backend-manager 5.2.14 → 5.2.16

package/CHANGELOG.md

@@ -14,6 +14,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+# [5.2.16] - 2026-05-28
+
+### Removed
+
+- **Dropped the legacy top-level `affiliateCode` field from `/user/signup`.** UJM and all current consumers send the referral code as `attribution.affiliate.code`; the top-level `affiliateCode` (and the normalize-to-`attribution` shim + the `processAffiliate` fallback that read it) was a dead legacy path. Removed from `src/manager/schemas/user/signup/post.js`, the `buildUserRecord` normalize block, and the `processAffiliate` lookup in `src/manager/routes/user/signup/post.js`. The route now reads referral codes exclusively from `attribution.affiliate.code`. (The legacy `bm_api` sign-up action `functions/core/actions/api/user/sign-up.js` is unchanged.)
+
+### Fixed
+
+- **Consent: never downgrade an existing granted consent on `/user/signup`** (`src/manager/routes/user/signup/post.js`). A legacy account — signed up before the `flags.signupProcessed` completion flow existed, so the flag was never set — re-fires `/user/signup` on every page load until the flag flips. Its consent payload arrives empty (the original is long gone from `localStorage`), which previously computed `'revoked'` and, on the `{ merge: true }` write, wiped the consent the user actually granted months ago. `buildConsentRecord` now reads the existing doc's consent and preserves any already-`granted` status when the incoming payload doesn't explicitly re-grant it. A genuine new grant still applies; an at-signup decline with no prior grant still records the decline. Added `consent-empty-payload-preserves-existing-grant` and `consent-explicit-decline-does-not-downgrade-existing-grant` tests (+ a dedicated `consent-preserve` test account). See `docs/consent.md`.
+
+### Changed
+
+- **`user/signup` schema: shaped the `consent` field.** `src/manager/schemas/user/signup/post.js` now declares the nested `consent.{legal,marketing}.{granted,text}` shape instead of a bare passthrough object, documenting the input contract at the schema layer (the SSOT for request shape). Each sub-object is optional — omitting it leaves existing consent untouched (see the downgrade guard above).
+
+# [5.2.15] - 2026-05-28
+
+### Changed
+
+- **Standardized the GitHub token env var `GITHUB_TOKEN` → `GH_TOKEN`** across the entire repo, to match the convention used in all other ITW repos. Updated every GitHub-backed route and action (`admin/post`, `content/post`, `admin/repo/content`, `general/fetch-post`, `admin/write-repo-content`, `admin/edit-post`, `admin/create-post`, legacy `create-post`), the email image-host library (`libraries/email/generators/lib/image-host.js`), the CLI deprecated-env notice, the `templates/_.env` scaffold, the `docs/marketing-campaigns.md` reference, and all related test files. This is a hard rename with no fallback — any environment (CI, prod, local `.env`) that still sets `GITHUB_TOKEN` must switch to `GH_TOKEN` for the GitHub-backed routes to work.
+
 # [5.2.14] - 2026-05-28
 
 ### Removed

package/docs/consent.md

@@ -67,16 +67,19 @@ There are four places where consent gets recorded or updated. All four converge
 }
 ```
 
-`buildConsentRecord(assistant, settings.consent)` translates this into the canonical user-doc shape:
+`buildConsentRecord(assistant, settings.consent, creationTime, existingConsent)` translates this into the canonical user-doc shape:
 
-- `legal.granted: true` → `legal.status = 'granted'`, `grantedAt` populated with `source: 'signup'` + **server timestamp** + server-detected IP + exact label text.
+- `legal.granted: true` → `legal.status = 'granted'`, `grantedAt` populated with `source: 'signup'` + **timestamp from Auth `creationTime`** + server-detected IP + exact label text.
 - `marketing.granted: false` → `marketing.status = 'revoked'`, `grantedAt` all-null, `revokedAt` populated with `source: 'signup'`. (Records the explicit decline.)
-- Missing `consent` block (legacy client) → both default to `'revoked'`.
 
-**Server time is authoritative.** Client-supplied timestamps are ignored — defends against clock manipulation by malicious clients.
+**Timestamps come from Firebase Auth `creationTime`,** not request time, so `consent.grantedAt` matches `metadata.created` (the OMEGA user migration treats `metadata.created` as the SSOT and reconciles `grantedAt` against it — stamping from request time made every new signup drift by a few seconds and get re-fixed on the next migration run).
+
+**Server-derived time is authoritative.** Client-supplied timestamps are ignored — defends against clock manipulation by malicious clients.
