@stjoseph/prumo 0.0.6 → 0.1.0

package/templates/api/test/support/factories/profile.factory.ts

@@ -0,0 +1,25 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createUser } from '@test/support/factories/user.factory'
+import { type Locale, Profile } from '@/domain/users/entities/profile.entity'
+
+type ProfileOverrides = Partial<{
+  userId: string
+  displayName: string
+  locale: Locale
+  timezone: string
+}>
+
+export async function createProfile(
+  em: EntityManager,
+  overrides: ProfileOverrides = {},
+): Promise<Profile> {
+  const profile = new Profile(
+    overrides.userId ?? (await createUser(em)),
+    overrides.displayName ?? 'Test Person',
+  )
+
+  profile.update({ locale: overrides.locale ?? 'en', timezone: overrides.timezone ?? 'UTC' })
+  await em.persist(profile).flush()
+
+  return profile
+}

package/templates/api/test/{factories → support/factories}/user.factory.ts

@@ -9,7 +9,7 @@ export async function createUser(
 ): Promise<string> {
   const id = randomUUID()
 
-  // auth.user belongs to Better Auth and has no entity here, so the QueryBuilder cannot reach it.
+  // auth.user belongs to Better Auth, and the ORM maps only its id, so the row is written in SQL.
   await em
     .getConnection()
     .execute(

package/templates/api/test/support/fakes/in-memory-profile.repository.ts

@@ -0,0 +1,14 @@
+import type { Profile } from '@/domain/users/entities/profile.entity'
+import type { ProfileRepository } from '@/domain/users/repositories/profile.repository'
+
+export class InMemoryProfileRepository implements ProfileRepository {
+  readonly rows = new Map<string, Profile>()
+
+  async findByUserId(userId: string): Promise<Profile | null> {
+    return this.rows.get(userId) ?? null
+  }
+
+  async save(profile: Profile): Promise<void> {
+    this.rows.set(profile.userId, profile)
+  }
+}

package/templates/api/test/{setup.ts → support/setup.ts}

@@ -1,9 +1,12 @@
+// tsyringe reads decorator metadata as each class is loaded, so this must come before any other import.
+import 'reflect-metadata'
 import { MikroORM } from '@mikro-orm/postgresql'
 import { getMigrations } from 'better-auth/db/migration'
 import { Client, type Pool } from 'pg'
 import { afterAll, beforeAll, beforeEach, inject } from 'vitest'
-import { createAuth } from '../src/auth/auth.factory'
-import { createOrmConfig } from '../src/mikro-orm.factory'
+import { createAuth } from '@/infra/auth/auth.factory'
+import type { Env } from '@/infra/config/env'
+import { createOrmConfig } from '@/infra/database/mikroorm/mikro-orm.factory'
 
 let orm: MikroORM
 let databaseUrl: string
@@ -17,6 +20,19 @@ export function testDatabaseUrl(): string {
   return databaseUrl
 }
 
+export function testEnv(): Env {
+  return {
+    NODE_ENV: 'test',
+    PORT: 3000,
+    DATABASE_URL: databaseUrl,
+    AUTH_DATABASE_URL: databaseUrl,
+    BETTER_AUTH_SECRET: 'test-secret-that-is-at-least-32-characters',
+    BETTER_AUTH_URL: 'http://localhost:3000',
+    WEB_ORIGIN: 'http://localhost:5173',
+    LOG_LEVEL: 'error',
+  }
+}
+
 async function createWorkerDatabase(baseUrl: string, name: string): Promise<string> {
   const admin = new Client({ connectionString: baseUrl })
 
@@ -37,13 +53,8 @@ async function createWorkerDatabase(baseUrl: string, name: string): Promise<stri
   return url.toString()
 }
 
-async function migrateAuth(databaseUrl: string): Promise<void> {
-  const auth = createAuth({
-    AUTH_DATABASE_URL: databaseUrl,
-    BETTER_AUTH_SECRET: 'test-secret-that-is-at-least-32-characters',
-    BETTER_AUTH_URL: 'http://localhost',
-    WEB_ORIGIN: 'http://localhost:5173',
-  })
+async function migrateAuth(): Promise<void> {
+  const auth = createAuth(testEnv())
   const { runMigrations } = await getMigrations(auth.options)
 
   await runMigrations()
@@ -52,18 +63,19 @@ async function migrateAuth(databaseUrl: string): Promise<void> {
 
 beforeAll(async () => {
   const name = `test_${process.env.VITEST_WORKER_ID ?? '1'}`
-  const clientUrl = await createWorkerDatabase(inject('postgresUrl'), name)
 
