create-ailk 0.11.2 → 0.11.4

package/templates/apps/web/lib/__tests__/account-config.test.ts

@@ -0,0 +1,285 @@
+/**
+ * Tests for lib/account-config.ts — the base account area's contributions
+ * (#7429, spec 7423 U3 · AC-6; amended by #7448, U5 · D6a/D8a/D9).
+ *
+ * Covers:
+ *   1. The three contribution arrays are exported; the base area ships no
+ *      Settings section (modules add those).
+ *   2. The base Inbox kinds are exactly `result` and `purchase` — rows of
+ *      the Recents and All tabs; none fills Scheduled (the old Upcoming).
+ *   3. `email-unverified` and `payment-due` are For-you sources — needs-you
+ *      items with an Open action to User settings, never Inbox rows.
+ *   4. Each contribution maps its existing read: the session for
+ *      `email-unverified`, `waitlistSignups.me` per configured key for
+ *      `result`, `flowCheckouts.me` for `purchase`, and `subscription.me`'s
+ *      own `actionRequired` for `payment-due`.
+ *   5. A 404 — or a 401/403 while the email is unverified — is "nothing for
+ *      this caller" (`[]`); any other failed read rejects, a 401/403 for a
+ *      verified email included, so the Inbox can show an error row (D12).
+ */
+
+const mockSignupMe = jest.fn();
+const mockCheckoutsMe = jest.fn();
+const mockSubscriptionMe = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  waitlistSignups: { me: (...args: unknown[]) => mockSignupMe(...args) },
+  flowCheckouts: { me: (...args: unknown[]) => mockCheckoutsMe(...args) },
+  subscription: { me: (...args: unknown[]) => mockSubscriptionMe(...args) },
+}));
+
+import type {
+  AccountContext,
+  AccountForYouSource,
+  AccountInboxKind,
+} from "@working-theory/templates/account";
+
+import {
+  accountExperimentKeys,
+  accountForYouSources,
+  accountInboxKinds,
+  accountSettingsSections,
+} from "../account-config";
+
+const INIT = { headers: { cookie: "session=abc" } };
+
+function ctx(overrides: Partial<AccountContext["user"]> = {}): AccountContext {
+  return {
+    locale: "en",
+    user: {
+      name: "Ada",
+      email: "ada@example.com",
+      emailVerified: true,
+      ...overrides,
+    },
+    t: (key) => `t:${key}`,
+    init: INIT,
+  };
+}
+
+function kind(id: string): AccountInboxKind {
+  const found = accountInboxKinds.find((k) => k.kind === id);
+  if (!found) throw new Error(`no base kind ${id}`);
+  return found;
+}
+
+function source(id: string): AccountForYouSource {
+  const found = accountForYouSources.find((s) => s.id === id);
+  if (!found) throw new Error(`no base For-you source ${id}`);
+  return found;
+}
+
+const SIGNUP = {
+  experimentKey: "diag",
+  waitlistKey: "early",
+  completedAt: "2026-09-01T10:00:00.000Z",
+  tier: "gold",
+  score: 42,
+  aeoScore: null,
+  answers: { q3: null },
+};
+
+const CHECKOUT = {
+  id: "flchk_1",
+  flowSlug: "buy",
+  experimentKey: "diag",
+  offerKey: "pro",
+  status: "completed",
+  amountMinor: 4900,
+  currency: "USD",
+  period: "month",
+  completedAt: "2026-09-02T10:00:00.000Z",
+  createdAt: "2026-09-02T09:00:00.000Z",
+};
+
+const ok = <T>(body: T) => ({ ok: true as const, body });
+const fail = (status: number) => ({ ok: false as const, status, body: null });
+
+afterEach(() => {
+  jest.clearAllMocks();
+  accountExperimentKeys.length = 0;
+});
+
+describe("account-config exports (AC-6)", () => {
