@owlmeans/client-auth 0.1.18-rc.8 → 0.1.18

package/tests/target.spec.ts

@@ -0,0 +1,210 @@
+import { describe, expect, test } from 'bun:test'
+import { makeTestContext } from './context.js'
+import { makeFixtureKeyPair } from '@owlmeans/test-auth'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import { AuthroizationType, AuthRole, DISPATCHER } from '@owlmeans/auth'
+import type { Auth } from '@owlmeans/auth'
+import type { BasicConfig, BasicContext } from '@owlmeans/context'
+import { createStaticResource } from '@owlmeans/static-resource'
+import type { Resource } from '@owlmeans/resource'
+import { FLOW_STATE, RESUME_FLOW } from '@owlmeans/client-flow'
+import type { SuspendedLandingRecord } from '@owlmeans/client-flow'
+import type { AuthService } from '@owlmeans/auth-common'
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../src/consts.js'
+import { appendLogin } from '../src/login/service.js'
+import { loginLandingOf } from '../src/login/land.js'
+import { loginStartOf } from '../src/login/start.js'
+import { LoginOutcome } from '../src/login/consts.js'
+import type { LoginPlugin, LoginService } from '../src/login/types.js'
+
+/**
+ * `useLogin(target)` — sign in FIRST, then land on the target.
+ *
+ * The hook is a thin React shell over `startLogin` and the login facade, so both halves are
+ * exercised here without a DOM: the facade parks the target in the record `resumeSuspendedFlow`
+ * reads, the continuation waits for that write and goes to the dispatcher, and the dispatcher's own
+ * landing (`landAfterLogin`) ends on the target once a session exists.
+ */
+
+let store = 0
+
+/** A validly-signed bearer, exactly as `server-auth` would issue one. */
+const makeBearer = async (): Promise<string> => {
+  const appKP = makeFixtureKeyPair('client-auth-target-test-key')
+  const auth: Auth = {
+    token: 'nonce-target', userId: 'target-user', scopes: ['*'], role: AuthRole.User,
+    type: AuthroizationType.Ed25519BasicToken, source: 'test-service', isUser: true,
+    createdAt: new Date(),
+  }
+  const signed = await makeEnvelopeModel<Auth>(AuthroizationType.Ed25519BasicToken)
+    .send(auth, null).sign(appKP, EnvelopeKind.Token)
+
+  return `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${signed}`
+}
+
+const bootstrap = async (opts?: {
+  authenticated?: boolean
+}): Promise<[BasicContext<BasicConfig>, LoginService, Resource<SuspendedLandingRecord>]> => {
+  const context = makeTestContext()
+  context.registerResource(
+    createStaticResource<SuspendedLandingRecord>(FLOW_STATE, `client-auth-target-tests-${store++}`)
+  )
+  context.configure()
+  await context.init()
+  if (opts?.authenticated === true) {
+    await context.service<AuthService>(AUTH_ALIAS).update(await makeBearer())
+  }
+  const login = appendLogin(context).login()
+
+  return [context, login, context.resource<Resource<SuspendedLandingRecord>>(FLOW_STATE)]
+}
+
+/** An ordinary tab: the redirect plugin's `begin` runs the caller's continuation and is done. */
+const redirectLike = (): LoginPlugin => ({
+  alias: 'redirect-like', match: () => true,
+  begin: async (_ctx, request) => {
+    await request.navigate?.()
+
+    return LoginOutcome.Handled
+  },
+  authorize: async () => LoginOutcome.Redirected,
+  complete: async () => LoginOutcome.Passed,
+})
+
+/** Grant a fake alias existence without building a real entrypoint/route graph. */
+const allowEntrypoints = (context: BasicContext<BasicConfig>, ...aliases: string[]): void => {
+  (context as unknown as { hasEntrypoint: (alias: string) => boolean }).hasEntrypoint =
