create-ailk 0.11.2 → 0.11.4

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/settings.test.tsx

@@ -0,0 +1,397 @@
+/**
+ * Tests for /[locale]/account/settings — User settings (#7430, spec 7423
+ * U4 · D10, D10a; AC-8, plus the operator fold-ins of 2026-10-01).
+ *
+ * Covers:
+ *   1. General, Security, Notifications and Privacy always render; no
+ *      Credentials, Scope, Organizations or Credits section exists.
+ *   2. Billing renders for `subscription.me()` answering `status: "active"`
+ *      or `portalAvailable: true`; it is absent for `status: null` with
+ *      `portalAvailable: false`, and for a 404.
+ *   3. General lets a member SET and edit their name (an accepted applicant
+ *      arrives with none, #7418) — saved through Better Auth's `updateUser`.
+ *   4. The color-mode control renders only when the site's theme defines
+ *      more than one mode.
+ *   5. Security lists the configured sign-in methods; a Password row only
+ *      when the password method is on.
+ *   6. Privacy links to the cookie settings and files a deletion request.
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { act, fireEvent, render, screen, waitFor, within } from "@testing-library/react";
+
+jest.mock("next-intl/server", () => {
+  const msgs: unknown = require("../../../../../messages/en.json");
+  const dig = (obj: unknown, path: string): unknown =>
+    path.split(".").reduce<unknown>(
+      (acc, k) => (acc !== null && typeof acc === "object" ? (acc as Record<string, unknown>)[k] : undefined),
+      obj,
+    );
+  return {
+    __esModule: true,
+    getTranslations: async (arg: string | { namespace?: string; locale?: string }) => {
+      const ns = typeof arg === "string" ? arg : (arg.namespace ?? "");
+      const messages = dig(msgs, ns);
+      return (key: string, values?: Record<string, unknown>): string => {
+        const value = dig(messages, key);
+        if (typeof value !== "string") return `${ns}.${key}`;
+        return value.replace(/\{(\w+)\}/g, (m, name: string) =>
+          values && name in values ? String(values[name]) : m,
+        );
+      };
+    },
+  };
+});
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue(new Headers()),
+  cookies: jest.fn().mockResolvedValue({ toString: () => "session=abc" }),
+}));
+
+const mockGetSession = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth.ts's lazy Better-Auth singleton has no HTTP/DB boundary a unit test of the session fields can mock without standing up Prisma.
+jest.mock("../../../../../auth", () => ({
+  __esModule: true,
+  auth: { api: { getSession: (...args: unknown[]) => mockGetSession(...args) } },
+}));
+
+const mockSubscriptionMe = jest.fn();
+const mockLeadsSubmit = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  waitlistSignups: { me: jest.fn() },
+  flowCheckouts: { me: jest.fn() },
+  subscription: {
+    me: (...args: unknown[]) => mockSubscriptionMe(...args),
+    portalSession: jest.fn(),
+  },
+  leads: { submit: (...args: unknown[]) => mockLeadsSubmit(...args) },
+  visitorForwardHeaders: () => null,
+}));
+
+const mockUpdateUser = jest.fn();
+jest.mock("better-auth/react", () => ({
+  __esModule: true,
+  createAuthClient: () => ({
+    signOut: jest.fn(),
+    updateUser: (...args: unknown[]) => mockUpdateUser(...args),
+  }),
+}));
+
+const mockRefresh = jest.fn();
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  useRouter: () => ({ push: jest.fn(), refresh: mockRefresh }),
+  usePathname: () => "/account/settings",
+  redirect: jest.fn(),
+}));
+
+import Page from "../settings/page";
+
+const SESSION = {
+  user: {
+    id: "user_1",
+    name: "Ada Lovelace",
+    email: "ada@example.com",
+    emailVerified: true,
+    createdAt: new Date("2026-09-01T00:00:00.000Z"),
+  },
+};
+
+const subscriptionBody = (body: Record<string, unknown>) => ({
+  ok: true,
