create-ailk 0.18.0 → 0.19.0

package/templates/apps/web/app/[locale]/(authed)/account/artifacts/[pieceId]/review-form.tsx

@@ -0,0 +1,145 @@
+"use client"; // submits through the review Server Action and shows its outcome
+
+/**
+ * ReviewForm — Approve or Request changes on an artifact's latest version
+ * (#8234, spec docs/specs/8234-member-artifacts-account-artifacts-and-spec.md
+ * D7). The artifact page renders it only while that version is reviewable
+ * (not approved, no review yet — `isReviewable`).
+ *
+ * The comment is controlled, so a refused review keeps what was typed
+ * (AC-MAA-07). A review that went through shows the sent line and refreshes
+ * the page once, which re-reads the artifact and shows Approved or the
+ * waiting line in the form's place. Every string arrives through `labels`.
+ */
+
+import {
+  Button,
+  Heading,
+  InlineMessage,
+  Label,
+  Text,
+  Textarea,
+} from "@working-theory/ui/primitives";
+import { REVIEW_COMMENT_MAX } from "@working-theory/validation";
+import { useRouter } from "next/navigation";
+import {
+  useActionState,
+  useEffect,
+  useId,
+  useState,
+  type ReactElement,
+} from "react";
+
+import {
+  submitArtifactReview,
+  type ArtifactReviewReason,
+  type ArtifactReviewState,
+} from "../artifact-actions";
+
+export interface ReviewFormLabels {
+  heading: string;
+  comment: string;
+  commentHint: string;
+  approve: string;
+  requestChanges: string;
+  submitting: string;
+  sent: string;
+  errors: Record<ArtifactReviewReason, string>;
+}
+
+export function ReviewForm({
+  pieceId,
+  version,
+  labels,
+}: {
+  pieceId: string;
+  version: number;
+  labels: ReviewFormLabels;
+}): ReactElement {
+  const commentId = useId();
+  const hintId = useId();
+  const router = useRouter();
+  const [comment, setComment] = useState("");
+  const [state, formAction, pending] = useActionState<
+    ArtifactReviewState,
+    FormData
+  >(submitArtifactReview, { kind: "idle" });
+  const reviewed = state.kind === "reviewed";
+
+  // Once per sent review: the page re-reads and replaces this form.
+  useEffect(() => {
+    if (reviewed) router.refresh();
+  }, [reviewed, router]);
+
+  if (reviewed) {
+    return (
+      <InlineMessage
+        variant="success"
+        role="status"
+        className="mt-block-tight text-body-sm"
+        data-testid="artifact-review-sent"
+      >
+        {labels.sent}
+      </InlineMessage>
+    );
+  }
+
+  return (
+    <form
+      action={formAction}
+      className="mt-block-tight flex flex-col gap-4"
+      data-testid="artifact-review-form"
+    >
+      <Heading level={3} visual={4} className="!text-body font-semibold">
+        {labels.heading}
+      </Heading>
+      <input type="hidden" name="pieceId" value={pieceId} />
+      <input type="hidden" name="version" value={String(version)} />
+      <div className="flex flex-col gap-2">
+        <Label htmlFor={commentId}>{labels.comment}</Label>
+        <Textarea
+          id={commentId}
+          name="comment"
+          value={comment}
+          rows={4}
+          maxLength={REVIEW_COMMENT_MAX}
+          aria-describedby={hintId}
+          onChange={(event) => setComment(event.target.value)}
+          data-testid="artifact-review-comment"
+        />
+        <Text as="p" id={hintId} variant="caption" tone="muted">
+          {labels.commentHint}
+        </Text>
+      </div>
+      {state.kind === "error" ? (
+        <InlineMessage variant="error" data-testid="artifact-review-error">
+          {labels.errors[state.reason]}
+        </InlineMessage>
+      ) : null}
+      <div className="flex flex-wrap gap-2">
+        <Button
+          type="submit"
+          name="review"
+          value="approved"
+          disabled={pending}
+          // 44px on a phone (a touch-first context); the 36px default from md up.
