@jant/core 0.6.16 → 0.7.0

package/src/routes/auth/__tests__/setup-page.test.tsx

@@ -0,0 +1,329 @@
+/**
+ * Tests for what the first-run screens say.
+ *
+ * These render the component rather than the route: the point under test is
+ * that an author is told which step this is — a hosted one landing on an
+ * unfamiliar domain, whose site it belongs to; a self-hosted one, how much of
+ * setup is left. Neither is something the POST handler or the onboarding
+ * middleware can vouch for.
+ */
+
+import type { Context } from "hono";
+import { renderToString } from "hono/jsx/dom/server";
+import { describe, expect, it } from "vitest";
+import { I18nProvider } from "../../../i18n/context.js";
+import { createI18n } from "../../../i18n/i18n.js";
+import type { DiscoverPageUrls } from "../../../lib/discover.js";
+import { getDiscoverCopy } from "../../../ui/dash/settings/discover-copy.js";
+import { SetupContent } from "../setup.js";
+
+type SetupProps = Parameters<typeof SetupContent>[0];
+
+const PAGES: DiscoverPageUrls = {
+  home: "https://jant.me/discover",
+  links: "https://jant.me/links",
+  quotes: "https://jant.me/quotes",
+  rules: "https://jant.me/discover/about",
+};
+
+function render(props: SetupProps): string {
+  const i18n = createI18n("en");
+  const c = {
+    get: (key: string) => (key === "i18n" ? i18n : undefined),
+  } as unknown as Context;
+
+  I18nProvider({ c, children: "" });
+  return renderToString(SetupContent(props));
+}
+
+describe("SetupContent — hosted site", () => {
+  const provisioned: SetupProps = {
+    mode: "site",
+    askSiteName: false,
+    contentLanguage: "en",
+    siteName: "My Blog",
+    discoverAvailable: true,
+    discoverDefault: true,
+    discoverPages: PAGES,
+  };
+
+  it("names the step and the site in one line", () => {
+    const html = render(provisioned);
+
+    expect(html).toContain("Setup · My Blog");
+    expect(html).toContain("What language do you write in?");
+  });
+
+  it("keeps the line when the site has no name", () => {
+    const { siteName: _omitted, ...unnamed } = provisioned;
+    const html = render(unnamed);
+
+    expect(html).toContain(">Setup</p>");
+    expect(html).not.toContain("·");
+  });
+
+  it("drops a blank name rather than trailing a separator", () => {
+    const html = render({ ...provisioned, siteName: "   " });
+
+    expect(html).not.toContain("·");
+  });
+
+  it("asks nothing but the language and Discover", () => {
+    const html = render(provisioned);
+
+    expect(html).toContain("setup-content-language");
+    expect(html).not.toContain("setup-email");
+    expect(html).not.toContain("setup-password");
+    expect(html).not.toContain("setup-site-name");
+  });
+
+  // A hosted author never saw a first screen — they created their account in
+  // the control plane — so counting steps at them would name one they cannot
+  // account for.
+  it("counts no steps on the only screen it shows", () => {
+    const html = render(provisioned);
+
+    expect(html).not.toContain("Step");
+  });
+
+  // The control plane already set the clock; this screen can be opened from
+  // anywhere, and the browser reporting another zone is not a decision.
+  it("reports no time zone", () => {
+    const html = render(provisioned);
+
+    expect(html).not.toContain("timezone");
+  });
+});
+
+/**
+ * The box's state is carried by the Datastar signal, not by a `checked`
+ * attribute: `data-bind` initialises the control from the signal on upgrade, so
+ * the signal is what the server actually decides.
+ */
+describe("SetupContent — the Discover question", () => {
+  const base: SetupProps = {
+    mode: "site",
+    askSiteName: true,
+    contentLanguage: "en",
+    discoverAvailable: true,
+    discoverDefault: false,
+    discoverPages: PAGES,
+  };
+
+  it("starts clear where the deployment lists nothing by default", () => {
+    const html = render(base);
+
+    expect(html).toContain("setup-discover");
+    expect(html).toContain("discover: false");
+  });
+
+  // Hosted Jant sets `DISCOVER=latest`, and the box has to say so rather than
+  // showing a refusal the site would not honour.
