create-ailk 0.18.0 → 0.19.0

package/templates/apps/web/app/[locale]/(authed)/account/general/profile-form.tsx

@@ -0,0 +1,104 @@
+"use client"; // owns the save call and the router.refresh() that follows it
+
+/**
+ * GeneralSettings — User settings › General's adapter over the shared
+ * `AccountSettings` composition (#8339 D8; builds on #8232 D3, D4).
+ *
+ * Rewritten in place from `ProfileForm` (#7430 → #8232), which rendered its
+ * own form. The form, the color logic and the markup now live in
+ * `@working-theory/templates/account`'s `AccountSettings` (spec 8339 D4);
+ * this file supplies `profile` and `onSave` from `via` (General's
+ * `loadProfileSource`, D3):
+ *
+ *   - `member` — `saveProfile` (`PATCH /v1/member/profile`, D6). `image` is
+ *     sent only when the photo field changed (an untouched field never
+ *     clears a photo, 8232 D4/D6); a refusal keeps both fields as typed.
+ *   - `session` — a build with no member API: the name saves through
+ *     Better Auth's own `updateUser`, and no photo field shows
+ *     (`profile="name-only"`).
+ *   - `none` — a hub-mode spoke whose hub answers no member route: no form,
+ *     the name as read-only text (`profile="read-only"`).
+ *
+ * On success, both paths call `router.refresh()` so the rail's name follows
+ * the save.
+ */
+
+import {
+  AccountSettings,
+  type AccountGeneralLabels,
+  type AccountSaveResult,
+  type AccountSettingsFrameProps,
+} from "@working-theory/templates/account";
+import { createAuthClient } from "better-auth/react";
+import { useRouter } from "next/navigation";
+import type { ReactElement, ReactNode } from "react";
+
+import { saveProfile } from "../profile-actions";
+
+const authClient = createAuthClient();
+
+export interface GeneralSettingsLabels extends AccountGeneralLabels {
+  /** The `saveProfile` refusal lines not already in `AccountGeneralLabels`. */
+  unverified: string;
+  unavailable: string;
+}
+
+export function GeneralSettings({
+  frame,
+  user,
+  labels,
+  colorMode,
+  via,
+  children,
+}: {
+  frame: Omit<AccountSettingsFrameProps, "name" | "children">;
+  user: { name: string; email: string; image: string | null };
+  labels: GeneralSettingsLabels;
+  colorMode: { cookieName: string } | null;
+  via: "member" | "session" | "none";
+  children?: ReactNode;
+}): ReactElement {
+  const router = useRouter();
+
+  async function onSave({
+    name,
+    image,
+    imageChanged,
+  }: {
+    name: string;
+    image: string | null;
+    imageChanged: boolean;
+  }): Promise<AccountSaveResult> {
+    if (via === "session") {
+      const { error } = await authClient.updateUser({ name });
+      if (error) return { ok: false, message: labels.saveError };
+      router.refresh();
+      return { ok: true };
+    }
+    const res = await saveProfile(imageChanged ? { name, image } : { name });
+    if (!res.ok) {
+      if (res.reason === "photo") return { ok: false, field: "photo", message: labels.photoInvalid };
+      if (res.reason === "required") return { ok: false, field: "name", message: labels.nameRequired };
+      if (res.reason === "unverified") return { ok: false, message: labels.unverified };
+      if (res.reason === "unavailable") return { ok: false, message: labels.unavailable };
+      return { ok: false, message: labels.saveError };
+    }
+    router.refresh();
+    // exactOptionalPropertyTypes: omit `name` entirely rather than set it to
+    // `undefined` — AccountSaveResult's `name?: string` has no `undefined` value.
+    return { ok: true, image: res.image, ...(res.name !== null ? { name: res.name } : {}) };
+  }
+
+  return (
+    <AccountSettings
+      frame={frame}
+      user={user}
+      labels={labels}
+      colorMode={colorMode}
+      profile={via === "member" ? "editable" : via === "session" ? "name-only" : "read-only"}
+      {...(via === "none" ? {} : { onSave })}
+    >
+      {children}
+    </AccountSettings>
+  );
+}

package/templates/apps/web/app/[locale]/(authed)/account/general/profile-source.ts

