@btst/stack 3.0.0-rc.1 → 3.0.0-rc.3

package/src/plugins/comments/__tests__/client-sweep.test.tsx

@@ -8,14 +8,22 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 // self-reference.
 import {
 	StackProvider,
-	type StackAuthProvider,
+	type StackClientAuth,
 	type StackI18nProvider,
 } from "@btst/stack/context";
+import { defineAuthorization } from "@btst/stack/authorization";
+import { createClientAuth } from "@btst/stack/authorization/client";
+import { z } from "zod";
 import { ModerationPage } from "../client/components/pages/moderation-page.internal";
+import { ModerationPageComponent } from "../client/components/pages/moderation-page";
 import { UserCommentsPage } from "../client/components/pages/my-comments-page.internal";
 import { CommentForm } from "../client/components/comment-form";
+import { CommentCount } from "../client/components/comment-count";
 import { CommentThread } from "../client/components/comment-thread";
 import type { SerializedComment } from "../types";
+import { commentsPermissions } from "../permissions";
+import { createTestClientStack } from "../../../__tests__/client-stack-test-utils";
+import { commentsClientPlugin } from "../client/plugin";
 
 (globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
 
@@ -92,10 +100,20 @@ beforeEach(() => {
 		isLoadingMore: false,
 		queryKey: ["comments", "infinite"],
 	});
+	hooks.useComments.mockReturnValue({
+		comments: [],
+		total: 0,
+		isFetching: false,
+	});
+	hooks.useCommentCount.mockReturnValue({ count: 3, isLoading: false });
 	hooks.usePostComment.mockReturnValue({
 		mutateAsync: vi.fn(),
 		isPending: false,
 	});
+	hooks.useUpdateComment.mockReturnValue({
+		mutateAsync: vi.fn(),
+		isPending: false,
+	});
 	hooks.useUpdateCommentStatus.mockReturnValue({
 		mutateAsync: vi.fn().mockResolvedValue(comment),
 		isPending: false,
@@ -104,6 +122,10 @@ beforeEach(() => {
 		mutateAsync: vi.fn().mockResolvedValue({ success: true }),
 		isPending: false,
 	});
+	hooks.useToggleLike.mockReturnValue({
+		mutate: vi.fn(),
+		isPending: false,
+	});
 });
 
 afterEach(async () => {
@@ -122,6 +144,10 @@ async function render(ui: React.ReactElement) {
 	});
 }
 
+function createCommentsStack() {
+	return createTestClientStack({ comments: commentsClientPlugin() });
+}
+
 function texts(): string {
 	return document.body.textContent ?? "";
 }
@@ -137,11 +163,62 @@ function createMockRouter(initial = "") {
 		navigate: vi.fn(),
 		getSearchParams: () => new URLSearchParams(params.toString()),
 		setSearchParams,
+		setExternalSearchParams: (next: string) => {
+			params = new URLSearchParams(next);
+		},
 	};
 }
 
 const commentsOverrides = {};
 
+const commentsAuthorization = defineAuthorization({
+	identity: z.object({
+		id: z.string(),
+		role: z.enum(["user", "moderator"]),
+	}),
+	permissions: [commentsPermissions] as const,
+	rules: ({ comments }) => [
+		comments.thread.read.when(({ identity, facts }) =>
+			facts.scope === "public"
+				? true
+				: facts.scope === "own"
+					? identity?.id === facts.authorId || identity?.role === "moderator"
+					: identity?.role === "moderator",
+		),
+		comments.thread.createComment.when(({ identity }) => identity !== null),
+		comments.comment.edit.when(
+			({ identity, facts }) =>
+				identity?.id === facts.authorId || identity?.role === "moderator",
+		),
+		comments.comment.delete.when(
+			({ identity, facts }) =>
+				identity?.id === facts.authorId || identity?.role === "moderator",
+		),
+		comments.comment.react.when(
+			({ identity, facts }) => identity !== null && facts.status === "approved",
+		),
+		comments.comment.moderate.when(
+			({ identity }) => identity?.role === "moderator",
+		),
+	],
+});
+
+type CommentsIdentity = { id: string; role: "user" | "moderator" };
+
+function clientAuth(
+	identity:
+		| CommentsIdentity
+		| null
+		| (() => CommentsIdentity | null | Promise<CommentsIdentity | null>),
+	options?: { loginPath?: string },
+) {
+	return createClientAuth({
+		authorization: commentsAuthorization,
+		getIdentity: typeof identity === "function" ? identity : () => identity,
+		...options,
+	});
+}
+
 function typeInto(element: HTMLElement, value: string) {
 	const proto =
 		element instanceof HTMLTextAreaElement
@@ -152,9 +229,9 @@ function typeInto(element: HTMLElement, value: string) {
 	element.dispatchEvent(new Event("input", { bubbles: true }));
 }
 