+  body: { actionRequired: false, status: null, accessRevokesAt: null, portalAvailable: false, ...body },
+});
+
+// ── The site's theme, as `_site.mdx` declares it ──────────────────────────────
+
+let contentRoot: string;
+
+function writeSite(frontmatter: string): void {
+  writeFileSync(join(contentRoot, "_site.mdx"), `---\n${frontmatter}\n---\n`);
+}
+
+const ENV_KEYS = [
+  "AILK_CONTENT_ROOT",
+  "GOOGLE_CLIENT_ID",
+  "GOOGLE_CLIENT_SECRET",
+  "GITHUB_CLIENT_ID",
+  "GITHUB_CLIENT_SECRET",
+  "AUTH_EMAIL_SERVER",
+  "AUTH_EMAIL_FROM",
+  "AUTH_EMAIL_WEBHOOK_SECRET",
+  "BETTER_AUTH_URL",
+  "BETTER_AUTH_SECRET",
+] as const;
+const savedEnv: Partial<Record<(typeof ENV_KEYS)[number], string>> = {};
+
+beforeAll(() => {
+  for (const key of ENV_KEYS) {
+    const value = process.env[key];
+    if (value !== undefined) savedEnv[key] = value;
+  }
+});
+
+afterAll(() => {
+  for (const key of ENV_KEYS) {
+    const value = savedEnv[key];
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+});
+
+beforeEach(() => {
+  for (const key of ENV_KEYS) delete process.env[key];
+  contentRoot = mkdtempSync(join(tmpdir(), "ailk-settings-"));
+  process.env.AILK_CONTENT_ROOT = contentRoot;
+  writeSite('siteName: "Test"');
+  mockGetSession.mockReset().mockResolvedValue(SESSION);
+  mockSubscriptionMe.mockReset().mockResolvedValue(subscriptionBody({}));
+  mockLeadsSubmit.mockReset().mockResolvedValue({ ok: true, body: { id: "lead_1", persisted: "db" } });
+  mockUpdateUser.mockReset().mockResolvedValue({ data: { status: true }, error: null });
+  mockRefresh.mockReset();
+});
+
+afterEach(() => {
+  rmSync(contentRoot, { recursive: true, force: true });
+});
+
+async function renderPage(): Promise<void> {
+  const element = await Page({ params: Promise.resolve({ locale: "en" }) });
+  render(element);
+}
+
+function sectionTitles(): string[] {
+  return screen
+    .getAllByRole("heading", { level: 2 })
+    .map((heading) => heading.textContent ?? "");
+}
+
+describe("the base sections (AC-8)", () => {
+  it("renders General, Security, Notifications and Privacy — and no admin-only section", async () => {
+    await renderPage();
+    expect(screen.getByRole("heading", { level: 1 })).toHaveTextContent("Settings");
+    expect(sectionTitles()).toEqual(["General", "Security", "Notifications", "Privacy"]);
+    for (const absent of [/credentials/i, /scope/i, /organizations/i, /credits/i]) {
+      expect(screen.queryByRole("heading", { name: absent })).not.toBeInTheDocument();
+    }
+  });
+
+  it("each section is an anchor the For-you items link to", async () => {
+    await renderPage();
+    for (const id of ["general", "security", "notifications", "privacy"]) {
+      expect(document.getElementById(id)).toBeInTheDocument();
+    }
+  });
+});
+
+describe("Billing (AC-8, D10)", () => {
+  it('renders for status: "active", with the status', async () => {
+    mockSubscriptionMe.mockResolvedValue(subscriptionBody({ status: "active" }));
+    await renderPage();
+    const billing = document.getElementById("billing")!;
+    expect(within(billing).getByRole("heading", { level: 2 })).toHaveTextContent("Billing");
+    expect(billing).toHaveTextContent("Active");
+    expect(within(billing).queryByTestId("account-billing-manage")).not.toBeInTheDocument();
+  });
+
+  it("renders for portalAvailable: true, with Manage billing", async () => {
+    mockSubscriptionMe.mockResolvedValue(subscriptionBody({ portalAvailable: true }));
+    await renderPage();
+    const billing = document.getElementById("billing")!;
+    expect(within(billing).getByTestId("account-billing-manage")).toHaveTextContent(
+      "Manage billing",
+    );
+  });
+
+  it("shows when access ends, when set", async () => {
+    mockSubscriptionMe.mockResolvedValue(
+      subscriptionBody({ status: "canceled", accessRevokesAt: "2026-10-20T00:00:00.000Z" }),
+    );
+    await renderPage();
