create-ailk 0.6.1 → 0.8.0

package/templates/apps/api/src/routes/leads/index.ts

@@ -5,6 +5,16 @@
  *   POST /v1/leads/submit    — lead submission (contact form / inquiry)
  *   POST /v1/leads/subscribe — newsletter subscription
  *   POST /v1/leads/callback  — callback request (phone-back)
+ *   GET  /v1/leads/capture   — whether this deployment accepts a contact
+ *                              message / a newsletter signup (#6730 D4)
+ *
+ * API↔MCP PARITY — `GET /v1/leads/capture` has NO MCP twin, a recorded
+ * exception on the same footing as the anonymous form-lifecycle routes. It
+ * exists so a web page can choose between the form and the contact email
+ * before rendering; an agent never needs that preflight, because the three
+ * write tools (`capture_lead`, `subscribe_newsletter`, `request_callback`)
+ * already return a typed `api_error` carrying the 503 when capture is not
+ * accepted — the same answer, at the moment it matters.
  *
  * TENANT RESOLUTION (#6203, spec §10.4 operator ruling — reverses this
  * file's former byte-unchanged posture). `siteId` used to be taken VERBATIM
@@ -24,6 +34,7 @@
 import { track } from "@working-theory/analytics/server";
 import type { FastifyPluginAsync } from "fastify";
 
+import { acceptsKind, resolveLeadDelivery } from "../../lib/lead-delivery.js";
 import { currentSiteId, resolveSiteWorkspaceId } from "../../lib/site.js";
 import {
   type LeadKind,
@@ -175,7 +186,20 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
           );
           return reply.status(503).send({ error: "persist_failed" });
         }
-        // config_missing — lead capture not configured (file disabled + no DB)
+        if (result.error.kind === "delivery_failed") {
+          // Email was the delivery and the provider did not accept it —
+          // never reported as sent (#6730 D5). Detail stays server-side.
+          // `{ kind, siteId }` only (spec D5): provider error text can echo
+          // an address.
+          request.log.error({ kind, siteId: workspaceId }, "lead delivery_failed");
+          return reply.status(503).send({
+            error: "delivery_failed",
+            message: "The message could not be delivered.",
+          });
+        }
+        // config_missing — this deployment has nowhere to put this kind of
+        // lead (#6730 D1: production with neither a database nor the email
+        // vars, or a newsletter signup with no database).
         return reply.status(503).send({
           error: "lead_capture_not_configured",
           message: "Lead capture is not configured.",
@@ -249,3 +273,24 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
 export const leadSubmitRoute = makeLeadsRoute("submit");
 export const leadSubscribeRoute = makeLeadsRoute("subscribe");
 export const leadCallbackRoute = makeLeadsRoute("callback");
+
+/**
+ * `GET /v1/leads/capture` (#6730 D4) — two booleans and nothing else: never
+ * an address or which env var is missing. (The pair implies as much of the
+ * delivery mode as the rendered page already shows.) Registered at
+ * the top level in `server.ts`, outside `leadsScope`'s strict per-IP limit
+ * (a web server's single egress IP already spends that on form submissions),
+ * so only the server-wide unauthenticated ceiling applies.
+ */
+export const leadCaptureStatusRoute: FastifyPluginAsync = async (fastify) => {
+  fastify.get("/v1/leads/capture", async (_request, reply) => {
+    const delivery = resolveLeadDelivery();
+    return reply.header("Cache-Control", "public, max-age=60").send({
+      ok: true,
+      data: {
+        contact: acceptsKind(delivery, "submit"),
+        newsletter: acceptsKind(delivery, "subscribe"),
+      },
+    });
+  });
+};

package/templates/apps/api/src/server.ts

@@ -23,6 +23,7 @@ import { config } from "./config/index.js";
 import { isModuleEnabled } from "./config/modules.js";
 import { registerErrorSerializer } from "./lib/error-serializer.js";
 import { validateLeadCaptureDir } from "./lib/lead-capture-store.js";
+import { registerLicenseKeyStore } from "./lib/license-key-store.js";
 import { requireCommerceClaim } from "./lib/require-commerce-claim.js";
 import { assertSiteAliasResolves } from "./lib/site.js";
 import { loadSlice } from "./lib/slice-load.js";
@@ -57,6 +58,7 @@ import {
 import { searchContentRoute } from "./routes/content/search.js";
 import {
   leadCallbackRoute,
+  leadCaptureStatusRoute,
   leadSubmitRoute,
   leadSubscribeRoute,
 } from "./routes/leads/index.js";
@@ -522,6 +524,11 @@ export async function build() {
   // database-less dev boot).
   await assertSiteAliasResolves();
 
