@akinon/pz-theme 2.0.50-beta.0 → 2.0.50

package/CHANGELOG.md

@@ -1,12 +1,12 @@
 # @akinon/pz-theme
 
-## 2.0.50-beta.0
+## 2.0.50
 
 ### Patch Changes
 
-- Updated dependencies [cbbbfd75]
-  - @akinon/next@2.0.50-beta.0
-  - @akinon/theme-contract@2.0.50-beta.0
+- 79d611c: ZERO-4745: Mount the login body slot and anchor the auth route rules to segment boundaries
+  - @akinon/next@2.0.50
+  - @akinon/theme-contract@2.0.50
 
 ## 2.0.49
 

package/package.json

@@ -1,26 +1,26 @@
 {
   "name": "@akinon/pz-theme",
   "description": "Theme package for Project Zero Next — ThemePlaceholder system and theme editor infrastructure",
-  "version": "2.0.50-beta.0",
+  "version": "2.0.50",
   "license": "MIT",
   "main": "src/index.ts",
   "scripts": {
     "test": "jest"
   },
   "peerDependencies": {
-    "@akinon/next": "2.0.50-beta.0",
+    "@akinon/next": "2.0.50",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0"
   },
   "dependencies": {
-    "@akinon/theme-contract": "2.0.50-beta.0",
+    "@akinon/theme-contract": "2.0.50",
     "clsx": "2.1.1",
     "lottie-web": "^5.13.0",
     "tailwind-merge": "^2.5.4",
     "zod": "4.4.1"
   },
   "devDependencies": {
-    "@akinon/next": "2.0.50-beta.0",
+    "@akinon/next": "2.0.50",
     "@testing-library/jest-dom": "5.16.4",
     "@testing-library/react": "16.3.2",
     "@testing-library/user-event": "14.1.1",

package/src/__tests__/auth-slot-coverage.test.ts

@@ -0,0 +1,145 @@
+import * as fs from 'fs';
+import * as path from 'path';
+
+import { PLACEHOLDER_SLUGS } from '../chrome/placeholder-slugs';
+import { isPageMountedSlug, resolveBodySlug } from '../chrome/route-slug';
+
+/**
+ * The auth half of the promise the account suite pins: a slug the editor offers
+ * must be mounted by a real page or layout, or the designer saves a composition
+ * the storefront never reads. Auth was exactly that gap — four slugs, route
+ * rules in both repos, starter templates, and no mount anywhere.
+ *
+ * Auth mounts live in two route trees (`auth` and `users/password`), so paths
+ * here are relative to the `[pz]` segment rather than to one page dir.
+ */
+
+const APP_DIR = path.resolve(
+  __dirname,
+  '../../../..',
+  'apps/projectzeronext/src/app/[pz]'
+);
+
+/** Placeholder key -> the file (relative to `[pz]`) mounting it. */
+const EXPECTED_MOUNTS: Record<string, string> = {
+  auth: 'auth/(login)/layout.tsx',
+  forgotPassword: 'users/password/reset/layout.tsx'
+};
+
+/**
+ * Login and register share ONE page in the reference app, and that is a
+ * decision rather than a gap: the shape (tabbed or not) is composed on the
+ * login body, so no `/auth/register` or `/auth/guest` route ships. The dir
+ * assertions below fail the moment someone adds one of those routes — the cue
+ * to mount its slot, not to delete the assertion.
+ */
+const UNMOUNTED_AUTH_KEYS: Record<string, string> = {
+  register: 'auth/register',
+  guestLogin: 'auth/guest'
+};
+
+/**
+ * Every auth path the editor's page picker offers, in the reference app's
+ * spelling and in the brand spellings the rule table accepts. Resolving these
+ * is what makes the completeness check route-truthful: a fifth auth slug with a
+ * rule but no mount lands here rather than in a hand-kept list.
+ */
+const AUTH_PICKER_PATHS = [
+  '/auth',
+  '/users/auth',
+  '/auth/register',
+  '/users/auth/register',
+  '/register',
+  '/auth/forgot-password',
+  '/users/password/reset',
+  '/auth/guest',
+  '/users/auth/guest'
+];
+
+/**
+ * Paths that LOOK like the login screen to a prefix rule but are not it. The
+ * callback is the dangerous one: `oauth-login` renders no markup at all (its
+ * whole job is a `signIn()` effect), so a login body composed over it would
+ * break social sign-in with nothing on screen to notice.
+ */
+const NEVER_THE_LOGIN_BODY = [
+  '/auth/oauth-login',
+  '/users/auth/oauth-login',
+  '/authors',
+  '/authors/latest',
+  '/auth-help',
+  '/registered-office'
+];
+
+const keyForSlug = (slug: string | null) =>
+  Object.keys(PLACEHOLDER_SLUGS).find(
+    (key) => PLACEHOLDER_SLUGS[key as keyof typeof PLACEHOLDER_SLUGS] === slug
+  ) ?? null;
+
+const getAuthKeysFromRouteTable = () =>
+  Array.from(
+    new Set(AUTH_PICKER_PATHS.map((p) => keyForSlug(resolveBodySlug(p))))
+  );
+
+const allAuthKeys = () => [
+  ...Object.keys(EXPECTED_MOUNTS),
+  ...Object.keys(UNMOUNTED_AUTH_KEYS)
+];
+
+const maybeDescribe = fs.existsSync(APP_DIR) ? describe : describe.skip;
+
+maybeDescribe('auth slot coverage in the reference app', () => {
+  it('mounts every auth slug that has a route in its own layout', () => {
+    Object.entries(EXPECTED_MOUNTS).forEach(([key, relativePath]) => {
+      const file = path.join(APP_DIR, relativePath);
+      expect(fs.existsSync(file)).toBe(true);
+      expect(fs.readFileSync(file, 'utf8')).toMatch(
+        new RegExp(`PLACEHOLDER_SLUGS\\.${key}\\b`)
+      );
+    });
+  });
+
+  it('keeps the login mount inside the route group, off the provider callback', () => {
+    // The mount must sit beside the login page in `(login)`, not one level up in
+    // `auth/layout.tsx` — that layout would also wrap `auth/oauth-login`.
+    expect(fs.existsSync(path.join(APP_DIR, 'auth/oauth-login'))).toBe(true);
+    expect(fs.existsSync(path.join(APP_DIR, 'auth/layout.tsx'))).toBe(false);
+    expect(fs.existsSync(path.join(APP_DIR, 'auth/(login)/page.tsx'))).toBe(
+      true
+    );
+  });
+
+  it('resolves no body slug for paths that merely start like /auth', () => {
+    NEVER_THE_LOGIN_BODY.forEach((p) => {
+      expect(resolveBodySlug(p)).toBeNull();
+    });
+  });
+
+  it('still resolves the login screen itself, in both spellings', () => {
+    expect(resolveBodySlug('/auth')).toBe(PLACEHOLDER_SLUGS.auth);
+    expect(resolveBodySlug('/auth/')).toBe(PLACEHOLDER_SLUGS.auth);
+    expect(resolveBodySlug('/users/auth')).toBe(PLACEHOLDER_SLUGS.auth);
+  });
+
+  it('accounts for every auth key the route table can resolve, exactly once', () => {
+    expect(allAuthKeys().sort()).toEqual(getAuthKeysFromRouteTable().sort());
+  });
+
+  it('declares every auth slug page-mounted so a root catch-all skips it', () => {
+    // Without this a future route-aware catch-all would compose the login body
+    // a second time in the root layout.
+    allAuthKeys().forEach((key) => {
+      expect(
+        isPageMountedSlug(
+          PLACEHOLDER_SLUGS[key as keyof typeof PLACEHOLDER_SLUGS]
+        )
+      ).toBe(true);
+    });
+  });
+
+  it('keeps the single-auth-page decision honest: no split routes exist', () => {
+    Object.values(UNMOUNTED_AUTH_KEYS).forEach((dirName) => {
+      expect(fs.existsSync(path.join(APP_DIR, dirName))).toBe(false);
+    });
+  });
+});