+  it("starts ticked where the deployment lists its blogs", () => {
+    const html = render({ ...base, discoverDefault: true });
+
+    expect(html).toContain("discover: true");
+  });
+
+  it("is asked on the hosted screen too", () => {
+    const html = render({
+      ...base,
+      askSiteName: false,
+      siteName: "My Blog",
+      discoverDefault: true,
+    });
+
+    expect(html).toContain("setup-discover");
+    expect(html).toContain("discover: true");
+  });
+
+  // Demo mode and feeds-off both outlive setup, so the question would be a
+  // promise the next screen breaks.
+  it("is not asked where the answer could not be honoured", () => {
+    const html = render({
+      ...base,
+      discoverAvailable: false,
+      discoverDefault: true,
+    });
+
+    expect(html).not.toContain("setup-discover");
+    expect(html).toContain("discover: false");
+  });
+
+  // One control appearing twice should not describe itself two ways: the
+  // label is the settings page's, and the help line is the settings page's
+  // opening sentence rather than a wording of setup's own. The delay, the
+  // lists and the rules wait for Settings, where an author has posts to show.
+  it("opens the way the settings page does, and stops there", () => {
+    const copy = getDiscoverCopy(createI18n("en"));
+    const html = render({ ...base, discoverPages: null });
+
+    expect(copy.intro.startsWith(copy.about)).toBe(true);
+    expect(html).toContain(`<span>${copy.label}</span>`);
+    expect(html).toContain(`${copy.about}</p>`);
+    expect(html).not.toContain("Featured");
+    expect(html).not.toContain(copy.rules);
+  });
+
+  // What Discover is, is best answered by the list itself, so its name in the
+  // help line is the way there — the same link the settings page puts on it.
+  it("links the directory's name in the help line to the directory", () => {
+    const html = render(base);
+
+    expect(html).toContain(
+      `<a href="${PAGES.home}" target="_blank" rel="noopener noreferrer" class="underline hover:text-foreground transition-colors">Jant Discover</a> is a directory of Jant blogs`,
+    );
+    expect(html.match(/<a href/g)).toHaveLength(1);
+  });
+
+  // A self-hosted site that announces to no directory has no address to link,
+  // and a sentence with a dead link in it is worse than a plain one.
+  it("leaves the help line plain when no directory is configured", () => {
+    const html = render({ ...base, discoverPages: null });
+
+    expect(html).toContain("Jant Discover is a directory of Jant blogs");
+    expect(html).not.toContain("<a href");
+  });
+
+  // The screen's footnote already says every answer here can change later.
+  // Saying it again under one checkbox was saying it twice.
+  it("does not repeat the way back to Settings", () => {
+    const copy = getDiscoverCopy(createI18n("en"));
+    const html = render({ ...base, discoverPages: null });
+
+    expect(html).not.toContain("→");
+    expect(html).toContain(`${copy.about}</p>`);
+  });
+});
+
+/**
+ * Where "you can change this later" sits. Under the heading, before the
+ * questions, it reads as permission to leave them blank; after the button it is
+ * only what it is.
+ */
+describe("SetupContent — the note that nothing is final", () => {
+  const site: SetupProps = {
+    mode: "site",
+    askSiteName: true,
+    contentLanguage: "en",
+    discoverAvailable: true,
+    discoverDefault: false,
+    discoverPages: null,
+  };
+  const note = "You can change all of this later in Settings.";
+
+  it("sits in the card's footer, after the button", () => {
+    const html = render(site);
+
+    expect(html).toContain(
+      `<footer><p class="text-sm text-muted-foreground">${note}</p></footer>`,
+    );
+    expect(html.indexOf(note)).toBeGreaterThan(html.indexOf("</button>"));
+  });
+
+  it("leaves nothing under the heading", () => {
+    const html = render(site);
+    const header = html.slice(
+      html.indexOf("<header>"),
+      html.indexOf("</header>"),
+    );
+
+    expect(header).toContain("<h2>");
+    expect(header).not.toContain(note);
+    expect(header.match(/<p/g)).toHaveLength(1);
+  });
+
+  // Same component, same reason: the hosted variant asks a question in its
+  // heading, and a reassurance sitting right under it dilutes the question.
+  it("sits in the same place on the hosted screen", () => {
+    const html = render({ ...site, askSiteName: false, siteName: "My Blog" });
+    const header = html.slice(
+      html.indexOf("<header>"),
+      html.indexOf("</header>"),
+    );
+
+    expect(header).not.toContain(note);
+    expect(html.indexOf(note)).toBeGreaterThan(html.indexOf("</button>"));
+  });
+
+  // The account screen has no answers to reassure anyone about.