-describe("ModerationPage row actions (CanAccess)", () => {
+describe("ModerationPage row actions (PermissionAccess)", () => {
 	function renderModerationPage(
-		auth?: StackAuthProvider,
+		auth?: StackClientAuth,
 		notify?: {
 			success: ReturnType<typeof vi.fn>;
 			error: ReturnType<typeof vi.fn>;
@@ -163,7 +240,7 @@ describe("ModerationPage row actions (CanAccess)", () => {
 	) {
 		return render(
 			<StackProvider
-				basePath="/pages"
+				stack={createCommentsStack()}
 				router={router}
 				notify={notify}
 				overrides={{ comments: commentsOverrides }}
@@ -183,49 +260,35 @@ describe("ModerationPage row actions (CanAccess)", () => {
 		expect(row.querySelector('[data-testid="spam-button"]')).toBeTruthy();
 		expect(row.querySelector('[data-testid="delete-button"]')).toBeTruthy();
 	});
-
-	it("hides approve/spam when can() denies comments:comment/moderate", async () => {
-		const can = vi.fn(
-			({ resource, action }: { resource: string; action: string }) =>
-				!(resource === "comments:comment" && action === "moderate"),
-		);
-		const auth: StackAuthProvider = {
-			getIdentity: () => ({ id: "user-1" }),
-			can,
-		};
+	it("distinguishes approval from marking spam in the shared rule", async () => {
+		const transitionAuthorization = defineAuthorization({
+			identity: z.object({ id: z.string(), role: z.literal("moderator") }),
+			permissions: [commentsPermissions] as const,
+			rules: ({ comments }) => [
+				comments.comment.moderate.when(
+					({ identity, facts }) =>
+						identity?.role === "moderator" && facts.nextStatus === "approved",
+				),
+			],
+		});
+		const auth = createClientAuth({
+			authorization: transitionAuthorization,
+			getIdentity: () => ({ id: "moderator-1", role: "moderator" as const }),
+		});
 
 		await renderModerationPage(auth);
 
 		const row = container.querySelector('[data-testid="moderation-row"]')!;
-		expect(row.querySelector('[data-testid="view-button"]')).toBeTruthy();
-		expect(row.querySelector('[data-testid="approve-button"]')).toBeNull();
+		expect(row.querySelector('[data-testid="approve-button"]')).toBeTruthy();
 		expect(row.querySelector('[data-testid="spam-button"]')).toBeNull();
-		// Delete is a separate action and stays visible
-		expect(row.querySelector('[data-testid="delete-button"]')).toBeTruthy();
-		expect(can).toHaveBeenCalledWith(
-			expect.objectContaining({
-				resource: "comments:comment",
-				action: "moderate",
-				params: { id: comment.id },
-			}),
-		);
 	});
-
-	it("hides the delete button when can() denies comments:comment/delete", async () => {
-		const can = vi.fn(
-			({ resource, action }: { resource: string; action: string }) =>
-				!(resource === "comments:comment" && action === "delete"),
-		);
-		const auth: StackAuthProvider = {
-			getIdentity: () => ({ id: "user-1" }),
-			can,
-		};
-
-		await renderModerationPage(auth);
+	it("uses the same schema-backed rule to hide routed moderation controls", async () => {
+		await renderModerationPage(clientAuth({ id: "viewer-1", role: "user" }));
 
 		const row = container.querySelector('[data-testid="moderation-row"]')!;
+		expect(row.querySelector('[data-testid="approve-button"]')).toBeNull();
+		expect(row.querySelector('[data-testid="spam-button"]')).toBeNull();
 		expect(row.querySelector('[data-testid="delete-button"]')).toBeNull();
-		expect(row.querySelector('[data-testid="approve-button"]')).toBeTruthy();
 	});
 
 	it("notifies success through the notify provider after approving", async () => {
@@ -248,13 +311,248 @@ describe("ModerationPage row actions (CanAccess)", () => {
 	});
 });
 
