create-ailk 0.14.0 → 0.16.0

package/templates/apps/web/app/[locale]/layout.tsx

@@ -47,18 +47,18 @@ import { NextIntlClientProvider } from "next-intl";
 import { getMessages, getTranslations } from "next-intl/server";
 import type { ReactElement, ReactNode } from "react";
 
-import { auth } from "../../auth";
 import { GoogleAnalytics } from "../../components/google-analytics";
 import {
   SignedInNav,
   type SignedInNavProps,
 } from "../../components/signed-in-nav";
 import { isAccountPath, isAuthPath } from "../../lib/auth-routes";
+import { isClosingFooterPath } from "../../lib/closing-footer-path";
 import { assertEnabledLocale } from "../../lib/locale-guard";
 import { footerColumns, navItems } from "../../lib/nav-config";
 import { getOgImageUrl } from "../../lib/og";
 import { backLinkHref } from "../../lib/profile-back-link";
-import { SITE_NAME } from "../../lib/site-brand";
+import { COPYRIGHT_HOLDER, SITE_NAME } from "../../lib/site-brand";
 import { siteChrome, type SiteChrome } from "../../lib/site-chrome";
 import { siteLogo } from "../../lib/site-logo";
 // Registers the `_site.mdx` identity with page-renderer at module load, so
@@ -69,6 +69,12 @@ import "../../lib/site-identity";
 // (#7521). Inert without AILK_LISTING_PUBLIC_KEY or the paid package.
 import "../../lib/listings";
 import { siteThemeHead } from "../../lib/site-theme-head";
+import {
+  SIGN_IN_PATH,
+  SIGN_OUT_ENDPOINT,
+  SIGN_UP_PATH,
+  readSession,
+} from "../../lib/topology.generated";
 import { resolveBaseUrl } from "../../src/lib/routes";
 
 import { readSiteContactLines } from "./contact/site-contact-lines";
@@ -83,6 +89,7 @@ const chrome: SiteChrome & {
   deckPresentation?: true;
   colorMode?: "light";
   chromeStyle?: "minimal";
+  closingFooterPaths?: readonly string[];
 } = siteChrome;
 
 // ── Constants ────────────────────────────────────────────────────────────────
@@ -142,6 +149,15 @@ async function resolveThemeMode(): Promise<ThemeMode> {
   }
 }
 
+/**
+ * The deck home's first slide (#7782): the element the consent bar waits on.
+ * The same section-slide selector `DeckSlideAdvance` walks (its `SLIDES`, minus
+ * the closing footer slide), so the first match is slide 1. The story that pins
+ * the geometry (`Shells/MarketingShell` → `Deck Consent Bar`) carries a copy.
+ */
+const DECK_FIRST_SLIDE_SELECTOR =
+  '.ailk-snap-deck .ailk-section-renderer > :not(.ailk-section-separator):not([data-section="separator"])';
+
 /**
  * Whether this visitor has already accepted or declined cookies (#5557).
  *
@@ -250,8 +266,10 @@ export default async function LocaleLayout({
   const isMinimalChrome = chrome.chromeStyle === "minimal";
   const consentDecided = await hasConsentChoice();
   // Server-side session read (#4984) — the same `auth.api.getSession` idiom
-  // the `(authed)` segment guard uses. Null when signed out or auth is unset.
-  const session = await auth.api.getSession({ headers: await headers() });
+  // the `(authed)` segment guard uses, through the generated topology seam
+  // (#7426 D5): a spoke has no sign-in, so its render always answers null.
+  // Null when signed out or auth is unset.
+  const session = await readSession(await headers());
 