 
 **Strict boolean check.** Only `granted === true` counts as granted. `'true'`, `1`, or other truthy values are rejected.
 
+**Never downgrades an existing grant (data-loss guard).** A legacy account — one signed up before the `flags.signupProcessed` completion flow existed, so its flag was never set — re-fires `/user/signup` on every page load until the flag flips. Its consent was captured months ago and is long gone from `localStorage`, so the payload arrives empty. Without protection, `buildConsentRecord` would compute `'revoked'` and the `{ merge: true }` write would wipe the consent the user actually granted. The guard reads the existing doc's consent (`existingConsent`) and **preserves any already-`granted` status when the incoming payload does not explicitly re-grant it.** A genuine new grant still applies; an at-signup decline with no prior grant still records the decline. (The primary mitigation is OMEGA migration Fix 4f, which backfills `flags.signupProcessed: true` for established accounts so they never re-fire; this guard is the backstop for the deploy-before-migration gap.)
+
 **Marketing sync gating.** After writing the user doc, the route checks `userRecord.consent.marketing.status === 'granted'` before calling `mailer.sync(uid)`. Declining the marketing checkbox means the user is created normally, gets transactional emails, but is NEVER added to SendGrid / Beehiiv marketing lists.
 
 ### 2. Account-page toggle (Phase D)

package/docs/marketing-campaigns.md

@@ -208,7 +208,7 @@ Templates add their own fields on top (e.g. classic adds `intro` + `sections`; f
 
 This means the newsletter is never "stuck" — even with Beehiiv disabled or failing, you get an actionable email pointing to ready-to-paste assets. The alert is best-effort; failure to send is logged but does not block the Firestore campaign-doc write.
 
-Requires `GITHUB_TOKEN` env var (org-scoped, write access to `newsletter-assets`). Without it, the cron's HTML/image upload calls throw and the run aborts.
+Requires `GH_TOKEN` env var (org-scoped, write access to `newsletter-assets`). Without it, the cron's HTML/image upload calls throw and the run aborts.
 
 ## Iteration test asset story
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.2.14",
+  "version": "5.2.16",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {

package/src/cli/commands/setup-tests/env-runtime-config-deprecated.js

@@ -36,7 +36,7 @@ class EnvRuntimeConfigDeprecatedTest extends BaseTest {
       '  The new format uses individual environment variables:\n' +
       '    BACKEND_MANAGER_KEY=\n' +
       '    BACKEND_MANAGER_NAMESPACE=\n' +
-      '    GITHUB_TOKEN=\n' +
+      '    GH_TOKEN=\n' +
       '  Please update your .env file manually and remove RUNTIME_CONFIG.'
     );
   }

package/src/manager/functions/_legacy/admin/create-post.js

@@ -55,7 +55,7 @@ let Module = {
           return new Promise(async function(resolve, reject) {
             let finalPath = poster.removeDirDot(meta.finalPath);
             let tempPath = (meta.tempPath);
-            await createFile(self.Manager.config?.github?.user, repoInfo.user, repoInfo.name, process.env.GITHUB_TOKEN, finalPath, await poster.readImage(tempPath))
+            await createFile(self.Manager.config?.github?.user, repoInfo.user, repoInfo.name, process.env.GH_TOKEN, finalPath, await poster.readImage(tempPath))
             .catch((e) => {
               // console.log('---CAUGHT 1', e);
             })
@@ -66,7 +66,7 @@ let Module = {
         let finalPost = await poster.create(assistant.request.data);
 
         // Save post OR commit
-        await createFile(self.Manager.config?.github?.user, repoInfo.user, repoInfo.name, process.env.GITHUB_TOKEN, poster.removeDirDot(finalPost.path), finalPost.content)
+        await createFile(self.Manager.config?.github?.user, repoInfo.user, repoInfo.name, process.env.GH_TOKEN, poster.removeDirDot(finalPost.path), finalPost.content)
         .catch((e) => {
           response.status = 400;
           response.error = new Error('Failed to post: ' + e);

package/src/manager/functions/core/actions/api/admin/create-post.js

@@ -39,7 +39,7 @@ Module.prototype.main = function () {
 
       // Setup Octokit
       self.octokit = new Octokit({
-        auth: process.env.GITHUB_TOKEN,
+        auth: process.env.GH_TOKEN,
       });
 
       // Check for required values

package/src/manager/functions/core/actions/api/admin/edit-post.js

@@ -25,7 +25,7 @@ Module.prototype.main = function () {
       }
 
       // Check for GitHub configuration
-      if (!process.env.GITHUB_TOKEN) {
