@tribe-nest/forge 3.14.0 → 3.19.0

package/src/ui/headless/booking/useBookingSecret.ts

@@ -0,0 +1,41 @@
+import { useEffect, useState } from "react";
+import { readBookingSecret } from "../../../utils/bookingSecret";
+
+export interface BookingSecretLookup {
+  /** The stored credential, or null when nothing is held for this booking. */
+  secret: string | null;
+  /** False until storage has actually been consulted (first client effect). */
+  resolved: boolean;
+  /** Storage was consulted and held nothing. Only meaningful once `resolved`. */
+  isMissing: boolean;
+}
+
+/**
+ * Read back the per-booking credential a checkout stashed before handing the
+ * buyer to the payment provider. Used by the confirmation pages, which are
+ * reached by a redirect and therefore start with no in-memory state at all.
+ *
+ * The read happens in an EFFECT rather than during render on purpose: these
+ * pages are server-rendered, `sessionStorage` does not exist on the server, and
+ * reading it inline would make the server and the first client render disagree.
+ * `resolved` lets the caller hold the finalise call until the real answer is in,
+ * so a booking is never finalised without a secret it actually has.
+ *
+ * A `null` secret is NOT proof the call will fail: bookings created before the
+ * credential existed have no stored hash server-side and still finalise on the
+ * id alone. So callers should attempt the finalise regardless and use
+ * `isMissing` only to EXPLAIN a failure — see `CourseConfirmation` /
+ * `CoachingConfirmation`.
+ */
+export function useBookingSecret(bookingId?: string | null): BookingSecretLookup {
+  const [state, setState] = useState<{ secret: string | null; resolved: boolean }>({
+    secret: null,
+    resolved: false,
+  });
+
+  useEffect(() => {
+    setState({ secret: readBookingSecret(bookingId), resolved: true });
+  }, [bookingId]);
+
+  return { ...state, isMissing: state.resolved && !state.secret };
+}

package/src/ui/headless/coaching/useCoachingBooking.ts

@@ -1,4 +1,4 @@
-import { useCallback, useState } from "react";
+import { useCallback, useRef, useState } from "react";
 import { usePublicAuth } from "../../../contexts/PublicAuthContext";
 import { useGetCoachingProduct } from "../../../data/queries/useCoachingProducts";
 import {
@@ -11,6 +11,7 @@ import { usePaymentFlow } from "../../../data/queries/usePaymentFlow";
 import { useCouponField, type CouponQuoteFn } from "../coupon/useCouponField";
 import { readAttributionRef } from "../../../utils/attribution";
 import { readLanding } from "../../../utils/landing";
+import { forgetBookingSecret, rememberBookingSecret } from "../../../utils/bookingSecret";
 import type { CancellationTermsView } from "../../../types/models";
 
 export type CoachingBookingStep = "slot" | "details" | "payment";
@@ -82,6 +83,13 @@ export function useCoachingBooking(slug?: string, opts: UseCoachingBookingOption
 