+  it("is absent from the account screen", () => {
+    const html = render({ mode: "account" });
+
+    expect(html).not.toContain("<footer>");
+  });
+});
+
+describe("SetupContent — self-hosted, first screen", () => {
+  const account: SetupProps = { mode: "account" };
+
+  it("wears the same one-line shell as the hosted screen, plus the count", () => {
+    const html = render(account);
+
+    expect(html).toContain("Setup · Step 1 of 2");
+    expect(html).toContain("Welcome to Jant");
+  });
+
+  // The whole reason credentials get a screen of their own: an email and a
+  // password with nothing between them is the shape password managers look for.
+  it("asks for credentials and nothing else", () => {
+    const html = render(account);
+
+    expect(html).toContain("setup-email");
+    expect(html).toContain("setup-password");
+    expect(html).not.toContain("setup-site-name");
+    expect(html).not.toContain("setup-content-language");
+    expect(html).not.toContain("setup-discover");
+  });
+
+  // "Complete Setup" here would make the next screen read as a rejection.
+  it("says it continues rather than finishes", () => {
+    const html = render(account);
+
+    expect(html).toContain(">Continue</button>");
+    expect(html).not.toContain("Complete Setup");
+  });
+});
+
+describe("SetupContent — self-hosted, second screen", () => {
+  const site: SetupProps = {
+    mode: "site",
+    askSiteName: true,
+    contentLanguage: "en",
+    discoverAvailable: true,
+    discoverDefault: false,
+    discoverPages: PAGES,
+  };
+
+  it("counts itself as the last step and names no site yet", () => {
+    const html = render(site);
+
+    expect(html).toContain("Setup · Step 2 of 2");
+    expect(html).toContain("Set up your site");
+  });
+
+  it("asks for the site and not the account", () => {
+    const html = render(site);
+
+    expect(html).toContain("setup-site-name");
+    expect(html).toContain("setup-content-language");
+    expect(html).toContain("setup-discover");
+    expect(html).not.toContain("setup-email");
+    expect(html).not.toContain("setup-password");
+  });
+
+  // The install that is still choosing its own clock is the one that reports
+  // it, so the site's time zone is settled by the screen that names the site.
+  it("reports the browser's time zone", () => {
+    const html = render(site);
+
+    expect(html).toContain("timezone");
+  });
+
+  it("ends the flow rather than continuing it", () => {
+    const html = render(site);
+
+    expect(html).toContain("Start writing");
+    expect(html).not.toContain(">Continue</button>");
+  });
+});

package/src/routes/auth/__tests__/setup-steps.test.ts

@@ -0,0 +1,310 @@
+/**
+ * Tests for which of the two self-hosted setup screens a request gets.
+ *
+ * The step is never in the URL. It is read from the onboarding status and, on
+ * the second screen, from whether the site has a name yet — the only records
+ * that survive a closed tab, a reload, or a back button. These cover the route
+ * making that choice; `setup-page.test.tsx` covers what each screen then says.
+ */
+
+import { describe, expect, it, vi } from "vitest";
+import { Hono } from "hono";
+import { createI18n } from "../../../i18n/index.js";
+import { attachSession } from "../../../middleware/session.js";
+import { ONBOARDING_STATUS } from "../../../lib/constants.js";
+import { setupRoutes } from "../setup.js";
+import type { Bindings } from "../../../types.js";
+import type { AppVariables } from "../../../types/app-context.js";
+
+type Env = { Bindings: Bindings; Variables: AppVariables };
+
+const SESSION_COOKIE = "jant.session_token=abc; Path=/; HttpOnly";
+
+function createMockAuth(signedIn: boolean) {
+  const signUpEmail = vi.fn(async () => ({
+    headers: new Headers({ "Set-Cookie": SESSION_COOKIE }),
+    response: { user: { id: "usr_new-owner" } },
+  }));
+  const updateUser = vi.fn(async () => ({}));
+
+  return {
+    signUpEmail,
+    updateUser,
+    auth: {
+      api: {
+        signUpEmail,
+        updateUser,
+        getSession: async () => ({
+          headers: new Headers(),
+          response: signedIn
+            ? {
+                user: { id: "usr_owner", email: "owner@test.com", name: "O" },
+                session: { id: "ses_owner" },
+              }
+            : null,
+        }),
+      },
+    } as unknown as AppVariables["auth"],
+  };
+}
+
+function createSetupApp(options: {
