@stjoseph/prumo 0.3.0 → 0.4.1

package/templates/web/src/routeTree.gen.ts

@@ -10,8 +10,11 @@
 
 import { Route as rootRouteImport } from './routes/__root'
 import { Route as AuthenticatedRouteImport } from './routes/_authenticated'
+import { Route as ForgotPasswordRouteImport } from './routes/forgot-password'
+import { Route as ResetPasswordRouteImport } from './routes/reset-password'
 import { Route as SignInRouteImport } from './routes/sign-in'
 import { Route as SignUpRouteImport } from './routes/sign-up'
+import { Route as VerifyEmailRouteImport } from './routes/verify-email'
 import { Route as AuthenticatedIndexRouteImport } from './routes/_authenticated/index'
 import { Route as AuthenticatedConsentRouteImport } from './routes/_authenticated/consent'
 
@@ -19,6 +22,16 @@ const AuthenticatedRoute = AuthenticatedRouteImport.update({
   id: '/_authenticated',
   getParentRoute: () => rootRouteImport,
 } as any)
+const ForgotPasswordRoute = ForgotPasswordRouteImport.update({
+  id: '/forgot-password',
+  path: '/forgot-password',
+  getParentRoute: () => rootRouteImport,
+} as any)
+const ResetPasswordRoute = ResetPasswordRouteImport.update({
+  id: '/reset-password',
+  path: '/reset-password',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const SignInRoute = SignInRouteImport.update({
   id: '/sign-in',
   path: '/sign-in',
@@ -29,6 +42,11 @@ const SignUpRoute = SignUpRouteImport.update({
   path: '/sign-up',
   getParentRoute: () => rootRouteImport,
 } as any)
+const VerifyEmailRoute = VerifyEmailRouteImport.update({
+  id: '/verify-email',
+  path: '/verify-email',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const AuthenticatedIndexRoute = AuthenticatedIndexRouteImport.update({
   id: '/',
   path: '/',
@@ -42,42 +60,71 @@ const AuthenticatedConsentRoute = AuthenticatedConsentRouteImport.update({
 
 export interface FileRoutesByFullPath {
   '/': typeof AuthenticatedIndexRoute
+  '/forgot-password': typeof ForgotPasswordRoute
+  '/reset-password': typeof ResetPasswordRoute
   '/sign-in': typeof SignInRoute
   '/sign-up': typeof SignUpRoute
+  '/verify-email': typeof VerifyEmailRoute
   '/consent': typeof AuthenticatedConsentRoute
 }
 export interface FileRoutesByTo {
+  '/forgot-password': typeof ForgotPasswordRoute
+  '/reset-password': typeof ResetPasswordRoute
   '/sign-in': typeof SignInRoute
   '/sign-up': typeof SignUpRoute
+  '/verify-email': typeof VerifyEmailRoute
   '/consent': typeof AuthenticatedConsentRoute
   '/': typeof AuthenticatedIndexRoute
 }
 export interface FileRoutesById {
   __root__: typeof rootRouteImport
   '/_authenticated': typeof AuthenticatedRouteWithChildren
+  '/forgot-password': typeof ForgotPasswordRoute
+  '/reset-password': typeof ResetPasswordRoute
   '/sign-in': typeof SignInRoute
   '/sign-up': typeof SignUpRoute
+  '/verify-email': typeof VerifyEmailRoute
   '/_authenticated/consent': typeof AuthenticatedConsentRoute
   '/_authenticated/': typeof AuthenticatedIndexRoute
 }
 export interface FileRouteTypes {
   fileRoutesByFullPath: FileRoutesByFullPath
-  fullPaths: '/' | '/sign-in' | '/sign-up' | '/consent'
+  fullPaths:
+    | '/'
+    | '/forgot-password'
+    | '/reset-password'
+    | '/sign-in'
+    | '/sign-up'
+    | '/verify-email'
+    | '/consent'
   fileRoutesByTo: FileRoutesByTo
-  to: '/sign-in' | '/sign-up' | '/consent' | '/'
+  to:
+    | '/forgot-password'
+    | '/reset-password'
+    | '/sign-in'
+    | '/sign-up'
+    | '/verify-email'
+    | '/consent'
+    | '/'
   id:
     | '__root__'
     | '/_authenticated'
+    | '/forgot-password'
+    | '/reset-password'
     | '/sign-in'
     | '/sign-up'
+    | '/verify-email'
     | '/_authenticated/consent'
     | '/_authenticated/'
   fileRoutesById: FileRoutesById
 }
 export interface RootRouteChildren {
   AuthenticatedRoute: typeof AuthenticatedRouteWithChildren
+  ForgotPasswordRoute: typeof ForgotPasswordRoute
+  ResetPasswordRoute: typeof ResetPasswordRoute
   SignInRoute: typeof SignInRoute
   SignUpRoute: typeof SignUpRoute
+  VerifyEmailRoute: typeof VerifyEmailRoute
 }
 