   const [step, setStep] = useState<CoachingBookingStep>("slot");
   const [bookingId, setBookingId] = useState<string | null>(null);
+  /**
+   * The per-booking credential returned by `reserve`. Held in a ref (not state)
+   * so it never triggers a render and never lands in a dependency array, and
+   * mirrored into sessionStorage for the leg after the payment redirect. The
+   * backend returns it once and cannot reissue it.
+   */
+  const bookingSecretRef = useRef<string | undefined>(undefined);
   const [selectedSlotId, setSelectedSlotId] = useState<string | null>(null);
   const [firstName, setFirstName] = useState(user?.firstName ?? "");
   const [lastName, setLastName] = useState(user?.lastName ?? "");
@@ -119,6 +127,7 @@ export function useCoachingBooking(slug?: string, opts: UseCoachingBookingOption
       }
       return update.mutateAsync({
         bookingId,
+        bookingSecret: bookingSecretRef.current,
         email,
         firstName,
         lastName,
@@ -158,9 +167,17 @@ export function useCoachingBooking(slug?: string, opts: UseCoachingBookingOption
     }
     try {
       // Release any previously-held slot before reserving a new one.
-      if (bookingId) await unreserve.mutateAsync({ bookingId }).catch(() => undefined);
+      if (bookingId) {
+        await unreserve.mutateAsync({ bookingId }).catch(() => undefined);
+        forgetBookingSecret(bookingId);
+      }
       const data = await reserve.mutateAsync({ slotId: selectedSlotId });
       setBookingId(data.bookingId);
+      bookingSecretRef.current = data.bookingSecret;
+      // Written the instant it arrives: this is the only time the server will
+      // ever hand it over, and the finalise page (post-redirect) has no other
+      // way to get it.
+      rememberBookingSecret(data.bookingId, data.bookingSecret);
       setAgreedCancellation(data.cancellation ?? null);
       setReservationExpiresAt(Date.now() + RESERVATION_HOLD_MS);
       setStep("details");
@@ -177,6 +194,11 @@ export function useCoachingBooking(slug?: string, opts: UseCoachingBookingOption
    */
   const releaseReservation = useCallback(async () => {
     if (bookingId) await unreserve.mutateAsync({ bookingId }).catch(() => undefined);
+    // The credential belonged to a booking that no longer exists — leaving it
+    // in storage would strand a dead secret in the tab for the rest of the
+    // session.
+    forgetBookingSecret(bookingId);
+    bookingSecretRef.current = undefined;
     setBookingId(null);
     setSelectedSlotId(null);
     setReservationExpiresAt(null);
@@ -206,6 +228,7 @@ export function useCoachingBooking(slug?: string, opts: UseCoachingBookingOption
     try {
       const updated = await update.mutateAsync({
         bookingId,
+        bookingSecret: bookingSecretRef.current,
         email,
         firstName,
         lastName,
@@ -227,7 +250,7 @@ export function useCoachingBooking(slug?: string, opts: UseCoachingBookingOption
         else if (typeof window !== "undefined") window.location.href = ru;
         return;
       }
-      const result = await flow.start({ bookingId, returnUrl: ru });
+      const result = await flow.start({ bookingId, bookingSecret: bookingSecretRef.current, returnUrl: ru });
       if (result.provider && result.provider !== "stripe") return;
       setStep("payment");
     } catch (e) {