@@ -0,0 +1,73 @@
+/**
+ * general/profile-source.ts (server code) — who saves User settings ›
+ * General's profile and takes its deletion request, and the photo the
+ * profile form starts with (#8232, spec
+ * docs/specs/8232-member-settings-account-general-and-spec.md D3, C2, C5).
+ *
+ * `via` — whether the member API answers, read once per request from
+ * `member.pieces`, the cheapest member read:
+ *
+ *   - `member` — any answer but a 404: a 2xx, any other refusal, a preflight
+ *     refusal (status 0) or a throw. A refusal of another kind belongs to the
+ *     write, which reports it honestly. A `503 tenant_unresolved` is
+ *     `member` too: the writes answer the same 503, shown as unavailable.
+ *   - on a 404, the sign-in seam (`signInMethod()`, D7) says who holds the
+ *     account. A `site` sign-in gives `session`: this site's own sign-in
+ *     holds it, and the 404 is a build with no tenancy module — every member
+ *     read and write registers in one module block — so the name saves
+ *     through Better Auth as before and deletion points at Support. A `hub`
+ *     sign-in gives `none`: the hub holds the account and answers no member
+ *     route for this spoke, and the spoke has no `/api/auth` of its own, so
+ *     no write can reach the account from here.
+ *
+ * A 404 is a module-presence test, as `read()` in `lib/account-config.ts`
+ * already makes; this file names no topology constant itself.
+ *
+ * `image` — the session's photo, which Better Auth's session carries at run
+ * time though the generated `SiteSession` type does not declare it. A hub
+ * session carries none (C5), so on a spoke the form starts empty.
+ */
+
+import { member } from "@working-theory/api-client";
+import type { AccountContext } from "@working-theory/templates/account";
+import { headers } from "next/headers";
+import { cache } from "react";
+
+import { readSession } from "../../../../../lib/topology.generated";
+import { signInMethod } from "../sign-in-method";
+
+export interface ProfileSource {
+  via: "member" | "session" | "none";
+  image: string | null;
+}
+
+/** `user.image` as a trimmed non-blank string, else `null`. */
+function sessionImage(session: unknown): string | null {
+  if (typeof session !== "object" || session === null) return null;
+  const user = (session as { user?: unknown }).user;
+  if (typeof user !== "object" || user === null) return null;
+  const image = (user as { image?: unknown }).image;
+  return typeof image === "string" && image.trim() !== "" ? image.trim() : null;
+}
+
+async function memberApiAnswers(ctx: AccountContext): Promise<boolean> {
+  try {
+    const res = await member.pieces(ctx.init);
+    return res.ok || res.status !== 404;
+  } catch {
+    return true;
+  }
+}
+
+export const loadProfileSource = cache(async (ctx: AccountContext): Promise<ProfileSource> => {
+  // The photo is optional: a failed session read starts the field empty
+  // rather than failing the page.
+  const [answers, session] = await Promise.all([
+    memberApiAnswers(ctx),
+    headers()
+      .then((h) => readSession(h))
+      .catch(() => null),
+  ]);
+  const via = answers ? "member" : signInMethod().kind === "site" ? "session" : "none";
+  return { via, image: sessionImage(session) };
+});

package/templates/apps/web/app/[locale]/(authed)/account/inbox/message/[id]/file/__tests__/route.test.ts