-  databaseUrl = clientUrl
-  await migrateAuth(clientUrl)
+  databaseUrl = await createWorkerDatabase(inject('postgresUrl'), name)
+  await migrateAuth()
 
-  orm = await MikroORM.init(createOrmConfig({ DATABASE_URL: clientUrl, NODE_ENV: 'test' }))
+  orm = await MikroORM.init(createOrmConfig(testEnv()))
 
   await orm.migrator.up()
 
   const metadata = orm.getMetadata().getAll()
   const own = Object.values(metadata)
-    .filter((meta) => meta.tableName !== undefined && meta.pivotTable !== true)
+    .filter(
+      (meta) => meta.tableName !== undefined && meta.pivotTable !== true && meta.schema !== 'auth',
+    )
     .map((meta) => `"${meta.tableName}"`)
 
   tables = [...own, 'auth."user"', 'auth.session', 'auth.account', 'auth.verification']

package/templates/api/tsconfig.json

@@ -6,13 +6,9 @@
     "lib": ["ES2023"],
     "experimentalDecorators": true,
     "emitDecoratorMetadata": true,
-    "declaration": true,
-    "removeComments": true,
     "allowSyntheticDefaultImports": true,
     "esModuleInterop": true,
-    "sourceMap": true,
-    "outDir": "./dist",
-    "incremental": true,
+    "noEmit": true,
     "skipLibCheck": true,
     "strict": true,
     "strictPropertyInitialization": false,
@@ -20,7 +16,8 @@
     "forceConsistentCasingInFileNames": true,
     "noFallthroughCasesInSwitch": true,
     "paths": {
-      "@/*": ["./src/*"]
+      "@/*": ["./src/*"],
+      "@test/*": ["./test/*"]
     },
     "types": ["vitest/globals", "node"]
   },

package/templates/api/vitest.config.mts

@@ -4,13 +4,13 @@ import { defineConfig } from 'vitest/config'
 export default defineConfig({
   plugins: [swc.vite({ module: { type: 'es6' } })],
   resolve: {
-    alias: { '@': `${import.meta.dirname}/src` },
+    alias: { '@': `${import.meta.dirname}/src`, '@test': `${import.meta.dirname}/test` },
   },
   test: {
     globals: true,
-    include: ['src/**/*.spec.ts'],
-    globalSetup: ['./test/global-setup.ts'],
-    setupFiles: ['./test/setup.ts'],
+    include: ['test/**/*.spec.ts'],
+    globalSetup: ['./test/support/global-setup.ts'],
+    setupFiles: ['./test/support/setup.ts'],
     pool: 'forks',
     coverage: { provider: 'v8', include: ['src/**'] },
   },

package/templates/mobile/jest.config.js

@@ -11,7 +11,7 @@ if (!nodeModules.includes('(?!(') || babel === undefined) {
 
 module.exports = {
   preset: 'jest-expo',
-  moduleNameMapper: { '^@/(.*)$': '<rootDir>/src/$1' },
+  moduleNameMapper: { '^@/(.*)$': '<rootDir>/src/$1', '^@test/(.*)$': '<rootDir>/test/$1' },
   // A first render brings React Native and Babel's transform with it, which costs seconds on a cold cache: inside a
   // workspace the contract is a package to transform too, and Jest's 5s default was crossed in CI while the same
   // suite passed alone. The budget is the machine's slowness, not the test's.

package/templates/mobile/package.json

@@ -15,12 +15,12 @@
     "prepare": "node .githooks/install.mjs"
   },
   "dependencies": {
-    "@better-auth/expo": "1.7.4",
+    "@better-auth/expo": "1.7.6",
     "@hookform/resolvers": "5.9.1",
     "@tanstack/query-sync-storage-persister": "5.102.8",
     "@tanstack/react-query": "5.102.8",
     "@tanstack/react-query-persist-client": "5.102.8",
-    "better-auth": "1.7.4",
+    "better-auth": "1.7.6",
     "class-variance-authority": "0.7.1",
     "expo": "57.0.22",
     "expo-constants": "57.0.18",

package/templates/mobile/{src → test}/features/auth/authenticated-layout.spec.tsx