 declare module '@tanstack/react-router' {
@@ -89,6 +136,20 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthenticatedRouteImport
       parentRoute: typeof rootRouteImport
     }
+    '/forgot-password': {
+      id: '/forgot-password'
+      path: '/forgot-password'
+      fullPath: '/forgot-password'
+      preLoaderRoute: typeof ForgotPasswordRouteImport
+      parentRoute: typeof rootRouteImport
+    }
+    '/reset-password': {
+      id: '/reset-password'
+      path: '/reset-password'
+      fullPath: '/reset-password'
+      preLoaderRoute: typeof ResetPasswordRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/sign-in': {
       id: '/sign-in'
       path: '/sign-in'
@@ -103,6 +164,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof SignUpRouteImport
       parentRoute: typeof rootRouteImport
     }
+    '/verify-email': {
+      id: '/verify-email'
+      path: '/verify-email'
+      fullPath: '/verify-email'
+      preLoaderRoute: typeof VerifyEmailRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/_authenticated/': {
       id: '/_authenticated/'
       path: '/'
@@ -136,8 +204,11 @@ const AuthenticatedRouteWithChildren = AuthenticatedRoute._addFileChildren(
 
 const rootRouteChildren: RootRouteChildren = {
   AuthenticatedRoute: AuthenticatedRouteWithChildren,
+  ForgotPasswordRoute: ForgotPasswordRoute,
+  ResetPasswordRoute: ResetPasswordRoute,
   SignInRoute: SignInRoute,
   SignUpRoute: SignUpRoute,
+  VerifyEmailRoute: VerifyEmailRoute,
 }
 export const routeTree = rootRouteImport
   ._addFileChildren(rootRouteChildren)

package/templates/web/src/routes/forgot-password.tsx

@@ -0,0 +1,17 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { ForgotPasswordForm } from '@/features/auth/forgot-password-form'
+
+export const Route = createFileRoute('/forgot-password')({
+  component: ForgotPasswordPage,
+})
+
+function ForgotPasswordPage() {
+  const { auth } = Route.useRouteContext()
+
+  return (
+    <>
+      <h1 className="text-2xl font-semibold">Reset your password</h1>
+      <ForgotPasswordForm auth={auth} />
+    </>
+  )
+}

package/templates/web/src/routes/reset-password.tsx

@@ -0,0 +1,20 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { ResetPasswordForm } from '@/features/auth/reset-password-form'
+
+export const Route = createFileRoute('/reset-password')({
+  validateSearch: z.object({ email: z.email() }),
+  component: ResetPasswordPage,
+})
+
+function ResetPasswordPage() {
+  const { auth } = Route.useRouteContext()
+  const { email } = Route.useSearch()
+
+  return (
+    <>
+      <h1 className="text-2xl font-semibold">Choose a new password</h1>
+      <ResetPasswordForm auth={auth} email={email} />
+    </>
+  )
+}