+    alias => aliases.includes(alias)
+}
+
+describe('startLogin — where a "Log in" control goes', () => {
+  test('signed out with a target: the continuation is the dispatcher, never the target', async () => {
+    const [context, login] = await bootstrap()
+    login.registerPlugin(redirectLike())
+    const went: string[] = []
+
+    expect(await loginStartOf(context).startLogin({
+      url: '/dispatcher', target: 'guarded-screen', go: alias => { went.push(alias) },
+    })).toBe(LoginOutcome.Handled)
+    expect(went).toEqual([DISPATCHER])
+  })
+
+  test('signed in with a target: straight to the target, no sign-in begun', async () => {
+    const [context, login] = await bootstrap({ authenticated: true })
+    let begun = false
+    login.registerPlugin({
+      ...redirectLike(), begin: async () => { begun = true; return LoginOutcome.Handled },
+    })
+    const went: string[] = []
+
+    expect(await loginStartOf(context).startLogin({
+      url: '/dispatcher', target: 'guarded-screen', go: alias => { went.push(alias) },
+    })).toBe(LoginOutcome.Handled)
+    expect(went).toEqual(['guarded-screen'])
+    expect(begun).toBe(false)
+  })
+
+  test('no target: a sign-in to the dispatcher whether or not a session exists, as always', async () => {
+    const [context, login, resource] = await bootstrap({ authenticated: true })
+    login.registerPlugin(redirectLike())
+    const went: string[] = []
+
+    await loginStartOf(context).startLogin({ url: '/dispatcher', go: alias => { went.push(alias) } })
+    expect(went).toEqual([DISPATCHER])
+    expect(await resource.load(RESUME_FLOW)).toBeNull()
+  })
+
+  test('the plugin is reached synchronously — a window can still open inside the gesture', async () => {
+    const [context, login] = await bootstrap()
+    let reached = false
+    login.registerPlugin({
+      ...redirectLike(),
+      begin: () => { reached = true; return Promise.resolve(LoginOutcome.Handled) },
+    })
+
+    const pending = loginStartOf(context).startLogin({
+      url: '/dispatcher', target: 'guarded-screen', go: () => undefined,
+    })
+    expect(reached).toBe(true)
+    await pending
+  })
+})
+
+describe('the login facade — LoginRequest.target', () => {
+  test('the target is parked BEFORE the continuation runs', async () => {
+    const [, login, resource] = await bootstrap()
+    login.registerPlugin(redirectLike())
+    let seen: SuspendedLandingRecord | null = null
+
+    await login.begin({
+      url: '/dispatcher', target: 'guarded-screen',
+      navigate: async () => { seen = await resource.load(RESUME_FLOW) },
+    })
+    expect(seen).not.toBeNull()
+    expect(seen!.entrypoint).toBe('guarded-screen')
+  })
+
+  test('a refusing precondition parks nothing', async () => {
+    const [, login, resource] = await bootstrap()
+    login.registerPlugin(redirectLike())
+    login.registerPrecondition({ alias: 'refuse', check: () => false })
+
+    expect(await login.begin({ url: '/dispatcher', target: 'guarded-screen' }))
+      .toBe(LoginOutcome.Gesture)
+    expect(await resource.load(RESUME_FLOW)).toBeNull()
+  })
+
+  test('an attempt that signs nobody in discards the parked target', async () => {
+    for (const outcome of [LoginOutcome.Blocked, LoginOutcome.Failed]) {
+      const [, login, resource] = await bootstrap()
+      login.registerPlugin({ ...redirectLike(), begin: async () => outcome })
+
+      expect(await login.begin({ url: '/dispatcher', target: 'guarded-screen' })).toBe(outcome)
+      // The discard chains on the write; let both settle.