@@ -1,4 +1,5 @@
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
 import { createAuthClient } from 'better-auth/react'
 import { renderRouter, screen } from 'expo-router/testing-library'
 import type { ReactNode } from 'react'
@@ -7,7 +8,6 @@ import { createClient } from '@/api-contract'
 import AuthenticatedLayout from '@/app/(app)/_layout'
 import type { AuthClient } from '@/features/auth/auth-client'
 import { ClientsProvider } from '@/features/clients/clients-context'
-import { API_URL, fakeTransport, json } from '../../../test/fake-transport'
 
 const user = { id: 'user-1', email: 'ana@example.com', name: 'Ana' }
 

package/templates/mobile/{src → test}/features/auth/sign-in-form.spec.tsx

@@ -1,8 +1,8 @@
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
 import { render, screen, userEvent } from '@testing-library/react-native'
 import { createAuthClient } from 'better-auth/react'
-import { API_URL, fakeTransport, json } from '../../../test/fake-transport'
-import { SignInForm } from './sign-in-form'
+import { SignInForm } from '@/features/auth/sign-in-form'
 
 describe('SignInForm', () => {
   it('shows a rejected sign-in as a form-level error', async () => {

package/templates/mobile/{src → test}/features/auth/sign-out-button.spec.tsx

@@ -1,9 +1,9 @@
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
 import { render, screen, userEvent, waitFor } from '@testing-library/react-native'
 import { createAuthClient } from 'better-auth/react'
+import { SignOutButton } from '@/features/auth/sign-out-button'
 import { clearUserData } from '@/features/storage/storage'
-import { API_URL, fakeTransport, json } from '../../../test/fake-transport'
-import { SignOutButton } from './sign-out-button'
 
 // MMKV needs its native module, which Jest does not have. What clearUserData removes is the persister's own key.
 jest.mock('@/features/storage/storage', () => ({ clearUserData: jest.fn() }))

package/templates/mobile/{src → test}/features/profile/profile-form.spec.tsx

@@ -1,8 +1,8 @@
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
 import { render, screen, userEvent, within } from '@testing-library/react-native'
 import { createClient, type Profile } from '@/api-contract'
-import { API_URL, fakeTransport, json } from '../../../test/fake-transport'
-import { ProfileForm } from './profile-form'
+import { ProfileForm } from '@/features/profile/profile-form'
 
 const profile: Profile = {
   id: '01a09ffe-635c-77e5-9aeb-d3e9d1a7ee24',

package/templates/mobile/tsconfig.json

@@ -6,7 +6,8 @@
     "noFallthroughCasesInSwitch": true,
     "forceConsistentCasingInFileNames": true,
     "paths": {
-      "@/*": ["./src/*"]
+      "@/*": ["./src/*"],
+      "@test/*": ["./test/*"]
     },
     "types": ["jest", "node"]
   },

package/templates/site/{src → test}/app/page.spec.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { metadata } from './page'
+import { metadata } from '@/app/page'
 
 describe('home page metadata', () => {
   it('gives search results a title and a description', () => {

package/templates/site/tsconfig.json

@@ -18,7 +18,8 @@
     "incremental": true,
     "plugins": [{ "name": "next" }],
     "paths": {
-      "@/*": ["./src/*"]
+      "@/*": ["./src/*"],
+      "@test/*": ["./test/*"]
     },
     "types": ["vitest/globals"]
   },

package/templates/site/vitest.config.mts

@@ -3,6 +3,8 @@ import { defineConfig } from 'vitest/config'
 
 export default defineConfig({
   plugins: [react()],
-  resolve: { alias: { '@': `${import.meta.dirname}/src` } },
-  test: { globals: true, include: ['src/**/*.spec.{ts,tsx}'] },
+  resolve: {
+    alias: { '@': `${import.meta.dirname}/src`, '@test': `${import.meta.dirname}/test` },
+  },
+  test: { globals: true, include: ['test/**/*.spec.{ts,tsx}'] },
 })