package/templates/web/src/routes/sign-in.tsx

@@ -1,20 +1,27 @@
 import { createFileRoute } from '@tanstack/react-router'
 import { z } from 'zod'
 import { SignInForm } from '@/features/auth/sign-in-form'
+import { SocialButtons } from '@/features/auth/social-buttons' // prumo:social
 
 export const Route = createFileRoute('/sign-in')({
-  validateSearch: z.object({ redirect: z.string().optional() }),
+  validateSearch: z.object({
+    redirect: z.string().optional(),
+    error: z.string().optional(), // prumo:social
+  }),
   component: SignInPage,
 })
 
 function SignInPage() {
   const { auth } = Route.useRouteContext()
-  const { redirect } = Route.useSearch()
+  const search = Route.useSearch()
 
   return (
     <>
       <h1 className="text-2xl font-semibold">Sign in</h1>
-      <SignInForm auth={auth} redirect={redirect} />
+      {/* prumo:social */}
+      <SocialButtons auth={auth} returnTo={search.redirect} error={search.error} />
+      {/* prumo:end-social */}
+      <SignInForm auth={auth} redirect={search.redirect} />
     </>
   )
 }

package/templates/web/src/routes/sign-up.tsx

@@ -1,5 +1,6 @@
 import { createFileRoute } from '@tanstack/react-router'
 import { SignUpForm } from '@/features/auth/sign-up-form'
+import { SocialButtons } from '@/features/auth/social-buttons' // prumo:social
 
 export const Route = createFileRoute('/sign-up')({
   component: SignUpPage,
@@ -11,6 +12,9 @@ function SignUpPage() {
   return (
     <>
       <h1 className="text-2xl font-semibold">Create an account</h1>
+      {/* prumo:social */}
+      <SocialButtons auth={auth} returnTo={undefined} error={undefined} />
+      {/* prumo:end-social */}
       <SignUpForm auth={auth} />
     </>
   )

package/templates/web/src/routes/verify-email.tsx

@@ -0,0 +1,20 @@
+import { createFileRoute } from '@tanstack/react-router'
+import { z } from 'zod'
+import { VerifyEmailForm } from '@/features/auth/verify-email-form'
+
+export const Route = createFileRoute('/verify-email')({
+  validateSearch: z.object({ email: z.email() }),
+  component: VerifyEmailPage,
+})
+
+function VerifyEmailPage() {
+  const { auth } = Route.useRouteContext()
+  const { email } = Route.useSearch()
+
+  return (
+    <>
+      <h1 className="text-2xl font-semibold">Confirm your email</h1>
+      <VerifyEmailForm auth={auth} email={email} />
+    </>
+  )
+}