@@ -12,7 +12,9 @@
  * `forwardedCookieInit()` and streams the bytes back. The api-client's
  * `member.messageFile` is the one external boundary mocked; the seal, the
  * cookie read and the route's decisions are real. Covers:
- *   - a 404 unless the web seam's `SIGN_IN_PROVIDER` is `"hub"`, no hub call;
+ *   - on a single site (`SIGN_IN_PROVIDER` `"site"`) the read carries the
+ *     caller's session cookie to the site's own API, and serves the same
+ *     way (#8231 D9) — the route itself tests no topology;
  *   - the read carries the signed-in caller's own credential, and the bytes
  *     come back with all five hub headers unchanged;
  *   - a hub answer missing any of the five is refused 502 — never bytes on
@@ -36,10 +38,11 @@ jest.mock("../../../../../../../../../lib/topology.generated", () => ({
 }));
 
 const mockHeaders = jest.fn();
+const mockCookies = jest.fn();
 jest.mock("next/headers", () => ({
   __esModule: true,
   headers: (...args: unknown[]) => mockHeaders(...args),
-  cookies: jest.fn().mockResolvedValue({ toString: () => "" }),
+  cookies: (...args: unknown[]) => mockCookies(...args),
 }));
 
 import { seal } from "../../../../../../../../../lib/hub-session/seal";
@@ -102,6 +105,7 @@ beforeEach(() => {
   };
   mockProvider.value = "hub";
   mockHeaders.mockReset().mockResolvedValue(new Headers());
+  mockCookies.mockReset().mockResolvedValue({ toString: () => "" });
   mockMessageFile.mockReset().mockResolvedValue(fileResult());
 });
 
@@ -194,12 +198,18 @@ describe("the member file read on a spoke that signs in through its hub", () =>
   });
 });
 
-describe("on a site that does not sign in through a hub", () => {
-  it.each(["site", "none"] as const)("SIGN_IN_PROVIDER %s answers 404 and calls nothing", async (provider) => {
-    mockProvider.value = provider;
-    signedIn();
+describe("on a single site — its own sign-in (#8231 D9)", () => {
+  it("reads the file with the caller's session cookie and serves it with all five headers unchanged", async () => {
+    mockProvider.value = "site";
+    mockCookies.mockResolvedValue({ toString: () => "session=abc" });
     const res = await get();
-    expect(res.status).toBe(404);
-    expect(mockMessageFile).not.toHaveBeenCalled();
+    expect(mockMessageFile).toHaveBeenCalledWith(ID, { headers: { cookie: "session=abc" } });
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toBe(FILE_HEADERS.contentType);
+    expect(res.headers.get("content-disposition")).toBe(FILE_HEADERS.contentDisposition);
+    expect(res.headers.get("x-content-type-options")).toBe(FILE_HEADERS.contentTypeOptions);
+    expect(res.headers.get("content-security-policy")).toBe(FILE_HEADERS.contentSecurityPolicy);
+    expect(res.headers.get("cache-control")).toBe(FILE_HEADERS.cacheControl);
+    await expect(res.text()).resolves.toBe("%PDF-1.7 bytes");
   });
 });

package/templates/apps/web/app/[locale]/(authed)/account/inbox/message/[id]/file/route.ts

@@ -3,8 +3,8 @@
  *
  * A message's file action (the `message` Inbox kind, `lib/account-config.ts`)
  * links here. The browser holds neither the client's hub credential (sealed in
- * the `hub-session` cookie) nor this site's spoke key, so this route reads the
- * hub's `GET /v1/member/messages/:id/file` with `forwardedCookieInit()` — the
+ * the `hub-session` cookie) nor this site's spoke key, so this route reads
+ * `GET /v1/member/messages/:id/file` with `forwardedCookieInit()` — the
  * caller's own credential, so a client only ever gets their own file — and
  * streams the bytes back unread.
  *
@@ -16,8 +16,8 @@
  * A hub answer missing any of the five is refused 502 rather than served
  * without it.
  *
- * Only a spoke that signs in through its hub (`SIGN_IN_PROVIDER === "hub"`,
- * #7894) carries the credential; anywhere else this is a 404 with no call.
+ * On a single site the read carries the caller's session cookie; on a spoke
+ * that signs in through its hub, the client's hub credential (#8231 D9).
  * A refusal has no body: no credential (signed out) is a 401, a hub 4xx keeps
  * its status, and a hub 5xx, a transport the api-client refuses or a hub call
  * that throws is a 502.
@@ -25,7 +25,6 @@
 import { member, type MemberFileHeaders } from "@working-theory/api-client";
 