package/src/ui/headless/course/_tests/courseAccessGate.spec.ts

@@ -0,0 +1,135 @@
+import { describe, expect, it } from "vitest";
+import { courseAccessDenial, isLegacyCourseAccess } from "../../../../data/queries/useCourseAccess";
+import { buildCourseAccessGate, buildCourseAccessSecurePrompt, courseSignInHref } from "../useCourseClassroom";
+import type { CourseAccessData } from "../../../../types/models";
+
+/**
+ * Account-bound course access — the decisions, without a DOM or a session.
+ *
+ * The whole feature is a two-way branch on a status code, and BOTH wrong
+ * answers strand a real person: a 403 drawn as "sign in" loops someone who is
+ * already signed in, and a 401 drawn as "wrong account" tells a buyer with no
+ * session that their own enrolment is somebody else's. So the mapping is
+ * pinned here rather than left to the component.
+ */
+
+const err = (status: number, message?: string) => ({
+  response: { status, ...(message ? { data: { message } } : {}) },
+});
+
+const accessData = (accountId: string | null, email = "buyer@example.com"): CourseAccessData =>
+  ({
+    access: { id: "a1", courseId: "c1", email, firstName: null, lastName: null, currentLessonId: null, accountId },
+    course: { id: "c1", title: "Course", description: "", modules: [] },
+    progress: [],
+  }) as unknown as CourseAccessData;
+
+describe("courseAccessDenial", () => {
+  it("splits the two account-binding refusals and nothing else", () => {
+    expect(courseAccessDenial(err(401))).toMatchObject({ reason: "account_required", status: 401 });
+    expect(courseAccessDenial(err(403))).toMatchObject({ reason: "wrong_account", status: 403 });
+  });
+
+  it("carries the API's own sentence when it sent one", () => {
+    expect(courseAccessDenial(err(401, "Sign in to open this course"))?.message).toBe("Sign in to open this course");
+    expect(courseAccessDenial(err(403))?.message).toBeNull();
+  });
+
+  it("is null for every failure that is NOT about account binding", () => {
+    // A 404 must keep its old rendering; a network error has no `response` at
+    // all. Total over unknown so no caller has to narrow first.
+    for (const other of [err(404), err(500), new Error("offline"), undefined, null, "nope", {}]) {
+      expect(courseAccessDenial(other)).toBeNull();
+    }
+  });
+});
+
+describe("isLegacyCourseAccess", () => {
+  it("is true only for a grant bound to nobody", () => {
+    expect(isLegacyCourseAccess(accessData(null))).toBe(true);
+    expect(isLegacyCourseAccess(accessData("acc_1"))).toBe(false);
+  });
+
+  it("treats an absent field as legacy — an older API sends no accountId at all", () => {
+    const stale = { access: { email: "x@y.com" }, course: {}, progress: [] } as unknown as CourseAccessData;
+    expect(isLegacyCourseAccess(stale)).toBe(true);
+    expect(isLegacyCourseAccess(undefined)).toBe(false);
+    expect(isLegacyCourseAccess(null)).toBe(false);
+  });
+});
+
+describe("buildCourseAccessGate", () => {
+  it("401 offers a sign-in that returns to this exact page", () => {
+    const gate = buildCourseAccessGate({
+      denial: courseAccessDenial(err(401)),
+      isError: true,
+      loginPath: "/i/login",
+      currentPath: "/i/course-access/abc?x=1",
+    });
+    expect(gate?.kind).toBe("sign_in_required");
+    expect(gate?.actionHref).toBe(`/i/login?redirect=${encodeURIComponent("/i/course-access/abc?x=1")}`);
+  });
+
+  it("403 never says 'sign in', and its action is a sign-OUT, not a link", () => {
+    const gate = buildCourseAccessGate({ denial: courseAccessDenial(err(403)), isError: true });
+    expect(gate?.kind).toBe("wrong_account");
+    // The failure this guards: a signed-in reader told to do the one thing they
+    // have already done.
+    expect(`${gate?.title} ${gate?.body} ${gate?.actionLabel}`.toLowerCase()).not.toContain("sign in ");
+    expect(gate?.actionHref).toBeNull();
+    expect(gate?.actionLabel).toBeTruthy();
+  });
+
+  it("falls back to the old not-found panel for any other failure", () => {
+    expect(buildCourseAccessGate({ denial: null, isError: true })?.kind).toBe("not_found");
+  });
+
+  it("is null when the course loaded — the player draws instead", () => {
+    expect(buildCourseAccessGate({ denial: null, isError: false })).toBeNull();
+  });
+
+  it("drops a redirect that is not a same-origin path", () => {
+    // safeRedirectPath's job, asserted here because this is the call site that
+    // feeds it a value straight off window.location.
+    const gate = buildCourseAccessGate({
+      denial: courseAccessDenial(err(401)),
+      isError: true,
+      loginPath: "/i/login",
+      currentPath: "//evil.example/steal",
+    });
+    expect(gate?.actionHref).toBe("/i/login");
+  });
+});
+
+describe("buildCourseAccessSecurePrompt", () => {
+  it("offers to secure a legacy grant that opened fine, for a signed-out reader", () => {
+    const prompt = buildCourseAccessSecurePrompt({
+      data: accessData(null),
+      isAuthenticated: false,
+      signupPath: "/i/signup",
+      currentPath: "/i/course-access/abc",
+    });
+    expect(prompt).toEqual({
+      email: "buyer@example.com",
+      href: `/i/signup?redirect=${encodeURIComponent("/i/course-access/abc")}`,
+    });
+  });
+
+  it("says nothing on a grant that is already bound", () => {
+    expect(buildCourseAccessSecurePrompt({ data: accessData("acc_1"), isAuthenticated: false })).toBeNull();
+  });
+
+  it("says nothing to a signed-in reader — there is no binding we can perform for them", () => {
+    expect(buildCourseAccessSecurePrompt({ data: accessData(null), isAuthenticated: true })).toBeNull();
+  });
+
+  it("says nothing before the course loads", () => {
+    expect(buildCourseAccessSecurePrompt({ data: null, isAuthenticated: false })).toBeNull();
+  });
+});
+
+describe("courseSignInHref", () => {
+  it("returns the bare path when there is nowhere safe to come back to (SSR, empty)", () => {
+    expect(courseSignInHref("/i/login", "")).toBe("/i/login");
+  });
+});

package/src/ui/headless/course/useCourseCheckout.ts

@@ -5,6 +5,7 @@ import { usePaymentFlow } from "../../../data/queries/usePaymentFlow";
 import { useCouponField, type CouponQuoteFn } from "../coupon/useCouponField";
 import { readAttributionRef } from "../../../utils/attribution";
 import { readLanding } from "../../../utils/landing";
+import { rememberBookingSecret } from "../../../utils/bookingSecret";
 
 export type CourseCheckoutStep = "details" | "payment";
 