+describe("Comments route descriptors", () => {
+	it("guards the real moderation route with the schema-backed moderation rule", async () => {
+		vi.spyOn(console, "warn").mockImplementation(() => {});
+		await expect(
+			render(
+				<StackProvider
+					stack={createCommentsStack()}
+					router={createMockRouter()}
+					overrides={{ comments: commentsOverrides }}
+					auth={clientAuth({ id: "viewer-1", role: "user" })}
+				>
+					<ModerationPageComponent />
+				</StackProvider>,
+			),
+		).rejects.toThrow("Unauthorized");
+
+		expect(hooks.useSuspenseModerationComments).not.toHaveBeenCalled();
+	});
+
+	it("guards the moderation route with the selected queue status", async () => {
+		const statusAuthorization = defineAuthorization({
+			identity: z.object({ id: z.string(), role: z.literal("moderator") }),
+			permissions: [commentsPermissions] as const,
+			rules: ({ comments }) => [
+				comments.thread.read.when(
+					({ identity, facts }) =>
+						facts.scope === "moderation" &&
+						facts.status === "spam" &&
+						identity?.role === "moderator",
+				),
+			],
+		});
+		const auth = createClientAuth({
+			authorization: statusAuthorization,
+			getIdentity: () => ({ id: "moderator-1", role: "moderator" as const }),
+		});
+
+		await render(
+			<StackProvider
+				stack={createCommentsStack()}
+				router={createMockRouter("tab=spam")}
+				overrides={{ comments: commentsOverrides }}
+				auth={auth}
+			>
+				<ModerationPageComponent />
+			</StackProvider>,
+		);
+
+		expect(hooks.useSuspenseModerationComments).toHaveBeenCalledWith(
+			expect.objectContaining({ status: "spam" }),
+		);
+	});
+});
+
+describe("CommentCount permission descriptors", () => {
+	it("renders an explicitly public approved count for an anonymous identity", async () => {
+		await render(
+			<StackProvider stack={createCommentsStack()} auth={clientAuth(null)}>
+				<CommentCount resourceId="post-1" resourceType="post" />
+			</StackProvider>,
+		);
+		await act(async () => {});
+
+		expect(
+			container.querySelector('[data-testid="comment-count"]'),
+		).toBeTruthy();
+		expect(hooks.useCommentCount).toHaveBeenCalledWith({
+			resourceId: "post-1",
+			resourceType: "post",
+			status: "approved",
+		});
+	});
+	it("does not fetch a moderation count when the local rule denies it", async () => {
+		await render(
+			<StackProvider
+				stack={createCommentsStack()}
+				auth={clientAuth({ id: "viewer-1", role: "user" })}
+			>
+				<CommentCount
+					resourceId="post-1"
+					resourceType="post"
+					status="pending"
+				/>
+			</StackProvider>,
+		);
+		await act(async () => {});
+
+		expect(container.querySelector('[data-testid="comment-count"]')).toBeNull();
+		expect(hooks.useCommentCount).not.toHaveBeenCalled();
+	});
+});
+
 describe("ModerationPage tab/page state (useListState)", () => {
+	it("clears selected rows before moving to another page", async () => {
+		hooks.useSuspenseModerationComments.mockReturnValue({
+			comments: [comment],
+			total: 40,
+			limit: 20,
+			offset: 0,
+			totalPages: 2,
+			refetch: vi.fn(),
+		});
+		const router = createMockRouter();
+
+		await render(
+			<StackProvider
+				stack={createCommentsStack()}
+				router={router}
+				overrides={{ comments: commentsOverrides }}
+			>
+				<ModerationPage />
+			</StackProvider>,
+		);
+
+		const rowCheckbox =
+			container.querySelectorAll<HTMLElement>('[role="checkbox"]')[1]!;
+		await act(async () => rowCheckbox.click());
+		expect(texts()).toContain("1 selected");