+  status: (typeof ONBOARDING_STATUS)[keyof typeof ONBOARDING_STATUS];
+  /** What `SITE_NAME` holds — null on a site nobody has named yet. */
+  storedSiteName?: string | null;
+  signedIn?: boolean;
+  isMember?: boolean;
+}) {
+  const provisionOwnerAccount = vi.fn(async () => {});
+  const completeSiteSetup = vi.fn(async () => {});
+  const updateDiscoverSetting = vi.fn(async () => ({ shouldAnnounce: false }));
+  const { auth, signUpEmail, updateUser } = createMockAuth(
+    options.signedIn ?? false,
+  );
+
+  const app = new Hono<Env>();
+  app.use("*", async (c, next) => {
+    c.env = {} as Bindings;
+    c.set("auth", auth);
+    c.set("services", {
+      settings: {
+        getOnboardingStatus: async () => options.status,
+        get: async (key: string) =>
+          key === "SITE_NAME" ? (options.storedSiteName ?? null) : null,
+        updateDiscoverSetting,
+      },
+      bootstrap: { provisionOwnerAccount, completeSiteSetup },
+      siteMembers: {
+        get: async () =>
+          options.isMember
+            ? {
+                createdAt: 0,
+                role: "owner",
+                siteId: "sit_test",
+                updatedAt: 0,
+                userId: "usr_owner",
+              }
+            : null,
+      },
+    } as unknown as AppVariables["services"]);
+    c.set("currentSite", {
+      createdAt: 0,
+      id: "sit_test",
+      key: "default",
+      status: "active",
+      updatedAt: 0,
+    });
+    c.set("appConfig", {
+      siteName: "Jant",
+      sitePathPrefix: "",
+      siteLanguage: "en",
+      demoMode: false,
+      noindex: false,
+      rssFeedsEnabled: true,
+    } as AppVariables["appConfig"]);
+    c.set("lang", "en");
+    c.set("i18n", createI18n("en"));
+    await next();
+  });
+  app.use("*", attachSession());
+  app.route("/", setupRoutes);
+
+  return {
+    app,
+    provisionOwnerAccount,
+    completeSiteSetup,
+    signUpEmail,
+    updateUser,
+  };
+}
+
+function post(app: Hono<Env>, body: Record<string, unknown>) {
+  return app.request("/setup", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+describe("GET /setup picks the step", () => {
+  it("asks an empty site for credentials, with no session needed", async () => {
+    const { app } = createSetupApp({ status: ONBOARDING_STATUS.PENDING });
+
+    const html = await (await app.request("/setup")).text();
+
+    expect(html).toContain("Setup · Step 1 of 2");
+    expect(html).toContain("setup-password");
+    expect(html).not.toContain("setup-site-name");
+  });
+
+  // The state the site rests in between the screens: an owner, and no answers.
+  it("asks a provisioned but unnamed site for its name", async () => {
+    const { app } = createSetupApp({
+      status: ONBOARDING_STATUS.PROVISIONED,
+      storedSiteName: null,
+      signedIn: true,
+      isMember: true,
+    });
+
+    const html = await (await app.request("/setup")).text();
+
+    expect(html).toContain("Setup · Step 2 of 2");
+    expect(html).toContain("setup-site-name");
+    expect(html).not.toContain("setup-password");
+  });
+
+  // The hosted arrival at the same screen. A name it already has is a question
+  // it must not be asked again.
+  it("asks a named site only what it is missing", async () => {
+    const { app } = createSetupApp({
+      status: ONBOARDING_STATUS.PROVISIONED,
+      storedSiteName: "My Blog",
+      signedIn: true,
+      isMember: true,
+    });
+
+    const html = await (await app.request("/setup")).text();
+
+    expect(html).not.toContain("setup-site-name");
+    expect(html).not.toContain("Step");
+    expect(html).toContain("setup-content-language");
+  });
+
+  it("sends a finished site home", async () => {
+    const { app } = createSetupApp({ status: ONBOARDING_STATUS.COMPLETED });
+
+    const res = await app.request("/setup", { redirect: "manual" });
+
+    expect(res.status).toBe(302);
+    expect(res.headers.get("Location")).toBe("/");
+  });
+});
+
+describe("POST /setup, the account step", () => {
+  it("opens the account, stands the site up, and comes back for step two", async () => {
+    const { app, provisionOwnerAccount, signUpEmail } = createSetupApp({
+      status: ONBOARDING_STATUS.PENDING,
+    });
+
+    const res = await post(app, {
+      email: "  Owner@Example.COM ",
+      password: "correct-horse-battery",
+    });
+
+    // Named after the address until the next screen has a site name to put
+    // there, and normalized before it is used for either.
