@0x0501/mystack 0.0.0-stage → 0.1.0-bootstrap.0

package/template/src/__tests__/auth-redirect.test.ts

@@ -0,0 +1,120 @@
+// @vitest-environment jsdom
+
+import { beforeAll, beforeEach, describe, expect, it } from "vitest";
+import {
+	afterAuthTarget,
+	goToSignIn,
+	localizedAuthPath,
+	safeRedirectPath,
+} from "@/utils/auth-redirect";
+
+beforeAll(async () => {
+	if (
+		typeof (globalThis as { URLPattern?: unknown }).URLPattern === "undefined"
+	) {
+		const mod = (await import("@inlang/paraglide-js/urlpattern-polyfill")) as {
+			URLPattern?: unknown;
+			default?: unknown;
+		};
+		(globalThis as { URLPattern?: unknown }).URLPattern =
+			mod.URLPattern ?? mod.default;
+	}
+});
+
+beforeEach(() => {
+	window.history.replaceState({}, "", "/sign-in");
+});
+
+describe("safeRedirectPath", () => {
+	it("defaults to the user dashboard when redirect is missing", () => {
+		expect(safeRedirectPath(null)).toBe("/dashboard");
+	});
+
+	it("accepts same-origin relative paths with query and hash", () => {
+		expect(safeRedirectPath("/dashboard/account?tab=security#x")).toBe(
+			"/dashboard/account?tab=security#x",
+		);
+	});
+
+	it("rejects open redirects and protocol-relative URLs", () => {
+		expect(safeRedirectPath("//evil.example")).toBe("/dashboard");
+		expect(safeRedirectPath("https://evil.example/phish")).toBe("/dashboard");
+		expect(safeRedirectPath("\\evil")).toBe("/dashboard");
+	});
+});
+
+describe("afterAuthTarget", () => {
+	it("resumes OAuth authorize when client_id is present", () => {
+		window.history.replaceState(
+			{},
+			"",
+			"/sign-in?client_id=abc&state=1&ba_param=client_id",
+		);
+		expect(afterAuthTarget()).toBe(
+			"/api/auth/oauth2/authorize?client_id=abc&state=1&ba_param=client_id",
+		);
+	});
+
+	it("honors a safe redirect query", () => {
+		window.history.replaceState(
+			{},
+			"",
+			"/sign-in?redirect=%2Fdashboard%2Faccount",
+		);
+		expect(afterAuthTarget()).toBe("/dashboard/account");
+	});
+
+	it("defaults to the dashboard with no redirect", () => {
+		window.history.replaceState({}, "", "/sign-in");
+		expect(afterAuthTarget()).toBe("/dashboard");
+	});
+});
+
+describe("localizedAuthPath + goToSignIn", () => {
+	it("keeps English auth paths bare", () => {
+		expect(localizedAuthPath("/sign-in")).toBe("/sign-in");
+		expect(localizedAuthPath("/two-factor")).toBe("/two-factor");
+	});
+
+	it("prefixes German auth paths", async () => {
+		const { overwriteGetLocale } = await import("@/paraglide/runtime");
+		overwriteGetLocale(() => "de");
+		try {
+			expect(localizedAuthPath("/sign-in")).toBe("/de/sign-in");
+			expect(localizedAuthPath("/two-factor")).toBe("/de/two-factor");
+		} finally {
+			overwriteGetLocale(() => "en");
+		}
+	});
+
+	it("sends expired sessions to the locale-aware sign-in URL", async () => {
+		const { overwriteGetLocale } = await import("@/paraglide/runtime");
+		overwriteGetLocale(() => "de");
+		const hrefs: string[] = [];
+		const original = window.location;
+		Object.defineProperty(window, "location", {
+			configurable: true,
+			value: {
+				...original,
+				get href() {
+					return hrefs[hrefs.length - 1] ?? original.href;
+				},
+				set href(v: string) {
+					hrefs.push(v);
+				},
+			},
+		});
+		try {
+			goToSignIn("/de/dashboard/account?tab=security");
+			expect(hrefs.at(-1)).toBe(
+				`/de/sign-in?redirect=${encodeURIComponent("/de/dashboard/account?tab=security")}`,
+			);
+		} finally {
+			Object.defineProperty(window, "location", {
+				configurable: true,
+				value: original,
+			});
+			overwriteGetLocale(() => "en");
+		}
+	});
+});