+
+		const next = [
+			...container.querySelectorAll<HTMLButtonElement>("button"),
+		].find((button) => button.textContent === "Next")!;
+		await act(async () => next.click());
+
+		expect(texts()).not.toContain("selected");
+		expect(texts()).not.toContain("Approve selected");
+		const [written] = router.setSearchParams.mock.calls.at(-1)!;
+		expect(written.get("page")).toBe("2");
+	});
+
+	it("fails closed when browser navigation changes the selected page", async () => {
+		hooks.useSuspenseModerationComments.mockReturnValue({
+			comments: [comment],
+			total: 40,
+			limit: 20,
+			offset: 0,
+			totalPages: 2,
+			refetch: vi.fn(),
+		});
+		const router = createMockRouter();
+
+		await render(
+			<StackProvider
+				stack={createCommentsStack()}
+				router={router}
+				overrides={{ comments: commentsOverrides }}
+			>
+				<ModerationPage />
+			</StackProvider>,
+		);
+
+		const rowCheckbox =
+			container.querySelectorAll<HTMLElement>('[role="checkbox"]')[1]!;
+		await act(async () => rowCheckbox.click());
+		expect(texts()).toContain("1 selected");
+
+		hooks.useSuspenseModerationComments.mockReturnValue({
+			comments: [{ ...comment, id: "c2" }],
+			total: 40,
+			limit: 20,
+			offset: 20,
+			totalPages: 2,
+			refetch: vi.fn(),
+		});
+		router.setExternalSearchParams("page=2");
+		await act(async () => {
+			window.dispatchEvent(new PopStateEvent("popstate"));
+		});
+
+		expect(hooks.useSuspenseModerationComments).toHaveBeenLastCalledWith(
+			expect.objectContaining({ page: 2 }),
+		);
+		expect(texts()).not.toContain("selected");
+		expect(texts()).not.toContain("Approve selected");
+		expect(texts()).not.toContain("Delete selected");
+
+		hooks.useSuspenseModerationComments.mockReturnValue({
+			comments: [comment],
+			total: 40,
+			limit: 20,
+			offset: 0,
+			totalPages: 2,
+			refetch: vi.fn(),
+		});
+		router.setExternalSearchParams("");
+		await act(async () => {
+			window.dispatchEvent(new PopStateEvent("popstate"));
+		});
+
+		expect(hooks.useSuspenseModerationComments).toHaveBeenLastCalledWith(
+			expect.objectContaining({ page: 1 }),
+		);
+		expect(texts()).not.toContain("selected");
+		expect(texts()).not.toContain("Approve selected");
+		expect(texts()).not.toContain("Delete selected");
+	});
+
+	it("closes bulk delete when a refetch no longer resolves every target", async () => {
+		const router = createMockRouter();
+		const page = () => (
+			<StackProvider
+				stack={createCommentsStack()}
+				router={router}
+				overrides={{ comments: commentsOverrides }}
+			>
+				<ModerationPage />
+			</StackProvider>
+		);
+		await render(page());
+
+		const rowCheckbox =
+			container.querySelectorAll<HTMLElement>('[role="checkbox"]')[1]!;
+		await act(async () => rowCheckbox.click());
+		const deleteSelected = [
+			...container.querySelectorAll<HTMLButtonElement>("button"),
+		].find((button) => button.textContent === "Delete selected")!;
+		await act(async () => deleteSelected.click());
+		expect(
+			document.querySelector('[data-testid="confirm-delete-button"]'),
+		).not.toBeNull();
+
+		hooks.useSuspenseModerationComments.mockReturnValue({
+			comments: [{ ...comment, id: "c2" }],
+			total: 1,
+			limit: 20,
+			offset: 0,
+			totalPages: 1,
+			refetch: vi.fn(),
+		});
+		await render(page());
+
+		expect(
+			document.querySelector('[data-testid="confirm-delete-button"]'),
+		).toBeNull();
+	});
+
 	it("seeds tab and page from the URL", async () => {
 		const router = createMockRouter("tab=spam&page=3");
 