+      await new Promise(resolve => setTimeout(resolve, 10))
+      expect(await resource.load(RESUME_FLOW)).toBeNull()
+    }
+  })
+
+  test('without a target the request reaches the plugin untouched', async () => {
+    const [, login, resource] = await bootstrap()
+    const navigate = (): void => undefined
+    let received: unknown = null
+    login.registerPlugin({
+      ...redirectLike(),
+      begin: async (_ctx, request) => { received = request.navigate; return LoginOutcome.Handled },
+    })
+
+    await login.begin({ url: '/dispatcher', navigate })
+    expect(received).toBe(navigate)
+    expect(await resource.load(RESUME_FLOW)).toBeNull()
+  })
+})
+
+describe('the landing after a targeted sign-in', () => {
+  test('the dispatcher lands on the target once signed in', async () => {
+    const [context, login] = await bootstrap()
+    login.registerPlugin(redirectLike())
+    await loginStartOf(context).startLogin({ url: '/dispatcher', target: 'guarded-screen', go: () => undefined })
+
+    await context.service<AuthService>(AUTH_ALIAS).update(await makeBearer())
+    expect(await loginLandingOf(context).landAfterLogin()).toEqual({ alias: 'guarded-screen', query: {} })
+  })
+
+  test('a pending step runs first, and the target is where the step continues to', async () => {
+    const [context, login] = await bootstrap()
+    allowEntrypoints(context, 'consent-screen')
+    login.registerPlugin(redirectLike())
+    let consented = false
+    login.registerStep({
+      alias: 'consent', entrypoint: 'consent-screen', pending: async () => !consented,
+    })
+    await loginStartOf(context).startLogin({ url: '/dispatcher', target: 'guarded-screen', go: () => undefined })
+
+    await context.service<AuthService>(AUTH_ALIAS).update(await makeBearer())
+    expect(await loginLandingOf(context).landAfterLogin()).toEqual({ alias: 'consent-screen', step: 'consent' })
+    consented = true
+    expect(await loginLandingOf(context).continueLogin({ after: 'consent' }))
+      .toEqual({ alias: 'guarded-screen', query: {} })
+  })
+})

package/tests/terms-deferred.spec.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from 'bun:test'
+import type { BasicContext, BasicConfig } from '@owlmeans/context'
+import { makeTestContext } from './context.js'
+import { appendLogin } from '../src/login/service.js'
+import { loginTermsHelper } from '../src/login/terms.js'
+import type { LoginStep } from '../src/login/types.js'
+
+/** Grant a fake alias existence without building a real entrypoint/route graph. */
+const allowEntrypoints = (context: BasicContext<BasicConfig>, ...aliases: string[]): void => {
+  (context as unknown as { hasEntrypoint: (alias: string) => boolean }).hasEntrypoint =
+    alias => aliases.includes(alias)
+}
+
+const step = (over: Partial<LoginStep> & { alias: string, entrypoint: string }): LoginStep => ({
+  pending: async () => false, ...over,
+})
+
+describe('termsDeferred', () => {
+  test('false with no login service registered at all', () => {
+    const context = makeTestContext()
+
+    expect(loginTermsHelper.termsDeferred(context)).toBe(false)
+  })
+
+  test('false with a login service but no confirming step', () => {
+    const context = makeTestContext()
+    const contextual = appendLogin(context)
+    allowEntrypoints(context, 'consent-screen')
+    contextual.login().registerStep(step({ alias: 'other', entrypoint: 'consent-screen' }))
+
+    expect(loginTermsHelper.termsDeferred(context)).toBe(false)
+  })
+
+  test('false when the confirming step is registered but its screen is not bound', () => {
+    const context = makeTestContext()
+    const contextual = appendLogin(context)
+    // hasEntrypoint left at its default (nothing bound) — an app that registered the step but
+    // never bound its screen keeps the sign-in checkbox, fail-closed.
