@jant/core 0.6.15 → 0.7.0

package/src/routes/auth/__tests__/setup-flow.test.ts

@@ -0,0 +1,270 @@
+/**
+ * The whole self-hosted setup, walked once with nothing mocked.
+ *
+ * Real services, a real better-auth, a real database: the other setup tests
+ * each hold one seam still, and this one is here to catch what only shows up
+ * when they are all moving — the session the first screen mints being the one
+ * the second screen accepts, the status the first screen writes being the one
+ * the second screen reads, and the site ending up named after neither of them
+ * guessed.
+ */
+
+import { describe, expect, it, vi } from "vitest";
+import { createTestApp } from "../../../__tests__/helpers/app.js";
+import { createAuth } from "../../../auth.js";
+import { attachSession } from "../../../middleware/session.js";
+import {
+  settings as settingsTable,
+  siteMembers,
+  user,
+} from "../../../db/schema.js";
+import { setupRoutes } from "../setup.js";
+
+const PASSWORD = "correct-horse-battery";
+
+function createSetupApp(options: Parameters<typeof createTestApp>[0] = {}) {
+  const { app, services, db } = createTestApp(options);
+
+  // The helper installs a stub that answers every session question the same
+  // way. Setup needs the real thing: it mints a session on the first screen and
+  // has to be believed on the second.
+  const auth = createAuth(db, {
+    secret: "test-secret-with-enough-entropy-for-session-cookies",
+    baseURL: "http://localhost",
+    useSecureCookies: false,
+  });
+  app.use("*", async (c, next) => {
+    c.set("auth", auth);
+    await next();
+  });
+  app.use("*", attachSession());
+  app.route("/", setupRoutes);
+
+  return { app, services, db, auth };
+}
+
+function post(
+  app: ReturnType<typeof createSetupApp>["app"],
+  body: Record<string, unknown>,
+  cookie?: string,
+) {
+  return app.request("/setup", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      ...(cookie ? { Cookie: cookie } : {}),
+    },
+    body: JSON.stringify(body),
+  });
+}
+
+/** The session cookie a response minted, in the form a request sends back. */
+function sessionCookie(res: Response): string {
+  const cookie = res.headers
+    .getSetCookie()
+    .find((value) => value.includes("session_token="));
+  expect(cookie).toBeDefined();
+  return cookie!.split(";")[0]!;
+}
+
+async function readSettings(db: ReturnType<typeof createSetupApp>["db"]) {
+  const rows = await db.select().from(settingsTable);
+  return Object.fromEntries(rows.map((row) => [row.key, row.value]));
+}
+
+describe("self-hosted setup, both screens", () => {
+  it("walks an empty install to a finished site", async () => {
+    const { app, db } = createSetupApp();
+
+    const first = await app.request("/setup");
+    await expect(first.text()).resolves.toContain("Setup · Step 1 of 2");
+
+    const account = await post(app, {
+      email: "owner@example.com",
+      password: PASSWORD,
+    });
+    const cookie = sessionCookie(account);
+
+    // Between the screens: an owner, a navigation profile, and no answers.
+    const midway = await readSettings(db);
+    expect(midway["ONBOARDING_STATUS"]).toBe("provisioned");
+    expect(midway["SITE_NAME"]).toBeUndefined();
+
+    // The session the first screen minted is the one the second screen trusts.
+    const second = await app.request("/setup", { headers: { Cookie: cookie } });
+    const secondHtml = await second.text();
+    expect(secondHtml).toContain("Setup · Step 2 of 2");
+    expect(secondHtml).toContain("setup-site-name");
+
+    await post(
+      app,
+      {
+        siteName: "My Blog",
+        contentLanguage: "zh-Hans",
+        language: "en-GB",
+        timezone: "Asia/Shanghai",
+        discover: true,
+      },
+      cookie,
+    );
+
+    const finished = await readSettings(db);
+    expect(finished["ONBOARDING_STATUS"]).toBe("completed");
+    expect(finished["SITE_NAME"]).toBe("My Blog");
+    expect(finished["SITE_LANGUAGE"]).toBe("zh-Hans");
+    expect(finished["TIME_ZONE"]).toBe("Asia/Shanghai");
+    expect(finished["DISCOVER"]).toBe("latest");
+    // Left following the content language. An English browser is what every
+    // unconfigured machine reports, so it is no evidence against the language
+    // the author just chose by hand one field above.