+    const billing = document.getElementById("billing")!;
+    expect(billing).toHaveTextContent("Canceled");
+    expect(billing).toHaveTextContent("Access ends");
+  });
+
+  it("is absent for status: null with portalAvailable: false", async () => {
+    await renderPage();
+    expect(document.getElementById("billing")).not.toBeInTheDocument();
+    expect(sectionTitles()).not.toContain("Billing");
+  });
+
+  it("is absent for a 404 (the commerce-disabled build)", async () => {
+    mockSubscriptionMe.mockResolvedValue({ ok: false, status: 404, body: {} });
+    await renderPage();
+    expect(document.getElementById("billing")).not.toBeInTheDocument();
+  });
+
+  it.each([401, 403])("is absent for a %i", async (status) => {
+    mockSubscriptionMe.mockResolvedValue({ ok: false, status, body: {} });
+    await renderPage();
+    expect(document.getElementById("billing")).not.toBeInTheDocument();
+  });
+});
+
+describe("General — the member's name (operator fold-in, #7418)", () => {
+  it("shows the email read-only and the name in an editable field", async () => {
+    await renderPage();
+    const general = document.getElementById("general")!;
+    expect(within(general).getByTestId("account-settings-email")).toHaveTextContent(
+      "ada@example.com",
+    );
+    expect(within(general).getByLabelText("Name")).toHaveValue("Ada Lovelace");
+  });
+
+  it("a member with no name can set one: Save is disabled until the field changes, then saves through updateUser", async () => {
+    mockGetSession.mockResolvedValue({ user: { ...SESSION.user, name: "" } });
+    await renderPage();
+    const input = screen.getByLabelText("Name");
+    expect(input).toHaveValue("");
+    const save = screen.getByTestId("account-name-save");
+    expect(save).toBeDisabled();
+    fireEvent.change(input, { target: { value: "  Grace Hopper " } });
+    expect(save).toBeEnabled();
+    expect(screen.getByTestId("account-name-status")).toHaveTextContent("Unsaved changes");
+    await act(async () => {
+      fireEvent.click(save);
+    });
+    expect(mockUpdateUser).toHaveBeenCalledWith({ name: "Grace Hopper" });
+    await waitFor(() => expect(mockRefresh).toHaveBeenCalledTimes(1));
+    expect(screen.getByTestId("account-name-status")).toHaveTextContent("Saved.");
+  });
+
+  it("a blank name is refused without a call", async () => {
+    await renderPage();
+    const input = screen.getByLabelText("Name");
+    fireEvent.change(input, { target: { value: "   " } });
+    await act(async () => {
+      fireEvent.click(screen.getByTestId("account-name-save"));
+    });
+    expect(mockUpdateUser).not.toHaveBeenCalled();
+    expect(screen.getByRole("alert")).toHaveTextContent("Enter your name.");
+  });
+
+  it("a failed save says so and keeps the edit", async () => {
+    mockUpdateUser.mockResolvedValue({ data: null, error: { message: "nope" } });
+    await renderPage();
+    const input = screen.getByLabelText("Name");
+    fireEvent.change(input, { target: { value: "Ada King" } });
+    await act(async () => {
+      fireEvent.click(screen.getByTestId("account-name-save"));
+    });
+    expect(screen.getByRole("alert")).toHaveTextContent("We couldn't save your name.");
+    expect(input).toHaveValue("Ada King");
+    expect(mockRefresh).not.toHaveBeenCalled();
+  });
+});
+
+describe("General — a save that throws", () => {
+  it("a network failure says so and re-enables Save", async () => {
+    mockUpdateUser.mockRejectedValue(new TypeError("Failed to fetch"));
+    await renderPage();
+    fireEvent.change(screen.getByLabelText("Name"), { target: { value: "Ada King" } });
+    await act(async () => {
+      fireEvent.click(screen.getByTestId("account-name-save"));
+    });
+    expect(screen.getByRole("alert")).toHaveTextContent("We couldn't save your name.");
+    expect(screen.getByTestId("account-name-save")).toBeEnabled();
+  });
+});
+