package/templates/web/test/features/auth/email-flows.spec.tsx

@@ -0,0 +1,121 @@
+import { fakeTransport, json } from '@test/support/fake-transport'
+import { renderApp } from '@test/support/render-app'
+import { screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { describe, expect, it } from 'vitest'
+import type { Profile } from '@/api-contract'
+
+const user = { id: 'user-1', email: 'ana@example.com' }
+
+const profile: Profile = {
+  id: 'profile-1',
+  userId: user.id,
+  displayName: 'Ana',
+  locale: 'en',
+  timezone: 'UTC',
+  createdAt: '2026-09-14T12:57:24.057Z',
+  updatedAt: '2026-09-14T12:57:24.057Z',
+}
+
+const empty = (status: number) => new Response(null, { status })
+
+const problem = (status: number, body: Record<string, unknown>) =>
+  json(status, { status, title: 'Error', ...body }, 'application/problem+json')
+
+// A visitor whose session appears once `signedIn` flips, as cookies would.
+function app(routes: Parameters<typeof fakeTransport>[0]) {
+  const state = { signedIn: false }
+
+  return {
+    state,
+    transport: fakeTransport({
+      'GET /api/auth/session': () => (state.signedIn ? json(200, { user }) : json(401, {})),
+      'POST /api/auth/refresh': () => json(401, {}),
+      'GET /api/v1/users/me': () => json(200, profile),
+      ...routes,
+    }),
+  }
+}
+
+describe('email verification on the web', () => {
+  it('takes a new account to the code, and into the app once it is entered', async () => {
+    const visitor = userEvent.setup()
+    const { state, transport } = app({
+      'POST /api/auth/sign-up': () => json(201, { verificationRequired: true }),
+      'POST /api/auth/email/verify': () => {
+        state.signedIn = true
+        return empty(204)
+      },
+    })
+
+    renderApp('/sign-up', transport)
+
+    await visitor.type(await screen.findByLabelText('Name'), 'Ana')
+    await visitor.type(screen.getByLabelText('Email'), user.email)
+    await visitor.type(screen.getByLabelText('Password'), 'correct-horse-battery')
+    await visitor.click(screen.getByRole('button', { name: 'Create account' }))
+
+    expect(await screen.findByRole('heading', { name: 'Confirm your email' })).toBeInTheDocument()
+
+    await visitor.type(screen.getByLabelText('Code'), '123456')
+    await visitor.click(screen.getByRole('button', { name: 'Confirm email' }))
+
+    expect(await screen.findByRole('heading', { name: 'Your profile' })).toBeInTheDocument()
+  })
+
+  it('sends an unconfirmed account that signs in to the code page', async () => {
+    const visitor = userEvent.setup()
+    const { transport } = app({
+      'POST /api/auth/sign-in': () => problem(403, { code: 'email_not_verified' }),
+    })
+
+    renderApp('/sign-in', transport)
+
+    await visitor.type(await screen.findByLabelText('Email'), user.email)
+    await visitor.type(screen.getByLabelText('Password'), 'correct-horse-battery')
+    await visitor.click(screen.getByRole('button', { name: 'Sign in' }))
+
+    expect(await screen.findByRole('heading', { name: 'Confirm your email' })).toBeInTheDocument()
+  })
+
+  it('shows a wrong code on the code field', async () => {
+    const visitor = userEvent.setup()
+    const { transport } = app({
+      'POST /api/auth/email/verify': () =>
+        problem(422, { code: 'invalid_code', detail: 'The code is wrong or has expired' }),
+    })
+
+    renderApp(`/verify-email?email=${user.email}`, transport)
+
+    await visitor.type(await screen.findByLabelText('Code'), '000000')
+    await visitor.click(screen.getByRole('button', { name: 'Confirm email' }))
+
+    expect(await screen.findByText(/The code is wrong or has expired/)).toBeInTheDocument()
+  })
+})
+
+describe('password reset on the web', () => {
+  it('goes from forgot to reset to the app', async () => {
+    const visitor = userEvent.setup()
+    const { state, transport } = app({
+      'POST /api/auth/password/forgot': () => empty(204),
+      'POST /api/auth/password/reset': () => {
+        state.signedIn = true
+        return empty(204)
+      },
+    })
+
+    renderApp('/sign-in', transport)
+
+    await visitor.click(await screen.findByRole('link', { name: 'Forgot your password?' }))
+    await screen.findByRole('heading', { name: 'Reset your password' })
+    await visitor.type(screen.getByLabelText('Email'), user.email)
+    await visitor.click(screen.getByRole('button', { name: 'Send a reset code' }))
+    await screen.findByRole('heading', { name: 'Choose a new password' })
+    await visitor.type(screen.getByLabelText('Code'), '123456')
+    await visitor.type(screen.getByLabelText('New password'), 'another-good-password')
+    await visitor.click(screen.getByRole('button', { name: 'Set the new password' }))
+
+    expect(await screen.findByRole('heading', { name: 'Your profile' })).toBeInTheDocument()
+  })
+})