   // Resolve nav labels server-side so Nav + Footer components stay
   // i18n-hook-free and are testable without a NextIntlClientProvider wrapper.
@@ -348,11 +366,22 @@ export default async function LocaleLayout({
   // above).
   // The signed-out auth pair, shared by the header (every page but the deck
   // home) and the deck home's closing footer slide (#7718 D4).
-  const authActions = [
-    // NO_HAND_IMPLEMENT_OK: operator-directed live Free-template pass.
-    { labelKey: "signIn", path: "/sign-in", variant: "outline-strong" },
-    { labelKey: "signUp", path: "/sign-up", variant: "primary" },
-  ] as const satisfies readonly NavAction[];
+  // The pair comes from the generated seam (#7894 D10): a hub's /sign-in and
+  // /sign-up; a spoke that signs in through its hub has Sign in → /account
+  // (its gate starts the hub sign-in) and no Sign up; a spoke without sign-in
+  // (#7426 D11) has neither, so it offers no auth pair anywhere — not in the
+  // header, the deck's closing footer or a bare page's footer.
+  const authActions: readonly Extract<NavAction, { path: string }>[] = [
+    ...(SIGN_IN_PATH !== null
+      ? [
+          // NO_HAND_IMPLEMENT_OK: operator-directed live Free-template pass.
+          { labelKey: "signIn", path: SIGN_IN_PATH, variant: "outline-strong" as const },
+        ]
+      : []),
+    ...(SIGN_UP_PATH !== null
+      ? [{ labelKey: "signUp", path: SIGN_UP_PATH, variant: "primary" as const }]
+      : []),
+  ];
   const navActions: NavAction[] = session
     ? [
         { labelKey: "account", kind: "flow", flow: NAV_CLIENT_ACTION_FLOW },
@@ -399,8 +428,12 @@ export default async function LocaleLayout({
     : session
       ? [{ label: tNav("account"), href: localeHref(locale, "/account") }]
       : [
-          { label: tNav("signIn"), href: localeHref(locale, "/sign-in") },
-          { label: tNav("signUp"), href: localeHref(locale, "/sign-up") },
+          ...(SIGN_IN_PATH !== null
+            ? [{ label: tNav("signIn"), href: localeHref(locale, SIGN_IN_PATH) }]
+            : []),
+          ...(SIGN_UP_PATH !== null
+            ? [{ label: tNav("signUp"), href: localeHref(locale, SIGN_UP_PATH) }]
+            : []),
         ];
 
   // A flow action needs `renderFlowTrigger`, a function — and this layout is a
@@ -434,6 +467,18 @@ export default async function LocaleLayout({
   // middleware and hreflang alternates read (NEXT_PUBLIC_ENABLED_LOCALES).
   const enabledLocales = readLocales();
 
+  // #7797 — an inner page the site lists in `closingFooterPaths` ends on the
+  // closing footer: the wordmark, the contact lines and the legal line. The
+  // home is never an inner page, and an absent or empty list is false for
+  // every page, so a site that lists none renders exactly as before.
+  const isClosingInner =
+    pathname !== homePath &&
+    isClosingFooterPath({
+      pathname,
+      paths: chrome.closingFooterPaths,
+      locales: enabledLocales,
+    });
+
   // The (auth) route group's chrome branch (#5963).
   //
   // A route group's layout nests INSIDE its parent segment's layout, so
@@ -519,7 +564,8 @@ export default async function LocaleLayout({
 
   // The site's own name (#6942) — `SITE_NAME` resolves from `_site.mdx`'s
   // `siteName:`, so a customer's footer never carries the kit vendor's name.
-  const copyrightText = `© ${new Date().getFullYear()} ${SITE_NAME}. All rights reserved.`;
+  // The holder is `siteIdentity.legalName` when declared (#7796), else the name.
+  const copyrightText = `© ${new Date().getFullYear()} ${COPYRIGHT_HOLDER}. All rights reserved.`;
 