+describe("General — color mode only on a multi-mode theme (operator fold-in)", () => {
+  it("a site with no theme block (the default light + dark palette) shows Light · Auto · Dark", async () => {
+    await renderPage();
+    const control = screen.getByTestId("account-color-mode");
+    expect(within(control).getAllByRole("radio").map((r) => r.textContent)).toEqual([
+      "Light",
+      "Auto",
+      "Dark",
+    ]);
+  });
+
+  it("a theme declaring both modes shows the control", async () => {
+    writeSite('theme:\n  colors:\n    light:\n      bg: "#ffffff"\n    dark:\n      bg: "#000000"');
+    await renderPage();
+    expect(screen.getByTestId("account-color-mode")).toBeInTheDocument();
+  });
+
+  it("a light-only theme shows no control", async () => {
+    writeSite('theme:\n  colors:\n    light:\n      bg: "#fdfcfa"\n      text: "#1c1917"');
+    await renderPage();
+    expect(screen.queryByTestId("account-color-mode")).not.toBeInTheDocument();
+  });
+
+  it("choosing Dark writes the theme cookie and the root's data-theme", async () => {
+    await renderPage();
+    const control = screen.getByTestId("account-color-mode");
+    fireEvent.click(within(control).getByRole("radio", { name: "Dark" }));
+    expect(document.documentElement.getAttribute("data-theme")).toBe("dark");
+    expect(document.cookie).toContain("ailk-theme=dark");
+  });
+});
+
+describe("Security — the configured sign-in methods (D10)", () => {
+  it("lists each configured method; no Password row without the password method", async () => {
+    process.env.GOOGLE_CLIENT_ID = "id";
+    process.env.GOOGLE_CLIENT_SECRET = "secret";
+    await renderPage();
+    const security = document.getElementById("security")!;
+    expect(within(security).getByText("Google")).toBeInTheDocument();
+    expect(within(security).queryByText("GitHub")).not.toBeInTheDocument();
+    expect(within(security).queryByText("Password")).not.toBeInTheDocument();
+  });
+
+  it("the password method adds a Password row", async () => {
+    process.env.AUTH_EMAIL_SERVER = "smtp://x";
+    process.env.AUTH_EMAIL_FROM = "site@example.com";
+    await renderPage();
+    const security = document.getElementById("security")!;
+    expect(within(security).getByText("Password")).toBeInTheDocument();
+  });
+
+  it("no configured method says so", async () => {
+    await renderPage();
+    expect(document.getElementById("security")).toHaveTextContent(
+      "No sign-in method is configured.",
+    );
+  });
+});
+
+describe("Privacy (D10)", () => {
+  it("links to the cookie settings", async () => {
+    await renderPage();
+    const privacy = document.getElementById("privacy")!;
+    expect(within(privacy).getByText("Cookie settings").closest("a")).toHaveAttribute(
+      "href",
+      "/privacy#cookie-settings",
+    );
+  });
+
+  it("Request account deletion files a support request of kind deletion", async () => {
+    await renderPage();
+    const privacy = document.getElementById("privacy")!;
+    await act(async () => {
+      fireEvent.click(within(privacy).getByTestId("account-deletion-request"));
+    });
+    await waitFor(() => expect(mockLeadsSubmit).toHaveBeenCalledTimes(1));
+    const [body] = mockLeadsSubmit.mock.calls[0] as [Record<string, unknown>];
+    expect(body).toEqual({
+      source: "web",
+      email: "ada@example.com",
+      payload: {
+        kind: "deletion",
+        subject: "Account deletion request",
+        message: "Please delete my account and its data.",
+      },
+    });
+    await waitFor(() =>
+      expect(within(privacy).getByRole("status")).toHaveTextContent(
+        "Your deletion request is on its way.",
+      ),
+    );
+  });
+});

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/support.test.tsx

@@ -0,0 +1,203 @@
+/**
+ * Tests for /[locale]/account/support — Contact support (#7430, spec 7423
+ * U4 · D11; AC-9).