+      if (!process.env.GH_TOKEN) {
         return reject(assistant.errorify(`GitHub API key not configured.`, {code: 500}));
       }
 
@@ -42,7 +42,7 @@ Module.prototype.main = function () {
 
       // Setup Octokit
       self.octokit = new Octokit({
-        auth: process.env.GITHUB_TOKEN,
+        auth: process.env.GH_TOKEN,
       });
 
       // Check for required values

package/src/manager/functions/core/actions/api/admin/write-repo-content.js

@@ -25,7 +25,7 @@ Module.prototype.main = function () {
       }
 
       // Check for GitHub configuration
-      if (!process.env.GITHUB_TOKEN) {
+      if (!process.env.GH_TOKEN) {
         return reject(assistant.errorify(`GitHub API key not configured.`, {code: 500}));
       }
 
@@ -42,7 +42,7 @@ Module.prototype.main = function () {
 
       // Setup Octokit
       self.octokit = new Octokit({
-        auth: process.env.GITHUB_TOKEN,
+        auth: process.env.GH_TOKEN,
       });
 
       // Check for required values

package/src/manager/functions/core/actions/api/general/fetch-post.js

@@ -14,7 +14,7 @@ Module.prototype.main = function () {
 
   return new Promise(async function(resolve, reject) {
     // Check for GitHub configuration
-    if (!process.env.GITHUB_TOKEN) {
+    if (!process.env.GH_TOKEN) {
       return reject(assistant.errorify(`GitHub API key not configured.`, {code: 500}));
     }
 
@@ -24,7 +24,7 @@ Module.prototype.main = function () {
 
     // Setup Octokit
     const octokit = new Octokit({
-      auth: process.env.GITHUB_TOKEN,
+      auth: process.env.GH_TOKEN,
     });
 
     // Setup options

package/src/manager/libraries/email/generators/lib/image-host.js

@@ -59,7 +59,7 @@ const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
  * @param {string} [args.subject] - Newsletter subject. Embedded in the commit message so
  *                                  `git log` reads as a human-browseable history.
  * @param {string} [args.commitMessage] - Full override of the default commit message
- * @param {string} [args.token] - GitHub token (defaults to process.env.GITHUB_TOKEN)
+ * @param {string} [args.token] - GitHub token (defaults to process.env.GH_TOKEN)
  * @param {object} [args.assistant] - logger
  * @returns {Promise<{ urls: string[], paths: string[], htmlUrl?: string, htmlPath?: string, folderUrl: string, commitSha: string }>}
  */
@@ -76,10 +76,10 @@ async function uploadAssets({ images, html, markdown, summary, brandId, campaign
   validateBrandId(brandId);
   validateCampaignId(campaignId);
 
-  const githubToken = token || process.env.GITHUB_TOKEN;
+  const githubToken = token || process.env.GH_TOKEN;
 
   if (!githubToken) {
-    throw new Error('image-host: GITHUB_TOKEN env var (or token arg) is required');
+    throw new Error('image-host: GH_TOKEN env var (or token arg) is required');
   }
 
   const log = (msg) => assistant?.log ? assistant.log(`[image-host] ${msg}`) : null;

package/src/manager/routes/admin/post/post.js

@@ -37,7 +37,7 @@ module.exports = async ({ assistant, Manager, user, settings, analytics }) => {
   }
 
   // Check for GitHub configuration
-  if (!process.env.GITHUB_TOKEN) {
+  if (!process.env.GH_TOKEN) {
     return assistant.respond('GitHub API key not configured.', { code: 500 });
   }
 
@@ -52,7 +52,7 @@ module.exports = async ({ assistant, Manager, user, settings, analytics }) => {
 
   // Setup Octokit
   const octokit = new Octokit({
-    auth: process.env.GITHUB_TOKEN,
+    auth: process.env.GH_TOKEN,
   });
 
   // Check for required values

package/src/manager/routes/admin/post/put.js

@@ -20,7 +20,7 @@ module.exports = async ({ assistant, Manager, user, settings, analytics }) => {
   }
 
   // Check for GitHub configuration
-  if (!process.env.GITHUB_TOKEN) {
+  if (!process.env.GH_TOKEN) {
     return assistant.respond('GitHub API key not configured.', { code: 500 });
   }
 
@@ -35,7 +35,7 @@ module.exports = async ({ assistant, Manager, user, settings, analytics }) => {
 
   // Setup Octokit
   const octokit = new Octokit({
-    auth: process.env.GITHUB_TOKEN,
+    auth: process.env.GH_TOKEN,
   });
 
   // Check for required values

package/src/manager/routes/admin/repo/content/post.js

@@ -17,7 +17,7 @@ module.exports = async ({ assistant, Manager, user, settings, analytics }) => {
   }
 
   // Check for GitHub configuration
-  if (!process.env.GITHUB_TOKEN) {
+  if (!process.env.GH_TOKEN) {
     return assistant.respond('GitHub API key not configured.', { code: 500 });
   }
 
@@ -31,7 +31,7 @@ module.exports = async ({ assistant, Manager, user, settings, analytics }) => {
 