   // Footer legal links (#5612 D3). The centered variant folds in FAQ — the
   // roster's third always-scaffolded core route (`/faq`, alongside `/privacy`
@@ -716,7 +762,7 @@ export default async function LocaleLayout({
                     }}
                   />
                 ) : hasFlowAction ? (
-                  <SignedInNav {...navProps} />
+                  <SignedInNav {...navProps} signOutEndpoint={SIGN_OUT_ENDPOINT} />
                 ) : (
                   <Nav
                     {...navProps}
@@ -740,18 +786,32 @@ export default async function LocaleLayout({
                   // Sign up are on no part of the home.
                   // #7721 D4 — a bare inner page's footer is the one bar, its
                   // link group carrying the account links the header drops.
+                  // #7797 — a listed inner page takes the same closing footer.
+                  // Under `innerPages: bare` the one-bar footer is where the
+                  // account links live (the header drops them), so the closing
+                  // footer carries the deck's auth actions in their place; on
+                  // any other inner page the header still holds them.
                   {...(isDeckHome && isMinimalChrome
                     ? { layout: "closing" as const, contactLines: readSiteContactLines() }
-                    : isBareInner
-                      ? { layout: "line" as const, accountLinks }
-                      : siteChrome.footer === "centered"
-                        ? { layout: "centered" as const }
-                        : {})}
+                    : isClosingInner
+                      ? {
+                          layout: "closing" as const,
+                          contactLines: readSiteContactLines(),
+                          ...(isBareInner ? { actions: deckFooterActions } : {}),
+                        }
+                      : isBareInner
+                        ? { layout: "line" as const, accountLinks }
+                        : siteChrome.footer === "centered"
+                          ? { layout: "centered" as const }
+                          : {})}
                   // #7718 D4 — the deck home's closing slide carries the
                   // centred brand and the auth links its bare header drops.
                   {...(isDeckHome && !isMinimalChrome
                     ? { centeredBrand: true, actions: deckFooterActions }
                     : {})}
+                  // #7823 — the minimal closing slide's actions are a button,
+                  // then a text link; Footer reads the style from this.
+                  {...(isMinimalChrome ? { chromeStyle: "minimal" as const } : {})}
                   // #7742 D2 — no theme switch under `colorMode: light`.
                   showThemeToggle={!pinLight}
                   bottomBarAlign="content"
@@ -816,6 +876,11 @@ export default async function LocaleLayout({
               // #7742 D5 — the minimal chrome's consent bar: the page ground,
               // a hairline, no shadow.
               {...(isMinimalChrome ? { consentAppearance: "hairline" as const } : {})}
+              // #7782 — on the minimal deck home the bar first shows once the
+              // first slide has left view; every other page shows it on load.
+              {...(isDeckHome && isMinimalChrome
+                ? { consentRevealAfter: DECK_FIRST_SLIDE_SELECTOR }
+                : {})}
             />
           )}
           <Telemetry />

package/templates/apps/web/app/[locale]/newsletter/__tests__/page.test.tsx

@@ -11,6 +11,9 @@ import React from "react";
 import { render, screen } from "@testing-library/react";
 
 jest.mock("@working-theory/ui", () => ({
+  // #7789: renderPage's fallback page head renders inside the section Container.
+  Container: ({ children }: { children?: React.ReactNode }) =>
+    React.createElement("div", null, children),
   Heading: ({ children, level }: { children: React.ReactNode; level: number }) =>
     React.createElement(`h${level}`, null, children),
   SectionRenderer: ({

package/templates/apps/web/app/[locale]/projects/__tests__/page-renderer-migration.test.tsx

@@ -20,6 +20,9 @@ import { render } from "@testing-library/react";
 