package/templates/web/test/features/auth/social-buttons.spec.tsx

@@ -0,0 +1,35 @@
+import { API_URL, fakeTransport, json } from '@test/support/fake-transport'
+import { renderApp } from '@test/support/render-app'
+import { screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+
+const signedOut = fakeTransport({
+  'GET /api/auth/session': () => json(401, {}),
+  'POST /api/auth/refresh': () => json(401, {}),
+})
+
+describe('SocialButtons', () => {
+  it('send the browser to the API, which returns it to the page it was turned away from', async () => {
+    renderApp('/sign-in?redirect=%2Forders', signedOut)
+
+    for (const name of [
+      'Continue with Google', // prumo:google
+      'Continue with Apple', // prumo:apple
+    ]) {
+      const link = await screen.findByRole('link', { name })
+      const href = new URL(link.getAttribute('href') ?? '')
+
+      expect(`${href.origin}${href.pathname}`).toMatch(
+        new RegExp(`^${API_URL}/api/auth/social/(google|apple)$`),
+      )
+      expect(href.searchParams.get('client')).toBe('web')
+      expect(href.searchParams.get('returnTo')).toBe('/orders')
+    }
+  })
+
+  it('says why a provider sign-in came back without a session', async () => {
+    renderApp('/sign-in?error=provider_email_unverified', signedOut)
+
+    expect(await screen.findByRole('alert')).toHaveTextContent('not verified with the provider')
+  })
+})

package/templates/web/test/features/oauth/consent-form.spec.tsx

@@ -15,6 +15,10 @@ const view = {
   clientHost: 'claude.example.com',
   redirectHost: 'claude.example.com',
   redirectsToThisDevice: false,
+  scopes: [
+    { scope: 'profile:read', description: 'Read your profile' },
+    { scope: 'profile:write', description: 'Change your display name, language and timezone' },
+  ],
 }
 
 function renderForm(routes: Parameters<typeof fakeTransport>[0]) {
@@ -44,6 +48,9 @@ describe('ConsentForm', () => {
 
     expect(await screen.findByText('Claude')).toBeInTheDocument()
     expect(screen.getByText(/claude\.example\.com\)/)).toBeInTheDocument()
+    expect(screen.getByRole('list', { name: 'What it will be able to do' })).toHaveTextContent(
+      'Read your profile',
+    )
 
     await visitor.click(screen.getByRole('button', { name: 'Allow' }))
 

package/templates/workspace/README.md

@@ -29,6 +29,16 @@ If the workspace holds `api` and its database is not set up yet, `pnpm dev` offe
 
 If the workspace holds `web`, open `http://localhost:5173`: you are sent to sign in, and **Sign up** creates an
 account and takes you to your profile. Each app's README says what it needs before it starts.
+<!-- prumo:email -->
+
+Signing up first asks for the 6-digit code that confirms the email. No mail is sent yet: the API writes it to its
+log, in a line starting `[mail] to`, which `pnpm dev` prints with the rest of the API's output.
+<!-- prumo:end-email -->
+<!-- prumo:social -->
+
+A provider's sign-in button answers *That sign-in is not set up yet* until its settings are filled in `apps/api/.env`;
+`.env.example` lists them and says where each one comes from.
+<!-- prumo:end-social -->
 