+  it("exports the three contribution arrays", () => {
+    expect(Array.isArray(accountInboxKinds)).toBe(true);
+    expect(accountSettingsSections).toEqual([]);
+    expect(Array.isArray(accountForYouSources)).toBe(true);
+  });
+
+  it("ships exactly the two base Inbox kinds, both Recents rows (D6a, D9)", () => {
+    expect(accountInboxKinds.map((k) => [k.kind, k.section])).toEqual([
+      ["result", "updates"],
+      ["purchase", "updates"],
+    ]);
+    // Nothing in the base area fills Scheduled (the old Upcoming), and no
+    // Inbox row asks for a decision — that is the For-you panel's job.
+    expect(accountInboxKinds.some((k) => k.section === "upcoming")).toBe(false);
+    expect(accountInboxKinds.some((k) => k.section === "needs-you")).toBe(false);
+  });
+
+  it("ships email-unverified and payment-due as For-you sources, not Inbox kinds (D9 as amended)", () => {
+    expect(accountForYouSources.map((s) => s.id)).toEqual([
+      "email-unverified",
+      "payment-due",
+    ]);
+    const kinds = accountInboxKinds.map((k) => k.kind);
+    expect(kinds).not.toContain("email-unverified");
+    expect(kinds).not.toContain("payment-due");
+  });
+
+  it("gives every kind a unique id — the `[kind]` route segment", () => {
+    const ids = accountInboxKinds.map((k) => k.kind);
+    expect(new Set(ids).size).toBe(ids.length);
+  });
+
+  it("names every kind by a message key, never a literal", () => {
+    for (const k of accountInboxKinds)
+      expect(k.label).toMatch(/^[a-z]+(\.[A-Za-z]+)+$/);
+  });
+});
+
+describe("email-unverified — a For-you item from the session", () => {
+  it("is one needs-you item, opening User settings › General", async () => {
+    const items = await source("email-unverified").load(
+      ctx({ emailVerified: false }),
+    );
+    expect(items).toHaveLength(1);
+    expect(items[0]).toMatchObject({
+      id: "email-unverified",
+      type: { id: "email", label: "t:profile.email", tone: "needs-you" },
+      title: "t:profile.unverified",
+      action: { kind: "open", href: "/account/settings#general" },
+      dismissible: true,
+    });
+  });
+
+  it("is empty when the email is verified, and reads no API", async () => {
+    await expect(source("email-unverified").load(ctx())).resolves.toEqual([]);
+    expect(mockSignupMe).not.toHaveBeenCalled();
+    expect(mockCheckoutsMe).not.toHaveBeenCalled();
+    expect(mockSubscriptionMe).not.toHaveBeenCalled();
+  });
+});
+
+describe("result — waitlistSignups.me per accountExperimentKeys", () => {
+  it("reads each configured key with the forwarded init, skipping a 404", async () => {
+    accountExperimentKeys.push("diag", "other");
+    mockSignupMe.mockImplementation(async (key: string) =>
+      key === "diag" ? ok(SIGNUP) : fail(404),
+    );
+    const items = await kind("result").load(ctx());
+    expect(mockSignupMe).toHaveBeenCalledWith("diag", INIT);
+    expect(mockSignupMe).toHaveBeenCalledWith("other", INIT);
+    expect(items).toEqual([
+      { id: "diag", title: "diag", at: SIGNUP.completedAt, data: SIGNUP },
+    ]);
+  });
+
+  it("is empty with no configured key", async () => {
+    await expect(kind("result").load(ctx())).resolves.toEqual([]);
+    expect(mockSignupMe).not.toHaveBeenCalled();
+  });
+
+  it("rejects on a failed read", async () => {
+    accountExperimentKeys.push("diag");
+    mockSignupMe.mockResolvedValue(fail(500));