@@ -50,6 +51,13 @@ export function useCourseCheckout(slug?: string, opts: UseCourseCheckoutOptions
   const [error, setError] = useState<string | null>(null);
   /** The booking created for quoting, reused so a code never mints a second one. */
   const bookingIdRef = useRef<string | null>(null);
+  /**
+   * The per-booking credential returned by `createBooking`. Held in a ref (not
+   * state) so it never triggers a render and never lands in a dependency array,
+   * and mirrored into sessionStorage for the leg after the payment redirect.
+   * The backend returns it once and cannot reissue it.
+   */
+  const bookingSecretRef = useRef<string | undefined>(undefined);
 
   const finalisePath =
     opts.finalisePath ?? ((s, bookingId) => `/i/courses/${s}/finalise?bookingId=${bookingId}`);
@@ -72,6 +80,11 @@ export function useCourseCheckout(slug?: string, opts: UseCourseCheckoutOptions
       ...(readLanding() ?? {}),
     });
     bookingIdRef.current = created.bookingId;
+    bookingSecretRef.current = created.bookingSecret;
+    // Written the instant it arrives: this is the only time the server will
+    // ever hand it over, and the finalise page (post-redirect) has no other
+    // way to get it.
+    rememberBookingSecret(created.bookingId, created.bookingSecret);
     return created.bookingId;
   };
 
@@ -86,6 +99,7 @@ export function useCourseCheckout(slug?: string, opts: UseCourseCheckoutOptions
       const bookingId = await ensureBooking();
       return updateBooking.mutateAsync({
         bookingId,
+        bookingSecret: bookingSecretRef.current,
         email,
         firstName,
         lastName,
@@ -119,6 +133,7 @@ export function useCourseCheckout(slug?: string, opts: UseCourseCheckoutOptions
         bookingId = await ensureBooking();
         const updated = await updateBooking.mutateAsync({
           bookingId,
+          bookingSecret: bookingSecretRef.current,
           email,
           firstName,
           lastName,
@@ -138,6 +153,8 @@ export function useCourseCheckout(slug?: string, opts: UseCourseCheckoutOptions
           ...(readLanding() ?? {}),
         });
         bookingIdRef.current = data.bookingId;
+        bookingSecretRef.current = data.bookingSecret;
+        rememberBookingSecret(data.bookingId, data.bookingSecret);
         bookingId = data.bookingId;
         isFree = !!data.isFree;
       }
@@ -150,7 +167,7 @@ export function useCourseCheckout(slug?: string, opts: UseCourseCheckoutOptions
         else if (typeof window !== "undefined") window.location.href = ru;
         return;
       }
-      const result = await flow.start({ bookingId, returnUrl: ru });
+      const result = await flow.start({ bookingId, bookingSecret: bookingSecretRef.current, returnUrl: ru });
       if (result.provider && result.provider !== "stripe") return;
       setStep("payment");
     } catch (e) {