 import { forwardedCookieInit } from "../../../../../../../../lib/server-api";
-import { SIGN_IN_PROVIDER } from "../../../../../../../../lib/topology.generated";
 
 interface Context {
   params: Promise<{ locale: string; id: string }>;
@@ -55,7 +54,6 @@ function refusalStatus(status: number, body: unknown): number {
 
 // platform-decisions-waiver: api-versioning — a page-scoped download link on the site's own account area, not an API contract; it re-serves the versioned hub route /v1/member/messages/:id/file
 export async function GET(_request: Request, { params }: Context): Promise<Response> {
-  if (SIGN_IN_PROVIDER !== "hub") return refusal(404);
   const { id } = await params;
 
   // The api-client throws, rather than answering `{ ok: false }`, on a

package/templates/apps/web/app/[locale]/(authed)/account/layout.tsx

@@ -4,7 +4,8 @@
  *
  * RSC. Every `/account` route renders inside `SignedInShell` (through the
  * client `AccountFrame`): the site's logo as the rail's top tile, linking
- * home; Inbox as the rail's only row; a footer of the avatar and ? alone;
+ * home; the rail's rows — Inbox, a Library group holding Artifacts, then
+ * Settings (#8231 D1); a footer of the avatar and ? alone;
  * the card avatar menu (name, then Settings and Log out); the ? help menu
  * (Contact support, and Help center when `AILK_HELP_CENTER_URL` is set);
  * and below `md` a tab bar reading avatar · Inbox · For you · Help (#7469).
@@ -69,6 +70,8 @@ export default async function AccountLayout({
         inbox: t("frame.inbox"),
         forYou: t("frame.forYou"),
         settings: t("frame.settings"),
+        library: t("frame.library"),
+        artifacts: t("frame.artifacts"),
         signOut: t("frame.signOut"),
         help: t("frame.help"),
         accountMenu: t("frame.accountMenu"),