 		await render(
 			<StackProvider
-				basePath="/pages"
+				stack={createCommentsStack()}
 				router={router}
 				overrides={{ comments: commentsOverrides }}
 			>
@@ -263,7 +561,6 @@ describe("ModerationPage tab/page state (useListState)", () => {
 		);
 
 		expect(hooks.useSuspenseModerationComments).toHaveBeenLastCalledWith(
-			expect.anything(),
 			expect.objectContaining({ status: "spam", page: 3 }),
 		);
 		// Nothing is written back for a read-only render
@@ -275,7 +572,7 @@ describe("ModerationPage tab/page state (useListState)", () => {
 
 		await render(
 			<StackProvider
-				basePath="/pages"
+				stack={createCommentsStack()}
 				router={router}
 				overrides={{ comments: commentsOverrides }}
 			>
@@ -284,7 +581,6 @@ describe("ModerationPage tab/page state (useListState)", () => {
 		);
 
 		expect(hooks.useSuspenseModerationComments).toHaveBeenLastCalledWith(
-			expect.anything(),
 			expect.objectContaining({ status: "pending", page: 1 }),
 		);
 	});
@@ -294,7 +590,7 @@ describe("ModerationPage tab/page state (useListState)", () => {
 
 		await render(
 			<StackProvider
-				basePath="/pages"
+				stack={createCommentsStack()}
 				router={router}
 				overrides={{ comments: commentsOverrides }}
 			>
@@ -320,7 +616,6 @@ describe("ModerationPage tab/page state (useListState)", () => {
 		// page resets to the default (1) and defaults are omitted from the URL
 		expect(written.get("page")).toBeNull();
 		expect(hooks.useSuspenseModerationComments).toHaveBeenLastCalledWith(
-			expect.anything(),
 			expect.objectContaining({ status: "approved", page: 1 }),
 		);
 	});
@@ -328,7 +623,7 @@ describe("ModerationPage tab/page state (useListState)", () => {
 
 describe("UserCommentsPage (login gate + useNotify + useListState)", () => {
 	function renderUserComments(
-		auth?: StackAuthProvider,
+		auth?: StackClientAuth,
 		notify?: {
 			success: ReturnType<typeof vi.fn>;
 			error: ReturnType<typeof vi.fn>;
@@ -337,11 +632,10 @@ describe("UserCommentsPage (login gate + useNotify + useListState)", () => {
 	) {
 		return render(
 			<StackProvider
-				basePath="/pages"
+				stack={createCommentsStack()}
 				router={router}
 				notify={notify}
 				auth={auth}
-				api={{ baseURL: "http://test.local", basePath: "/api/data" }}
 				overrides={{ comments: commentsOverrides }}
 			>
 				<UserCommentsPage />
@@ -363,25 +657,21 @@ describe("UserCommentsPage (login gate + useNotify + useListState)", () => {
 		const router = createMockRouter("page=2");
 
 		await renderUserComments(
-			{ getIdentity: () => ({ id: "user-1" }) },
+			clientAuth({ id: "user-1", role: "user" }),
 			undefined,
 			router,
 		);
 
 		expect(hooks.useSuspenseComments).toHaveBeenLastCalledWith(
-			expect.anything(),
 			expect.objectContaining({ authorId: "user-1", offset: 20 }),
 		);
 	});
 
 	it("uses the top-level auth identity", async () => {
-		await renderUserComments({
-			getIdentity: () => ({ id: "provider-user" }),
-		});
+		await renderUserComments(clientAuth({ id: "provider-user", role: "user" }));
 		await act(async () => {});
 
 		expect(hooks.useSuspenseComments).toHaveBeenLastCalledWith(
-			expect.anything(),
 			expect.objectContaining({ authorId: "provider-user" }),
 		);
 		expect(
@@ -392,7 +682,10 @@ describe("UserCommentsPage (login gate + useNotify + useListState)", () => {
 	it("notifies success through the notify provider after deleting", async () => {
 		const notify = { success: vi.fn(), error: vi.fn() };
 