+    expect(signUpEmail).toHaveBeenCalledWith(
+      expect.objectContaining({
+        body: {
+          name: "owner",
+          email: "owner@example.com",
+          password: "correct-horse-battery",
+        },
+      }),
+    );
+    expect(provisionOwnerAccount).toHaveBeenCalledWith({
+      ownerUserId: "usr_new-owner",
+    });
+    await expect(res.text()).resolves.toContain("/setup");
+  });
+
+  // The whole reason there is no `/signin` hop between the screens: the second
+  // one can only be answered by a member, so the first has to leave a session
+  // behind.
+  it("signs the new owner in on the way out", async () => {
+    const { app } = createSetupApp({ status: ONBOARDING_STATUS.PENDING });
+
+    const res = await post(app, {
+      email: "owner@example.com",
+      password: "correct-horse-battery",
+    });
+
+    expect(res.headers.get("Set-Cookie")).toBe(SESSION_COOKIE);
+  });
+
+  it("rejects a password too short to be one", async () => {
+    const { app, provisionOwnerAccount } = createSetupApp({
+      status: ONBOARDING_STATUS.PENDING,
+    });
+
+    const res = await post(app, { email: "owner@example.com", password: "sh" });
+
+    await expect(res.text()).resolves.toContain("8 characters");
+    expect(provisionOwnerAccount).not.toHaveBeenCalled();
+  });
+});
+
+describe("POST /setup, the site step", () => {
+  const owner = {
+    status: ONBOARDING_STATUS.PROVISIONED,
+    storedSiteName: null,
+    signedIn: true,
+    isMember: true,
+  } as const;
+
+  it("carries the name, the language, and the browser's clock", async () => {
+    const { app, completeSiteSetup } = createSetupApp(owner);
+
+    await post(app, {
+      siteName: "My Blog",
+      contentLanguage: "zh-Hans",
+      language: "en-GB",
+      timezone: "Asia/Shanghai",
+      discover: true,
+    });
+
+    expect(completeSiteSetup).toHaveBeenCalledWith(
+      {
+        siteName: "My Blog",
+        siteLanguage: "zh-Hans",
+        browserLanguage: "en-GB",
+        timeZone: "Asia/Shanghai",
+      },
+      { oldLanguage: "en" },
+      expect.anything(),
+    );
+  });
+
+  // The rename better-auth needs, wired through the service rather than run in
+  // the route, and reaching better-auth with the request's own headers.
+  it("hands the service a way to rename the operator's account", async () => {
+    const { app, completeSiteSetup, updateUser } = createSetupApp(owner);
+
+    await post(app, { siteName: "My Blog", contentLanguage: "en" });
+
+    const deps = completeSiteSetup.mock.calls[0]?.[2] as {
+      updateCurrentUserName: (name: string) => Promise<void>;
+    };
+    await deps.updateCurrentUserName("My Blog");
+
+    expect(updateUser).toHaveBeenCalledWith(
+      expect.objectContaining({ body: { name: "My Blog" } }),
+    );
+  });
+
+  it("refuses to finish an unnamed site with no name", async () => {
+    const { app, completeSiteSetup } = createSetupApp(owner);
+
+    const res = await post(app, { contentLanguage: "en" });
+
+    await expect(res.text()).resolves.toContain("Site name");
+    expect(completeSiteSetup).not.toHaveBeenCalled();
+  });
+
+  // A named site is never asked for one, so a name arriving anyway is not the
+  // author renaming their site from the setup screen.
+  it("leaves a named site's name alone", async () => {
+    const { app, completeSiteSetup } = createSetupApp({
+      ...owner,
+      storedSiteName: "My Blog",
+    });
+
+    await post(app, { siteName: "Something Else", contentLanguage: "en" });
+
+    expect(completeSiteSetup).toHaveBeenCalledWith(
+      expect.objectContaining({ siteName: undefined, timeZone: undefined }),
+      expect.anything(),
+      expect.anything(),
+    );
+  });
+});