package/templates/apps/web/app/[locale]/(authed)/account/new-actions.ts

@@ -0,0 +1,219 @@
+"use server";
+
+/**
+ * account/new-actions.ts — the New menu's reads and writes (#8233, spec
+ * docs/specs/8233-member-new-menu-the-new-spec.md D5, D6; the writes are
+ * #8170's).
+ *
+ * A popup reads its data when it opens (D5) and posts through a write here:
+ *
+ *   - `readMeetingTypes` — `member.meetingTypes`, the types the provider
+ *     offers its clients.
+ *   - `readSlots` — `member.availability` for one type, from now to
+ *     `SLOT_WINDOW_DAYS` later. The range is computed here; the browser
+ *     sends only the slug and its time zone.
+ *   - `readRequestForm` — `member.requestForm`, the request-quote magnet's
+ *     current steps, or `form: null` while Request quote is switched off.
+ *   - `sendMessage` · `requestQuote` · `bookService` — `member.sendMessage`,
+ *     `member.requestQuote` and `member.book`.
+ *
+ * Every call sends `forwardedCookieInit()`'s init as built: on a single site
+ * the session cookie plus the request's `Origin` (`apps/api`'s cookie CSRF
+ * check), on a hub-mode spoke the hub credential — so nothing here tests the
+ * topology, and no identity is posted: the server takes the name and the
+ * verified email from the credential (8170 D7).
+ *
+ * A value is sent exactly as typed — never trimmed, never given a scheme: the
+ * server's `plainText` and `isHttpsLink` are the one rule. An optional value
+ * left empty or all-space is omitted, because the server refuses `""`. A
+ * refusal maps to its `error.code` when a popup has words for it, else to
+ * `failed`.
+ *
+ * Not a `*.actions.ts` file and no `*Action`-suffixed export: apps/mcp's
+ * parity test reads that suffix, and these member writes have no MCP twin by
+ * decision (8170's header). Logs carry the function, the status and the code
+ * only — never a typed value or a credential.
+ */
+
+import { member } from "@working-theory/api-client";
+import type {
+  MemberMeetingType,
+  MemberRequestFormResponse,
+  SchedulingSlot,
+} from "@working-theory/validation";
+
+import { forwardedCookieInit } from "../../../../lib/server-api";
+
+/** How far ahead Schedule service offers times (the read's own cap is 60 days). */
+const SLOT_WINDOW_DAYS = 14;
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+/** The refusal codes a popup has its own words for; anything else is `failed`. */
+const KNOWN_CODES = [
+  "link_not_https",
+  "answers_invalid",
+  "request_form_off",
+  "meeting_type_not_offered",
+  "slot_unavailable",
+  "too_many_requests",
+  "invalid_input",
+] as const;
+
+export type NewActionErrorCode = (typeof KNOWN_CODES)[number] | "failed";
+
+/** What a popup's form shows after a submit. */
+export type NewActionState =
+  | { kind: "idle" }
+  | { kind: "success" }
+  | { kind: "error"; code: NewActionErrorCode };
+
+export type NewReadResult<T> = ({ kind: "ok" } & T) | { kind: "error" };
+
+/** Structural mirror of `@working-theory/api-client`'s `ApiResult<T>` (not re-exported). */
+type ApiResult<T> = { ok: true; body: T } | { ok: false; status: number; body: unknown };
+
+/** PII-safe error identity for logs (the `checkout.actions.ts` idiom: `err.name` only). */
+function errorName(err: unknown): string {
+  return err instanceof Error ? err.name : "unknown";
+}
+
+/** The `error.code` of a member refusal body, when it has one. */
+function errorCode(body: unknown): string | null {
+  if (typeof body !== "object" || body === null) return null;
+  const error = (body as { error?: unknown }).error;
+  if (typeof error !== "object" || error === null) return null;
+  const code = (error as { code?: unknown }).code;
+  return typeof code === "string" ? code : null;
+}
+
+function knownCode(code: string | null): NewActionErrorCode {
+  return KNOWN_CODES.find((known) => known === code) ?? "failed";
+}
+
+/** A posted value as typed; `undefined` when it is absent or not a string. */
+function value(formData: FormData, name: string): string | undefined {
+  const entry = formData.get(name);
+  return typeof entry === "string" ? entry : undefined;
+}
+
+/** An optional posted value as typed, or `undefined` when it is empty or all-space. */
+function optional(formData: FormData, name: string): string | undefined {
+  const entry = value(formData, name);
+  return entry !== undefined && entry.trim() !== "" ? entry : undefined;