+  // #6677 DD-6 — the renewed licence key's durable home: with a database,
+  // one deployment-wide SiteSetting row, so a redeploy keeps the key this
+  // site renewed. Never throws; without DATABASE_URL the file store stays.
+  await registerLicenseKeyStore();
+
   // Runtime sandbox-mode guard: reject live-mode Stripe keys before any
   // webhook or checkout call can exercise them. Idempotent — safe even if
   // assertSandboxKey is called again inside a route handler. UNCONDITIONAL
@@ -1139,6 +1146,12 @@ export async function build() {
     await authEmailScope.register(transactionalEmailRoute);
   });
 
+  // Lead-capture status (#6730 D4) — a cheap read the web page makes before
+  // choosing the form or the contact email. Top level, NOT in `leadsScope`:
+  // the web server's single egress IP already spends that scope's strict
+  // 10/min on form submissions. The global unauth ceiling above applies.
+  await server.register(leadCaptureStatusRoute);
+
   // Leads routes — rate-limit middleware scoped to this sub-router. Own
   // default (10/min, pre-#4730) rather than inheriting the wider
   // flows-sized default (#5111, DEF-004 — #4730's shared-default bump was

package/templates/apps/api/src/services/__tests__/lead-routing.test.ts

@@ -553,3 +553,197 @@ describe("#6257 — the duplicate-subscriber lookup carries workspaceId", () =>
     });
   });
 });
+
+// ─── #6730 D1/D2 — success only for a durable row or an accepted email ───────
+
+describe("#6730 — routeLead delivery modes", () => {
+  const ENV_KEYS = [
+    "DATABASE_URL",
+    "NODE_ENV",
+    "RESEND_API_KEY",
+    "AILK_LEAD_NOTIFICATION_TO",
+    "AILK_LEAD_NOTIFICATION_FROM",
+    "AILK_INBOX_FALLBACK_DIR",
+    "LEAD_CAPTURE_FILE",
+  ] as const;
+  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+  let tmpDir: string;
+  const listFiles = () => fs.readdir(tmpDir);
+
+  const EMAIL_ENV = {
+    RESEND_API_KEY: "re_test",
+    AILK_LEAD_NOTIFICATION_TO: "owner@example.com",
+    AILK_LEAD_NOTIFICATION_FROM: "noreply@example.com",
+  };
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    saved = {};
+    for (const k of ENV_KEYS) saved[k] = process.env[k];
+    for (const k of ENV_KEYS) delete process.env[k];
+    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "ailk-delivery-test-"));
+    process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
+    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: "lead_db_1" });
+    mockSendLeadNotification.mockResolvedValue({ ok: true, messageId: "msg-1" });
+  });
+
+  afterEach(async () => {
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  });
+
+  describe("email delivery (the three email vars, no DATABASE_URL, production)", () => {
+    beforeEach(() => {
+      Object.assign(process.env, EMAIL_ENV, { NODE_ENV: "production" });
+    });
+
+    it("an accepted email → ok:true persisted:email with an email- id; no Prisma, no file fallback", async () => {
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: true }
+      >;
+
+      expect(result).toMatchObject({
+        ok: true,
+        persisted: "email",
+        email: { ok: true, messageId: "msg-1" },
+      });
+      expect(result.id).toMatch(/^email-/);
+      expect(result.id).toMatch(/^[a-z0-9_-]{8,64}$/i);
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(await listFiles()).toEqual([]);
+      expect(mockSendLeadNotification).toHaveBeenCalledTimes(1);
+    });
+
+    it("a refused email → ok:false delivery_failed (never reported as sent)", async () => {
+      mockSendLeadNotification.mockResolvedValue({
+        ok: false,
+        error: { kind: "provider_error", message: "rejected" },
+      });
+
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: false }
+      >;
+
+      expect(result.ok).toBe(false);
+      expect(result.error.kind).toBe("delivery_failed");
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(await listFiles()).toEqual([]);
+    });
+
+    it("a skipped email (provider reports the key missing) → delivery_failed", async () => {
+      mockSendLeadNotification.mockResolvedValue({
+        ok: false,
+        error: { kind: "config_missing", message: "RESEND_API_KEY not set" },
+      });
+
+      const result = await routeLead(leadInput, sourceMeta);