+ *
+ * Covers:
+ *   1. The form posts `{ kind: "support", subject, message }` to
+ *      `/v1/leads/submit` (`leads.submit`) with `source: "web"`, the
+ *      session's email and no `siteId`, and shows a confirmation on 201.
+ *   2. A missing subject or message is refused without a call.
+ *   3. A failed submit says so and keeps what was typed; the API's
+ *      `lead_capture_not_configured` 503 says requests can't be sent.
+ */
+import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
+
+jest.mock("next-intl/server", () => {
+  const msgs: unknown = require("../../../../../messages/en.json");
+  const dig = (obj: unknown, path: string): unknown =>
+    path.split(".").reduce<unknown>(
+      (acc, k) => (acc !== null && typeof acc === "object" ? (acc as Record<string, unknown>)[k] : undefined),
+      obj,
+    );
+  return {
+    __esModule: true,
+    getTranslations: async (arg: string | { namespace?: string; locale?: string }) => {
+      const ns = typeof arg === "string" ? arg : (arg.namespace ?? "");
+      const messages = dig(msgs, ns);
+      return (key: string, values?: Record<string, unknown>): string => {
+        const value = dig(messages, key);
+        if (typeof value !== "string") return `${ns}.${key}`;
+        return value.replace(/\{(\w+)\}/g, (m, name: string) =>
+          values && name in values ? String(values[name]) : m,
+        );
+      };
+    },
+  };
+});
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue(new Headers()),
+  cookies: jest.fn().mockResolvedValue({ toString: () => "session=abc" }),
+}));
+
+const mockGetSession = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth.ts's lazy Better-Auth singleton has no HTTP/DB boundary a unit test of the session fields can mock without standing up Prisma.
+jest.mock("../../../../../auth", () => ({
+  __esModule: true,
+  auth: { api: { getSession: (...args: unknown[]) => mockGetSession(...args) } },
+}));
+
+const mockLeadsSubmit = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  subscription: { me: jest.fn(), portalSession: jest.fn() },
+  leads: { submit: (...args: unknown[]) => mockLeadsSubmit(...args) },
+  visitorForwardHeaders: () => undefined,
+}));
+
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  useRouter: () => ({ push: jest.fn(), refresh: jest.fn() }),
+  usePathname: () => "/account/support",
+  redirect: jest.fn(),
+}));
+
+import { submitSupportRequest } from "../support-actions";
+import Page from "../support/page";
+
+const SESSION = {
+  user: { id: "user_1", name: "Ada", email: "ada@example.com", emailVerified: true },
+};
+
+beforeEach(() => {
+  mockGetSession.mockReset().mockResolvedValue(SESSION);
+  mockLeadsSubmit
+    .mockReset()
+    .mockResolvedValue({ ok: true, body: { id: "lead_1", persisted: "db" } });
+});
+
+async function renderPage(): Promise<void> {
+  const element = await Page({ params: Promise.resolve({ locale: "en" }) });
+  render(element);
+}
+
+async function submit(subject: string, message: string): Promise<void> {
+  fireEvent.change(screen.getByLabelText("Subject"), { target: { value: subject } });
+  fireEvent.change(screen.getByLabelText("Message"), { target: { value: message } });
+  await act(async () => {
+    fireEvent.click(screen.getByTestId("account-support-submit"));
+  });
+}
+
+describe("Contact support (AC-9, D11)", () => {
+  it("the primary is 44px on a phone only — the 36px default from md up (DESIGN.md §4)", async () => {
+    await renderPage();
+    const submit = screen.getByTestId("account-support-submit");
+    expect(submit).toHaveClass("max-md:min-h-11");
+  });
+
+  it("renders the page heading and says where the reply goes", async () => {
+    await renderPage();
+    expect(screen.getByRole("heading", { level: 1 })).toHaveTextContent("Contact support");