 // ── @working-theory/ui mock ─────────────────────────────────────────────────────────────
 jest.mock("@working-theory/ui", () => ({
+  // #7789: renderPage's fallback page head renders inside the section Container.
+  Container: ({ children }: { children?: React.ReactNode }) =>
+    React.createElement("div", null, children),
   // #4446/#4447: renderPage's own fallback/empty-state title now composes
   // Heading (mobile type-budget classes, #4417) instead of a bare <h1>.
   Heading: ({
@@ -106,7 +109,7 @@ describe("ProjectsPage — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(
-      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Projects","description":"Open-source projects built with AI Launch Kit.","mainEntity":{"@type":"ItemList","itemListElement":[{"@type":"CreativeWork"}]}}</script><main id="main"><h1>Projects</h1><p data-testid="projects-description">Open-source projects built with AI Launch Kit.</p><div data-testid="section-renderer" data-section-count="0"></div></main>"`,
+      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Projects","description":"Open-source projects built with AI Launch Kit.","mainEntity":{"@type":"ItemList","itemListElement":[{"@type":"CreativeWork"}]}}</script><main id="main"><div><h1>Projects</h1><p data-testid="projects-description" class="mt-block-tight text-lead">Open-source projects built with AI Launch Kit.</p></div><div data-testid="section-renderer" data-section-count="0"></div></main>"`,
     );
   });
 });
@@ -130,7 +133,7 @@ describe("ProjectSlugPage — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(
-      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@graph":[{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"AI Launch Kit","description":"The AX-first OSS template.","mainEntity":{"@context":"https://schema.org","@type":"CreativeWork","name":"AI Launch Kit","description":"The AX-first OSS template."}},{"@context":"https://schema.org","@type":"BreadcrumbList","inLanguage":"en","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http://localhost:3000/en/"},{"@type":"ListItem","position":2,"name":"Projects","item":"http://localhost:3000/en/projects"},{"@type":"ListItem","position":3,"name":"AI Launch Kit","item":"http://localhost:3000/en/projects/ailk"}]}]}</script><main id="main"><h1>AI Launch Kit</h1><p data-testid="ailk-description">The AX-first OSS template.</p><div data-testid="section-renderer" data-section-count="0"></div></main>"`,
+      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@graph":[{"@context":"https://schema.org","@type":"WebPage","inLanguage":"en","name":"AI Launch Kit","description":"The AX-first OSS template.","mainEntity":{"@context":"https://schema.org","@type":"CreativeWork","name":"AI Launch Kit","description":"The AX-first OSS template."}},{"@context":"https://schema.org","@type":"BreadcrumbList","inLanguage":"en","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http://localhost:3000/en/"},{"@type":"ListItem","position":2,"name":"Projects","item":"http://localhost:3000/en/projects"},{"@type":"ListItem","position":3,"name":"AI Launch Kit","item":"http://localhost:3000/en/projects/ailk"}]}]}</script><main id="main"><div><h1>AI Launch Kit</h1><p data-testid="ailk-description" class="mt-block-tight text-lead">The AX-first OSS template.</p></div><div data-testid="section-renderer" data-section-count="0"></div></main>"`,
     );
   });
 

package/templates/apps/web/app/[locale]/thanks/[slug]/__tests__/page.test.tsx

@@ -17,6 +17,9 @@ jest.mock("next/navigation", () => ({
 }));
 
 jest.mock("@working-theory/ui", () => ({
+  // #7789: renderPage's fallback page head renders inside the section Container.
+  Container: ({ children }: { children?: React.ReactNode }) =>
+    React.createElement("div", null, children),
   // #4446/#4447: renderPage's own fallback/empty-state title now composes
   // Heading (mobile type-budget classes, #4417) instead of a bare <h1>.
   Heading: ({