   // Setup Octokit
   const octokit = new Octokit({
-    auth: process.env.GITHUB_TOKEN,
+    auth: process.env.GH_TOKEN,
   });
 
   // Check for required values

package/src/manager/routes/content/post/get.js

@@ -8,7 +8,7 @@ const { parse } = require('yaml');
 module.exports = async ({ assistant, Manager, settings, analytics }) => {
 
   // Check for GitHub configuration
-  if (!process.env.GITHUB_TOKEN) {
+  if (!process.env.GH_TOKEN) {
     return assistant.respond('GitHub API key not configured.', { code: 500 });
   }
 
@@ -18,7 +18,7 @@ module.exports = async ({ assistant, Manager, settings, analytics }) => {
 
   // Setup Octokit
   const octokit = new Octokit({
-    auth: process.env.GITHUB_TOKEN,
+    auth: process.env.GH_TOKEN,
   });
 
   // Check for required parameters

package/src/manager/routes/user/signup/post.js

@@ -61,7 +61,7 @@ module.exports = async ({ assistant, user, settings, libraries }) => {
   // 4. Gather all data, then write once
   const email = user.auth.email;
   const inferred = await inferUserContact(assistant, email);
-  const userRecord = buildUserRecord(assistant, settings, inferred, authUser.metadata.creationTime);
+  const userRecord = buildUserRecord(assistant, settings, inferred, authUser.metadata.creationTime, userDoc);
 
   assistant.log(`signup(): Writing user record for ${uid}`, userRecord);
 
@@ -113,15 +113,10 @@ async function pollForUserDoc(assistant, uid) {
 /**
  * Build the full user record: client details, attribution, and inferred contact
  */
-function buildUserRecord(assistant, settings, inferred, creationTime) {
+function buildUserRecord(assistant, settings, inferred, creationTime, existingDoc) {
   const Manager = assistant.Manager;
   const attribution = settings.attribution;
 
-  // Legacy support: if affiliateCode exists, normalize to new format
-  if (settings.affiliateCode && !attribution.affiliate?.code) {
-    attribution.affiliate = { code: settings.affiliateCode };
-  }
-
   const record = {
     flags: {
       signupProcessed: true,
@@ -138,7 +133,7 @@ function buildUserRecord(assistant, settings, inferred, creationTime) {
       },
     },
     attribution: attribution || {},
-    consent: buildConsentRecord(assistant, settings.consent, creationTime),
+    consent: buildConsentRecord(assistant, settings.consent, creationTime, existingDoc?.consent),
     metadata: Manager.Metadata().set({ tag: 'user/signup' }),
   };
 
@@ -184,7 +179,7 @@ function buildUserRecord(assistant, settings, inferred, creationTime) {
  * record what the client sent, but the route will not have reached this point in practice
  * (the signup-form HTML5-requires the legal checkbox).
  */
-function buildConsentRecord(assistant, clientConsent, creationTime) {
+function buildConsentRecord(assistant, clientConsent, creationTime, existingConsent) {
   const consent = clientConsent || {};
   const ip = assistant.request.geolocation?.ip || null;
 
@@ -202,7 +197,7 @@ function buildConsentRecord(assistant, clientConsent, creationTime) {
   const legalGranted = consent.legal?.granted === true;
   const legalText = typeof consent.legal?.text === 'string' ? consent.legal.text : null;
 
-  const legal = legalGranted
+  let legal = legalGranted
     ? {
       status: 'granted',
       grantedAt: { timestamp, timestampUNIX, source: 'signup', ip, text: legalText },
@@ -216,7 +211,7 @@ function buildConsentRecord(assistant, clientConsent, creationTime) {
   const marketingGranted = consent.marketing?.granted === true;
   const marketingText = typeof consent.marketing?.text === 'string' ? consent.marketing.text : null;
 
-  const marketing = marketingGranted
+  let marketing = marketingGranted
     ? {
       status: 'granted',
       grantedAt: { timestamp, timestampUNIX, source: 'signup', ip, text: marketingText },
@@ -229,6 +224,19 @@ function buildConsentRecord(assistant, clientConsent, creationTime) {
       revokedAt: { timestamp, timestampUNIX, source: 'signup', ip, text: null },
     };
 
+  // Never DOWNGRADE an existing granted consent. A legacy account (signed up before this
+  // flow, flags.signupProcessed never set) re-fires /user/signup on page load with empty
+  // consent — which would compute status 'revoked' above and, on a {merge:true} write, wipe
+  // out the consent they actually granted months ago. If the existing doc already has a
+  // consent granted and the incoming payload doesn't explicitly re-grant it, preserve the
+  // existing record. A genuine new grant or an at-signup decline (no prior grant) still applies.