+    contextual.login().registerStep(step({
+      alias: 'consent', entrypoint: 'consent-screen', confirmsTerms: true,
+    }))
+
+    expect(loginTermsHelper.termsDeferred(context)).toBe(false)
+  })
+
+  test('true once a confirming step is both registered AND bound', () => {
+    const context = makeTestContext()
+    const contextual = appendLogin(context)
+    allowEntrypoints(context, 'consent-screen')
+    contextual.login().registerStep(step({
+      alias: 'consent', entrypoint: 'consent-screen', confirmsTerms: true,
+    }))
+
+    expect(loginTermsHelper.termsDeferred(context)).toBe(true)
+  })
+
+  test('a non-confirming step bound elsewhere does not defer', () => {
+    const context = makeTestContext()
+    const contextual = appendLogin(context)
+    allowEntrypoints(context, 'other-screen')
+    contextual.login().registerStep(step({ alias: 'other', entrypoint: 'other-screen' }))
+
+    expect(loginTermsHelper.termsDeferred(context)).toBe(false)
+  })
+})

package/tests/terms.spec.ts

@@ -0,0 +1,314 @@
+import { describe, expect, test } from 'bun:test'
+import { OWLMEANS_COOKIES_URL, OWLMEANS_PRIVACY_URL, OWLMEANS_TERMS_URL, type LoginTermsConfig } from '@owlmeans/config'
+import { loginTermsHelper } from '../src/login/terms.js'
+import type { ResolvedTermsDocument } from '../src/login/terms/types.js'
+
+/**
+ * The pre-existing digest, copied rather than imported: `resolveTerms`'s own `digest` is private,
+ * and re-deriving it here is the whole point — this pins what the ALGORITHM produced before this
+ * file grew billing/product/custom documents, so a change to either one is caught independently.
+ */
+const legacyDigest = (parts: string[]): string => {
+  let hash = 0
+  for (const char of parts.join(' ')) {
+    hash = ((hash << 5) - hash + char.charCodeAt(0)) | 0
+  }
+
+  return (hash >>> 0).toString(36)
+}
+
+const DEFAULT_LABEL: Record<string, string> = {
+  terms: 'Terms & Conditions', privacy: 'Privacy Policy', cookies: 'Cookie Policy',
+  billing: 'Billing Terms', product: '{{product}} Product Terms',
+}
+
+/** A minimal stand-in for a renderer's own `resolveLabel` — no i18n context, just the fallback. */
+const label = (doc: ResolvedTermsDocument): string => {
+  let text = doc.label ?? DEFAULT_LABEL[doc.key] ?? doc.i18nKey ?? doc.key
+  if (doc.params != null) {
+    for (const [key, value] of Object.entries(doc.params)) {
+      text = text.split(`{{${key}}}`).join(value)
+    }
+  }
+
+  return text
+}
+
+describe('resolveTerms — the digest', () => {
+  test('is byte-identical to the pre-existing algorithm when nothing new is configured', () => {
+    const cfg: LoginTermsConfig = {
+      required: true, terms: 'https://a.test/terms', privacy: 'https://a.test/privacy',
+    }
+    const resolved = loginTermsHelper.resolveTerms(cfg)
+
+    expect(resolved?.version).toBe(
+      legacyDigest(['https://a.test/terms', 'https://a.test/privacy', OWLMEANS_COOKIES_URL])
+    )
+  })
+
+  test('a defaulted config (no terms/privacy/cookies at all) matches the same algorithm', () => {
+    const resolved = loginTermsHelper.resolveTerms({})
+
+    expect(resolved?.version).toBe(
+      legacyDigest([OWLMEANS_TERMS_URL, OWLMEANS_PRIVACY_URL, OWLMEANS_COOKIES_URL])
+    )
+  })
+
+  test('an explicit version override is used verbatim, as before', () => {
+    expect(loginTermsHelper.resolveTerms({ version: 'pinned-v3' })?.version).toBe('pinned-v3')
+  })
+
+  test('adding a billing document changes the digest', () => {
+    const base = loginTermsHelper.resolveTerms({})?.version
+    const withBilling = loginTermsHelper.resolveTerms({ billing: 'https://a.test/billing' })?.version
+
+    expect(withBilling).not.toBe(base)
+  })
+
+  test('changing only a revision date changes the digest', () => {
+    const unrevised = loginTermsHelper.resolveTerms({})?.version
+    const revised = loginTermsHelper.resolveTerms({ revisions: { terms: '2026-01-01' } })?.version
+
+    expect(revised).not.toBe(unrevised)
+  })
+})
+
+describe('resolveTerms — documents and notices', () => {
+  test('billing/product/documents/revisions all populate `documents`, in order', () => {
+    // Module-augmentation proof: this whole literal type-checks against `LoginTermsConfig` only
+    // because `@owlmeans/client-auth/login`'s augmentation merged onto it — a file that imports
+    // NOTHING from this package would fail to compile the `billing`/`product`/`documents`/
+    // `revisions`/`showRevision` fields below.
