create-ailk 0.7.0 → 0.9.0

package/templates/apps/api/src/routes/checkout/sessions.ts

@@ -12,19 +12,40 @@
  *     Only the first 8 chars of the session ID appear in log lines.
  *   - Error responses never echo user input (productCode, URLs).
  *   - No DB write: this unit creates a Stripe session only; webhook-driven
- *     persistence is a follow-up issue.
+ *     persistence is a follow-up issue. It READS the database only to resolve
+ *     an optional signed-in buyer (below).
+ *   - Optional cookie identity (#6866): a valid, same-origin Better Auth
+ *     session cookie whose user has a verified email makes the Checkout a
+ *     signed-in one — the session is pinned to the buyer's Stripe customer and
+ *     stamped `metadata.ailk_user_id`, so the #6852 webhook binds it. The id
+ *     comes ONLY from the session cookie, never the body; a bearer token never
+ *     identifies a buyer. Any lookup failure, and a pinned customer Stripe
+ *     does not know, degrades to today's anonymous Checkout — never an error.
+ *     The stamped id is never echoed or logged.
  *   - X-Internal-Auth gate: when OSS_API_INTERNAL_SECRET env var is set,
  *     the X-Internal-Auth header must match; requests without a matching header
  *     are rejected with 401. When the env var is unset, no gate is applied
  *     (backward-compat for OSS standalone deployments). See #935.
+ *   - Same-origin redirects (#6877): a request that did not pass an ENABLED
+ *     internal-auth gate (the OSS default) must send successUrl and cancelUrl
+ *     on the site's own origin — `FRONTEND_URL`'s, exact scheme + host + port,
+ *     checked on the raw string as well as on the parse, because the raw
+ *     string is what Stripe receives. Anything else is a 400 before any Stripe
+ *     call or database read. A caller authenticated by X-Internal-Auth keeps
+ *     its redirects; that exemption holds only while every internal caller
+ *     builds its redirects itself — an internal caller MUST NEVER forward a
+ *     redirect taken from its own end user.
  *
  * Error mapping:
  *   401 internal-auth-required — X-Internal-Auth missing/mismatch (only when env var set)
- *   400 validation-error      — Zod validation failed (missing/invalid fields)
+ *   400 validation-error      — Zod validation failed (missing/invalid fields), or an
+ *                               unauthenticated redirect is off the site origin (#6877)
  *   404 unknown-product-code  — no active Stripe price for the given productCode
  *   500 stripe-not-configured — STRIPE_SECRET_KEY is missing/empty (no Stripe call)
  *   500 live-mode-forbidden   — STRIPE_SECRET_KEY is a live key
- *   500 config-error          — STRIPE_SECRET_KEY invalid configuration (from the SDK wrapper)
+ *   500 config-error          — STRIPE_SECRET_KEY invalid configuration (from the SDK wrapper),
+ *                               or FRONTEND_URL is not an absolute http(s) URL / is unset in
+ *                               production when the origin lock applies (#6877)
  *   502 checkout-unavailable  — Stripe SDK threw an unexpected error
  */
 import { timingSafeEqual } from "node:crypto";
@@ -32,12 +53,28 @@ import { timingSafeEqual } from "node:crypto";
 import type { FastifyReply, FastifyRequest } from "fastify";
 import { z } from "zod";
 
+import { config } from "../../config/index.js";
 import {
   assertSandboxKey,
   createCheckoutSession,
   StripeConfigError,
+  UnknownCustomerError,
   UnknownProductCodeError,
 } from "../../lib/stripe.js";
+import type {
+  CreateCheckoutSessionInput,
+  CreateCheckoutSessionOutput,
+} from "../../lib/stripe.js";
+import {
+  type OptionalCookieUser,
+  resolveOptionalCookieUser,
+} from "../../middleware/auth.js";
+import {
+  type CheckoutBuyerResult,
+  resolveCheckoutBuyer,
+} from "../../services/checkout-buyer.js";
+
+type OptionalCookieUserNone = Extract<OptionalCookieUser, { kind: "none" }>;
 
 // ── Input validation schema ───────────────────────────────────────────────────
 
@@ -81,14 +118,13 @@ const CheckoutSessionRequestSchema = z.object({
 // ── Internal-auth gate ────────────────────────────────────────────────────────
 