package/templates/web/package.json

@@ -8,7 +8,7 @@
     "build": "vite build",
     "preview": "vite preview",
     "lint": "biome check",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsr generate && tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:cov": "vitest run --coverage",
@@ -16,11 +16,12 @@
   },
   "dependencies": {
     "@base-ui/react": "1.8.0",
+    "@better-auth/oauth-provider": "1.7.6",
     "@fontsource-variable/geist": "5.3.0",
     "@hookform/resolvers": "5.9.1",
     "@tanstack/react-query": "5.102.8",
     "@tanstack/react-router": "1.170.36",
-    "better-auth": "1.7.4",
+    "better-auth": "1.7.6",
     "class-variance-authority": "0.7.1",
     "cn": "0.3.0",
     "lucide-react": "1.45.0",
@@ -34,6 +35,7 @@
   "devDependencies": {
     "@biomejs/biome": "2.5.13",
     "@tailwindcss/vite": "4.3.3",
+    "@tanstack/router-cli": "1.167.36",
     "@tanstack/router-plugin": "1.168.38",
     "@testing-library/jest-dom": "7.0.1",
     "@testing-library/react": "16.3.3",

package/templates/web/src/features/auth/auth-client.ts

@@ -1,3 +1,4 @@
+import { oauthProviderClient } from '@better-auth/oauth-provider/client' // prumo:mcp
 import { createAuthClient } from 'better-auth/react'
 import type { Transport } from '@/api-contract'
 
@@ -8,5 +9,9 @@ export function createAuth({ baseUrl, fetch }: { baseUrl: string; fetch: Transpo
     baseURL: baseUrl,
     basePath: '/api/auth',
     fetchOptions: { customFetchImpl: fetch },
+    // prumo:mcp
+    // Carries the signed query of an MCP client's authorization through sign-in and consent.
+    plugins: [oauthProviderClient()],
+    // prumo:end-mcp
   })
 }

package/templates/web/src/features/auth/sign-in-form.tsx

@@ -31,13 +31,20 @@ export function SignInForm({ auth, redirect }: { auth: AuthClient; redirect: str
   const { errors, isSubmitting } = form.formState
 
   async function onSubmit(values: SignInValues) {
-    const { error } = await auth.signIn.email(values)
+    const result = await auth.signIn.email(values)
 
-    if (error !== null) {
-      applyServerError(ApiError.fromAuthError(error), ['email', 'password'], form.setError)
+    if (result.error !== null) {
+      applyServerError(ApiError.fromAuthError(result.error), ['email', 'password'], form.setError)
       return
     }
 
+    // prumo:mcp
+    // Signing in during an MCP client's authorization: Better Auth has already sent the browser on.
+    if (result.data.redirect) {
+      return
+    }
+
+    // prumo:end-mcp
     // Invalidating is not enough: nothing observes the session, and the protected route's ensureQueryData
     // would keep returning the cached null. Refetching replaces it before the route reads it.
     await queryClient.refetchQueries({ queryKey: sessionQuery(auth).queryKey })

package/templates/web/src/features/oauth/consent-form.tsx

@@ -0,0 +1,63 @@
+import { useQuery } from '@tanstack/react-query'
+import { useState } from 'react'
+import { Button } from '@/components/ui/button'
+import type { AuthClient } from '@/features/auth/auth-client'
+
+type PublicClient = { client_name?: string }
+
+// Better Auth checks the signed query on submit; what is shown here comes from the same URL.
+export function ConsentForm({
+  auth,
+  clientId,
+  scopes,
+}: {
+  auth: AuthClient
+  clientId: string
+  scopes: string[]
+}) {
+  const [failed, setFailed] = useState(false)
+  const client = useQuery({
+    queryKey: ['oauth-client', clientId],
+    queryFn: async () => {
+      const { data } = await auth.$fetch<PublicClient>('/oauth2/public-client', {
+        query: { client_id: clientId },
+      })
+
+      return data
+    },
+  })
+  const name = client.data?.client_name ?? clientId
+
+  async function answer(accept: boolean) {
+    // On success Better Auth sends the browser back to the client, so nothing follows here.
+    const { error } = await auth.$fetch('/oauth2/consent', { method: 'POST', body: { accept } })
+
+    setFailed(error !== null)
+  }
+
+  return (
+    <div className="flex flex-col gap-6">
+      <p>
+        <strong>{name}</strong> wants to act on your behalf.
+      </p>
+      {scopes.length > 0 && (
+        <ul className="list-disc pl-6 text-sm text-muted-foreground">
+          {scopes.map((scope) => (
+            <li key={scope}>{scope}</li>
+          ))}
+        </ul>
+      )}
+      {failed && (
+        <p role="alert" className="text-sm text-destructive">
+          The authorization could not be completed. Start again from the application.
+        </p>
+      )}
+      <div className="flex gap-3">
+        <Button onClick={() => answer(true)}>Allow</Button>
+        <Button variant="outline" onClick={() => answer(false)}>
+          Deny
+        </Button>
+      </div>
+    </div>
+  )
+}