+    const cfg: LoginTermsConfig = {
+      terms: 'https://a.test/terms',
+      billing: { href: 'https://a.test/billing', revisedAt: '2026-02-01' },
+      product: { name: 'Acme', href: 'https://a.test/product' },
+      documents: [
+        { key: 'custom-a', href: 'https://a.test/custom-a', label: 'Custom A' },
+        { key: 'custom-b', href: 'https://a.test/custom-b', i18nKey: 'login.terms.custom-b' },
+      ],
+      revisions: { terms: '2026-01-15' },
+    }
+
+    const resolved = loginTermsHelper.resolveTerms(cfg)
+
+    expect(resolved?.documents.map(doc => doc.key))
+      .toEqual(['terms', 'billing', 'product', 'custom-a', 'custom-b'])
+    expect(resolved?.documents[0].revisedAt).toBe('2026-01-15')
+    expect(resolved?.documents[1].href).toBe('https://a.test/billing')
+    expect(resolved?.documents[1].revisedAt).toBe('2026-02-01')
+    expect(resolved?.documents[2].href).toBe('https://a.test/product')
+    expect(resolved?.documents[2].params).toEqual({ product: 'Acme' })
+    expect(resolved?.documents[3]).toMatchObject({ key: 'custom-a', href: 'https://a.test/custom-a', label: 'Custom A' })
+    expect(resolved?.documents[4]).toMatchObject({ key: 'custom-b', href: 'https://a.test/custom-b', i18nKey: 'login.terms.custom-b' })
+  })
+
+  test('a bare billing string is treated as `{ href }`', () => {
+    const resolved = loginTermsHelper.resolveTerms({ billing: 'https://a.test/billing' })
+
+    expect(resolved?.documents.find(doc => doc.key === 'billing')?.href).toBe('https://a.test/billing')
+  })
+
+  test('`false` turns billing/product off — the default', () => {
+    const resolved = loginTermsHelper.resolveTerms({ billing: false, product: false })
+
+    expect(resolved?.documents.map(doc => doc.key)).toEqual(['terms'])
+  })
+
+  test('the cookies notice is included when explicitly configured', () => {
+    const resolved = loginTermsHelper.resolveTerms({
+      terms: 'https://a.test/terms', privacy: 'https://a.test/privacy', cookies: 'https://a.test/cookies',
+    })
+
+    expect(resolved?.notices.map(doc => doc.key)).toEqual(['privacy', 'cookies'])
+  })
+
+  test('the cookies notice is included when terms/privacy/cookies are ALL still the defaults', () => {
+    const resolved = loginTermsHelper.resolveTerms({})
+
+    expect(resolved?.notices.map(doc => doc.key)).toEqual(['privacy', 'cookies'])
+  })
+
+  test('the cookies notice is DROPPED when terms/privacy were customised but cookies was not', () => {
+    const resolved = loginTermsHelper.resolveTerms({ terms: 'https://a.test/terms', privacy: 'https://a.test/privacy' })
+
+    expect(resolved?.notices.map(doc => doc.key)).toEqual(['privacy'])
+  })
+
+  test('`revisedAt` is set only when `showRevision` is true', () => {
+    const cfg: LoginTermsConfig = { revisions: { terms: '2026-03-01' } }
+
+    expect(loginTermsHelper.resolveTerms(cfg)?.revisedAt).toBeUndefined()
+    expect(loginTermsHelper.resolveTerms({ ...cfg, showRevision: true })?.revisedAt).toBe('2026-03-01')
+  })
+
+  test('`revisedAt` is the LATEST revision among documents', () => {
+    const cfg: LoginTermsConfig = {
+      showRevision: true,
+      billing: { href: 'https://a.test/billing', revisedAt: '2026-01-01' },
+      revisions: { terms: '2026-06-01' },
+    }
+
+    expect(loginTermsHelper.resolveTerms(cfg)?.revisedAt).toBe('2026-06-01')
+  })
+})
+
+describe('termsSentence', () => {
+  test('interpolates {{documents}} as a formatted, linked list', () => {
+    const resolved = loginTermsHelper.resolveTerms({
+      terms: 'https://a.test/terms', billing: 'https://a.test/billing',
+    })!