package/template/src/__tests__/body-limit.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from "vitest";
+import { BodyTooLargeError, readJsonCapped } from "@/utils/body-limit";
+
+function requestFromChunks(chunks: Uint8Array[]): Request {
+	let next = 0;
+	return new Request("http://local/body", {
+		method: "POST",
+		body: new ReadableStream<Uint8Array>({
+			pull(controller) {
+				const chunk = chunks[next++];
+				if (chunk) controller.enqueue(chunk);
+				else controller.close();
+			},
+		}),
+		duplex: "half",
+	} as RequestInit);
+}
+
+describe("readJsonCapped", () => {
+	it("decodes JSON split across UTF-8 byte boundaries", async () => {
+		const bytes = new TextEncoder().encode(
+			JSON.stringify({ message: "你好，Starter" }),
+		);
+		const value = await readJsonCapped(
+			requestFromChunks([
+				bytes.slice(0, 14),
+				bytes.slice(14, 15),
+				bytes.slice(15),
+			]),
+			{ maxBytes: bytes.byteLength, requireJson: false },
+		);
+
+		expect(value).toEqual({ message: "你好，Starter" });
+	});
+
+	it("rejects a chunked body as soon as its cumulative bytes exceed the cap", async () => {
+		await expect(
+			readJsonCapped(
+				requestFromChunks([
+					new TextEncoder().encode('{"a":'),
+					new TextEncoder().encode('"too-large"}'),
+				]),
+				{ maxBytes: 8, requireJson: false },
+			),
+		).rejects.toBeInstanceOf(BodyTooLargeError);
+	});
+});

package/template/src/__tests__/creem.test.ts

@@ -0,0 +1,62 @@
+import { createHmac } from "node:crypto";
+import { describe, expect, it } from "vitest";
+import type { Database } from "@/db";
+import { handleCreemWebhook, verifyCreemSignature } from "@/services/creem";
+
+/** A db that fails the test if the handler touches it. */
+const unusableDb = new Proxy({} as Database, {
+	get() {
+		throw new Error("handler reached the database on an unverified event");
+	},
+});
+
+function sign(secret: string, body: string): string {
+	return createHmac("sha256", secret).update(body).digest("hex");
+}
+
+describe("verifyCreemSignature", () => {
+	it("accepts HMAC-SHA256 of the raw body", () => {
+		const body = '{"id":"ch_1"}';
+		expect(
+			verifyCreemSignature("creem_sec", body, sign("creem_sec", body)),
+		).toBe(true);
+	});
+
+	it("rejects a bad or missing signature", () => {
+		const body = '{"id":"ch_1"}';
+		expect(verifyCreemSignature("creem_sec", body, "deadbeef")).toBe(false);
+		expect(verifyCreemSignature("creem_sec", body, null)).toBe(false);
+	});
+});
+
+describe("handleCreemWebhook", () => {
+	it("refuses an unverified event without touching the database", async () => {
+		const body = '{"id":"ch_1"}';
+		const result = await handleCreemWebhook(unusableDb, {
+			rawBody: body,
+			signature: "deadbeef",
+			secret: "creem_sec",
+		});
+		expect(result).toBe("invalid_signature");
+	});
+
+	it("refuses a signed body that is not JSON", async () => {
+		const body = "{not json";
+		const result = await handleCreemWebhook(unusableDb, {
+			rawBody: body,
+			signature: sign("creem_sec", body),
+			secret: "creem_sec",
+		});
+		expect(result).toBe("invalid_payload");
+	});
+
+	it("ignores an event that carries no checkout id", async () => {
+		const body = '{"eventType":"checkout.updated"}';
+		const result = await handleCreemWebhook(unusableDb, {
+			rawBody: body,
+			signature: sign("creem_sec", body),
+			secret: "creem_sec",
+		});
+		expect(result).toBe("noop");
+	});
+});