 /**
- * Enforce the X-Internal-Auth gate when OSS_API_INTERNAL_SECRET is configured.
+ * Classify the request against the X-Internal-Auth gate (#935, #6877 D3).
  *
  * Gate is env-var-conditional:
- *   - env var SET → header must be present and must match exactly
- *   - env var UNSET → no gate applied (OSS standalone backward-compat)
- *
- * Returns true if the request should be allowed through; false if it must be
- * rejected with 401.
+ *   - env var SET, header missing or wrong → "refused" (401)
+ *   - env var SET, header matches           → "authenticated" (redirects kept)
+ *   - env var UNSET                         → "open" (OSS standalone backward-
+ *     compat; the request is anonymous, so the origin lock applies)
  *
  * Uses a constant-time string comparison to prevent timing attacks on the
  * secret value. Node's `crypto.timingSafeEqual` requires equal-length Buffers,
@@ -96,20 +132,116 @@ const CheckoutSessionRequestSchema = z.object({
  * no information about the secret's content beyond its length, which is
  * acceptable for a shared internal secret).
  */
-function passesInternalAuthGate(request: FastifyRequest): boolean {
+function internalAuthVerdict(
+  request: FastifyRequest,
+): "refused" | "open" | "authenticated" {
   const expectedSecret = process.env["OSS_API_INTERNAL_SECRET"];
   // Gate is disabled when env var is not set — OSS standalone backward-compat.
-  if (!expectedSecret) return true;
+  if (!expectedSecret) return "open";
 
   const provided = request.headers["x-internal-auth"];
-  if (typeof provided !== "string" || !provided) return false;
+  if (typeof provided !== "string" || !provided) return "refused";
 
   // Constant-time comparison.
   const expectedBuf = Buffer.from(expectedSecret, "utf8");
   const providedBuf = Buffer.from(provided, "utf8");
-  if (expectedBuf.length !== providedBuf.length) return false;
+  if (expectedBuf.length !== providedBuf.length) return "refused";
+
+  return timingSafeEqual(expectedBuf, providedBuf)
+    ? "authenticated"
+    : "refused";
+}
+
+// ── Same-origin redirect lock (#6877) ────────────────────────────────────────
+
+/**
+ * The site's own origin, from `FRONTEND_URL` (#6877 D6). `null` when the
+ * setting does not parse, parses to a non-http(s) scheme (whose origin would
+ * be the literal `"null"`), or is unset in production — where the config
+ * default `http://localhost:3000` would lock a live site to localhost.
+ */
+function siteRedirectOrigin(): string | null {
+  if (!process.env["FRONTEND_URL"] && config.NODE_ENV === "production") {
+    return null;
+  }
+  let parsed: URL;
+  try {
+    parsed = new URL(config.FRONTEND_URL);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+  return parsed.origin;
+}
+
+/** C0 controls, space, DEL and backslash — anything a parser may normalize. */
+// eslint-disable-next-line no-control-regex -- the control-character range is exactly what D2 check 1 must refuse.
+const NON_CANONICAL_URL_CHAR = /[\u0000-\u0020\u007f\\]/;
+
+/**
+ * True only when `raw` is on `siteOrigin` both as written and as parsed
+ * (#6877 D2). The raw-string checks matter because the route forwards `raw`
+ * itself to Stripe: WHATWG parses `https://example.com\@evil.test/x` to
+ * origin `https://example.com`, and another parser may not. Requiring the
+ * literal origin followed by `/`, `?`, `#` or the end keeps
+ * `https://example.com.evil.test` out, and exact origin equality keeps a
+ * scheme downgrade or another port out.
+ */
+function isSameOriginRedirect(raw: string, siteOrigin: string): boolean {
+  if (NON_CANONICAL_URL_CHAR.test(raw)) return false;
+  if (!raw.startsWith(siteOrigin)) return false;
+  const boundary = raw.charAt(siteOrigin.length);
+  if (boundary !== "" && !"/?#".includes(boundary)) return false;
+  let resolved: URL;
+  try {
+    resolved = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (resolved.protocol !== "https:" && resolved.protocol !== "http:")
+    return false;
+  return resolved.origin === siteOrigin;
+}
+
+// ── Optional signed-in buyer (#6866) ─────────────────────────────────────────
+
+type Buyer = NonNullable<CreateCheckoutSessionInput["buyer"]>;
+
+/** Why a present cookie produced no buyer — the closed set D6 logs. */
+type IdentityReason =
+  | Exclude<OptionalCookieUserNone["reason"], "no_cookie">
+  | Extract<CheckoutBuyerResult, { ok: false }>["reason"]
+  | "buyer_lookup_failed"
+  | "buyer_invalid"
+  | "stale_customer";
 