+    expect(finished["DASHBOARD_LANGUAGE"]).toBeUndefined();
+
+    // The account opened under the address, and the second screen renamed it.
+    const [owner] = await db.select().from(user);
+    expect(owner?.name).toBe("My Blog");
+    expect(owner?.email).toBe("owner@example.com");
+  });
+
+  // A finished site must never offer the screen that opens the first account
+  // again, to anyone, signed in or not.
+  it("closes setup once the site is finished", async () => {
+    const { app } = createSetupApp();
+
+    const cookie = sessionCookie(
+      await post(app, { email: "owner@example.com", password: PASSWORD }),
+    );
+    await post(app, { siteName: "My Blog", contentLanguage: "en" }, cookie);
+
+    const page = await app.request("/setup", {
+      headers: { Cookie: cookie },
+      redirect: "manual",
+    });
+    expect(page.status).toBe(302);
+    expect(page.headers.get("Location")).toBe("/");
+
+    const submitted = await post(
+      app,
+      { email: "someone@example.com", password: PASSWORD },
+      cookie,
+    );
+    expect(submitted.status).toBe(302);
+  });
+
+  // Losing the session between the screens is the failure the split invented.
+  // The site is provisioned, so the setup screen refuses an unauthenticated
+  // visitor — and `/signin` stays open for them, which is how they get back.
+  it("hides the second screen from a lost session", async () => {
+    const { app } = createSetupApp();
+
+    await post(app, { email: "owner@example.com", password: PASSWORD });
+
+    const res = await app.request("/setup", { redirect: "manual" });
+
+    expect(res.status).toBe(302);
+    expect(res.headers.get("Location")).toBe("/");
+  });
+
+  // The failure that used to brick an install: the account is opened, standing
+  // the site up then fails, and the site is left `pending` with a user row in
+  // it. From there `createAuth` refuses every signup and the onboarding
+  // middleware sends `/signin` and `/reset` back to this screen — so retrying
+  // the screen has to be the way out.
+  it("resumes a first screen that failed after opening the account", async () => {
+    const { app, services, db } = createSetupApp();
+    const provision = vi.spyOn(services.bootstrap, "provisionOwnerAccount");
+    provision.mockRejectedValueOnce(new Error("D1 unavailable"));
+
+    const failed = await post(app, {
+      email: "owner@example.com",
+      password: PASSWORD,
+    });
+    await expect(failed.text()).resolves.toContain("Couldn't create your");
+
+    // The account outlived the failure, and the site did not advance.
+    expect((await db.select().from(user)).length).toBe(1);
+    expect(await services.settings.getOnboardingStatus()).toBe("pending");
+
+    // Registration is closed to everyone now, this address included — which is
+    // why the retry has to resume rather than create.
+    const resumed = await post(app, {
+      email: "owner@example.com",
+      password: PASSWORD,
+    });
+
+    expect(await services.settings.getOnboardingStatus()).toBe("provisioned");
+    const second = await app.request("/setup", {
+      headers: { Cookie: sessionCookie(resumed) },
+    });
+    await expect(second.text()).resolves.toContain("Setup · Step 2 of 2");
+    // Still one account: resuming picked the existing one up.
+    expect((await db.select().from(user)).length).toBe(1);
+  });
+
+  it("refuses to resume on the wrong password", async () => {
+    const { app, services, db } = createSetupApp();
+    vi.spyOn(services.bootstrap, "provisionOwnerAccount").mockRejectedValueOnce(
+      new Error("D1 unavailable"),
+    );
+
+    await post(app, { email: "owner@example.com", password: PASSWORD });
+    const res = await post(app, {
+      email: "owner@example.com",
+      password: "not-the-password",
+    });
+
+    await expect(res.text()).resolves.toContain("Couldn't create your");
+    expect(res.headers.getSetCookie()).toHaveLength(0);
+    expect(await services.settings.getOnboardingStatus()).toBe("pending");
+  });
+
+  // The reason a different address is not an escape hatch, and so the reason
+  // resuming had to be built: the registration hook counts rows, not emails.