package/templates/apps/web/app/api/auth/hub/authorize/__tests__/route.test.ts

@@ -0,0 +1,295 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * Tests for the hub's authorize step (#7894, spec
+ * docs/specs/7894-the-hub-signs-in-its-spec.md D4; AC-4, AC-6).
+ *
+ * The Better Auth session read and `@working-theory/api-client`'s `hubSignIn`
+ * are the two external boundaries; both are mocked. The route's own decisions
+ * are what is under test: which query it accepts, who it sends to sign in,
+ * where a minted code goes, and what it refuses to redirect to.
+ */
+
+// --- Mocks set up BEFORE imports ---
+
+const mockGetSession = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- auth.ts is the Better Auth singleton (its adapter needs a live database); this stand-in for the session read is the repo-standard double for that boundary (see the sibling suites under app/[locale]/(authed)/account/__tests__).
+jest.mock("../../../../../../auth", () => ({
+  __esModule: true,
+  auth: {
+    api: { getSession: (...args: unknown[]) => mockGetSession(...args) },
+  },
+}));
+
+const mockCreateCode = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  hubSignIn: { createCode: (...args: unknown[]) => mockCreateCode(...args) },
+}));
+
+import { resolveNextPath } from "../../../../../[locale]/(auth)/sign-in/next-path";
+import { GET } from "../route";
+
+const HUB = "https://hub.example.com";
+const SPOKE_CALLBACK = "https://spoke.example.com/api/hub-session/callback";
+const CHALLENGE = "c".repeat(43);
+const STATE = "s".repeat(43);
+const CODE = "k".repeat(43);
+
+const ORIGINAL_ENV = process.env;
+
+function query(overrides: Record<string, string | undefined> = {}): string {
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: "spoke_abc",
+    redirect_uri: SPOKE_CALLBACK,
+    state: STATE,
+    code_challenge: CHALLENGE,
+    code_challenge_method: "S256",
+  });
+  for (const [key, value] of Object.entries(overrides)) {
+    if (value === undefined) params.delete(key);
+    else params.set(key, value);
+  }
+  return params.toString();
+}
+
+function request(
+  search: string,
+  headers: Record<string, string> = {},
+): Request {
+  return new Request(`${HUB}/api/auth/hub/authorize?${search}`, { headers });
+}
+
+beforeEach(() => {
+  jest.resetAllMocks();
+  process.env = { ...ORIGINAL_ENV, BETTER_AUTH_URL: `${HUB}/some/base` };
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+describe("a malformed query is a 400 and never a redirect", () => {
+  it.each([
+    ["no client_id", { client_id: undefined }],
+    ["response_type token", { response_type: "token" }],
+    ["method plain", { code_challenge_method: "plain" }],
+    ["a short code_challenge", { code_challenge: "short" }],
+    ["no state", { state: undefined }],
+    ["a state with a delimiter", { state: "a&b=c;d e" }],
+    ["no redirect_uri", { redirect_uri: undefined }],
+  ])("%s", async (_name, overrides) => {
+    mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+
+    const res = await GET(request(query(overrides)));
+
+    expect(res.status).toBe(400);
+    expect(res.headers.get("location")).toBeNull();
+    expect(res.headers.get("content-type")).toBe("application/json");
+    expect(await res.json()).toEqual({ error: "invalid_request" });
+    expect(mockCreateCode).not.toHaveBeenCalled();
+    expect(mockGetSession).not.toHaveBeenCalled();
+  });
+
+  it("a repeated key is ambiguous, so 400", async () => {
+    const res = await GET(request(`${query()}&client_id=spoke_other`));
+    expect(res.status).toBe(400);
+    expect(res.headers.get("location")).toBeNull();
+  });
+});
+
+describe("no Better Auth session", () => {
+  it("AC-4: 303 to /sign-in?next= followed by the encoded authorize path and query", async () => {
+    mockGetSession.mockResolvedValue(null);
+    const search = query();
+
+    const res = await GET(request(search));
+
+    expect(res.status).toBe(303);
+    const location = res.headers.get("location") ?? "";
+    expect(location).toBe(
+      `/sign-in?next=${encodeURIComponent(`/api/auth/hub/authorize?${search}`)}`,
+    );
+    expect(mockCreateCode).not.toHaveBeenCalled();
+  });
+
+  it("AC-6: the next value is a same-origin path the sign-in card keeps (resolveNextPath)", async () => {
+    mockGetSession.mockResolvedValue(null);
+
+    const res = await GET(request(query()));
+
+    const next =
+      new URL(res.headers.get("location") ?? "", HUB).searchParams.get(
+        "next",
+      ) ?? "";
+    expect(next.startsWith("/api/auth/hub/authorize?")).toBe(true);
+    // Unchanged — not the fallback — so Better Auth is handed it as the callback
+    // for Google and for the emailed link alike.
+    expect(resolveNextPath(next, "/account")).toBe(next);
+    expect(next).not.toMatch(/^https?:/);
+  });
+});
+
+describe("a signed-in person", () => {
+  beforeEach(() => {
+    mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+  });