-  return timingSafeEqual(expectedBuf, providedBuf);
+/**
+ * Resolve the signed-in buyer from the session cookie alone (#6866 D2/D3).
+ * Never throws: a failed lookup is anonymous (F7). `identity` is the reason a
+ * present cookie produced no buyer — logged, never the user's id; absent for
+ * a call with no cookie (D6).
+ */
+async function resolveBuyer(
+  request: FastifyRequest,
+): Promise<{ buyer?: Buyer; identity?: IdentityReason }> {
+  const cookieUser = await resolveOptionalCookieUser(request, {
+    frontendOrigin: config.FRONTEND_URL,
+  });
+  if (cookieUser.kind === "none") {
+    return cookieUser.reason === "no_cookie"
+      ? {}
+      : { identity: cookieUser.reason };
+  }
+  try {
+    const result = await resolveCheckoutBuyer(cookieUser.userId);
+    if (!result.ok) return { identity: result.reason };
+    const { userId, email, customerId } = result.buyer;
+    return {
+      buyer: { userId, email, ...(customerId !== null && { customerId }) },
+    };
+  } catch {
+    return { identity: "buyer_lookup_failed" };
+  }
 }
 
 // ── Handler ───────────────────────────────────────────────────────────────────
@@ -119,7 +251,8 @@ export async function checkoutSessionsHandler(
   reply: FastifyReply,
 ): Promise<void> {
   // ── X-Internal-Auth gate (env-var-conditional) ────────────────────────────
-  if (!passesInternalAuthGate(request)) {
+  const authVerdict = internalAuthVerdict(request);
+  if (authVerdict === "refused") {
     return reply.status(401).send({ error: "internal-auth-required" });
   }
 
@@ -144,16 +277,79 @@ export async function checkoutSessionsHandler(
   const { productCode, successUrl, cancelUrl, quantity, allowPromotionCodes } =
     parsed.data;
 
+  // ── Same-origin redirect lock (#6877) — before any Stripe or DB call ──────
+  if (authVerdict === "open") {
+    const siteOrigin = siteRedirectOrigin();
+    if (siteOrigin === null) {
+      request.log.error(
+        { method: request.method, path: request.url },
+        "[checkout] FRONTEND_URL is not a valid absolute URL",
+      );
+      return reply.status(500).send({ error: "config-error" });
+    }
+    const refused = (["successUrl", "cancelUrl"] as const).filter(
+      (field) => !isSameOriginRedirect(parsed.data[field], siteOrigin),
+    );
+    if (refused.length > 0) {
+      // Field names only — the refused URL is never logged or echoed.
+      request.log.warn(
+        {
+          method: request.method,
+          path: request.url,
+          outcome: "redirect_origin_refused",
+          fields: refused,
+        },
+        "[checkout] redirect origin refused",
+      );
+      return reply.status(400).send({
+        error: "validation-error",
+        details: refused.map((field) => ({
+          code: "custom",
+          path: [field],
+          message: `${field} must be on this site's origin`,
+        })),
+      });
+    }
+  }
+
+  const sessionInput: CreateCheckoutSessionInput = {
+    productCode,
+    successUrl,
+    cancelUrl,
+    quantity: quantity ?? 1,
+    // Omitted when the caller says nothing — Stripe's default (no promo-code
+    // field) is unchanged for every existing caller.
+    ...(allowPromotionCodes !== undefined && { allowPromotionCodes }),
+  };
+  // Built only from the session cookie — never from `parsed.data` (#6866 D5).
+  let { buyer, identity } = await resolveBuyer(request);
+
   try {
-    const { sessionId, url } = await createCheckoutSession({
-      productCode,
-      successUrl,
-      cancelUrl,
-      quantity: quantity ?? 1,
-      // Omitted when the caller says nothing — Stripe's default (no promo-code
-      // field) is unchanged for every existing caller.
-      ...(allowPromotionCodes !== undefined && { allowPromotionCodes }),
-    });
+    let created: CreateCheckoutSessionOutput;
+    try {
+      created = await createCheckoutSession({
+        ...sessionInput,
+        ...(buyer !== undefined && { buyer }),
+      });
+    } catch (err) {
+      // The buyer itself cannot be used — a pinned customer Stripe does not
+      // know (#6866 D8), or a stored email / customer id the library's schema
+      // refuses (F7: no new failure mode). Retry once as anonymous; the
+      // stored binding is never touched here. The request fields already
+      // passed the route's schema, so an anonymous retry that still fails
+      // maps exactly as today.
+      const reason: IdentityReason | undefined =
+        err instanceof UnknownCustomerError
+          ? "stale_customer"
+          : err instanceof Error && err.name === "ZodError"
+            ? "buyer_invalid"
+            : undefined;
+      if (buyer === undefined || reason === undefined) throw err;
+      buyer = undefined;
+      identity = reason;
+      created = await createCheckoutSession(sessionInput);
+    }
+    const { sessionId, url } = created;
 