 ## Conventions
 

package/dist/mcp.js

@@ -1,107 +0,0 @@
-import { existsSync } from 'node:fs';
-import { readdir, readFile, rm, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { setJsonc } from "./jsonc.js";
-// The api and web templates ship with MCP. A project that answered no receives them without it: these files are
-// deleted, these dependencies removed, and every marked line or block cut. Every other type has nothing to cut.
-// The API's MCP is its server and the OAuth authorization server that issues its tokens, with the table that
-// holds an authorization in a migration of its own, so a project without MCP never creates it.
-export const FILES = {
-    api: [
-        'src/infra/mcp',
-        'src/domain/oauth',
-        'src/infra/oauth',
-        'src/infra/di/oauth.di.ts',
-        'src/infra/http/fetch-bridge.ts',
-        'src/infra/http/controllers/mcp.controller.ts',
-        'src/infra/http/controllers/oauth.controller.ts',
-        'src/infra/database/mikroorm/entities/authorization.schema.ts',
-        'src/infra/database/mikroorm/repositories/mikroorm-authorization.repository.ts',
-        'migrations/Migration20261002210631_create_authorization.ts',
-        'test/domain/oauth',
-        'test/infra/oauth',
-        'test/infra/http/controllers/mcp.controller.spec.ts',
-    ],
-    web: ['src/features/oauth', 'src/routes/_authenticated/consent.tsx', 'test/features/oauth'],
-};
-const DEPENDENCIES = {
-    api: ['@modelcontextprotocol/client', '@modelcontextprotocol/server'],
-    web: [],
-};
-const BLOCK_START = /^\s*\/\/ prumo:mcp$/;
-const BLOCK_END = /^\s*\/\/ prumo:end-mcp$/;
-// A marked import keeps its marker as a trailing comment, which the import sorter carries along.
-const MARKED_LINE = /\s*\/\/ prumo:mcp$/;
-export function cutMcp(text, keep, file = 'a file') {
-    const kept = [];
-    let inBlock = false;
-    for (const line of text.split('\n')) {
-        if (BLOCK_START.test(line)) {
-            if (inBlock) {
-                throw new Error(`${file} opens a prumo:mcp block inside another`);
-            }
-            inBlock = true;
-        }
-        else if (BLOCK_END.test(line)) {
-            if (!inBlock) {
-                throw new Error(`${file} closes a prumo:mcp block it never opened`);
-            }
-            inBlock = false;
-        }
-        else if (MARKED_LINE.test(line)) {
-            if (keep) {
-                kept.push(line.replace(MARKED_LINE, ''));
-            }
-        }
-        else if (keep || !inBlock) {
-            kept.push(line);
-        }
-    }
-    if (inBlock) {
-        throw new Error(`${file} leaves a prumo:mcp block open`);
-    }
-    return kept.join('\n');
-}
-async function sourceFiles(directory) {
-    if (!existsSync(directory)) {
-        return [];
-    }
-    const entries = await readdir(directory, { withFileTypes: true, recursive: true });
-    return entries
-        .filter((entry) => entry.isFile() && /\.tsx?$/.test(entry.name))
-        .map((entry) => join(entry.parentPath, entry.name));
-}
-export async function applyMcp(app, type, enabled) {
-    const files = FILES[type];
-    const dependencies = DEPENDENCIES[type];
-    if (files === undefined || dependencies === undefined) {
-        return;
-    }
-    if (!enabled) {
-        for (const file of files) {
-            await rm(join(app, file), { recursive: true, force: true });
-        }
-        const manifest = join(app, 'package.json');
-        let text = await readFile(manifest, 'utf8');
-        for (const section of ['dependencies', 'devDependencies']) {
-            for (const dependency of dependencies) {
-                text = setJsonc(text, [section, dependency], undefined);
-            }
-        }
-        await writeFile(manifest, text);
-    }
-    const sources = [
-        ...(await sourceFiles(join(app, 'src'))),
-        ...(await sourceFiles(join(app, 'test'))),
-    ];
-    for (const source of sources) {
-        const text = await readFile(source, 'utf8');
-        const cut = cutMcp(text, enabled, source);
-        if (!enabled && dependencies.some((dependency) => cut.includes(`'${dependency}`))) {
-            throw new Error(`${source} still imports an MCP package outside a prumo:mcp marker`);
-        }
-        if (cut !== text) {
-            await writeFile(source, cut);
-        }
-    }
-}