+    expect(screen.getByTestId("account-support")).toHaveTextContent("ada@example.com");
+  });
+
+  it('posts { kind: "support", subject, message } with source "web", and confirms on 201', async () => {
+    await renderPage();
+    await submit("Billing question", "Where is my receipt?");
+    await waitFor(() => expect(mockLeadsSubmit).toHaveBeenCalledTimes(1));
+    expect(mockLeadsSubmit.mock.calls[0]).toEqual([
+      {
+        source: "web",
+        email: "ada@example.com",
+        payload: {
+          kind: "support",
+          subject: "Billing question",
+          message: "Where is my receipt?",
+        },
+      },
+    ]);
+    await waitFor(() =>
+      expect(screen.getByRole("status")).toHaveTextContent("your request is on its way"),
+    );
+    expect(screen.queryByTestId("account-support-submit")).not.toBeInTheDocument();
+  });
+
+  it("a missing message is refused without a call", async () => {
+    await renderPage();
+    await submit("Billing question", "   ");
+    expect(mockLeadsSubmit).not.toHaveBeenCalled();
+    expect(screen.getByRole("alert")).toHaveTextContent(
+      "Fill in both the subject and the message.",
+    );
+  });
+
+  it("a failed submit says so and keeps what was typed", async () => {
+    mockLeadsSubmit.mockResolvedValue({ ok: false, status: 500, body: {} });
+    await renderPage();
+    await submit("Billing question", "Where is my receipt?");
+    await waitFor(() =>
+      expect(screen.getByRole("alert")).toHaveTextContent("We couldn't send your request."),
+    );
+    expect(screen.getByLabelText("Subject")).toHaveValue("Billing question");
+    expect(screen.getByLabelText("Message")).toHaveValue("Where is my receipt?");
+  });
+
+  it("a deployment that accepts no contact message says requests can't be sent", async () => {
+    mockLeadsSubmit.mockResolvedValue({
+      ok: false,
+      status: 503,
+      body: { error: "lead_capture_not_configured" },
+    });
+    await renderPage();
+    await submit("Billing question", "Where is my receipt?");
+    await waitFor(() =>
+      expect(screen.getByRole("alert")).toHaveTextContent("Requests can't be sent from this site yet."),
+    );
+  });
+});
+
+describe("submitSupportRequest — the Server Action's own guards", () => {
+  function form(fields: Record<string, string>): FormData {
+    const data = new FormData();
+    for (const [key, value] of Object.entries(fields)) data.set(key, value);
+    return data;
+  }
+
+  it("with no session, files nothing", async () => {
+    mockGetSession.mockResolvedValue(null);
+    const state = await submitSupportRequest(
+      { kind: "idle" },
+      form({ kind: "support", subject: "Hi", message: "Help" }),
+    );
+    expect(state).toEqual({ kind: "error", reason: "failed" });
+    expect(mockLeadsSubmit).not.toHaveBeenCalled();
+  });
+
+  it("refuses an over-length subject or message", async () => {
+    const long = await submitSupportRequest(
+      { kind: "idle" },
+      form({ kind: "support", subject: "x".repeat(201), message: "Help" }),
+    );
+    expect(long).toEqual({ kind: "error", reason: "required" });
+    const longer = await submitSupportRequest(
+      { kind: "idle" },
+      form({ kind: "support", subject: "Hi", message: "x".repeat(5001) }),
+    );
+    expect(longer).toEqual({ kind: "error", reason: "required" });
+    expect(mockLeadsSubmit).not.toHaveBeenCalled();
+  });
+
+  it("any kind other than deletion files as support; the email is always the session's", async () => {
+    await submitSupportRequest(
+      { kind: "idle" },
+      form({ kind: "refund", subject: "Hi", message: "Help", email: "someone@else.com" }),
+    );
+    expect(mockLeadsSubmit).toHaveBeenCalledWith({
+      source: "web",
+      email: "ada@example.com",
+      payload: { kind: "support", subject: "Hi", message: "Help" },
+    });
+  });
+});