package/template/src/__tests__/demo-checkout.test.ts

@@ -0,0 +1,141 @@
+/**
+ * Purchase seam extension: demo checkout start is gated by payment toggles
+ * and provider env readiness. Creates a pending Purchase under service scope
+ * only (user RLS cannot insert purchases).
+ */
+import { describe, expect, it, vi } from "vitest";
+import {
+	DEMO_CHECKOUT_AMOUNT_MINOR,
+	type DemoCheckoutPort,
+	resolveCheckoutGate,
+	startDemoCheckout,
+} from "@/services/demo-checkout";
+import type { PurchaseProvider } from "@/services/purchase";
+
+describe("resolveCheckoutGate", () => {
+	const configured = {
+		stripe: true,
+		creem: true,
+		nowpayments: true,
+	};
+
+	it("allows a rail that is toggled on and configured", () => {
+		expect(
+			resolveCheckoutGate({
+				provider: "stripe",
+				toggles: { stripe: true, creem: true, nowpayments: true },
+				configured,
+			}),
+		).toEqual({ ok: true });
+	});
+
+	it("refuses a rail that is toggled off even when configured", () => {
+		expect(
+			resolveCheckoutGate({
+				provider: "stripe",
+				toggles: { stripe: false, creem: true, nowpayments: true },
+				configured,
+			}),
+		).toEqual({ ok: false, code: "disabled" });
+	});
+
+	it("refuses a rail that lacks credentials even when toggled on", () => {
+		expect(
+			resolveCheckoutGate({
+				provider: "creem",
+				toggles: { stripe: true, creem: true, nowpayments: true },
+				configured: { ...configured, creem: false },
+			}),
+		).toEqual({ ok: false, code: "not_configured" });
+	});
+});
+
+describe("startDemoCheckout", () => {
+	function makePort(
+		overrides: Partial<DemoCheckoutPort> = {},
+	): DemoCheckoutPort {
+		return {
+			getToggles: async () => ({
+				stripe: true,
+				creem: true,
+				nowpayments: true,
+			}),
+			isConfigured: (p: PurchaseProvider) => p === "stripe",
+			createHostedSession: async () => ({
+				externalId: "cs_test_1",
+				url: "https://checkout.example/session",
+			}),
+			createPendingPurchase: async () => ({ purchaseId: "pur_1" }),
+			...overrides,
+		};
+	}
+
+	it("creates a pending purchase and returns the hosted URL", async () => {
+		const createPending = vi.fn(async () => ({ purchaseId: "pur_1" }));
+		const createHosted = vi.fn(async () => ({
+			externalId: "cs_test_1",
+			url: "https://checkout.example/session",
+		}));
+		const result = await startDemoCheckout(
+			makePort({
+				createPendingPurchase: createPending,
+				createHostedSession: createHosted,
+			}),
+			{ userId: "u1", userEmail: "u1@example.test", provider: "stripe" },
+		);
+
+		expect(result).toEqual({
+			ok: true,
+			url: "https://checkout.example/session",
+			purchaseId: "pur_1",
+			externalId: "cs_test_1",
+			amount: DEMO_CHECKOUT_AMOUNT_MINOR,
+		});
+		expect(createHosted).toHaveBeenCalledWith({
+			provider: "stripe",
+			userId: "u1",
+			// Providers bill an address, not an id — a session created without it
+			// is the difference between a receipt and a silent orphan charge.
+			userEmail: "u1@example.test",
+			amount: DEMO_CHECKOUT_AMOUNT_MINOR,
+			currency: "usd",
+		});
+		expect(createPending).toHaveBeenCalledWith({
+			userId: "u1",
+			provider: "stripe",
+			externalId: "cs_test_1",
+			amount: DEMO_CHECKOUT_AMOUNT_MINOR,
+			currency: "usd",
+		});
+	});
+
+	it("does not create a purchase when the rail is disabled", async () => {
+		const createPending = vi.fn();
+		const result = await startDemoCheckout(
+			makePort({
+				getToggles: async () => ({
+					stripe: false,
+					creem: true,
+					nowpayments: true,
+				}),
+				createPendingPurchase: createPending,
+			}),
+			{ userId: "u1", userEmail: "u1@example.test", provider: "stripe" },
+		);
+		expect(result).toEqual({ ok: false, code: "disabled" });
+		expect(createPending).not.toHaveBeenCalled();
+	});
+
+	it("does not create a purchase when credentials are missing", async () => {
+		const createPending = vi.fn();
+		const result = await startDemoCheckout(
+			makePort({
+				isConfigured: () => false,
+				createPendingPurchase: createPending,
+			}),
+			{ userId: "u1", userEmail: "u1@example.test", provider: "stripe" },
+		);
+		expect(result).toEqual({ ok: false, code: "not_configured" });
+		expect(createPending).not.toHaveBeenCalled();
+	});
+});