+
+    const parts = loginTermsHelper.termsSentence('I agree to the {{documents}}.', resolved, 'en', label)
+    const linked = parts.filter(part => part.href != null)
+
+    expect(linked.map(part => part.documentKey)).toEqual(['terms', 'billing'])
+    expect(parts[0]).toEqual({ text: 'I agree to the ' })
+    expect(parts.at(-1)).toEqual({ text: '.' })
+  })
+
+  test('interpolates {{notices}} the same way, from `resolved.notices`', () => {
+    const resolved = loginTermsHelper.resolveTerms({
+      terms: 'https://a.test/terms', privacy: 'https://a.test/privacy', cookies: 'https://a.test/cookies',
+    })!
+
+    const parts = loginTermsHelper.termsSentence('Data: {{notices}}.', resolved, 'en', label)
+    const linked = parts.filter(part => part.href != null)
+
+    expect(linked.map(part => part.documentKey)).toEqual(['privacy', 'cookies'])
+  })
+
+  test('supports the legacy {{terms}}/{{privacy}}/{{cookies}} placeholders', () => {
+    const resolved = loginTermsHelper.resolveTerms({
+      terms: 'https://a.test/terms', privacy: 'https://a.test/privacy', cookies: 'https://a.test/cookies',
+    })!
+
+    const parts = loginTermsHelper.termsSentence('{{terms}} and {{privacy}} and {{cookies}}', resolved, 'en', label)
+    const linked = parts.filter(part => part.href != null)
+
+    expect(linked.map(part => part.documentKey)).toEqual(['terms', 'privacy', 'cookies'])
+    expect(linked.map(part => part.href))
+      .toEqual(['https://a.test/terms', 'https://a.test/privacy', 'https://a.test/cookies'])
+  })
+
+  test('a single document renders with no list separator', () => {
+    const resolved = loginTermsHelper.resolveTerms({ terms: 'https://a.test/terms' })!
+
+    const parts = loginTermsHelper.termsSentence('{{documents}}', resolved, 'en', label)
+
+    expect(parts).toEqual([{ text: 'Terms & Conditions', href: 'https://a.test/terms', documentKey: 'terms' }])
+  })
+})
+
+describe('termsLabelResolver', () => {
+  test('resolves a document label the same way the two renderers used to, by hand', () => {
+    const translate = (key: string, defaultValue: string) => key === 'login.terms.custom' ? 'Custom!' : defaultValue
+    const resolve = loginTermsHelper.termsLabelResolver(translate, 'en')
+
+    expect(resolve({ key: 'terms', href: 'https://a.test/terms', i18nKey: 'login.terms.terms' }))
+      .toBe('Terms & Conditions')
+    expect(resolve({ key: 'x', href: 'https://a.test/x', i18nKey: 'login.terms.custom' })).toBe('Custom!')
+    expect(resolve({ key: 'x', href: 'https://a.test/x', label: 'Literal' })).toBe('Literal')
+    expect(resolve({ key: 'x', href: 'https://a.test/x', labelMap: { en: 'English', fr: 'Français' } }))
+      .toBe('English')
+    expect(resolve({
+      key: 'product', href: 'https://a.test/p', i18nKey: 'login.terms.product', params: { product: 'Acme' },
+    })).toBe('{{product}} Product Terms'.replace('{{product}}', 'Acme'))
+  })
+})
+
+describe('termsAcceptanceOf', () => {
+  test('keeps only key/href/revisedAt — never i18nKey, params or label', () => {
+    // A viable-shaped config: billing, a product document carrying `params`, and revisions —
+    // exactly what `termsRecorder`/a Terms-mode consent screen sends the server.