+          className="max-md:min-h-11"
+          data-testid="artifact-review-approve"
+        >
+          {pending ? labels.submitting : labels.approve}
+        </Button>
+        <Button
+          type="submit"
+          name="review"
+          value="changes-requested"
+          variant="outline"
+          disabled={pending}
+          className="max-md:min-h-11"
+          data-testid="artifact-review-request-changes"
+        >
+          {labels.requestChanges}
+        </Button>
+      </div>
+    </form>
+  );
+}

package/templates/apps/web/app/[locale]/(authed)/account/artifacts/[pieceId]/versions/[version]/file/route.ts

@@ -0,0 +1,100 @@
+/**
+ * A delivered version's file, re-served (#8234, spec
+ * docs/specs/8234-member-artifacts-account-artifacts-and-spec.md D5) —
+ * `GET /[locale]/account/artifacts/:pieceId/versions/:version/file`.
+ *
+ * A file version's Download on the artifact page links here. The browser
+ * holds neither the client's hub credential nor this site's spoke key, so
+ * this route reads `GET /v1/member/artifacts/:pieceId/versions/:version/file`
+ * with `forwardedCookieInit()` — the caller's own credential, so a client
+ * only ever gets their own file — and streams the bytes back unread. It
+ * mirrors `inbox/message/[id]/file/route.ts`: an app route file is not a
+ * shared module, so the header map and the refusal mapping are copied.
+ *
+ * SEC-7877-D (the obligation in `@working-theory/api-client`'s `member.ts`):
+ * the bytes go out with all five hub headers UNCHANGED — `Content-Type`,
+ * `Content-Disposition` (attachment), `X-Content-Type-Options: nosniff`, the
+ * sandbox `Content-Security-Policy` and `Cache-Control: private, no-store` —
+ * so the file is never a document on this origin and never cached on the way.
+ * A hub answer missing any of the five is refused 502 rather than served
+ * without it.
+ *
+ * The params are shape-checked before any call (a malformed piece id or a
+ * version that is not a whole number from 1 is a 404 with no call). A
+ * refusal has no body: no credential (signed out) is a 401, a hub 4xx keeps
+ * its status, and a hub 5xx, a transport the api-client refuses or a hub call
+ * that throws is a 502.
+ */
+import { member, type MemberFileHeaders } from "@working-theory/api-client";
+import { memberArtifactFileParamsSchema } from "@working-theory/validation";
+
+import { forwardedCookieInit } from "../../../../../../../../../lib/server-api";
+
+interface Context {
+  params: Promise<{ locale: string; pieceId: string; version: string }>;
+}
+
+/** The response header each of the five hub headers goes out under. */
+const FILE_HEADER_NAMES: Record<keyof MemberFileHeaders, string> = {
+  contentType: "Content-Type",
+  contentDisposition: "Content-Disposition",
+  contentTypeOptions: "X-Content-Type-Options",
+  contentSecurityPolicy: "Content-Security-Policy",
+  cacheControl: "Cache-Control",
+};
+
+function refusal(status: number): Response {
+  return new Response(null, {
+    status,
+    headers: { "Cache-Control": "private, no-store" },
+  });
+}
+
+/** The refusal's status, from the api-client's `{ ok: false, status, body }`. */
+function refusalStatus(status: number, body: unknown): number {
+  if (status === 0) {
+    const code = (body as { error?: { code?: unknown } } | null)?.error?.code;
+    return code === "unauthorized" ? 401 : 502;
+  }
+  return status >= 500 ? 502 : status;
+}
+
+// platform-decisions-waiver: api-versioning — a page-scoped download link on the site's own account area, not an API contract; it re-serves the versioned hub route /v1/member/artifacts/:pieceId/versions/:version/file
+export async function GET(
+  _request: Request,
+  { params }: Context,
+): Promise<Response> {
+  // Exactly the two segments the strict schema takes — `params` also carries `locale`.