-		await renderUserComments({ getIdentity: () => ({ id: "user-1" }) }, notify);
+		await renderUserComments(
+			clientAuth({ id: comment.authorId, role: "user" }),
+			notify,
+		);
 
 		const deleteButton = container.querySelector<HTMLButtonElement>(
 			'[data-testid="my-comment-delete-button"]',
@@ -421,15 +714,89 @@ describe("UserCommentsPage (login gate + useNotify + useListState)", () => {
 });
 
 describe("CommentThread provider wiring", () => {
-	it("uses top-level API and auth", async () => {
+	it("uses the same schema-backed rule for embedded owner controls", async () => {
+		const ownedComment = {
+			...comment,
+			authorId: "owner-1",
+			status: "approved" as const,
+		};
+		hooks.useInfiniteComments.mockReturnValue({
+			comments: [ownedComment],
+			total: 1,
+			isLoading: false,
+			loadMore: vi.fn(),
+			hasMore: false,
+			isLoadingMore: false,
+			queryKey: ["comments", "infinite"],
+		});
+
 		await render(
 			<StackProvider
-				basePath="/pages"
-				api={{ baseURL: "http://provider.local", basePath: "/api/stack" }}
-				auth={{
-					getIdentity: () => ({ id: "provider-user" }),
-					loginPath: "/sign-in",
-				}}
+				stack={createCommentsStack()}
+				auth={clientAuth({ id: "owner-1", role: "user" })}
+			>
+				<CommentThread resourceId="post-1" resourceType="post" />
+			</StackProvider>,
+		);
+		await act(async () => {});
+
+		expect(container.querySelector('[data-testid="edit-button"]')).toBeTruthy();
+		expect(
+			container.querySelector('[data-testid="delete-button"]'),
+		).toBeTruthy();
+		expect(container.querySelector('[data-testid="like-button"]')).toBeTruthy();
+	});
+	it("notifies an error when deleting an owned comment fails", async () => {
+		const ownedComment = {
+			...comment,
+			authorId: "provider-user",
+			status: "approved" as const,
+		};
+		hooks.useInfiniteComments.mockReturnValue({
+			comments: [ownedComment],
+			total: 1,
+			isLoading: false,
+			loadMore: vi.fn(),
+			hasMore: false,
+			isLoadingMore: false,
+			queryKey: ["comments", "infinite"],
+		});
+		const mutateAsync = vi.fn().mockRejectedValue(new Error("Unauthorized"));
+		hooks.useDeleteComment.mockReturnValue({
+			mutateAsync,
+			isPending: false,
+		});
+		const notify = { success: vi.fn(), error: vi.fn() };
+		vi.spyOn(window, "confirm").mockReturnValue(true);
+
+		await render(
+			<StackProvider
+				stack={createCommentsStack()}
+				auth={clientAuth({ id: "provider-user", role: "user" })}
+				notify={notify}
+			>
+				<CommentThread resourceId="post-1" resourceType="blog-post" />
+			</StackProvider>,
+		);
+		await act(async () => {});
+
+		const deleteButton = container.querySelector<HTMLButtonElement>(
+			'[data-testid="delete-button"]',
+		)!;
+		await act(async () => {
+			deleteButton.click();
+		});
+
+		expect(mutateAsync).toHaveBeenCalledWith(comment.id);
+		expect(notify.error).toHaveBeenCalledWith("Failed to delete comment");
+		expect(notify.success).not.toHaveBeenCalled();
+	});
+
+	it("uses the provider identity for authenticated thread rendering", async () => {
+		await render(
+			<StackProvider
+				stack={createCommentsStack()}
+				auth={clientAuth({ id: "provider-user", role: "user" })}
 			>
 				<CommentThread resourceId="post-1" resourceType="blog-post" />
 			</StackProvider>,
@@ -437,10 +804,6 @@ describe("CommentThread provider wiring", () => {
 		await act(async () => {});
 
 		expect(hooks.useInfiniteComments).toHaveBeenLastCalledWith(
-			{
-				apiBaseURL: "http://provider.local",
-				apiBasePath: "/api/stack",
-			},
 			expect.objectContaining({ currentUserId: "provider-user" }),
 		);
 		expect(
@@ -449,16 +812,15 @@ describe("CommentThread provider wiring", () => {
 	});
 