+      expect(result).toMatchObject({ ok: false, error: { kind: "delivery_failed" } });
+    });
+
+    it("a callback is delivered by email too — carrying the name and number to call", async () => {
+      const result = await routeLead(
+        { ...callbackInput, preferredTime: "mornings" },
+        sourceMeta,
+      );
+      expect(result).toMatchObject({ ok: true, persisted: "email" });
+      expect(prisma.callback.create).not.toHaveBeenCalled();
+      const arg = mockSendLeadNotification.mock.calls[0][0];
+      expect(arg.lead.payload).toMatchObject({
+        name: "Alice",
+        phone: "+15551234567",
+        preferredTime: "mornings",
+        notes: "urgent",
+      });
+      // No visitor address to reply to — never an empty Reply-To.
+      expect(arg.replyToOverride).toBe("owner@example.com");
+    });
+
+    it("a newsletter subscribe is refused with config_missing — a signup needs a database", async () => {
+      const result = await routeLead(subscribeInput, sourceMeta);
+      expect(result).toMatchObject({ ok: false, error: { kind: "config_missing" } });
+      expect(prisma.subscriber.create).not.toHaveBeenCalled();
+      expect(mockSendLeadNotification).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("production with neither a database nor the email vars", () => {
+    beforeEach(() => {
+      process.env.NODE_ENV = "production";
+    });
+
+    it("refuses with config_missing before any write", async () => {
+      const result = await routeLead(leadInput, sourceMeta);
+
+      expect(result).toMatchObject({ ok: false, error: { kind: "config_missing" } });
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(mockSendLeadNotification).not.toHaveBeenCalled();
+      expect(await listFiles()).toEqual([]);
+    });
+  });
+
+  describe("inbox delivery in production with the database failing (not a constraint)", () => {
+    beforeEach(() => {
+      process.env.DATABASE_URL = "postgres://test";
+      process.env.NODE_ENV = "production";
+      (prisma.lead.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+    });
+
+    it("no email vars → persist_failed, and the non-durable file fallback is not attempted", async () => {
+      const result = await routeLead(leadInput, sourceMeta);
+
+      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+      expect(await listFiles()).toEqual([]);
+    });
+
+    it("email vars set and the send accepted → persisted:email", async () => {
+      Object.assign(process.env, EMAIL_ENV);
+
+      const result = (await routeLead(leadInput, sourceMeta)) as Extract<
+        RouteLeadResult,
+        { ok: true }
+      >;
+
+      expect(result).toMatchObject({ ok: true, persisted: "email" });
+      expect(result.id).toMatch(/^email-/);
+      expect(await listFiles()).toEqual([]);
+    });
+
+    it("a newsletter signup is never emailed — persist_failed", async () => {
+      Object.assign(process.env, EMAIL_ENV);
+      (prisma.subscriber.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+
+      const result = await routeLead(subscribeInput, sourceMeta);
+
+      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+      expect(mockSendLeadNotification).not.toHaveBeenCalled();
+    });
+
+    it("email vars set but the send refused → persist_failed", async () => {
+      Object.assign(process.env, EMAIL_ENV);
+      mockSendLeadNotification.mockResolvedValue({
+        ok: false,
+        error: { kind: "provider_error", message: "rejected" },
+      });
+
+      const result = await routeLead(leadInput, sourceMeta);
+      expect(result).toMatchObject({ ok: false, error: { kind: "persist_failed" } });
+    });
+  });
+
+  describe("inbox delivery outside production keeps today's file fallback", () => {
+    it("DB down in test → persisted:file", async () => {
+      process.env.DATABASE_URL = "postgres://test";
+      process.env.NODE_ENV = "test";
+      (prisma.lead.create as jest.Mock).mockRejectedValue(new Error("connection refused"));
+
+      const result = await routeLead(leadInput, sourceMeta);
+      expect(result).toMatchObject({ ok: true, persisted: "file" });
+      expect((await listFiles()).length).toBeGreaterThan(0);
+    });
+  });
+});

