`services/waitlist-signups.ts`,
-  // `services/flow-checkouts.ts`) refuse before any Lead read for the same
-  // reason. An unverified address is an unproven claim to the pinned one.
-  if (!user || !user.emailVerified) {
+  // The verified-email read is `services/verified-email.ts` (#5701 D4) — the
+  // one this and the four other email-keyed paths share. It returns the
+  // address only when `emailVerified === true`, which is what makes a match
+  // against the pin a proven claim rather than an asserted one.
+  const verified = await findVerifiedEmail(userId);
+  if (!verified.ok) {
     return null;
   }
-  if (user.email.trim().toLowerCase() !== pinnedEmail) {
+  if (verified.value.email.trim().toLowerCase() !== pinnedEmail) {
     return null;
   }
   return resolveDefaultTenant(userId);
 }
 
+/**
+ * The DEPLOYMENT half of the default resolution, extracted so it exists once
+ * (#5852 D2). Returns the sole, well-known default Workspace row, or `null`
+ * the instant the deployment is not unambiguously one-workspace — a second
+ * Workspace exists, none does, or the sole one is not the seeded default.
+ *
+ * Carries no authentication: it answers "is this deployment one-workspace, and
+ * which workspace is it", nothing about the caller. `resolveDefaultTenant`
+ * adds the authentication half on top; `services/public-site-resolver.ts`
+ * (unauthenticated public reads) uses the deployment half alone. One
+ * predicate, reached two ways — never two predicates.
+ *
+ * The predicate itself is `@working-theory/database/tenancy`'s
+ * `resolveDefaultWorkspaceRow` (#5876 spec D2/D3) — this is now a thin
+ * pass-through of `apps/api`'s own `prisma` singleton, kept as a named local
+ * function (rather than re-exporting the shared one directly) so every
+ * existing caller — this file's own `resolveDefaultWorkspaceId` and
+ * `resolveDefaultTenant`, and `services/public-site-resolver.ts`'s dynamic
+ * import of the wrapper — is untouched. There is exactly one implementation
+ * of the one-workspace predicate in the repository (NFR-7); apps/mcp's own
+ * resolution (`apps/mcp/src/lib/public-workspace.ts`) delegates to the same
+ * shared export.
+ */
+async function resolveDefaultWorkspaceRow(): Promise<{
+  id: string;
+  organizationId: string;
+} | null> {
+  return resolveDefaultWorkspaceRowShared(prisma);
+}
+
+/**
+ * The one-workspace deployment predicate, as a workspace id (#5852 D2).
+ * `null` means the deployment is not unambiguously one-workspace, and every
+ * caller fails closed on it.
+ */
+export async function resolveDefaultWorkspaceId(): Promise<Id<"workspace"> | null> {
+  const workspace = await resolveDefaultWorkspaceRow();
+  return workspace ? (workspace.id as Id<"workspace">) : null;
+}
+
 /**
  * Resolves the default single-tenant scope when the deployment is
  * unambiguously single-tenant — the default Workspace (`DEFAULT_WORKSPACE_ID`)
@@ -226,17 +274,8 @@ export async function resolveDefaultTenantForOperator(
 export async function resolveDefaultTenant(
   userId: Id<"user">,
 ): Promise<TenantContext | null> {
-  const workspaceCount = await prisma.workspace.count();
-  if (workspaceCount !== 1) {
-    return null;
-  }
-  const workspace = await prisma.workspace.findUnique({
-    where: { id: DEFAULT_WORKSPACE_ID },
-    select: { id: true, organizationId: true },
-  });
-  // The default workspace must hang off the sentinel default Organization
-  // (ADR-0031 rule 7): keyed on the reserved-range predicate, not a literal.
-  if (!workspace || !isSentinel(workspace.organizationId)) {
+  const workspace = await resolveDefaultWorkspaceRow();
+  if (!workspace) {
     return null;
   }
   await bindOperatorMembership(userId);

package/templates/apps/api/src/services/deliverable-fulfillment.ts

@@ -45,13 +45,30 @@
  * PII boundary: logs carry only `{ siteId, flowSlug, sessionId, outcome }` —
  * never email/asset-key/copy values (mirrors flow-engine.ts's + abandon-
  * email.ts's boundary).
+ *
+ * #6310 D1/D2/D4/D5/D15 — a non-`playbook:` `assetKey` now resolves against
+ * the workspace-scoped `Asset` store FIRST, via the named boundary
+ * `lib/deliverable-asset-store.ts` (never a raw `prisma.asset` call here —
+ * that access is banned by architecture.yaml's tenant-scope
+ * `forbidden_pattern`), falling back to the LEGACY `DeliverableAsset` store
+ * on a miss (D3 — existing rows keep delivering, unmigrated). The workspace
+ * is read from the magnet's own `FlowDefinition.workspaceId`, ONE
+ * `findUnique` issued only on this branch (never for a `playbook:` key, and
+ * never before the `no_entry` exit) — a `null`/absent value skips the
+ * `Asset` lookup entirely and falls straight to the legacy arm, never
+ * guessing a workspace (D5, mirroring #6155 D3's posture). The grant is
+ * minted with `workspaceId` ONLY on the `Asset` arm — the same value that
+ * authorized the resolution — restoring the download route's serve-time
+ * tenancy re-check for this new grant class (D15).
  */
 
 import { sendDeliverableEmail } from "@working-theory/email";
 import { logger } from "@working-theory/observability";
 import { flowConfigSchema, type FlowConfig } from "@working-theory/validation";
 