package/src/ui/headless/course/useCourseClassroom.ts

@@ -0,0 +1,242 @@
+import { useMemo, useRef, useState } from "react";
+import type { CourseAccessData, CourseLesson } from "../../../types/models";
+import {
+  courseAccessDenial,
+  isLegacyCourseAccess,
+  useCourseAccess,
+  useUpdateCourseProgress,
+  type CourseAccessDenial,
+} from "../../../data/queries/useCourseAccess";
+import { usePublicAuth } from "../../../contexts/PublicAuthContext";
+import { safeRedirectPath } from "../../../utils/safeRedirect";
+
+/**
+ * What the classroom should draw INSTEAD of the player.
+ *
+ * `sign_in_required` and `wrong_account` are the two halves of account-bound
+ * course access, and they must never be merged: one caller needs a way IN, the
+ * other needs a way OUT of the session they are already in. `not_found` keeps
+ * the pre-existing behaviour for a revoked or unknown grant.
+ */
+export type CourseAccessGateKind = "sign_in_required" | "wrong_account" | "not_found";
+
+export interface CourseAccessGate {
+  kind: CourseAccessGateKind;
+  title: string;
+  /** The API's sentence when it sent one, else a local fallback. */
+  body: string;
+  /** Primary CTA label. */
+  actionLabel: string | null;
+  /**
+   * Where the primary CTA goes. `null` on `wrong_account`, whose action is
+   * signing OUT — a state change, not a navigation, so the caller runs
+   * `signOutAndRetry` instead.
+   */
+  actionHref: string | null;
+}
+
+// Not re-exported from the headless barrel — `COURSE_SIGNUP_PATH` is already
+// taken there by the posts upsell, and these are only defaults for the options.
+export const COURSE_LOGIN_PATH = "/login";
+export const COURSE_SIGNUP_PATH = "/signup";
+
+/** `loginPath?redirect=<here>` — a sign-in that lands back on the course, never on a generic home. */
+export const courseSignInHref = (loginPath: string, currentPath: string): string => {
+  const target = safeRedirectPath(currentPath, "");
+  return target ? `${loginPath}?redirect=${encodeURIComponent(target)}` : loginPath;
+};
+
+/**
+ * The gate for a failed access read, or `null` when there is nothing to gate.
+ *
+ * Pure and total so the two 4xx branches can be exercised without a DOM, a
+ * client or a session — this mapping is the whole feature, and getting the
+ * 401/403 arms backwards produces a page that is technically correct and
+ * practically a dead end.
+ */
+export function buildCourseAccessGate(input: {
+  denial: CourseAccessDenial | null;
+  /** The query failed for some OTHER reason (404, 500, offline). */
+  isError: boolean;
+  loginPath?: string;
+  /** Path (+ search) to return to after signing in. */
+  currentPath?: string;
+}): CourseAccessGate | null {
+  const { denial, isError } = input;
+  const loginPath = input.loginPath ?? COURSE_LOGIN_PATH;
+
+  if (denial?.reason === "account_required") {
+    return {
+      kind: "sign_in_required",
+      title: "Sign in to open this course",
+      // Said plainly because the person reading it is almost always the buyer,
+      // arriving from an email they were sent months ago.
+      body:
+        denial.message ??
+        "This enrolment is tied to an account. Sign in and you'll come straight back to your course.",
+      actionLabel: "Sign in",
+      actionHref: courseSignInHref(loginPath, input.currentPath ?? ""),
+    };
+  }
+
+  if (denial?.reason === "wrong_account") {
+    return {
+      kind: "wrong_account",
+      title: "This enrolment belongs to a different account",
+      // NOT "sign in" — they already are. The only useful move is leaving the
+      // session they are in.
+      body:
+        denial.message ??
+        "You're signed in with a different account. Sign out and sign back in with the account that bought this course.",
+      actionLabel: "Sign out and switch account",
+      actionHref: null,
+    };
+  }
+
+  if (isError) {
+    return {
+      kind: "not_found",
+      title: "Course access not found",
+      body: "This link may have expired or the enrolment may have been revoked.",
+      actionLabel: null,
+      actionHref: null,
+    };
+  }
+
+  return null;
+}
+
+/**
+ * The nudge shown ON TOP of a course that opened fine, when the grant is still
+ * legacy (`account_id` NULL) — i.e. the link alone is the credential.
+ *
+ * Only offered to a signed-OUT reader. There is no bind-my-grant endpoint, so
+ * the honest thing to offer is an account on the grant's own email; telling a
+ * reader who is already signed in to "secure" something we cannot bind for them
+ * would be noise on every page view.
+ */
+export interface CourseAccessSecurePrompt {
+  /** The email the grant was issued to — shown so the reader knows which one to use. */
+  email: string;
+  href: string;
+}
+
+export function buildCourseAccessSecurePrompt(input: {