package/templates/apps/api/src/services/__tests__/leads-inbox.test.ts

@@ -327,3 +327,127 @@ describe("listOwnedLeads", () => {
     expect(second.value.nextCursor).toBeNull();
   });
 });
+
+// ─── #6730 D7 — the single-tenant inbox, pinned to the operator ──────────────
+
+describe("listOwnedLeads — single-tenant build (#6730 D7)", () => {
+  const { DEFAULT_ORG_ID, DEFAULT_WORKSPACE_ID } = jest.requireActual(
+    "@working-theory/database/tenancy",
+  ) as { DEFAULT_ORG_ID: string; DEFAULT_WORKSPACE_ID: string };
+  const OPERATOR_EMAIL = "owner@example.com";
+  const prior = {
+    modules: process.env.AILK_ENABLED_MODULES,
+    pin: process.env.AILK_OPERATOR_EMAIL,
+  };
+
+  /** One workspace — the seeded default — and a caller whose verified email is `email`. */
+  function oneWorkspaceDeployment(opts: {
+    email: string;
+    verified?: boolean;
+    workspaceCount?: number;
+    role?: string;
+  }) {
+    (prisma.workspace.count as jest.Mock).mockResolvedValue(opts.workspaceCount ?? 1);
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
+      id: DEFAULT_WORKSPACE_ID,
+      organizationId: DEFAULT_ORG_ID,
+    });
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
+      id: USER_ID,
+      email: opts.email,
+      emailVerified: opts.verified ?? true,
+    });
+    (prisma.membership.create as jest.Mock).mockResolvedValue({});
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: opts.role ?? "owner",
+    });
+  }
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    delete process.env.AILK_ENABLED_MODULES;
+    process.env.AILK_OPERATOR_EMAIL = OPERATOR_EMAIL;
+    seedLeadTable([
+      lead({ id: "lead_own", siteId: DEFAULT_WORKSPACE_ID }),
+      lead({ id: "lead_elsewhere", siteId: OTHER_SITE_ID }),
+    ]);
+  });
+
+  afterAll(() => {
+    for (const [key, value] of [
+      ["AILK_ENABLED_MODULES", prior.modules],
+      ["AILK_OPERATOR_EMAIL", prior.pin],
+    ] as const) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+  });
+
+  it("the pinned, verified owner sees the default workspace's leads — and only those", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    expect(result.value.items.map((r) => r.id)).toEqual(["lead_own"]);
+  });
+
+  it("the pin unset → empty", async () => {
+    delete process.env.AILK_OPERATOR_EMAIL;
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+    expect(prisma.lead.findMany).not.toHaveBeenCalled();
+  });
+
+  it("a different verified email → empty", async () => {
+    oneWorkspaceDeployment({ email: "stranger@example.com" });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+    expect(prisma.lead.findMany).not.toHaveBeenCalled();
+  });
+
+  it("the pinned email, unverified → empty", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, verified: false });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+  });
+
+  it("a second workspace → empty (not unambiguously one-workspace)", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, workspaceCount: 2 });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+  });
+
+  it("a `member` role → empty — the role floor still holds", async () => {
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL, role: "member" });
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+  });
+
+  it("with multi-tenant on, resolveOwnerWorkspaces is the path — the default-tenant resolver is not called", async () => {
+    process.env.AILK_ENABLED_MODULES = "multi-tenant";
+    oneWorkspaceDeployment({ email: OPERATOR_EMAIL });
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue([]);
+    const ownerWorkspaces = jest.requireActual("../owner-workspaces.js");
+    const spy = jest.spyOn(ownerWorkspaces, "resolveOwnerWorkspaces");
+
+    const result = await listOwnedLeads({ userId: USER_ID, limit: 50 });
+
+    expect(spy).toHaveBeenCalledWith(USER_ID);
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
+    expect(result).toEqual({ ok: true, value: { items: [], nextCursor: null } });
+    spy.mockRestore();
+  });
+});