     request.log.info(
       {
@@ -161,6 +357,8 @@ export async function checkoutSessionsHandler(
         path: request.url,
         sessionIdPrefix: sessionId.substring(0, 8),
         status: 201,
+        buyer: buyer !== undefined ? "signed_in" : "anonymous",
+        ...(identity !== undefined && { identity }),
       },
       "[checkout] session created",
     );

package/templates/apps/api/src/routes/leads/__tests__/capture.test.ts

@@ -0,0 +1,88 @@
+/**
+ * @file capture.test.ts
+ * `GET /v1/leads/capture` (#6730 D4) — the four D1 environments, and the
+ * body's exact shape: two booleans, never the mode or an env name.
+ */
+
+import type { FastifyInstance } from "fastify";
+
+// The route module also carries the write routes; their dependencies are
+// external boundaries this read never reaches.
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts is the repo-standard double
+jest.mock("../../../lib/prisma.js");
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn(),
+  sendRequestConfirmEmail: jest.fn(),
+  sendRequestPaidLinkEmail: jest.fn(),
+}));
+
+import { leadCaptureStatusRoute } from "../index";
+
+const ENV_KEYS = [
+  "DATABASE_URL",
+  "NODE_ENV",
+  "RESEND_API_KEY",
+  "AILK_LEAD_NOTIFICATION_TO",
+  "AILK_LEAD_NOTIFICATION_FROM",
+  "LEAD_CAPTURE_FILE_DISABLED",
+] as const;
+
+const EMAIL_ENV = {
+  RESEND_API_KEY: "re_test",
+  AILK_LEAD_NOTIFICATION_TO: "owner@example.com",
+  AILK_LEAD_NOTIFICATION_FROM: "noreply@example.com",
+};
+
+describe("GET /v1/leads/capture", () => {
+  let app: FastifyInstance;
+  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+
+  beforeEach(async () => {
+    saved = {};
+    for (const k of ENV_KEYS) saved[k] = process.env[k];
+    for (const k of ENV_KEYS) delete process.env[k];
+    const fastify = require("fastify")();
+    await fastify.register(leadCaptureStatusRoute);
+    app = fastify;
+  });
+
+  afterEach(async () => {
+    await app.close();
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+  });
+
+  const get = () => app.inject({ method: "GET", url: "/v1/leads/capture" });
+
+  it.each([
+    ["inbox", { DATABASE_URL: "postgres://x", NODE_ENV: "production" }, true, true],
+    ["email", { ...EMAIL_ENV, NODE_ENV: "production" }, true, false],
+    ["local", { NODE_ENV: "development" }, true, true],
+    ["none", { NODE_ENV: "production" }, false, false],
+  ] as const)("%s → contact=%s newsletter=%s", async (_mode, env, contact, newsletter) => {
+    Object.assign(process.env, env);
+
+    const res = await get();
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, data: { contact, newsletter } });
+  });
+
+  it("the body carries exactly ok + data{contact,newsletter} — no mode, no env names", async () => {
+    Object.assign(process.env, EMAIL_ENV, { NODE_ENV: "production" });
+
+    const res = await get();
+    const body = res.json();
+
+    expect(Object.keys(body).sort()).toEqual(["data", "ok"]);
+    expect(Object.keys(body.data).sort()).toEqual(["contact", "newsletter"]);
+    expect(res.body).not.toMatch(/email|inbox|RESEND|DATABASE|owner@example\.com/);
+  });
+
+  it("is cacheable for a minute", async () => {
+    const res = await get();
+    expect(res.headers["cache-control"]).toBe("public, max-age=60");
+  });
+});