+  if (existingConsent?.legal?.status === 'granted' && legal.status !== 'granted') {
+    legal = existingConsent.legal;
+  }
+  if (existingConsent?.marketing?.status === 'granted' && marketing.status !== 'granted') {
+    marketing = existingConsent.marketing;
+  }
+
   assistant.log(`buildConsentRecord: legal=${legal.status}, marketing=${marketing.status} (raw input legal.granted=${consent.legal?.granted}, marketing.granted=${consent.marketing?.granted})`);
 
   return { legal, marketing };
@@ -262,9 +270,7 @@ async function inferUserContact(assistant, email) {
  */
 async function processAffiliate(assistant, uid, email, settings) {
   const { admin } = assistant.Manager.libraries;
-  const affiliateCode = settings.attribution?.affiliate?.code
-    || settings.affiliateCode
-    || null;
+  const affiliateCode = settings.attribution?.affiliate?.code || null;
 
   if (!affiliateCode) {
     return;

package/src/manager/schemas/user/signup/post.js

@@ -4,11 +4,6 @@ module.exports = ({ user }) => ({
     default: user?.auth?.uid,
     required: false,
   },
-  affiliateCode: {
-    types: ['string'],
-    default: undefined,
-    required: false,
-  },
   attribution: {
     types: ['object'],
     default: {},
@@ -19,9 +14,18 @@ module.exports = ({ user }) => ({
     default: {},
     required: false,
   },
+  // Consent decision captured at signup. Each sub-object is OPTIONAL — if the client omits
+  // `legal`/`marketing` (e.g. a legacy account re-firing /user/signup on page load with no
+  // fresh consent), the route leaves that consent untouched rather than downgrading it.
+  // When present, `granted` is the decision and `text` is the exact copy shown to the user.
   consent: {
-    types: ['object'],
-    default: {},
-    required: false,
+    legal: {
+      granted: { types: ['boolean'], required: false },
+      text: { types: ['string'], required: false },
+    },
+    marketing: {
+      granted: { types: ['boolean'], required: false },
+      text: { types: ['string'], required: false },
+    },
   },
 });

package/src/test/test-accounts.js

@@ -193,6 +193,18 @@ const STATIC_ACCOUNTS = {
       subscription: { product: { id: 'basic' }, status: 'active' },
     },
   },
+  // Used to verify the never-downgrade guard: the test seeds this account's doc with already-
+  // granted consent, then re-fires /user/signup with an empty consent payload and asserts the
+  // grant is preserved (not flipped to revoked). Dedicated account so the seeded state is isolated.