+    await expect(kind("result").load(ctx())).rejects.toThrow();
+  });
+});
+
+describe("purchase — flowCheckouts.me", () => {
+  it("is one item per checkout, at its completion time", async () => {
+    mockCheckoutsMe.mockResolvedValue(ok([CHECKOUT]));
+    const items = await kind("purchase").load(ctx());
+    expect(mockCheckoutsMe).toHaveBeenCalledWith(INIT);
+    expect(items).toEqual([
+      { id: "flchk_1", title: "pro", at: CHECKOUT.completedAt, data: CHECKOUT },
+    ]);
+  });
+
+  it("is empty on a 404", async () => {
+    mockCheckoutsMe.mockResolvedValue(fail(404));
+    await expect(kind("purchase").load(ctx())).resolves.toEqual([]);
+  });
+
+  it.each([401, 403])(
+    "is empty on a %i while the email is unverified",
+    async (status) => {
+      mockCheckoutsMe.mockResolvedValue(fail(status));
+      await expect(
+        kind("purchase").load(ctx({ emailVerified: false })),
+      ).resolves.toEqual([]);
+    },
+  );
+
+  it.each([401, 403])(
+    "rejects on a %i for a verified email",
+    async (status) => {
+      mockCheckoutsMe.mockResolvedValue(fail(status));
+      await expect(kind("purchase").load(ctx())).rejects.toMatchObject({
+        status,
+      });
+    },
+  );
+
+  it("rejects on a failed read", async () => {
+    mockCheckoutsMe.mockResolvedValue(fail(503));
+    await expect(kind("purchase").load(ctx())).rejects.toThrow();
+  });
+
+  it("details the checkout's fields", () => {
+    const item = {
+      id: "flchk_1",
+      title: "pro",
+      at: CHECKOUT.completedAt,
+      data: CHECKOUT,
+    };
+    const detail = kind("purchase").renderDetail(item, ctx());
+    expect(detail.status).toBe("completed");
+    expect(detail.fields?.items.map((i) => i.label)).toEqual([
+      "t:purchases.offer",
+      "t:purchases.amount",
+      "t:purchases.period",
+      "t:purchases.date",
+    ]);
+  });
+});
+
+describe("payment-due — a For-you item from subscription.me's actionRequired", () => {
+  const SUB = {
+    actionRequired: true,
+    status: "past_due",
+    accessRevokesAt: null,
+    portalAvailable: true,
+  };
+
+  it("is one needs-you item, opening User settings › Billing, when the API says action is required", async () => {
+    mockSubscriptionMe.mockResolvedValue(ok(SUB));
+    const items = await source("payment-due").load(ctx());
+    expect(mockSubscriptionMe).toHaveBeenCalledWith(INIT);
+    expect(items).toHaveLength(1);
+    expect(items[0]).toMatchObject({
+      id: "payment-due",
+      type: { id: "payment", label: "t:subscription.action", tone: "needs-you" },
+      title: "t:subscription.headline",
+      action: { kind: "open", href: "/account/settings#billing" },
+      dismissible: true,
+    });
+  });
+
+  it("is empty when it is not — the status is never re-derived", async () => {
+    mockSubscriptionMe.mockResolvedValue(ok({ ...SUB, actionRequired: false }));
+    await expect(source("payment-due").load(ctx())).resolves.toEqual([]);
+  });
+
+  it("is empty on a 404 (the commerce-disabled build)", async () => {
+    mockSubscriptionMe.mockResolvedValue(fail(404));
+    await expect(source("payment-due").load(ctx())).resolves.toEqual([]);
+  });
+
+  it("rejects on a failed read", async () => {
+    mockSubscriptionMe.mockResolvedValue(fail(500));
+    await expect(source("payment-due").load(ctx())).rejects.toThrow();
+  });
+});