+  it("will not open a second account to get around it", async () => {
+    const { app, services, db } = createSetupApp();
+    vi.spyOn(services.bootstrap, "provisionOwnerAccount").mockRejectedValueOnce(
+      new Error("D1 unavailable"),
+    );
+
+    await post(app, { email: "owner@example.com", password: PASSWORD });
+    const res = await post(app, {
+      email: "someone-else@example.com",
+      password: PASSWORD,
+    });
+
+    await expect(res.text()).resolves.toContain("Couldn't create your");
+    expect((await db.select().from(user)).length).toBe(1);
+    expect(await services.settings.getOnboardingStatus()).toBe("pending");
+  });
+});
+
+// A hosted site's owner arrives through the control plane's handoff, never
+// through this screen. The control plane creates each hosted site already
+// provisioned, so a `pending` one is a site that lost its status somehow — and
+// the database behind it holds every tenant's accounts. Signing in here with
+// any of them must not come away owning the site.
+describe("setup on a host-based install", () => {
+  it("never makes an existing account the owner of a hosted site", async () => {
+    const { app, services, db, auth } = createSetupApp({
+      siteResolutionMode: "host-based",
+    });
+    // Another tenant's owner. Being the first account, it also closes
+    // registration, as it is closed on any hosted database.
+    await auth.api.signUpEmail({
+      body: {
+        name: "Other Tenant",
+        email: "other@example.com",
+        password: PASSWORD,
+      },
+    });
+
+    const res = await post(app, {
+      email: "other@example.com",
+      password: PASSWORD,
+    });
+
+    await expect(res.text()).resolves.toContain("Couldn't create your");
+    expect(res.headers.getSetCookie()).toHaveLength(0);
+    expect(await db.select().from(siteMembers)).toHaveLength(0);
+    expect(await services.settings.getOnboardingStatus()).toBe("pending");
+  });
+});

package/src/routes/auth/__tests__/setup-page.test.tsx

@@ -0,0 +1,329 @@
+/**
+ * Tests for what the first-run screens say.
+ *
+ * These render the component rather than the route: the point under test is
+ * that an author is told which step this is — a hosted one landing on an
+ * unfamiliar domain, whose site it belongs to; a self-hosted one, how much of
+ * setup is left. Neither is something the POST handler or the onboarding
+ * middleware can vouch for.
+ */
+
+import type { Context } from "hono";
+import { renderToString } from "hono/jsx/dom/server";
+import { describe, expect, it } from "vitest";
+import { I18nProvider } from "../../../i18n/context.js";
+import { createI18n } from "../../../i18n/i18n.js";
+import type { DiscoverPageUrls } from "../../../lib/discover.js";
+import { getDiscoverCopy } from "../../../ui/dash/settings/discover-copy.js";
+import { SetupContent } from "../setup.js";
+
+type SetupProps = Parameters<typeof SetupContent>[0];
+
+const PAGES: DiscoverPageUrls = {
+  home: "https://jant.me/discover",
+  links: "https://jant.me/links",
+  quotes: "https://jant.me/quotes",
+  rules: "https://jant.me/discover/about",
+};
+
+function render(props: SetupProps): string {
+  const i18n = createI18n("en");
+  const c = {
+    get: (key: string) => (key === "i18n" ? i18n : undefined),
+  } as unknown as Context;
+
+  I18nProvider({ c, children: "" });
+  return renderToString(SetupContent(props));
+}
+
+describe("SetupContent — hosted site", () => {
+  const provisioned: SetupProps = {
+    mode: "site",
+    askSiteName: false,
+    contentLanguage: "en",
+    siteName: "My Blog",
+    discoverAvailable: true,
+    discoverDefault: true,
+    discoverPages: PAGES,
+  };
+
+  it("names the step and the site in one line", () => {
+    const html = render(provisioned);
+
+    expect(html).toContain("Setup · My Blog");
+    expect(html).toContain("What language do you write in?");
+  });
+
+  it("keeps the line when the site has no name", () => {
+    const { siteName: _omitted, ...unnamed } = provisioned;
+    const html = render(unnamed);
+
+    expect(html).toContain(">Setup</p>");
+    expect(html).not.toContain("·");
+  });
+
+  it("drops a blank name rather than trailing a separator", () => {
+    const html = render({ ...provisioned, siteName: "   " });
+
+    expect(html).not.toContain("·");
+  });
+
+  it("asks nothing but the language and Discover", () => {
+    const html = render(provisioned);
+
+    expect(html).toContain("setup-content-language");
+    expect(html).not.toContain("setup-email");
+    expect(html).not.toContain("setup-password");
+    expect(html).not.toContain("setup-site-name");
+  });
+
+  // A hosted author never saw a first screen — they created their account in
+  // the control plane — so counting steps at them would name one they cannot
+  // account for.