+import { findDeliverableAssetIdByKey } from "../lib/deliverable-asset-store.js";
 import { prisma } from "../lib/prisma.js";
+import { resolveWorkspaceIdForAlias } from "../lib/site.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────────
 
@@ -194,6 +211,15 @@ async function stampOutcome(
   now: Date,
 ): Promise<void> {
   try {
+    // fence: global-key — `DeliverableGrant.id`, the capability token itself
+    // (#3961 D5: the grant IS the token). Every caller reaches this line
+    // inside an already-scoped frame — `fulfillDeliverable` has just MINTED
+    // this id under the session's workspace, and `resendDeliverableGrant` has
+    // just read the row back by the same opaque id — so the id is the row's
+    // own primary key, not a tenant selector, and a `workspaceId` term here
+    // could only re-state what the mint already fenced. It would also stop
+    // stamping LEGACY grants, whose `workspaceId` is NULL by the #6254 § 10.1
+    // Q2 carve-out, turning a post-mint audit stamp into a silent no-op.
     await prisma.deliverableGrant.update({
       where: { id: grantId },
       data: { sendStatus: outcome, sendAt: now },
@@ -312,9 +338,17 @@ export async function fulfillDeliverable(
   const playbookKey = playbookExperimentKey(entry.assetKey);
 
   let assetId: string;
+  // #6310 D15 — written ONLY on the Asset arm; stays undefined (no column
+  // written) for a playbook: or legacy dasset_ grant.
+  let grantWorkspaceId: string | undefined;
+
   if (playbookKey !== undefined) {
+    // #6257 — `siteId` is the session's own, resolved by the route that
+    // opened it (#6254/#6374 AC-7), so `workspaceId` rides beside it: a lead
+    // id and an experiment key alone would select a row whose tenant the
+    // query never stated.
     const instance = await prisma.playbookInstance.findFirst({
-      where: { siteId, leadId, experimentKey: playbookKey },
+      where: { siteId, workspaceId: siteId, leadId, experimentKey: playbookKey },
       select: { id: true },
     });
     if (!instance) {
@@ -323,24 +357,75 @@ export async function fulfillDeliverable(
     }
     assetId = entry.assetKey;
   } else {
-    // A missing row (config references an un-uploaded key) → same
-    // skip-and-log posture (D3).
-    const asset = (await prisma.deliverableAsset.findUnique({
-      where: { siteId_key: { siteId, key: entry.assetKey } },
-    })) as DeliverableAssetRow | null;
-
-    if (!asset) {
-      logOutcome(logCtx, "asset_missing");
-      return;
+    // #6310 D4 — resolve the workspace from the magnet's own live
+    // FlowDefinition, ONE query, issued only on this branch. D5 — a null or
+    // absent workspaceId skips the Asset lookup entirely; it is never
+    // guessed.
+    const definition = (await prisma.flowDefinition.findUnique({
+      where: { siteId_slug: { siteId, slug: flowSlug } },
+      select: { workspaceId: true },
+    })) as { workspaceId: string | null } | null;
+    const workspaceId = definition?.workspaceId ?? null;
+
+    const resolvedAssetId =
+      workspaceId !== null
+        ? await findDeliverableAssetIdByKey(workspaceId, entry.assetKey)
+        : null;
+
+    if (resolvedAssetId !== null && workspaceId !== null) {
+      // #6310 D2 — Asset resolves first; D15 — the grant carries the SAME
+      // workspaceId that authorized this resolution.
+      assetId = resolvedAssetId;
+      grantWorkspaceId = workspaceId;
+    } else {
+      // #6310 D2/D3 — legacy fallback. A missing row (config references an
+      // un-uploaded key) → same skip-and-log posture as before.
+      // #6257 — the LEGACY store's read, scoped by the same resolved
+      // workspace id the `Asset` arm above already resolves through
+      // `lib/deliverable-asset-store.ts`. The compound `[siteId, key]` names
+      // one row; `workspaceId` is what makes the tenant the QUERY's statement.
+      const asset = (await prisma.deliverableAsset.findUnique({
+        where: { siteId_key: { siteId, key: entry.assetKey }, workspaceId: siteId },
+      })) as DeliverableAssetRow | null;
+
+      if (!asset) {
+        logOutcome(logCtx, "asset_missing");
+        return;
+      }
+      assetId = asset.id;
     }
-    assetId = asset.id;
   }
 