+  'consent-preserve': {
+    id: 'consent-preserve',
+    uid: '_test-consent-preserve',
+    email: '_test.consent-preserve@{domain}',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'basic' }, status: 'active' },
+    },
+  },
 };
 
 /**

package/templates/_.env

@@ -1,4 +1,7 @@
 # ========== Default Values ==========
+# GitHub
+GH_TOKEN=""
+
 # Backend Manager
 BACKEND_MANAGER_KEY=""
 BACKEND_MANAGER_WEBHOOK_KEY=""
@@ -6,9 +9,6 @@ BACKEND_MANAGER_NAMESPACE=""
 BACKEND_MANAGER_OPENAI_API_KEY=""
 BACKEND_MANAGER_ANTHROPIC_API_KEY=""
 
-# GitHub
-GITHUB_TOKEN=""
-
 # AI
 OPENAI_API_KEY=""
 ANTHROPIC_API_KEY=""

package/test/functions/admin/edit-post.js

@@ -112,7 +112,7 @@ module.exports = {
       name: 'create-test-post',
       auth: 'admin',
       timeout: 60000,
-      skip: !process.env.GITHUB_TOKEN ? 'GITHUB_TOKEN env var not set' : false,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
 
       async run({ assert, state, config }) {
         if (!config.github?.repo_website) {
@@ -120,7 +120,7 @@ module.exports = {
           return;
         }
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Parse owner/repo from githubRepoWebsite
         const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);
@@ -181,7 +181,7 @@ module.exports = {
       name: 'verify-file-exists',
       auth: 'admin',
       timeout: 30000,
-      skip: !process.env.GITHUB_TOKEN ? 'GITHUB_TOKEN env var not set' : false,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
 
       async run({ assert, state, config }) {
         if (!state.postPath) {
@@ -190,7 +190,7 @@ module.exports = {
 
         state.postUrl = `https://${config.domain}/blog/${state.postSlug}`;
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Verify the file exists via direct API (not code search)
         const { data: fileData } = await octokit.rest.repos.getContent({
@@ -211,7 +211,7 @@ module.exports = {
       name: 'edit-test-post',
       auth: 'admin',
       timeout: 60000,
-      skip: !process.env.GITHUB_TOKEN ? 'GITHUB_TOKEN env var not set' : false,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
 
       async run({ http, assert, state }) {
         if (!state.postUrl) {
@@ -244,7 +244,7 @@ module.exports = {
       name: 'verify-edit',
       auth: 'admin',
       timeout: 30000,
-      skip: !process.env.GITHUB_TOKEN ? 'GITHUB_TOKEN env var not set' : false,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
 
       async run({ assert, state }) {
         if (!state.postPath || state.editSkipped) {
@@ -252,7 +252,7 @@ module.exports = {
           return;
         }
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Fetch the file directly from GitHub
         const { data: fileData } = await octokit.rest.repos.getContent({
@@ -309,11 +309,11 @@ module.exports = {
       timeout: 60000,
 
       async run({ state }) {
-        if (!process.env.GITHUB_TOKEN || !state.postPath) {
+        if (!process.env.GH_TOKEN || !state.postPath) {
           return;
         }
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Get the current SHA (may have changed after edit)
         try {

package/test/functions/admin/write-repo-content.js

@@ -4,7 +4,7 @@
  * Writes arbitrary content to a GitHub repository
  * Requires admin/blogger role, GitHub API key, and repo_website config
  *
- * IMPORTANT: These tests require GITHUB_TOKEN and github.repo_website to be configured.
+ * IMPORTANT: These tests require GH_TOKEN and github.repo_website to be configured.
  * If GitHub is not configured, the tests will fail.
  *
  * This is a suite because we need to clean up created files and cancel workflows after tests.
@@ -155,11 +155,11 @@ module.exports = {
       timeout: 60000,
 
       async run({ state, config }) {
-        if (!process.env.GITHUB_TOKEN || !config.github?.repo_website) {
+        if (!process.env.GH_TOKEN || !config.github?.repo_website) {
           return;
         }
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Parse owner/repo from githubRepoWebsite (e.g., 'https://github.com/owner/repo')
         const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);

package/test/routes/admin/create-post.js

@@ -111,8 +111,8 @@ module.exports = {
       skip: !process.env.TEST_EXTENDED_MODE ? 'TEST_EXTENDED_MODE env var not set' : false,
 
       async run({ http, assert, state, config }) {
-        if (!process.env.GITHUB_TOKEN) {
-          assert.fail('GITHUB_TOKEN env var not set');
+        if (!process.env.GH_TOKEN) {
+          assert.fail('GH_TOKEN env var not set');
           return;
         }
 
@@ -167,7 +167,7 @@ module.exports = {
           return; // Previous test didn't run
         }
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Fetch the committed post from GitHub
         const { data: fileData } = await octokit.rest.repos.getContent({
@@ -203,7 +203,7 @@ module.exports = {
           return; // Previous test didn't run
         }
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
         const imageDir = `src/assets/images/blog/post-${state.postId}/`;
 
         // List committed images and pick the header (matches the slugified URL "bem-test-create-post")