+  it("counts no steps on the only screen it shows", () => {
+    const html = render(provisioned);
+
+    expect(html).not.toContain("Step");
+  });
+
+  // The control plane already set the clock; this screen can be opened from
+  // anywhere, and the browser reporting another zone is not a decision.
+  it("reports no time zone", () => {
+    const html = render(provisioned);
+
+    expect(html).not.toContain("timezone");
+  });
+});
+
+/**
+ * The box's state is carried by the Datastar signal, not by a `checked`
+ * attribute: `data-bind` initialises the control from the signal on upgrade, so
+ * the signal is what the server actually decides.
+ */
+describe("SetupContent — the Discover question", () => {
+  const base: SetupProps = {
+    mode: "site",
+    askSiteName: true,
+    contentLanguage: "en",
+    discoverAvailable: true,
+    discoverDefault: false,
+    discoverPages: PAGES,
+  };
+
+  it("starts clear where the deployment lists nothing by default", () => {
+    const html = render(base);
+
+    expect(html).toContain("setup-discover");
+    expect(html).toContain("discover: false");
+  });
+
+  // Hosted Jant sets `DISCOVER=latest`, and the box has to say so rather than
+  // showing a refusal the site would not honour.
+  it("starts ticked where the deployment lists its blogs", () => {
+    const html = render({ ...base, discoverDefault: true });
+
+    expect(html).toContain("discover: true");
+  });
+
+  it("is asked on the hosted screen too", () => {
+    const html = render({
+      ...base,
+      askSiteName: false,
+      siteName: "My Blog",
+      discoverDefault: true,
+    });
+
+    expect(html).toContain("setup-discover");
+    expect(html).toContain("discover: true");
+  });
+
+  // Demo mode and feeds-off both outlive setup, so the question would be a
+  // promise the next screen breaks.
+  it("is not asked where the answer could not be honoured", () => {
+    const html = render({
+      ...base,
+      discoverAvailable: false,
+      discoverDefault: true,
+    });
+
+    expect(html).not.toContain("setup-discover");
+    expect(html).toContain("discover: false");
+  });
+
+  // One control appearing twice should not describe itself two ways: the
+  // label is the settings page's, and the help line is the settings page's
+  // opening sentence rather than a wording of setup's own. The delay, the
+  // lists and the rules wait for Settings, where an author has posts to show.
+  it("opens the way the settings page does, and stops there", () => {
+    const copy = getDiscoverCopy(createI18n("en"));
+    const html = render({ ...base, discoverPages: null });
+
+    expect(copy.intro.startsWith(copy.about)).toBe(true);
+    expect(html).toContain(`<span>${copy.label}</span>`);
+    expect(html).toContain(`${copy.about}</p>`);
+    expect(html).not.toContain("Featured");
+    expect(html).not.toContain(copy.rules);
+  });
+
+  // What Discover is, is best answered by the list itself, so its name in the
+  // help line is the way there — the same link the settings page puts on it.
+  it("links the directory's name in the help line to the directory", () => {
+    const html = render(base);
+
+    expect(html).toContain(
+      `<a href="${PAGES.home}" target="_blank" rel="noopener noreferrer" class="underline hover:text-foreground transition-colors">Jant Discover</a> is a directory of Jant blogs`,
+    );
+    expect(html.match(/<a href/g)).toHaveLength(1);
+  });
+
+  // A self-hosted site that announces to no directory has no address to link,
+  // and a sentence with a dead link in it is worse than a plain one.
+  it("leaves the help line plain when no directory is configured", () => {
+    const html = render({ ...base, discoverPages: null });
+
+    expect(html).toContain("Jant Discover is a directory of Jant blogs");
+    expect(html).not.toContain("<a href");
+  });
+
+  // The screen's footnote already says every answer here can change later.
+  // Saying it again under one checkbox was saying it twice.
+  it("does not repeat the way back to Settings", () => {
+    const copy = getDiscoverCopy(createI18n("en"));
+    const html = render({ ...base, discoverPages: null });
+
+    expect(html).not.toContain("→");
+    expect(html).toContain(`${copy.about}</p>`);
+  });
+});
+
+/**
+ * Where "you can change this later" sits. Under the heading, before the
+ * questions, it reads as permission to leave them blank; after the button it is
+ * only what it is.