package/templates/apps/web/lib/__tests__/auth-email.test.ts

@@ -1,5 +1,5 @@
 /**
- * @file auth-email.test.ts — Better Auth's three mail callbacks (#5962 § D3).
+ * @file auth-email.test.ts — Better Auth's mail callbacks (#5962 § D3, #7435).
  *
  * Written before the implementation. The transport is INJECTED, so nothing
  * here mocks an internal module and nothing here sends mail.
@@ -23,6 +23,8 @@
 import type { AuthEmailLog } from "../auth-email";
 import {
   buildAuthEmailRequest,
+  MAGIC_LINK_TTL_SECONDS,
+  makeMagicLinkOptions,
   makeSendResetPassword,
   makeSendVerificationEmail,
   makeSendPasswordChangedNotice,
@@ -212,3 +214,156 @@ describe("makeSendPasswordChangedNotice (§ D17)", () => {
     ).resolves.toBeUndefined();
   });
 });
+
+// ── #7435 — the magic-link callback (§ D2, § D3, AC-2) ─────────────────────
+
+/**
+ * A Better Auth endpoint-context double: only the two members the callback
+ * may touch. `runInBackgroundOrAwait` records the promise it is handed and
+ * returns immediately, as the real one does with `backgroundTasks.handler`.
+ */
+function makeCtx(user: { id: string; email: string } | null | "throws") {
+  const background: Promise<unknown>[] = [];
+  const findUserByEmail = jest.fn((_email: string) =>
+    user === "throws"
+      ? Promise.reject(new Error("db down for person@example.com"))
+      : Promise.resolve(user ? { user } : null),
+  );
+  const runInBackgroundOrAwait = jest.fn((p: Promise<unknown> | void) => {
+    if (p) background.push(p);
+  });
+  return {
+    background,
+    findUserByEmail,
+    runInBackgroundOrAwait,
+    ctx: { context: { internalAdapter: { findUserByEmail }, runInBackgroundOrAwait } },
+  };
+}
+
+const LINK =
+  "https://site.example/api/auth/magic-link/verify?token=MLTOKEN&callbackURL=%2Faccount";
+
+describe("makeMagicLinkOptions (#7435 § D2)", () => {
+  it("is sign-in only, five minutes, hashed at rest", () => {
+    const opts = makeMagicLinkOptions({ send: jest.fn() });
+    expect(MAGIC_LINK_TTL_SECONDS).toBe(300);
+    expect(opts).toMatchObject({
+      disableSignUp: true,
+      expiresIn: 300,
+      storeToken: "hashed",
+    });
+    expect(typeof opts.sendMagicLink).toBe("function");
+    // allowedAttempts is deliberately unset — the plugin warns on any value.
+    expect(opts).not.toHaveProperty("allowedAttempts");
+  });
+});
+
+describe("sendMagicLink — existing users only, deferred (#7435 § D3, AC-2)", () => {
+  it("sends NOTHING for an unknown address, never backgrounds, and logs no address", async () => {
+    const send = jest.fn();
+    const { lines, log } = makeLog();
+    const { ctx, findUserByEmail, runInBackgroundOrAwait } = makeCtx(null);
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log });
+
+    await expect(
+      sendMagicLink({ email: "nobody@example.com", url: LINK, token: "MLTOKEN" }, ctx),
+    ).resolves.toBeUndefined();
+
+    expect(findUserByEmail).toHaveBeenCalledWith("nobody@example.com");
+    expect(runInBackgroundOrAwait).not.toHaveBeenCalled();
+    expect(send).not.toHaveBeenCalled();
+    expect(lines).toEqual([
+      { level: "info", fields: { kind: "magic-link", reason: "no_account" } },
+    ]);
+    const serialized = JSON.stringify(lines);
+    expect(serialized).not.toContain("nobody@example.com");
+    expect(serialized).not.toContain("MLTOKEN");
+  });
+
+  it("backgrounds ONE magic-link send for a known address and returns before it settles", async () => {
+    let settle!: (v: unknown) => void;
+    const send = jest.fn(
+      (_rawBody: string, _headers: Record<string, string>) =>
+        new Promise((resolve) => (settle = resolve)),
+    );
+    const { lines, log } = makeLog();
+    const { ctx, background, runInBackgroundOrAwait } = makeCtx({
+      id: "user_1",
+      email: "person@example.com",
+    });
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log });
+
+    await sendMagicLink(
+      { email: "Person@Example.com", url: LINK, token: "MLTOKEN" },
+      ctx,
+    );
+
+    // Returned while the transport promise is still pending: the endpoint's
+    // answer does not wait on the relay round-trip (no timing oracle).
+    expect(runInBackgroundOrAwait).toHaveBeenCalledTimes(1);
+    expect(lines.some((l) => l.fields.reason === "sent")).toBe(false);
+
+    expect(send).toHaveBeenCalledTimes(1);
+    const [rawBody] = send.mock.calls[0]!;
+    expect(JSON.parse(rawBody)).toEqual({
+      kind: "magic-link",
+      userId: "user_1",
+      // The STORED address, not the typed casing.
+      to: "person@example.com",
+      url: LINK,
+    });
+
+    settle({ ok: true });
+    await Promise.all(background);
+    expect(lines).toEqual([
+      {
+        level: "info",
+        fields: { userId: "user_1", kind: "magic-link", reason: "sent" },
+      },
+    ]);
+    const serialized = JSON.stringify(lines);
+    expect(serialized).not.toContain("person@example.com");
+    expect(serialized).not.toContain("MLTOKEN");
+    expect(serialized).not.toContain("magic-link/verify");
+  });
+
+  it("never throws, and sends nothing, when the user lookup fails", async () => {
+    const send = jest.fn();
+    const { lines, log } = makeLog();
+    const { ctx, runInBackgroundOrAwait } = makeCtx("throws");
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log });
+
+    await expect(
+      sendMagicLink({ email: "person@example.com", url: LINK, token: "MLTOKEN" }, ctx),
+    ).resolves.toBeUndefined();
+
+    expect(runInBackgroundOrAwait).not.toHaveBeenCalled();
+    expect(send).not.toHaveBeenCalled();
+    expect(lines).toEqual([
+      {
+        level: "warn",
+        fields: {
+          kind: "magic-link",
+          reason: "send_failed",
+          errorKind: "lookup_failed",
+        },
+      },
+    ]);
+  });
+
+  it("never throws, and sends nothing, when Better Auth passes no context", async () => {
+    const send = jest.fn();
+    const { lines, log } = makeLog();
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log });
+
+    await expect(
+      sendMagicLink({ email: "person@example.com", url: LINK, token: "MLTOKEN" }),
+    ).resolves.toBeUndefined();
+    expect(send).not.toHaveBeenCalled();
+    expect(lines[0]?.fields).toEqual({
+      kind: "magic-link",
+      reason: "send_failed",
+      errorKind: "lookup_failed",
+    });
+  });
+});