+  data?: CourseAccessData | null;
+  isAuthenticated: boolean;
+  signupPath?: string;
+  currentPath?: string;
+}): CourseAccessSecurePrompt | null {
+  if (!input.data || input.isAuthenticated) return null;
+  if (!isLegacyCourseAccess(input.data)) return null;
+  const email = input.data.access.email;
+  if (!email) return null;
+  return {
+    email,
+    href: courseSignInHref(input.signupPath ?? COURSE_SIGNUP_PATH, input.currentPath ?? ""),
+  };
+}
+
+const currentPath = (): string =>
+  typeof window === "undefined" ? "" : `${window.location.pathname}${window.location.search}`;
+
+export interface UseCourseClassroomOptions {
+  /** Sign-in path (default `/login`; site-starter uses `/i/login`). */
+  loginPath?: string;
+  /** Signup path for the secure-your-access nudge (default `/signup`). */
+  signupPath?: string;
+  /** Suppress the legacy-grant nudge entirely. */
+  showSecurePrompt?: boolean;
+}
+
+/**
+ * Headless enrolled-course player: the account-binding gate, lesson selection
+ * and throttled video-progress reporting over `useCourseAccess` +
+ * `useUpdateCourseProgress`. Bring your own UI.
+ */
+export function useCourseClassroom(accessId?: string, opts: UseCourseClassroomOptions = {}) {
+  const { isAuthenticated, isInitialized, user, logout } = usePublicAuth();
+  /**
+   * Held until the session is restored. `PublicAuthProvider` reads the stored
+   * token in an effect, so a query fired on the first render goes out with no
+   * Authorization header — and a BOUND grant would answer 401 to the very person
+   * it belongs to, showing "sign in" to someone already signed in. Costs one
+   * `/public/accounts/me` round trip that the page makes anyway.
+   */
+  const { data, isLoading, isError, error, refetch } = useCourseAccess(isInitialized ? accessId : undefined);
+  const updateProgress = useUpdateCourseProgress(accessId);
+  const lastSent = useRef(0);
+
+  const [selectedLessonId, setSelectedLessonId] = useState<string | null>(null);
+  const [securePromptDismissed, setSecurePromptDismissed] = useState(false);
+
+  const denial = useMemo(() => (isError ? courseAccessDenial(error) : null), [isError, error]);
+
+  const gate = useMemo(
+    () => buildCourseAccessGate({ denial, isError, loginPath: opts.loginPath, currentPath: currentPath() }),
+    [denial, isError, opts.loginPath],
+  );
+
+  const modules = data?.course.modules ?? [];
+  const lessons: CourseLesson[] = modules.flatMap((m) => m.lessons ?? []);
+
+  // The server's resume point wins until the reader picks a lesson; deriving it
+  // rather than seeding state means it is not frozen at whatever the very first
+  // (undefined) render saw.
+  const selected =
+    lessons.find((l) => l.id === selectedLessonId) ??
+    lessons.find((l) => l.id === data?.access.currentLessonId) ??
+    lessons[0];
+
+  const securePrompt = useMemo(() => {
+    if (opts.showSecurePrompt === false || securePromptDismissed) return null;
+    return buildCourseAccessSecurePrompt({
+      data,
+      isAuthenticated,
+      signupPath: opts.signupPath,
+      currentPath: currentPath(),
+    });
+  }, [data, isAuthenticated, opts.showSecurePrompt, opts.signupPath, securePromptDismissed]);
+
+  /** Throttled to ~1/s — `timeupdate` fires several times a second. */
+  const reportProgress = (videoProgress: number, duration?: number) => {
+    if (!selected || !duration) return;
+    const now = Date.now();
+    if (now - lastSent.current < 1000) return;
+    lastSent.current = now;
+    const percent = (videoProgress / duration) * 100;
+    updateProgress.mutate({ lessonId: selected.id, videoProgress: percent, isCompleted: percent >= 95 });
+  };
+
+  /**
+   * The `wrong_account` exit. Clears the session and re-asks: a LEGACY grant
+   * opens immediately once anonymous, and a bound one falls through to the
+   * sign-in gate — either way the reader moves forward instead of in a circle.
+   */
+  const signOutAndRetry = async () => {
+    await logout();
+    await refetch();
+  };
+
+  return {
+    data,
+    // A disabled query is not "loading" to react-query, so the pre-session
+    // window has to be folded in by hand or the page flashes its error state.
+    isLoading: isLoading || !isInitialized,
+    /** Non-null when the player must not be drawn. */
+    gate,
+    denial,
+    securePrompt,
+    dismissSecurePrompt: () => setSecurePromptDismissed(true),
+    signOutAndRetry,
+    /** The email of the account currently signed in — names it in the wrong-account copy. */
+    signedInEmail: user?.email ?? null,
+    isAuthenticated,
+    modules,
+    lessons,
+    selected,
+    selectLesson: setSelectedLessonId,
+    completedCount: lessons.filter((l) => l.progress?.isCompleted).length,
+    reportProgress,
+  };
+}