+ */
+describe("SetupContent — the note that nothing is final", () => {
+  const site: SetupProps = {
+    mode: "site",
+    askSiteName: true,
+    contentLanguage: "en",
+    discoverAvailable: true,
+    discoverDefault: false,
+    discoverPages: null,
+  };
+  const note = "You can change all of this later in Settings.";
+
+  it("sits in the card's footer, after the button", () => {
+    const html = render(site);
+
+    expect(html).toContain(
+      `<footer><p class="text-sm text-muted-foreground">${note}</p></footer>`,
+    );
+    expect(html.indexOf(note)).toBeGreaterThan(html.indexOf("</button>"));
+  });
+
+  it("leaves nothing under the heading", () => {
+    const html = render(site);
+    const header = html.slice(
+      html.indexOf("<header>"),
+      html.indexOf("</header>"),
+    );
+
+    expect(header).toContain("<h2>");
+    expect(header).not.toContain(note);
+    expect(header.match(/<p/g)).toHaveLength(1);
+  });
+
+  // Same component, same reason: the hosted variant asks a question in its
+  // heading, and a reassurance sitting right under it dilutes the question.
+  it("sits in the same place on the hosted screen", () => {
+    const html = render({ ...site, askSiteName: false, siteName: "My Blog" });
+    const header = html.slice(
+      html.indexOf("<header>"),
+      html.indexOf("</header>"),
+    );
+
+    expect(header).not.toContain(note);
+    expect(html.indexOf(note)).toBeGreaterThan(html.indexOf("</button>"));
+  });
+
+  // The account screen has no answers to reassure anyone about.
+  it("is absent from the account screen", () => {
+    const html = render({ mode: "account" });
+
+    expect(html).not.toContain("<footer>");
+  });
+});
+
+describe("SetupContent — self-hosted, first screen", () => {
+  const account: SetupProps = { mode: "account" };
+
+  it("wears the same one-line shell as the hosted screen, plus the count", () => {
+    const html = render(account);
+
+    expect(html).toContain("Setup · Step 1 of 2");
+    expect(html).toContain("Welcome to Jant");
+  });
+
+  // The whole reason credentials get a screen of their own: an email and a
+  // password with nothing between them is the shape password managers look for.
+  it("asks for credentials and nothing else", () => {
+    const html = render(account);
+
+    expect(html).toContain("setup-email");
+    expect(html).toContain("setup-password");
+    expect(html).not.toContain("setup-site-name");
+    expect(html).not.toContain("setup-content-language");
+    expect(html).not.toContain("setup-discover");
+  });
+
+  // "Complete Setup" here would make the next screen read as a rejection.
+  it("says it continues rather than finishes", () => {
+    const html = render(account);
+
+    expect(html).toContain(">Continue</button>");
+    expect(html).not.toContain("Complete Setup");
+  });
+});
+
+describe("SetupContent — self-hosted, second screen", () => {
+  const site: SetupProps = {
+    mode: "site",
+    askSiteName: true,
+    contentLanguage: "en",
+    discoverAvailable: true,
+    discoverDefault: false,
+    discoverPages: PAGES,
+  };
+
+  it("counts itself as the last step and names no site yet", () => {
+    const html = render(site);
+
+    expect(html).toContain("Setup · Step 2 of 2");
+    expect(html).toContain("Set up your site");
+  });
+
+  it("asks for the site and not the account", () => {
+    const html = render(site);
+
+    expect(html).toContain("setup-site-name");
+    expect(html).toContain("setup-content-language");
+    expect(html).toContain("setup-discover");
+    expect(html).not.toContain("setup-email");
+    expect(html).not.toContain("setup-password");
+  });
+
+  // The install that is still choosing its own clock is the one that reports
+  // it, so the site's time zone is settled by the screen that names the site.
+  it("reports the browser's time zone", () => {
+    const html = render(site);
+
+    expect(html).toContain("timezone");
+  });
+
+  it("ends the flow rather than continuing it", () => {
+    const html = render(site);
+
+    expect(html).toContain("Start writing");
+    expect(html).not.toContain(">Continue</button>");
+  });
+});