package/templates/apps/web/lib/__tests__/auth-routes.test.ts

@@ -4,10 +4,10 @@
  * `isAuthPath()` is the ONE list the locale layout branches on and the five
  * `(auth)` page segments are named from, so the layout and the routes cannot
  * drift. Covers bare paths, locale-prefixed paths, near misses, nested paths,
- * and the absent-header fail-safe.
+ * and the absent-header fail-safe — and the same for `isAccountPath()` (#7430).
  */
 
-import { AUTH_SEGMENTS, isAuthPath } from "../auth-routes";
+import { AUTH_SEGMENTS, isAccountPath, isAuthPath } from "../auth-routes";
 
 const LOCALES = ["en", "fr", "de"];
 
@@ -72,3 +72,42 @@ describe("isAuthPath", () => {
     expect(isAuthPath(undefined, LOCALES)).toBe(false);
   });
 });
+
+describe("isAccountPath (#7430, spec 7423 D4)", () => {
+  it("matches the account root, bare and locale-prefixed", () => {
+    expect(isAccountPath("/account", LOCALES)).toBe(true);
+    expect(isAccountPath("/en/account", LOCALES)).toBe(true);
+    expect(isAccountPath("/fr/account", LOCALES)).toBe(true);
+  });
+
+  it("matches every path under /account", () => {
+    expect(isAccountPath("/account/settings", LOCALES)).toBe(true);
+    expect(isAccountPath("/account/support", LOCALES)).toBe(true);
+    expect(isAccountPath("/fr/account/inbox/purchase/fc_1", LOCALES)).toBe(true);
+  });
+
+  it("matches a trailing slash and a query string", () => {
+    expect(isAccountPath("/account/", LOCALES)).toBe(true);
+    expect(isAccountPath("/account?tab=all", LOCALES)).toBe(true);
+  });
+
+  it("does not match a near miss or a marketing path", () => {
+    expect(isAccountPath("/accounts", LOCALES)).toBe(false);
+    expect(isAccountPath("/about", LOCALES)).toBe(false);
+    expect(isAccountPath("/blog/account", LOCALES)).toBe(false);
+  });
+
+  it("does not match an auth path", () => {
+    expect(isAccountPath("/sign-in?next=/account", LOCALES)).toBe(false);
+  });
+
+  it("does not strip a prefix that is not an enabled locale", () => {
+    expect(isAccountPath("/es/account", LOCALES)).toBe(false);
+  });
+
+  it("fails to NOT-an-account-path for an empty or absent pathname", () => {
+    expect(isAccountPath("", LOCALES)).toBe(false);
+    expect(isAccountPath(undefined, LOCALES)).toBe(false);
+    expect(isAccountPath(null, LOCALES)).toBe(false);
+  });
+});