+  const { pieceId, version } = await params;
+  const parsed = memberArtifactFileParamsSchema.safeParse({ pieceId, version });
+  if (!parsed.success) return refusal(404);
+
+  // The api-client throws, rather than answering `{ ok: false }`, on a
+  // network failure or a redirect — that is a 502 too, never Next's own 500.
+  let res: Awaited<ReturnType<typeof member.artifactFile>>;
+  try {
+    res = await member.artifactFile(
+      parsed.data.pieceId,
+      parsed.data.version,
+      await forwardedCookieInit(),
+    );
+  } catch {
+    return refusal(502);
+  }
+  if (!res.ok) return refusal(refusalStatus(res.status, res.body));
+
+  const { stream, headers } = res.body;
+  const out = new Headers();
+  for (const [key, name] of Object.entries(FILE_HEADER_NAMES) as [
+    keyof MemberFileHeaders,
+    string,
+  ][]) {
+    const value = headers[key];
+    if (value === null) {
+      await stream.cancel();
+      return refusal(502);
+    }
+    out.set(name, value);
+  }
+  return new Response(stream, { status: 200, headers: out });
+}

package/templates/apps/web/app/[locale]/(authed)/account/artifacts/__tests__/file-route.test.ts

@@ -0,0 +1,179 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * A delivered version's file, re-served (#8234, spec 8234 D5, AC-3;
+ * SEC-7877-D) — `GET /[locale]/account/artifacts/:pieceId/versions/:version/file`.
+ *
+ * The api-client's `member.artifactFile` is the one external boundary
+ * mocked; `forwardedCookieInit()` and the route's decisions are real (the
+ * build's own sign-in, a single site: the caller's session cookie). Covers:
+ *   - the read carries exactly the piece id, the version as a number and the
+ *     caller's credential, and the bytes come back with all five hub headers
+ *     unchanged;
+ *   - a hub answer missing any of the five is refused 502, its stream
+ *     cancelled — never bytes on this origin without them;
+ *   - malformed params are a 404 with no call — and `locale`, which Next
+ *     always passes, never makes a real request fail;
+ *   - refusals map to a status with no body and `private, no-store`;
+ *   - the route reads no topology constant.
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const mockArtifactFile = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  member: { artifactFile: (...args: unknown[]) => mockArtifactFile(...args) },
+}));
+
+const mockHeaders = jest.fn();
+const mockCookies = jest.fn();
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: (...args: unknown[]) => mockHeaders(...args),
+  cookies: (...args: unknown[]) => mockCookies(...args),
+}));
+
+import { GET } from "../[pieceId]/versions/[version]/file/route";
+
+const SITE = "https://site.example.com";
+const PIECE = "piece_01920000-0000-7000-8000-000000000001";
+const ROUTE_FILE = join(
+  __dirname,
+  "..",
+  "[pieceId]",
+  "versions",
+  "[version]",
+  "file",
+  "route.ts",
+);
+
+const FILE_HEADERS = {
+  contentType: "application/pdf",
+  contentDisposition: 'attachment; filename="brief-v2.pdf"',
+  contentTypeOptions: "nosniff",
+  contentSecurityPolicy: "default-src 'none'; sandbox",
+  cacheControl: "private, no-store",
+};
+
+function fileResult(
+  headers: Partial<Record<keyof typeof FILE_HEADERS, string | null>> = {},
+) {
+  return {
+    ok: true,
+    body: {
+      stream: new Response("%PDF-1.7 bytes").body,
+      headers: { ...FILE_HEADERS, ...headers },
+    },
+  };
+}
+
+function get(pieceId = PIECE, version = "2"): Promise<Response> {
+  return GET(
+    new Request(
+      `${SITE}/account/artifacts/${pieceId}/versions/${version}/file`,
+    ),
+    {
+      params: Promise.resolve({ locale: "en", pieceId, version }),