package/templates/apps/api/src/routes/leads/__tests__/index.test.ts

@@ -1236,3 +1236,103 @@ describe("#6335 — the shared prisma mock declares no workspace default", () =>
     });
   });
 });
+
+// ─── #6730 D2/D5 — email delivery and the production refusal, over HTTP ─────
+
+describe("POST /v1/leads/submit — #6730 delivery modes", () => {
+  let app: FastifyInstance;
+  const ENV_KEYS = [
+    "DATABASE_URL",
+    "NODE_ENV",
+    "RESEND_API_KEY",
+    "AILK_LEAD_NOTIFICATION_TO",
+    "AILK_LEAD_NOTIFICATION_FROM",
+    "LEAD_CAPTURE_FILE",
+    "AILK_INBOX_FALLBACK_DIR",
+  ] as const;
+  let saved: Partial<Record<(typeof ENV_KEYS)[number], string | undefined>>;
+  const sendLeadNotification = jest.requireMock("@working-theory/email")
+    .sendLeadNotification as jest.Mock;
+  const writeLeadFallbackSpy = jest.spyOn(
+    jest.requireActual("../../../lib/file-fallback.js"),
+    "writeLeadFallback",
+  );
+
+  const submit = () =>
+    app.inject({
+      method: "POST",
+      url: "/v1/leads/submit",
+      payload: {
+        kind: "submit",
+        source: "contact",
+        email: "visitor@example.com",
+        payload: { message: "hello" },
+      },
+    });
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    saved = {};
+    for (const k of ENV_KEYS) saved[k] = process.env[k];
+    for (const k of ENV_KEYS) delete process.env[k];
+    process.env.NODE_ENV = "production";
+    const fastify = require("fastify")();
+    await fastify.register(leadSubmitRoute);
+    app = fastify;
+  });
+
+  afterEach(async () => {
+    await app.close();
+    for (const k of ENV_KEYS) {
+      if (saved[k] === undefined) delete process.env[k];
+      else process.env[k] = saved[k];
+    }
+  });
+
+  describe("email delivery (no DATABASE_URL, the three email vars)", () => {
+    beforeEach(() => {
+      process.env.RESEND_API_KEY = "re_test";
+      process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
+      process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
+    });
+
+    it("an accepted email → 201 persisted:email; no Prisma write", async () => {
+      sendLeadNotification.mockResolvedValueOnce({ ok: true, messageId: "msg-e" });
+
+      const res = await submit();
+
+      expect(res.statusCode).toBe(201);
+      expect(res.json()).toMatchObject({ persisted: "email" });
+      expect(res.json().id).toMatch(/^email-/);
+      expect(prisma.lead.create).not.toHaveBeenCalled();
+      expect(sendLeadNotification).toHaveBeenCalledTimes(1);
+      expect(sendLeadNotification.mock.calls[0][0].recipientEmail).toBe("owner@example.com");
+    });
+
+    it("a refused email → 503 delivery_failed, never 201", async () => {
+      sendLeadNotification.mockResolvedValueOnce({
+        ok: false,
+        error: { kind: "provider_error", message: "rejected" },
+      });
+
+      const res = await submit();
+
+      expect(res.statusCode).toBe(503);
+      expect(res.json()).toEqual({
+        error: "delivery_failed",
+        message: "The message could not be delivered.",
+      });
+    });
+  });
+
+  it("production with neither → 503 lead_capture_not_configured; no Prisma, no file, no email", async () => {
+    const res = await submit();
+
+    expect(res.statusCode).toBe(503);
+    expect(res.json().error).toBe("lead_capture_not_configured");
+    expect(prisma.lead.create).not.toHaveBeenCalled();
+    expect(writeLeadFallbackSpy).not.toHaveBeenCalled();
+    expect(sendLeadNotification).not.toHaveBeenCalled();
+    await expect(fs.access(fileEnv.getCaptureFilePath())).rejects.toThrow();
+  });
+});