+    const resolved = loginTermsHelper.resolveTerms({
+      terms: 'https://a.test/terms', privacy: 'https://a.test/privacy', cookies: 'https://a.test/cookies',
+      billing: { href: 'https://a.test/billing', revisedAt: '2026-02-01' },
+      product: { name: 'Acme', href: 'https://a.test/product' },
+      revisions: { terms: '2026-01-15', privacy: '2026-01-15' },
+    })!
+
+    const acceptance = loginTermsHelper.termsAcceptanceOf(resolved, 'en')
+
+    expect(acceptance.version).toBe(resolved.version)
+    expect(acceptance.locale).toBe('en')
+    expect(acceptance.documents).toEqual([
+      { key: 'terms', href: 'https://a.test/terms', revisedAt: '2026-01-15' },
+      { key: 'billing', href: 'https://a.test/billing', revisedAt: '2026-02-01' },
+      { key: 'product', href: 'https://a.test/product', revisedAt: undefined },
+    ])
+    expect(acceptance.notices).toEqual([
+      { key: 'privacy', href: 'https://a.test/privacy', revisedAt: '2026-01-15' },
+      { key: 'cookies', href: 'https://a.test/cookies', revisedAt: undefined },
+    ])
+    // Every key is exactly {key, href, revisedAt} — no i18nKey, params or label leaked through.
+    for (const doc of [...acceptance.documents, ...acceptance.notices]) {
+      expect(Object.keys(doc).sort()).toEqual(['href', 'key', 'revisedAt'])
+    }
+  })
+
+  test('omits `locale` entirely when none is given', () => {
+    const resolved = loginTermsHelper.resolveTerms({ terms: 'https://a.test/terms' })!
+
+    expect(loginTermsHelper.termsAcceptanceOf(resolved)).not.toHaveProperty('locale')
+  })
+})
+
+describe('explicit localized document destinations', () => {
+  const cfg: LoginTermsConfig = {
+    terms: 'https://a.test/terms', privacy: 'https://a.test/privacy', cookies: 'https://a.test/cookies',
+    billing: 'https://a.test/billing',
+    revisions: { terms: '2026-05-30', privacy: '2026-05-30', billing: '2026-10-04' },
+  }
+  const localizedHrefs = {
+    terms: { pl: 'https://a.test/pl/warunki', fr: 'https://a.test/fr/conditions' },
+    billing: { pl: 'https://a.test/pl/abonament', fr: 'https://a.test/fr/abonnement' },
+    privacy: { pl: 'https://a.test/pl/prywatnosc', fr: 'https://a.test/fr/confidentialite' },
+    cookies: { pl: 'https://a.test/pl/cookies', fr: 'https://a.test/fr/cookies' },
+  }
+
+  test('translated paths leave the canonical digest and document revisions unchanged', () => {
+    const canonical = loginTermsHelper.resolveTerms(cfg)!
+    const localized = loginTermsHelper.resolveTerms({ ...cfg, localizedHrefs })!
+
+    expect(localized.version).toBe(canonical.version)
+    for (const locale of ['pl', 'fr']) {
+      const acceptance = loginTermsHelper.termsAcceptanceOf(localized, locale)
+      expect(acceptance.version).toBe(canonical.version)
+      expect(acceptance.documents.map(doc => doc.revisedAt)).toEqual(canonical.documents.map(doc => doc.revisedAt))
+      expect(acceptance.notices.map(doc => doc.revisedAt)).toEqual(canonical.notices.map(doc => doc.revisedAt))
+    }
+    expect(localized.documents.map(doc => doc.href)).toEqual(canonical.documents.map(doc => doc.href))
+  })
+
+  test('rendered lists, legacy placeholders and recorded evidence select the same PL/FR URLs', () => {
+    const resolved = loginTermsHelper.resolveTerms({ ...cfg, localizedHrefs })!