package/templates/web/src/routeTree.gen.ts

@@ -13,6 +13,7 @@ import { Route as AuthenticatedRouteImport } from './routes/_authenticated'
 import { Route as SignInRouteImport } from './routes/sign-in'
 import { Route as SignUpRouteImport } from './routes/sign-up'
 import { Route as AuthenticatedIndexRouteImport } from './routes/_authenticated/index'
+import { Route as AuthenticatedConsentRouteImport } from './routes/_authenticated/consent'
 
 const AuthenticatedRoute = AuthenticatedRouteImport.update({
   id: '/_authenticated',
@@ -33,15 +34,22 @@ const AuthenticatedIndexRoute = AuthenticatedIndexRouteImport.update({
   path: '/',
   getParentRoute: () => AuthenticatedRoute,
 } as any)
+const AuthenticatedConsentRoute = AuthenticatedConsentRouteImport.update({
+  id: '/consent',
+  path: '/consent',
+  getParentRoute: () => AuthenticatedRoute,
+} as any)
 
 export interface FileRoutesByFullPath {
   '/': typeof AuthenticatedIndexRoute
   '/sign-in': typeof SignInRoute
   '/sign-up': typeof SignUpRoute
+  '/consent': typeof AuthenticatedConsentRoute
 }
 export interface FileRoutesByTo {
   '/sign-in': typeof SignInRoute
   '/sign-up': typeof SignUpRoute
+  '/consent': typeof AuthenticatedConsentRoute
   '/': typeof AuthenticatedIndexRoute
 }
 export interface FileRoutesById {
@@ -49,18 +57,20 @@ export interface FileRoutesById {
   '/_authenticated': typeof AuthenticatedRouteWithChildren
   '/sign-in': typeof SignInRoute
   '/sign-up': typeof SignUpRoute
+  '/_authenticated/consent': typeof AuthenticatedConsentRoute
   '/_authenticated/': typeof AuthenticatedIndexRoute
 }
 export interface FileRouteTypes {
   fileRoutesByFullPath: FileRoutesByFullPath
-  fullPaths: '/' | '/sign-in' | '/sign-up'
+  fullPaths: '/' | '/sign-in' | '/sign-up' | '/consent'
   fileRoutesByTo: FileRoutesByTo
-  to: '/sign-in' | '/sign-up' | '/'
+  to: '/sign-in' | '/sign-up' | '/consent' | '/'
   id:
     | '__root__'
     | '/_authenticated'
     | '/sign-in'
     | '/sign-up'
+    | '/_authenticated/consent'
     | '/_authenticated/'
   fileRoutesById: FileRoutesById
 }
@@ -100,14 +110,23 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthenticatedIndexRouteImport
       parentRoute: typeof AuthenticatedRoute
     }
+    '/_authenticated/consent': {
+      id: '/_authenticated/consent'
+      path: '/consent'
+      fullPath: '/consent'
+      preLoaderRoute: typeof AuthenticatedConsentRouteImport
+      parentRoute: typeof AuthenticatedRoute
+    }
   }
 }
 
 interface AuthenticatedRouteChildren {
+  AuthenticatedConsentRoute: typeof AuthenticatedConsentRoute
   AuthenticatedIndexRoute: typeof AuthenticatedIndexRoute
 }
 
 const AuthenticatedRouteChildren: AuthenticatedRouteChildren = {
+  AuthenticatedConsentRoute: AuthenticatedConsentRoute,
   AuthenticatedIndexRoute: AuthenticatedIndexRoute,
 }
 

package/templates/web/src/routes/_authenticated/consent.tsx

@@ -0,0 +1,21 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { ConsentForm } from '@/features/oauth/consent-form'
+
+// Loose, because every parameter Better Auth signed has to stay in the URL for the consent request.
+export const Route = createFileRoute('/_authenticated/consent')({
+  validateSearch: z.looseObject({ client_id: z.string(), scope: z.string().default('') }),
+  component: ConsentPage,
+})
+
+function ConsentPage() {
+  const { auth } = Route.useRouteContext()
+  const { client_id, scope } = Route.useSearch()
+
+  return (
+    <>
+      <h1 className="text-2xl font-semibold">Allow access</h1>
+      <ConsentForm auth={auth} clientId={client_id} scopes={scope.split(' ').filter(Boolean)} />
+    </>
+  )
+}