+
+  it("AC-4: 303 to the REGISTERED redirect URI with the code and the same state", async () => {
+    mockCreateCode.mockResolvedValue({
+      ok: true,
+      body: { code: CODE, redirectUri: SPOKE_CALLBACK },
+    });
+
+    const res = await GET(
+      request(query(), { cookie: "better-auth.session_token=tok" }),
+    );
+
+    expect(res.status).toBe(303);
+    const target = new URL(res.headers.get("location") ?? "");
+    expect(`${target.origin}${target.pathname}`).toBe(SPOKE_CALLBACK);
+    expect(target.searchParams.get("code")).toBe(CODE);
+    expect(target.searchParams.get("state")).toBe(STATE);
+    expect(res.headers.get("cache-control")).toBe("no-store");
+    expect(res.headers.get("referrer-policy")).toBe("no-referrer");
+  });
+
+  it("forwards the visitor's cookie and the hub's pinned origin to the API — nothing else", async () => {
+    mockCreateCode.mockResolvedValue({
+      ok: true,
+      body: { code: CODE, redirectUri: SPOKE_CALLBACK },
+    });
+
+    await GET(
+      request(query(), {
+        cookie: "better-auth.session_token=tok",
+        origin: "https://evil.example",
+      }),
+    );
+
+    expect(mockCreateCode).toHaveBeenCalledWith(
+      {
+        clientId: "spoke_abc",
+        redirectUri: SPOKE_CALLBACK,
+        codeChallenge: CHALLENGE,
+      },
+      { headers: { cookie: "better-auth.session_token=tok", origin: HUB } },
+    );
+  });
+
+  it("AC-4: a redirect_uri the API does not register is a 400 with NO Location header", async () => {
+    mockCreateCode.mockResolvedValue({
+      ok: false,
+      status: 400,
+      body: {
+        ok: false,
+        error: { code: "invalid_redirect_uri", message: "x" },
+      },
+    });
+
+    const res = await GET(
+      request(
+        query({
+          redirect_uri: "https://attacker.example.com/api/hub-session/callback",
+        }),
+      ),
+    );
+
+    expect(res.status).toBe(400);
+    expect(res.headers.get("location")).toBeNull();
+    expect(await res.json()).toEqual({ error: "invalid_request" });
+  });
+
+  it("redirects to the URI the API echoed, never to the query's own", async () => {
+    // A (hypothetical) API answer for a different URI than the query named.
+    mockCreateCode.mockResolvedValue({
+      ok: true,
+      body: { code: CODE, redirectUri: SPOKE_CALLBACK },
+    });
+
+    const res = await GET(
+      request(
+        query({
+          redirect_uri: "https://attacker.example.com/api/hub-session/callback",
+        }),
+      ),
+    );
+
+    expect(new URL(res.headers.get("location") ?? "").origin).toBe(
+      "https://spoke.example.com",
+    );
+  });
+
+  it("answers 503, not a redirect, when the API echoes a URI that does not parse", async () => {
+    mockCreateCode.mockResolvedValue({
+      ok: true,
+      body: { code: CODE, redirectUri: "not a url" },
+    });
+
+    const res = await GET(request(query()));
+
+    expect(res.status).toBe(503);
+    expect(res.headers.get("location")).toBeNull();
+  });
+
+  it("AC-6: an unverified email goes to the hub's own /account/settings, never the spoke", async () => {
+    mockCreateCode.mockResolvedValue({
+      ok: false,
+      status: 403,
+      body: { ok: false, error: { code: "email_unverified", message: "x" } },
+    });
+
+    const res = await GET(request(query()));
+
+    expect(res.status).toBe(303);
+    expect(res.headers.get("location")).toBe("/account/settings");
+    expect(res.headers.get("location")).not.toContain("spoke.example.com");
+  });
+
+  it.each([
+    ["an unknown client", 400, "invalid_client"],
+    ["a rate limit", 429, "rate_limited"],
+    ["a forbidden caller", 403, "forbidden"],
+    ["an expired session", 401, "unauthorized"],
+  ])("%s is a 400, never a redirect", async (_name, status, code) => {
+    mockCreateCode.mockResolvedValue({
+      ok: false,
+      status,
+      body: { ok: false, error: { code, message: "x" } },
+    });
+
+    const res = await GET(request(query()));
+
+    expect(res.status).toBe(400);
+    expect(res.headers.get("location")).toBeNull();
+  });
+
+  it("answers 503 — not a redirect — when the API cannot be reached", async () => {
+    mockCreateCode.mockRejectedValue(new Error("network"));
+
+    const res = await GET(request(query()));
+
+    expect(res.status).toBe(503);
+    expect(res.headers.get("location")).toBeNull();
+    expect(await res.json()).toEqual({ error: "temporarily_unavailable" });
+  });
+
+  it.each([
+    ["unset", undefined],
+    ["not a URL", "not a url"],
+  ])(
+    "answers 503 when BETTER_AUTH_URL is %s (no pinned origin to send)",
+    async (_name, value) => {
+      if (value === undefined) delete process.env.BETTER_AUTH_URL;
+      else process.env.BETTER_AUTH_URL = value;
+
+      const res = await GET(request(query()));
+
+      expect(res.status).toBe(503);
+      expect(mockCreateCode).not.toHaveBeenCalled();
+    },
+  );
+});