+}
+
+async function runRead<T, R>(
+  name: string,
+  call: (init: { headers: Record<string, string> }) => Promise<ApiResult<T>>,
+  shape: (body: T) => R,
+): Promise<NewReadResult<R>> {
+  try {
+    const res = await call(await forwardedCookieInit());
+    if (res.ok) return { kind: "ok", ...shape(res.body) };
+    console.error(`[new-actions] ${name} status=${res.status} code=${errorCode(res.body) ?? "none"}`);
+  } catch (err) {
+    console.error(`[new-actions] ${name} errName=${errorName(err)}`);
+  }
+  return { kind: "error" };
+}
+
+/** Action input is untrusted: a hand-built call may post anything but FormData. */
+function isFormData(input: unknown): input is FormData {
+  return input instanceof FormData;
+}
+
+async function runWrite(
+  name: string,
+  call: (init: { headers: Record<string, string> }) => Promise<ApiResult<unknown>>,
+): Promise<NewActionState> {
+  try {
+    const res = await call(await forwardedCookieInit());
+    if (res.ok) return { kind: "success" };
+    const code = knownCode(errorCode(res.body));
+    console.error(`[new-actions] ${name} status=${res.status} code=${code}`);
+    return { kind: "error", code };
+  } catch (err) {
+    console.error(`[new-actions] ${name} errName=${errorName(err)}`);
+    return { kind: "error", code: "failed" };
+  }
+}
+
+// ── Reads (D5) ───────────────────────────────────────────────────────────────
+
+export async function readMeetingTypes(): Promise<NewReadResult<{ items: MemberMeetingType[] }>> {
+  return runRead("readMeetingTypes", (init) => member.meetingTypes(init), ({ items }) => ({ items }));
+}
+
+export async function readSlots(input: {
+  slug: string;
+  timeZone?: string;
+}): Promise<NewReadResult<{ slots: SchedulingSlot[] }>> {
+  // Action input is untrusted: a hand-built call may send anything.
+  const { slug, timeZone } = (typeof input === "object" && input !== null ? input : {}) as {
+    slug?: unknown;
+    timeZone?: unknown;
+  };
+  if (typeof slug !== "string") return { kind: "error" };
+  const from = new Date();
+  const to = new Date(from.getTime() + SLOT_WINDOW_DAYS * DAY_MS);
+  const query = {
+    slug,
+    from: from.toISOString(),
+    to: to.toISOString(),
+    ...(typeof timeZone === "string" && timeZone !== "" ? { timeZone } : {}),
+  };
+  return runRead("readSlots", (init) => member.availability(query, init), ({ slots }) => ({ slots }));
+}
+
+export async function readRequestForm(): Promise<
+  NewReadResult<{ form: MemberRequestFormResponse["form"] }>
+> {
+  return runRead("readRequestForm", (init) => member.requestForm(init), ({ form }) => ({ form }));
+}
+
+// ── Writes (D6) — `(prev, formData)` for `useActionState` ───────────────────
+
+export async function sendMessage(
+  _prev: NewActionState,
+  formData: FormData,
+): Promise<NewActionState> {
+  if (!isFormData(formData)) return { kind: "error", code: "invalid_input" };
+  const link = optional(formData, "link");
+  const body = {
+    subject: value(formData, "subject") ?? "",
+    body: value(formData, "body") ?? "",
+    ...(link === undefined ? {} : { link }),
+  };
+  return runWrite("sendMessage", (init) => member.sendMessage(body, init));
+}
+
+/** The answers are the entries named `answer.<field name>`; a blank one is omitted. */
+export async function requestQuote(
+  _prev: NewActionState,
+  formData: FormData,
+): Promise<NewActionState> {
+  if (!isFormData(formData)) return { kind: "error", code: "invalid_input" };
+  const answers: Record<string, string> = {};
+  for (const key of new Set(formData.keys())) {
+    if (!key.startsWith("answer.")) continue;
+    const answer = optional(formData, key);
+    if (answer !== undefined) answers[key.slice("answer.".length)] = answer;
+  }
+  return runWrite("requestQuote", (init) => member.requestQuote({ answers }, init));
+}
+
+export async function bookService(
+  _prev: NewActionState,
+  formData: FormData,
+): Promise<NewActionState> {
+  if (!isFormData(formData)) return { kind: "error", code: "invalid_input" };
+  const timeZone = optional(formData, "timeZone");
+  const notes = optional(formData, "notes");
+  const body = {
+    slug: value(formData, "slug") ?? "",
+    start: value(formData, "start") ?? "",
+    ...(timeZone === undefined ? {} : { timeZone }),
+    ...(notes === undefined ? {} : { notes }),
+  };
+  return runWrite("bookService", (init) => member.book(body, init));
+}