package/template/src/__tests__/email-locale.test.ts

@@ -0,0 +1,110 @@
+/**
+ * Transactional email is rendered in the recipient's language, not the
+ * sender's (CONTEXT.md: emails honour `user.locale`).
+ *
+ * The trap this pins: Paraglide messages read an *ambient* locale by default,
+ * and an email is rendered inside whatever request triggered it — a webhook,
+ * a cron, or another person's session. So the locale has to arrive as an
+ * argument, and a test that only calls the message function would pass while
+ * every real send went out in the sender's language.
+ */
+import { render } from "@react-email/render";
+import { describe, expect, it } from "vitest";
+import { PasswordOtpEmail } from "@/integrations/react-email/PasswordOtpEmail";
+import { ResetPasswordEmail } from "@/integrations/react-email/ResetPasswordEmail";
+import { VerifyEmail } from "@/integrations/react-email/VerifyEmail";
+import { mailLocale } from "@/lib/email";
+
+describe("mailLocale", () => {
+	it("keeps a locale the Starter has a catalog for", () => {
+		expect(mailLocale("de")).toBe("de");
+		expect(mailLocale("en")).toBe("en");
+	});
+
+	// An account that never chose a language must fall back to the base locale
+	// rather than to whatever the triggering request happened to be in.
+	it("falls back to the base locale, never to ambient state", () => {
+		expect(mailLocale(null)).toBe("en");
+		expect(mailLocale(undefined)).toBe("en");
+		expect(mailLocale("fr")).toBe("en");
+	});
+});
+
+describe("verification email", () => {
+	it("renders German for a German account", async () => {
+		const html = await render(
+			VerifyEmail({
+				url: "https://example.test/verify",
+				name: "Ada",
+				brandName: "Starter",
+				locale: "de",
+			}),
+		);
+		expect(html).toContain("Bestätige deine E-Mail-Adresse");
+		expect(html).toContain('lang="de"');
+		expect(html).not.toContain("Confirm your email");
+	});
+
+	it("renders English for an account with no stored locale", async () => {
+		const html = await render(
+			VerifyEmail({
+				url: "https://example.test/verify",
+				brandName: "Starter",
+				locale: mailLocale(null),
+			}),
+		);
+		expect(html).toContain("Confirm your email");
+	});
+});
+
+describe("password reset email", () => {
+	it("renders German for a German account", async () => {
+		const html = await render(
+			ResetPasswordEmail({
+				url: "https://example.test/reset",
+				name: "Ada",
+				brandName: "Starter",
+				locale: "de",
+			}),
+		);
+		expect(html).toContain("Passwort zurücksetzen");
+		expect(html).not.toContain("Reset your password");
+	});
+});
+
+describe("one-time code email", () => {
+	it("renders German, and distinguishes reset from sign-in", async () => {
+		const reset = await render(
+			PasswordOtpEmail({
+				otp: "123456",
+				brandName: "Starter",
+				purpose: "forget-password",
+				locale: "de",
+			}),
+		);
+		const signIn = await render(
+			PasswordOtpEmail({
+				otp: "123456",
+				brandName: "Starter",
+				purpose: "sign-in",
+				locale: "de",
+			}),
+		);
+
+		expect(reset).toContain("Zurücksetzen");
+		expect(signIn).toContain("Anmeldecode");
+		expect(reset).not.toBe(signIn);
+	});
+
+	it("still carries the code itself", async () => {
+		const html = await render(
+			PasswordOtpEmail({
+				otp: "123456",
+				brandName: "Starter",
+				purpose: "sign-in",
+				locale: "de",
+			}),
+		);
+		expect(html).toContain("123456");
+	});
+});