@@ -285,11 +285,11 @@ module.exports = {
       timeout: 60000,
 
       async run({ state }) {
-        if (!process.env.GITHUB_TOKEN || !state.postPath) {
+        if (!process.env.GH_TOKEN || !state.postPath) {
           return;
         }
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Delete the test post
         try {

package/test/routes/admin/post.js

@@ -114,7 +114,7 @@ module.exports = {
       name: 'create-test-post',
       auth: 'admin',
       timeout: 60000,
-      skip: !process.env.GITHUB_TOKEN ? 'GITHUB_TOKEN env var not set' : false,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
 
       async run({ assert, state, config }) {
         if (!config.github?.repo_website) {
@@ -122,7 +122,7 @@ module.exports = {
           return;
         }
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Parse owner/repo from githubRepoWebsite
         const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);
@@ -183,7 +183,7 @@ module.exports = {
       name: 'verify-file-exists',
       auth: 'admin',
       timeout: 30000,
-      skip: !process.env.GITHUB_TOKEN ? 'GITHUB_TOKEN env var not set' : false,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
 
       async run({ assert, state, config }) {
         if (!state.postPath) {
@@ -192,7 +192,7 @@ module.exports = {
 
         state.postUrl = `https://${config.domain}/blog/${state.postSlug}`;
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Verify the file exists via direct API (not code search)
         const { data: fileData } = await octokit.rest.repos.getContent({
@@ -213,7 +213,7 @@ module.exports = {
       name: 'edit-test-post',
       auth: 'admin',
       timeout: 60000,
-      skip: !process.env.GITHUB_TOKEN ? 'GITHUB_TOKEN env var not set' : false,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
 
       async run({ http, assert, state }) {
         if (!state.postUrl) {
@@ -246,7 +246,7 @@ module.exports = {
       name: 'verify-edit',
       auth: 'admin',
       timeout: 30000,
-      skip: !process.env.GITHUB_TOKEN ? 'GITHUB_TOKEN env var not set' : false,
+      skip: !process.env.GH_TOKEN ? 'GH_TOKEN env var not set' : false,
 
       async run({ assert, state }) {
         if (!state.postPath || state.editSkipped) {
@@ -254,7 +254,7 @@ module.exports = {
           return;
         }
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Fetch the file directly from GitHub
         const { data: fileData } = await octokit.rest.repos.getContent({
@@ -311,11 +311,11 @@ module.exports = {
       timeout: 60000,
 
       async run({ state }) {
-        if (!process.env.GITHUB_TOKEN || !state.postPath) {
+        if (!process.env.GH_TOKEN || !state.postPath) {
           return;
         }
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Get the current SHA (may have changed after edit)
         try {

package/test/routes/admin/repo-content.js

@@ -4,7 +4,7 @@
  * Writes arbitrary content to a GitHub repository
  * Requires admin/blogger role, GitHub API key, and repo_website config
  *
- * IMPORTANT: These tests require GITHUB_TOKEN and github.repo_website to be configured.
+ * IMPORTANT: These tests require GH_TOKEN and github.repo_website to be configured.
  * If GitHub is not configured, the tests will fail.
  *
  * This is a suite because we need to clean up created files and cancel workflows after tests.
@@ -155,11 +155,11 @@ module.exports = {
       timeout: 60000,
 
       async run({ state, config }) {
-        if (!process.env.GITHUB_TOKEN || !config.github?.repo_website) {
+        if (!process.env.GH_TOKEN || !config.github?.repo_website) {
           return;
         }
 
-        const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
+        const octokit = new Octokit({ auth: process.env.GH_TOKEN });
 
         // Parse owner/repo from githubRepoWebsite (e.g., 'https://github.com/owner/repo')
         const repoMatch = config.github?.repo_website.match(/github\.com\/([^/]+)\/([^/]+)/);

package/test/routes/user/signup.js

@@ -347,6 +347,95 @@ module.exports = {
       },
     },
 
+    // --- Consent downgrade-protection tests ---
+    // Guards against data loss when a LEGACY account (signed up before the flags.signupProcessed
+    // flow existed, so flag never set) re-fires /user/signup on page load. Its localStorage
+    // consent is long gone, so the payload is empty — without the guard, buildConsentRecord
+    // would compute 'revoked' and the {merge:true} write would wipe the consent the user
+    // actually granted months ago. The guard preserves any existing 'granted' status.
+    {
+      name: 'consent-empty-payload-preserves-existing-grant',
+      async run({ http, firestore, assert, accounts }) {
+        const uid = accounts['consent-preserve'].uid;
+
+        // Seed the doc as an established account whose consent is already granted (as a real
+        // legacy signup would be after the OMEGA migration backfilled consent). flags is left
+        // at the schema default (signupProcessed: false) to mimic the legacy state exactly.
+        // merge:true — preserve the runner-provisioned auth.uid (pollForUserDoc needs it).