package/templates/web/{src → test}/app.spec.tsx

@@ -1,9 +1,9 @@
+import { fakeTransport, json } from '@test/support/fake-transport'
+import { renderApp } from '@test/support/render-app'
 import { screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { describe, expect, it } from 'vitest'
 import type { Profile } from '@/api-contract'
-import { fakeTransport, json } from '../test/fake-transport'
-import { renderApp } from '../test/render-app'
 
 const user = { id: 'user-1', email: 'ana@example.com', name: 'Ana' }
 

package/templates/web/{src → test}/features/auth/sign-in-form.spec.tsx

@@ -1,8 +1,8 @@
+import { fakeTransport, json } from '@test/support/fake-transport'
+import { renderApp } from '@test/support/render-app'
 import { screen, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { describe, expect, it } from 'vitest'
-import { fakeTransport, json } from '../../../test/fake-transport'
-import { renderApp } from '../../../test/render-app'
 
 describe('SignInForm', () => {
   it('shows a rejected sign-in as a form-level error', async () => {

package/templates/web/test/features/oauth/consent-form.spec.tsx

@@ -0,0 +1,45 @@
+import { fakeTransport, json } from '@test/support/fake-transport'
+import { renderApp } from '@test/support/render-app'
+import { screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { afterEach, describe, expect, it } from 'vitest'
+
+const user = { id: 'user-1', email: 'ana@example.com', name: 'Ana' }
+
+// The shape Better Auth signs: every signed name listed in ba_param, then the signature.
+const SIGNED =
+  'client_id=client-1&scope=openid+profile&ba_param=ba_param&ba_param=client_id&ba_param=scope&sig=signature'
+
+afterEach(() => {
+  window.history.replaceState(null, '', '/')
+})
+
+describe('ConsentForm', () => {
+  it('names the client, lists the scopes and sends the signed query with the answer', async () => {
+    const visitor = userEvent.setup()
+    let consent: Record<string, unknown> | undefined
+
+    // The OAuth client plugin reads the browser's own URL, not the router's memory history.
+    window.history.replaceState(null, '', `/consent?${SIGNED}&unrelated=1`)
+
+    renderApp(
+      `/consent?${SIGNED}`,
+      fakeTransport({
+        'GET /api/auth/get-session': () =>
+          json(200, { session: { id: 's-1', userId: user.id }, user }),
+        'GET /api/auth/oauth2/public-client': () => json(200, { client_name: 'Claude' }),
+        'POST /api/auth/oauth2/consent': async (request) => {
+          consent = await request.json()
+          return json(200, { redirect: false })
+        },
+      }),
+    )
+
+    expect(await screen.findByText('Claude')).toBeInTheDocument()
+    expect(screen.getByText('profile')).toBeInTheDocument()
+
+    await visitor.click(screen.getByRole('button', { name: 'Allow' }))
+
+    expect(consent).toMatchObject({ accept: true, oauth_query: SIGNED })
+  })
+})

package/templates/web/{src → test}/features/profile/profile-form.spec.tsx

@@ -1,10 +1,10 @@
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
 import { render, screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { describe, expect, it } from 'vitest'
 import { createClient, type Profile } from '@/api-contract'
-import { API_URL, fakeTransport, json } from '../../../test/fake-transport'
-import { ProfileForm } from './profile-form'
+import { ProfileForm } from '@/features/profile/profile-form'
 
 const profile: Profile = {
   id: '01a09ffe-635c-77e5-9aeb-d3e9d1a7ee24',

package/templates/web/test/{render-app.tsx → support/render-app.tsx}

@@ -1,10 +1,10 @@
 import { QueryClient } from '@tanstack/react-query'
 import { createMemoryHistory } from '@tanstack/react-router'
+import { API_URL } from '@test/support/fake-transport'
 import { render } from '@testing-library/react'
 import { createClient, type Transport } from '@/api-contract'
 import { App } from '@/app'
 import { createAuth } from '@/features/auth/auth-client'
-import { API_URL } from './fake-transport'
 
 export function renderApp(path: string, transport: Transport) {
   const context = {

package/templates/web/tsconfig.json

@@ -13,7 +13,8 @@
     "isolatedModules": true,
     "noEmit": true,
     "paths": {
-      "@/*": ["./src/*"]
+      "@/*": ["./src/*"],
+      "@test/*": ["./test/*"]
     },
     "types": ["vite/client", "vitest/globals", "@testing-library/jest-dom/vitest"]
   },