package/template/src/__tests__/global-setup.ts

@@ -0,0 +1,80 @@
+import { existsSync } from "node:fs";
+import { PostgreSqlContainer } from "@testcontainers/postgresql";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Pool } from "pg";
+import type { TestProject } from "vitest/node";
+
+declare module "vitest" {
+	interface ProvidedContext {
+		pgUri: string;
+		pgRlsAppUri: string;
+	}
+}
+
+/**
+ * One Postgres container for the whole run.
+ *
+ * - `postgres` superuser (`pgUri`): temp-table suites (CREATE TEMP TABLE isolation).
+ * - `rls_test` as `starter_app` (`pgRlsAppUri`): real migrations, NOBYPASSRLS —
+ *   policies and GUC contexts match Hyperdrive production.
+ *
+ * Migration 0000 references role/database names used by local Hyperdrive
+ * (`starter_app`, CONNECT on database `postgres`); the container uses the same
+ * username/database so those grants apply.
+ */
+export default async function setup(project: TestProject) {
+	// Pure unit suites (pipeline, search params, HttpError wire) can run without
+	// Docker. Integration suites that call inject("pgUri") still require a real
+	// container — they will fail closed if this path is used.
+	if (process.env.SKIP_TESTCONTAINERS === "1") {
+		project.provide("pgUri", "");
+		project.provide("pgRlsAppUri", "");
+		return;
+	}
+
+	configureDockerRuntime();
+	const container = await new PostgreSqlContainer("postgres:17")
+		.withUsername("postgres")
+		.withPassword("postgres")
+		.withDatabase("postgres")
+		.start();
+	project.provide("pgUri", container.getConnectionUri());
+
+	const admin = new Pool({
+		connectionString: container.getConnectionUri(),
+		max: 1,
+	});
+	await admin.query("CREATE DATABASE rls_test");
+	await admin.end();
+
+	const rlsAdmin = new Pool({
+		connectionString: container
+			.getConnectionUri()
+			.replace(/\/postgres(\?|$)/, "/rls_test$1"),
+		max: 1,
+	});
+	await migrate(drizzle(rlsAdmin), { migrationsFolder: "./drizzle" });
+	// Known test password; migration 0000 bakes the local-dev default.
+	await rlsAdmin.query("ALTER ROLE starter_app PASSWORD 'rls_test'");
+	// Migration 0000 grants CONNECT on database `postgres` only.
+	await rlsAdmin.query("GRANT CONNECT ON DATABASE rls_test TO starter_app");
+	await rlsAdmin.end();
+
+	project.provide(
+		"pgRlsAppUri",
+		`postgresql://starter_app:rls_test@${container.getHost()}:${container.getMappedPort(5432)}/rls_test`,
+	);
+
+	return async () => {
+		await container.stop();
+	};
+}
+
+function configureDockerRuntime() {
+	const orbstackSocket = `${process.env.HOME}/.orbstack/run/docker.sock`;
+	if (!process.env.DOCKER_HOST && existsSync(orbstackSocket)) {
+		process.env.DOCKER_HOST = `unix://${orbstackSocket}`;
+	}
+	process.env.TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE ??= "/var/run/docker.sock";
+}

package/template/src/__tests__/message-parity.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import de from "../../messages/de.json";
+import en from "../../messages/en.json";
+
+/**
+ * Every locale catalog must carry exactly the same message keys (ADR 0005).
+ *
+ * A missing key ships as a silent English fallback, which reads as a finished
+ * translation to everyone except the reader who speaks the other language.
+ * The German *values* are reviewed by hand; this only guards the key set.
+ */
+const keysOf = (catalog: Record<string, unknown>) =>
+	Object.keys(catalog)
+		.filter((key) => key !== "$schema")
+		.sort();
+
+describe("message catalog parity", () => {
+	const enKeys = keysOf(en);
+
+	it("German covers exactly the same keys as English", () => {
+		expect(keysOf(de)).toEqual(enKeys);
+	});
+
+	it("no catalog ships an empty string for a defined key", () => {
+		for (const [locale, catalog] of [
+			["en", en],
+			["de", de],
+		] as const) {
+			for (const key of keysOf(catalog)) {
+				const value = (catalog as Record<string, unknown>)[key];
+				expect(
+					typeof value === "string" && value.trim().length > 0,
+					`${locale}.${key} is empty`,
+				).toBe(true);
+			}
+		}
+	});
+});