package/templates/apps/api/src/routes/leads/index.ts

@@ -5,6 +5,16 @@
  *   POST /v1/leads/submit    — lead submission (contact form / inquiry)
  *   POST /v1/leads/subscribe — newsletter subscription
  *   POST /v1/leads/callback  — callback request (phone-back)
+ *   GET  /v1/leads/capture   — whether this deployment accepts a contact
+ *                              message / a newsletter signup (#6730 D4)
+ *
+ * API↔MCP PARITY — `GET /v1/leads/capture` has NO MCP twin, a recorded
+ * exception on the same footing as the anonymous form-lifecycle routes. It
+ * exists so a web page can choose between the form and the contact email
+ * before rendering; an agent never needs that preflight, because the three
+ * write tools (`capture_lead`, `subscribe_newsletter`, `request_callback`)
+ * already return a typed `api_error` carrying the 503 when capture is not
+ * accepted — the same answer, at the moment it matters.
  *
  * TENANT RESOLUTION (#6203, spec §10.4 operator ruling — reverses this
  * file's former byte-unchanged posture). `siteId` used to be taken VERBATIM
@@ -24,6 +34,7 @@
 import { track } from "@working-theory/analytics/server";
 import type { FastifyPluginAsync } from "fastify";
 
+import { acceptsKind, resolveLeadDelivery } from "../../lib/lead-delivery.js";
 import { currentSiteId, resolveSiteWorkspaceId } from "../../lib/site.js";
 import {
   type LeadKind,
@@ -175,7 +186,20 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
           );
           return reply.status(503).send({ error: "persist_failed" });
         }
-        // config_missing — lead capture not configured (file disabled + no DB)
+        if (result.error.kind === "delivery_failed") {
+          // Email was the delivery and the provider did not accept it —
+          // never reported as sent (#6730 D5). Detail stays server-side.
+          // `{ kind, siteId }` only (spec D5): provider error text can echo
+          // an address.
+          request.log.error({ kind, siteId: workspaceId }, "lead delivery_failed");
+          return reply.status(503).send({
+            error: "delivery_failed",
+            message: "The message could not be delivered.",
+          });
+        }
+        // config_missing — this deployment has nowhere to put this kind of
+        // lead (#6730 D1: production with neither a database nor the email
+        // vars, or a newsletter signup with no database).
         return reply.status(503).send({
           error: "lead_capture_not_configured",
           message: "Lead capture is not configured.",
@@ -249,3 +273,24 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
 export const leadSubmitRoute = makeLeadsRoute("submit");
 export const leadSubscribeRoute = makeLeadsRoute("subscribe");
 export const leadCallbackRoute = makeLeadsRoute("callback");
+
+/**
+ * `GET /v1/leads/capture` (#6730 D4) — two booleans and nothing else: never
+ * an address or which env var is missing. (The pair implies as much of the
+ * delivery mode as the rendered page already shows.) Registered at
+ * the top level in `server.ts`, outside `leadsScope`'s strict per-IP limit
+ * (a web server's single egress IP already spends that on form submissions),
+ * so only the server-wide unauthenticated ceiling applies.
+ */
+export const leadCaptureStatusRoute: FastifyPluginAsync = async (fastify) => {
+  fastify.get("/v1/leads/capture", async (_request, reply) => {
+    const delivery = resolveLeadDelivery();
+    return reply.header("Cache-Control", "public, max-age=60").send({
+      ok: true,
+      data: {
+        contact: acceptsKind(delivery, "submit"),
+        newsletter: acceptsKind(delivery, "subscribe"),
+      },
+    });
+  });
+};

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-flow-checkout.test.ts

@@ -170,7 +170,7 @@ describe("AC-1 — completed stamps the row once, guarded, beside the legacy tas
     expect(prisma.user.findFirst).toHaveBeenCalledWith({
       where: { billingProvider: "stripe", billingCustomerId: CUSTOMER_ID },
     });
-    expect(prisma.user.findUnique).toHaveBeenCalledWith({ where: { email: EMAIL } });
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
   });
 });
 

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-org-billing.test.ts

@@ -232,7 +232,11 @@ describe("POST /api/webhooks/stripe — org-scoped billing (#3601)", () => {
     (prisma.user.update as jest.Mock).mockResolvedValueOnce({ id: "usr_st" });
 
     mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_st_004", { productId: "pro" }, customerId),
+      checkoutEvent(
+        "evt_st_004",
+        { productId: "pro", ailk_user_id: "usr_st" },
+        customerId,
+      ),
     );
     const r = await fire(server);
     expect(r.statusCode).toBe(200);