package/src/chrome/route-slug.ts

@@ -56,13 +56,22 @@ const DEFAULT_RULES: RouteSlugRule[] = [
   // account layout mounts for it.
   [/^\/account(\/|$)/, PLACEHOLDER_SLUGS.accountShell],
 
-  // Auth
-  [/^\/(users\/)?auth\/register/, PLACEHOLDER_SLUGS.register],
-  [/^\/(users\/)?register/, PLACEHOLDER_SLUGS.register],
-  [/^\/(users\/)?auth\/forgot-password/, PLACEHOLDER_SLUGS.forgotPassword],
-  [/^\/users\/password\/reset/, PLACEHOLDER_SLUGS.forgotPassword],
-  [/^\/(users\/)?auth\/guest/, PLACEHOLDER_SLUGS.guestLogin],
-  [/^\/(users\/)?auth/, PLACEHOLDER_SLUGS.auth],
+  // Auth — every rule ends at a segment boundary, and the login rule matches
+  // the login screen ONLY. A prefix rule here reaches further than it reads:
+  // `/auth/oauth-login` is the provider callback, a component whose whole job
+  // is a `signIn()` effect and which renders no markup, while `/authors` and
+  // `/auth-help` are ordinary content pages. Composing the login body onto any
+  // of them would replace a page nobody asked to compose — and in the
+  // callback's case invisibly, since it has no markup to compare against.
+  [/^\/(users\/)?auth\/register(\/|$)/, PLACEHOLDER_SLUGS.register],
+  [/^\/(users\/)?register(\/|$)/, PLACEHOLDER_SLUGS.register],
+  [
+    /^\/(users\/)?auth\/forgot-password(\/|$)/,
+    PLACEHOLDER_SLUGS.forgotPassword
+  ],
+  [/^\/users\/password\/reset(\/|$)/, PLACEHOLDER_SLUGS.forgotPassword],
+  [/^\/(users\/)?auth\/guest(\/|$)/, PLACEHOLDER_SLUGS.guestLogin],
+  [/^\/(users\/)?auth\/?$/, PLACEHOLDER_SLUGS.auth],
 
   // Order flow
   [/^\/orders\/completed/, PLACEHOLDER_SLUGS.orderSuccess],
@@ -117,6 +126,16 @@ const PAGE_MOUNTED_SLUGS = new Set<string>([
   PLACEHOLDER_SLUGS.accountNotifications,
   PLACEHOLDER_SLUGS.accountFaq,
   PLACEHOLDER_SLUGS.accountContact,
+  // Auth. The login screen mounts its slot inside an `auth/(login)` route
+  // group, so a root catch-all would compose it a second time — and would also
+  // reach `auth/oauth-login`, a provider callback that must never be
+  // replaceable. Register and guest login have no route of their own in the
+  // reference app (the /auth tabs carry both); brands that do split them out
+  // mount their own layout, the same way.
+  PLACEHOLDER_SLUGS.auth,
+  PLACEHOLDER_SLUGS.register,
+  PLACEHOLDER_SLUGS.forgotPassword,
+  PLACEHOLDER_SLUGS.guestLogin,
   PLACEHOLDER_SLUGS.flatPage
 ]);