+        await firestore.set(`users/${uid}`, {
+          consent: {
+            legal: {
+              status: 'granted',
+              grantedAt: { timestamp: '2025-01-01T00:00:00.000Z', timestampUNIX: 1735689600, source: 'signup', ip: null, text: 'Legacy legal grant' },
+            },
+            marketing: {
+              status: 'granted',
+              grantedAt: { timestamp: '2025-01-01T00:00:00.000Z', timestampUNIX: 1735689600, source: 'signup', ip: null, text: 'Legacy marketing grant' },
+              revokedAt: { timestamp: null, timestampUNIX: null, source: null, ip: null, text: null },
+            },
+          },
+          flags: { signupProcessed: false },
+        }, { merge: true });
+
+        // Re-fire signup with NO consent payload (the legacy page-load case).
+        const signupResponse = await http.as('consent-preserve').post('user/signup', {});
+        assert.isSuccess(signupResponse, `Signup should succeed: ${JSON.stringify(signupResponse, null, 2)}`);
+
+        const userDoc = await firestore.get(`users/${uid}`);
+
+        // CRITICAL: the prior grants must survive — NOT be downgraded to revoked.
+        assert.equal(userDoc?.consent?.legal?.status, 'granted', 'legal.status must stay granted (not downgraded by empty payload)');
+        assert.equal(userDoc?.consent?.legal?.grantedAt?.text, 'Legacy legal grant', 'legal grantedAt must be the preserved original, not wiped');
+        assert.equal(userDoc?.consent?.legal?.grantedAt?.timestampUNIX, 1735689600, 'legal grantedAt timestamp must be preserved');
+
+        assert.equal(userDoc?.consent?.marketing?.status, 'granted', 'marketing.status must stay granted (not downgraded by empty payload)');
+        assert.equal(userDoc?.consent?.marketing?.grantedAt?.text, 'Legacy marketing grant', 'marketing grantedAt must be the preserved original');
+        // No spurious revokedAt should have been stamped over the preserved grant.
+        assert.equal(userDoc?.consent?.marketing?.revokedAt?.timestamp, null, 'marketing revokedAt must stay null (no decline was recorded)');
+
+        // signupProcessed should now be flipped true by this run.
+        assert.equal(userDoc?.flags?.signupProcessed, true, 'signupProcessed should be set true after the run');
+      },
+    },
+    {
+      name: 'consent-explicit-decline-does-not-downgrade-existing-grant',
+      async run({ http, firestore, assert, accounts }) {
+        const uid = accounts['consent-preserve'].uid;
+
+        // Re-seed: granted marketing + UNSET signupProcessed so the route processes this call.
+        // Then send a payload that explicitly DECLINES marketing. The guard must still preserve
+        // the existing grant — only an explicit RE-GRANT may overwrite; a decline-over-grant on
+        // the signup path is treated as a non-grant and must not wipe a prior consent.
+        // merge:true — preserve the runner-provisioned auth.uid (pollForUserDoc needs it).
+        await firestore.set(`users/${uid}`, {
+          consent: {
+            marketing: {
+              status: 'granted',
+              grantedAt: { timestamp: '2025-01-01T00:00:00.000Z', timestampUNIX: 1735689600, source: 'signup', ip: null, text: 'Prior marketing grant' },
+              revokedAt: { timestamp: null, timestampUNIX: null, source: null, ip: null, text: null },
+            },
+          },
+          flags: { signupProcessed: false },
+        }, { merge: true });
+
+        const signupResponse = await http.as('consent-preserve').post('user/signup', {
+          consent: {
+            legal: { granted: true, text: 'Legal grant on re-fire' },
+            marketing: { granted: false, text: 'Declining marketing' },
+          },
+        });
+        assert.isSuccess(signupResponse, `Signup should succeed: ${JSON.stringify(signupResponse, null, 2)}`);
+
+        const userDoc = await firestore.get(`users/${uid}`);
+
+        // Legal newly granted this call.
+        assert.equal(userDoc?.consent?.legal?.status, 'granted', 'legal.status should be granted from this call');
+        // Marketing was already granted; an explicit decline must NOT downgrade it.
+        assert.equal(userDoc?.consent?.marketing?.status, 'granted', 'marketing.status must stay granted (decline cannot downgrade an existing grant on signup path)');
+        assert.equal(userDoc?.consent?.marketing?.grantedAt?.text, 'Prior marketing grant', 'marketing grant must be the preserved original');
+      },
+    },
+
     // --- Auth rejection test (at end per convention) ---
     {
       name: 'unauthenticated-rejected',