 	it("waits for the provider identity before mounting the thread", async () => {
-		let resolveIdentity: (identity: { id: string }) => void = () => {};
-		const identity = new Promise<{ id: string }>((resolve) => {
+		let resolveIdentity: (identity: CommentsIdentity) => void = () => {};
+		const identity = new Promise<CommentsIdentity>((resolve) => {
 			resolveIdentity = resolve;
 		});
 
 		await render(
 			<StackProvider
-				basePath="/pages"
-				api={{ baseURL: "http://provider.local", basePath: "/api/stack" }}
-				auth={{ getIdentity: () => identity }}
+				stack={createCommentsStack()}
+				auth={clientAuth(() => identity)}
 			>
 				<CommentThread resourceId="post-1" resourceType="blog-post" />
 			</StackProvider>,
@@ -468,12 +830,11 @@ describe("CommentThread provider wiring", () => {
 		expect(container.querySelector('[data-testid="login-link"]')).toBeNull();
 
 		await act(async () => {
-			resolveIdentity({ id: "provider-user" });
+			resolveIdentity({ id: "provider-user", role: "user" });
 			await identity;
 		});
 
 		expect(hooks.useInfiniteComments).toHaveBeenLastCalledWith(
-			expect.anything(),
 			expect.objectContaining({ currentUserId: "provider-user" }),
 		);
 	});
@@ -481,9 +842,10 @@ describe("CommentThread provider wiring", () => {
 	it("uses the top-level auth login path when unauthenticated", async () => {
 		await render(
 			<StackProvider
-				basePath="/pages"
-				api={{ baseURL: "http://provider.local", basePath: "/api/stack" }}
-				auth={{ getIdentity: () => null, loginPath: "/sign-in" }}
+				stack={createCommentsStack()}
+				auth={clientAuth(null, {
+					loginPath: "/sign-in",
+				})}
 			>
 				<CommentThread resourceId="post-1" resourceType="blog-post" />
 			</StackProvider>,
@@ -496,13 +858,37 @@ describe("CommentThread provider wiring", () => {
 				?.getAttribute("href"),
 		).toBe("/sign-in");
 	});
+
+	it("prefers the per-thread login href when unauthenticated", async () => {
+		await render(
+			<StackProvider
+				stack={createCommentsStack()}
+				auth={clientAuth(null, {
+					loginPath: "/sign-in",
+				})}
+			>
+				<CommentThread
+					resourceId="post-1"
+					resourceType="blog-post"
+					loginHref="/sign-in?redirectTo=%2Fblog%2Fpost-1%23comments"
+				/>
+			</StackProvider>,
+		);
+		await act(async () => {});
+
+		expect(
+			container
+				.querySelector<HTMLAnchorElement>('[data-testid="login-link"]')
+				?.getAttribute("href"),
+		).toBe("/sign-in?redirectTo=%2Fblog%2Fpost-1%23comments");
+	});
 });
 
 describe("CommentForm inline field errors (StackError)", () => {
 	function renderForm(onSubmit: (body: string) => Promise<void>) {
 		return render(
 			<StackProvider
-				basePath="/pages"
+				stack={createCommentsStack()}
 				router={createMockRouter()}
 				overrides={{ comments: commentsOverrides }}
 			>
@@ -548,7 +934,7 @@ describe("comments i18n precedence (useTranslate + localization prop)", () => {
 	it("renders the English default without providers", async () => {
 		await render(
 			<StackProvider
-				basePath="/pages"
+				stack={createCommentsStack()}
 				router={createMockRouter()}
 				overrides={{ comments: commentsOverrides }}
 			>
@@ -569,7 +955,7 @@ describe("comments i18n precedence (useTranslate + localization prop)", () => {
 
 		await render(
 			<StackProvider
-				basePath="/pages"
+				stack={createCommentsStack()}
 				router={createMockRouter()}
 				overrides={{ comments: commentsOverrides }}
 				i18n={i18n}
@@ -588,7 +974,7 @@ describe("comments i18n precedence (useTranslate + localization prop)", () => {
 
 		await render(
 			<StackProvider
-				basePath="/pages"
+				stack={createCommentsStack()}
 				router={createMockRouter()}
 				overrides={{ comments: commentsOverrides }}
 				i18n={{ translate }}