+    for (const locale of ['pl', 'fr']) {
+      const parts = loginTermsHelper.termsSentence('{{documents}}; {{notices}}', resolved, locale, label)
+      const evidence = loginTermsHelper.termsAcceptanceOf(resolved, locale)
+      expect(parts.filter(part => part.href != null).map(({ documentKey, href }) => ({ key: documentKey, href })))
+        .toEqual([...evidence.documents, ...evidence.notices].map(({ key, href }) => ({ key, href })))
+      expect(evidence.documents[0].href).toBe(localizedHrefs.terms[locale as 'pl' | 'fr'])
+      expect(evidence.notices[0].href).toBe(localizedHrefs.privacy[locale as 'pl' | 'fr'])
+      const legacy = loginTermsHelper.termsSentence('{{terms}} {{privacy}} {{cookies}}', resolved, locale, label)
+      expect(legacy.filter(part => part.href != null).map(part => part.href))
+        .toEqual([evidence.documents[0].href, ...evidence.notices.map(doc => doc.href)])
+      for (const doc of [...evidence.documents, ...evidence.notices]) {
+        expect(Object.keys(doc).sort()).toEqual(['href', 'key', 'revisedAt'])
+      }
+    }
+  })
+
+  test('unmapped/default locales retain canonical destinations; regional tags use a configured base language', () => {
+    const canonical = loginTermsHelper.resolveTerms(cfg)!
+    const resolved = loginTermsHelper.resolveTerms({ ...cfg, localizedHrefs })!
+    for (const locale of [undefined, 'en', 'it']) {
+      expect(loginTermsHelper.termsAcceptanceOf(resolved, locale))
+        .toEqual(loginTermsHelper.termsAcceptanceOf(canonical, locale))
+    }
+    expect(loginTermsHelper.termsHrefOf(resolved.documents[0], 'pl-PL')).toBe(localizedHrefs.terms.pl)
+    expect(loginTermsHelper.termsHrefOf(resolved.documents[0], 'fr-FR')).toBe(localizedHrefs.terms.fr)
+    // Omitted maps never rewrite a customer application's URLs, even in a non-English UI.
+    expect(loginTermsHelper.termsHrefOf(canonical.documents[0], 'pl')).toBe(cfg.terms!)
+  })
+})

package/src/manager/modules.ts

@@ -1,18 +0,0 @@
-
-import { AUTHEN, AUTHEN_AUTHEN, AUTHEN_INIT, AUTHEN_RELY, CAUTHEN, CAUTHEN_AUTHEN, CAUTHEN_AUTHEN_DEFAULT, CAUTHEN_AUTHEN_TYPED, DISPATCHER } from '@owlmeans/auth'
-import { modules as list } from '@owlmeans/auth-common'
-import { handler } from '@owlmeans/client'
-import { elevate, stab } from '@owlmeans/client-entrypoint'
-import { AuthenticationHOC } from './components/authentication/component.js'
-
-elevate(list, AUTHEN)
-elevate(list, AUTHEN_INIT, true)
-elevate(list, AUTHEN_AUTHEN, true)
-elevate(list, AUTHEN_RELY)
-elevate(list, CAUTHEN)
-elevate(list, CAUTHEN_AUTHEN)
-elevate(list, CAUTHEN_AUTHEN_DEFAULT, handler(AuthenticationHOC()))
-elevate(list, CAUTHEN_AUTHEN_TYPED, handler(AuthenticationHOC()))
-elevate(list, DISPATCHER, stab, { force: true })
-
-export const modules = list

package/src/modules.ts

@@ -1,13 +0,0 @@
-
-import { elevate, stab } from '@owlmeans/client-entrypoint'
-import { modules as list } from '@owlmeans/auth-common'
-import { CAUTHEN_FLOW_ENTER, DISPATCHER_AUTHEN } from '@owlmeans/auth'
-import type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
-
-elevate(list, DISPATCHER_AUTHEN)
-
-export const modules: ClientEntrypoint[] = list as ClientEntrypoint[]
-
-export const setupExternalAuthentication = (service: string) => {
-  elevate(list, CAUTHEN_FLOW_ENTER, stab, { routeOptions: { overrides: { service } } })
-}