+    },
+  );
+}
+
+async function expectBodylessRefusal(
+  res: Response,
+  status: number,
+): Promise<void> {
+  expect(res.status).toBe(status);
+  expect(res.headers.get("cache-control")).toBe("private, no-store");
+  expect(res.headers.get("content-disposition")).toBeNull();
+  await expect(res.text()).resolves.toBe("");
+}
+
+beforeEach(() => {
+  mockHeaders.mockReset().mockResolvedValue(new Headers());
+  mockCookies.mockReset().mockResolvedValue({ toString: () => "session=abc" });
+  mockArtifactFile.mockReset().mockResolvedValue(fileResult());
+});
+
+describe("the version file read", () => {
+  it("reads the file with the piece id, the version as a number and the caller's credential, and re-serves it with all five headers unchanged", async () => {
+    const res = await get();
+    expect(mockArtifactFile).toHaveBeenCalledTimes(1);
+    expect(mockArtifactFile).toHaveBeenCalledWith(PIECE, 2, {
+      headers: { cookie: "session=abc" },
+    });
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toBe(FILE_HEADERS.contentType);
+    expect(res.headers.get("content-disposition")).toBe(
+      FILE_HEADERS.contentDisposition,
+    );
+    expect(res.headers.get("x-content-type-options")).toBe(
+      FILE_HEADERS.contentTypeOptions,
+    );
+    expect(res.headers.get("content-security-policy")).toBe(
+      FILE_HEADERS.contentSecurityPolicy,
+    );
+    expect(res.headers.get("cache-control")).toBe(FILE_HEADERS.cacheControl);
+    await expect(res.text()).resolves.toBe("%PDF-1.7 bytes");
+  });
+
+  it("forwards the request's Origin with the cookie, as forwardedCookieInit builds it", async () => {
+    mockHeaders.mockResolvedValue(new Headers({ origin: SITE }));
+    await get();
+    expect(mockArtifactFile).toHaveBeenCalledWith(PIECE, 2, {
+      headers: { cookie: "session=abc", origin: SITE },
+    });
+  });
+
+  it.each(Object.keys(FILE_HEADERS) as (keyof typeof FILE_HEADERS)[])(
+    "refuses 502 with no bytes when the hub's answer lacks %s",
+    async (name) => {
+      const result = fileResult({ [name]: null });
+      const cancel = jest.spyOn(result.body.stream as ReadableStream, "cancel");
+      mockArtifactFile.mockResolvedValue(result);
+      const res = await get();
+      expect(cancel).toHaveBeenCalled();
+      await expectBodylessRefusal(res, 502);
+    },
+  );
+
+  it.each([
+    ["a version of 0", PIECE, "0"],
+    ["a version that is not a number", PIECE, "abc"],
+    ["a fractional version", PIECE, "1.5"],
+    ["a malformed piece id", "x", "2"],
+  ])("%s is a 404 with no call", async (_case, pieceId, version) => {
+    const res = await get(pieceId, version);
+    expect(mockArtifactFile).not.toHaveBeenCalled();
+    await expectBodylessRefusal(res, 404);
+  });
+
+  it.each([
+    ["a status-0 unauthorized (signed out)", 0, "unauthorized", 401],
+    ["a status-0 insecure_transport", 0, "insecure_transport", 502],
+    ["a hub 404", 404, "not_found", 404],
+    ["a hub 403", 403, "forbidden", 403],
+    ["a hub 500", 500, "internal", 502],
+  ])("%s answers %#", async (_case, hubStatus, code, status) => {
+    mockArtifactFile.mockResolvedValue({
+      ok: false,
+      status: hubStatus,
+      body: { ok: false, error: { code, message: "x" } },
+    });
+    await expectBodylessRefusal(await get(), status);
+  });
+
+  it("a hub call that throws answers 502 with no body", async () => {
+    mockArtifactFile.mockRejectedValue(new TypeError("fetch failed"));
+    await expectBodylessRefusal(await get(), 502);
+  });
+
+  it("reads no topology constant", () => {
+    expect(readFileSync(ROUTE_FILE, "utf8")).not.toContain(
+      "topology.generated",
+    );
+  });
+});