   // D5: the grant IS the token — minted before the send is attempted so a
   // later email-config gap or send failure never wastes it (a later
   // manual/operator resend can reuse the same grant id).
   const grant = (await prisma.deliverableGrant.create({
-    data: { siteId, assetId, leadId, sessionId },
+    data: {
+      siteId,
+      assetId,
+      leadId,
+      sessionId,
+      // #6374 D4 / AC-8 — the SECOND DeliverableGrant mint site. The column
+      // stays NULLABLE for LEGACY rows (NULL is the serve path's fail-closed
+      // sentinel, #6254 § 10.1 Q2) and the migration touches none of them —
+      // but a grant minted HERE always knows its workspace, so it is never
+      // left to fail closed.
+      //
+      // `grantWorkspaceId` is #6310 D15's value, resolved from the magnet's
+      // own FlowDefinition on the `asset_` arm; that read is scoped by
+      // `siteId`, and the keystone's `flow_definitions_workspace_site_agree`
+      // CHECK makes `workspaceId = siteId` on that row, so the two are the
+      // SAME value and the `??` is a fallback for the legacy `dasset_` and
+      // virtual `playbook:` arms rather than a choice between two scopes.
+      // The new `deliverable_grants_workspace_site_agree` CHECK would reject
+      // a disagreement loudly either way.
+      //
+      // This does NOT change which bytes the download route serves: that
+      // route branches on the `assetId` PREFIX, and consults
+      // `grant.workspaceId` only on the `asset_` arm, where this value is
+      // what it already was.
+      workspaceId: grantWorkspaceId ?? siteId,
+    },
     select: { id: true },
   })) as { id: string };
 
@@ -400,6 +485,13 @@ type FlowSessionConfigRow = {
 export async function resendDeliverableGrant(
   grantId: string,
 ): Promise<ResendGrantResult> {
+  // fence: global-key — `DeliverableGrant.id`, the capability token itself
+  // (#3961 D5). This is the resolver: the operator hands the
+  // `deliverable:resend` CLI one opaque grant id and nothing else, and the
+  // WORKSPACE is what this read produces (`grant.siteId`, carried into
+  // `sendAndStamp` below), so a tenant term here would have to come from the
+  // answer it is computing. Holding the id is the capability, exactly as it
+  // is for the download route this resend re-sends a link to.
   const grant = (await prisma.deliverableGrant.findUnique({
     where: { id: grantId },
     select: { id: true, siteId: true, leadId: true, sessionId: true },
@@ -514,9 +606,45 @@ type DeliverableGrantListRow = {
 export async function listSendlessGrants(
   opts: ListSendlessGrantsOptions,
 ): Promise<SendlessGrantRow[]> {
+  // #6257 — `opts.siteId` is the one value in this service that arrives as a
+  // RAW ALIAS: the `deliverable:resend` CLI passes `--site` through verbatim.
+  // It is resolved here, once, the way `dunning-policy.ts` resolves its own
+  // parameter — an alias that names no workspace lists nothing rather than
+  // falling back to the unscoped read it used to make.
+  const workspaceId = await resolveWorkspaceIdForAlias(opts.siteId);
+  if (workspaceId === null) {
+    logger.warn(
+      { siteId: opts.siteId, outcome: "site_unresolved" },
+      "[deliverable-fulfillment] --site names no workspace — listing nothing",
+    );
+    return [];
+  }
+
+  // #6257 — LEGACY grants are NOT in this list, and the narrowing is stated
+  // rather than left for an operator to discover. Two terms exclude them: the
+  // `workspaceId` filter below (their column is NULL by the #6254 § 10.1 Q2
+  // carve-out) and the resolved `siteId` (the keystone migration deliberately
+  // does NOT normalize `deliverable_grants.site_id` — migration.sql:1059 — so
+  // a legacy row on a `"default"`-aliased deployment still carries the alias).
+  //
+  // This is a genuine TIGHTENING beyond the serve path, not parity with it:
+  // `routes/deliverables/index.ts` consults `grant.workspaceId` only on the
+  // `asset_` arm, so a legacy `dasset_` or `playbook:` grant still downloads.
+  // The fence forces it — AC-2 forbids keying this read on the raw alias the
+  // CLI was given, and a legacy row carries no workspace key to resolve — so
+  // the list is narrower by construction and the recovery path for such a row
+  // is `deliverable:resend --grant <id>`, which is unaffected.
+  logger.info(
+    { siteId: workspaceId, outcome: "legacy_grants_excluded" },
+    "[deliverable-fulfillment] grants with no workspace key are NOT listed — resend one by id with --grant",
+  );
+
   const rows = (await prisma.deliverableGrant.findMany({
     where: {
-      siteId: opts.siteId,
+      siteId: workspaceId,
+      // #6257 — the fence term. See the note above for what it excludes and
+      // why that is a tightening rather than serve-path parity.
+      workspaceId,
       sendStatus: null,
       ...(opts.since !== undefined && { createdAt: { gte: opts.since } }),
     },