create-ailk 0.18.0 → 0.19.1

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/security.test.tsx

@@ -0,0 +1,409 @@
+/**
+ * Tests for /[locale]/account/security — User settings › Security (#8339
+ * D8; #8431 D2, D3, AC-2, AC-3, AC-4).
+ *
+ *   - the frame with Security current (#8339);
+ *   - AC-2: a site or hub that can email a password link shows the Password
+ *     row from the session's own accounts, and its button requests a link
+ *     for the person's own address with the server-built `redirectTo`; a
+ *     seam rendered before #8431 degrades to the sentence;
+ *   - AC-3: any other site shows one sentence naming the deployment's
+ *     methods, never a provider list;
+ *   - AC-4 (site half): Log out signs out through Better Auth and lands on
+ *     the sign-in page, and a failed log-out navigates nowhere. The spoke
+ *     half is hub-mode.test.tsx's.
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { act, fireEvent, render, screen, within } from "@testing-library/react";
+
+jest.mock("next-intl/server", () => {
+  const msgs: unknown = require("../../../../../messages/en.json");
+  const dig = (obj: unknown, path: string): unknown =>
+    path.split(".").reduce<unknown>(
+      (acc, k) => (acc !== null && typeof acc === "object" ? (acc as Record<string, unknown>)[k] : undefined),
+      obj,
+    );
+  return {
+    __esModule: true,
+    getTranslations: async (arg: string | { namespace?: string; locale?: string }) => {
+      const ns = typeof arg === "string" ? arg : (arg.namespace ?? "");
+      const messages = dig(msgs, ns);
+      return (key: string, values?: Record<string, unknown>): string => {
+        const value = dig(messages, key);
+        if (typeof value !== "string") return `${ns}.${key}`;
+        return value.replace(/\{(\w+)\}/g, (m, name: string) =>
+          values && name in values ? String(values[name]) : m,
+        );
+      };
+    },
+  };
+});
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue(new Headers()),
+  cookies: jest.fn().mockResolvedValue({ toString: () => "session=abc" }),
+}));
+
+const mockGetSession = jest.fn();
+const mockListUserAccounts = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth.ts's lazy Better-Auth singleton has no HTTP/DB boundary a unit test of the session fields can mock without standing up Prisma.
+jest.mock("../../../../../auth", () => ({
+  __esModule: true,
+  auth: {
+    api: {
+      getSession: (...args: unknown[]) => mockGetSession(...args),
+      listUserAccounts: (...args: unknown[]) => mockListUserAccounts(...args),
+    },
+  },
+}));
+
+/** `stale: true` serves the seam as one rendered before #8431 — no accounts reader (D2b). */
+const mockSeam = { stale: false };
+// eslint-disable-next-line no-restricted-syntax -- #507: the seam is generated per build (#7894 D8); a seam rendered before #8431 (D2b) is the boundary under test, and no env or HTTP surface selects it.
+jest.mock("../../../../../lib/topology.generated", () => {
+  const real = jest.requireActual("../../../../../lib/topology.generated") as Record<string, unknown>;
+  return {
+    ...real,
+    __esModule: true,
+    get readOwnAccounts(): unknown {
+      return mockSeam.stale ? undefined : real.readOwnAccounts;
+    },
+  };
+});
+
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  waitlistSignups: { me: jest.fn() },
+  flowCheckouts: { me: jest.fn() },
+  subscription: { me: jest.fn(), portalSession: jest.fn() },
+  leads: { submit: jest.fn() },
+  member: { pieces: jest.fn().mockResolvedValue({ ok: true, body: [] }) },
+  hubSignIn: { me: jest.fn() },
+  visitorForwardHeaders: () => null,
+}));
+
+const mockRequestPasswordReset = jest.fn();
+const mockSignOut = jest.fn();
+jest.mock("better-auth/react", () => ({
+  __esModule: true,
+  createAuthClient: () => ({
+    requestPasswordReset: (...args: unknown[]) => mockRequestPasswordReset(...args),
+    signOut: (...args: unknown[]) => mockSignOut(...args),
+  }),
+}));
+
+const mockPush = jest.fn();
+const mockRefresh = jest.fn();
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  useRouter: () => ({ push: mockPush, refresh: mockRefresh, replace: jest.fn() }),
+  usePathname: () => "/account/security",
+  redirect: jest.fn(),
+}));
+
+import Page from "../security/page";
+
+const SESSION = {
+  user: {
+    id: "user_1",
+    name: "Ada Lovelace",
+    email: "ada@example.com",
+    emailVerified: true,
+    createdAt: new Date("2026-09-01T00:00:00.000Z"),
+  },
+};
+
+const BASE_URL = "https://site.example.com";
+const ENV = process.env;
+const ENV_KEYS = [
+  "GOOGLE_CLIENT_ID",
+  "GOOGLE_CLIENT_SECRET",
+  "GITHUB_CLIENT_ID",
+  "GITHUB_CLIENT_SECRET",
+  "AUTH_EMAIL_SERVER",
+  "AUTH_EMAIL_FROM",
+  "AUTH_EMAIL_WEBHOOK_SECRET",
+  "AILK_AUTH_PASSWORD_RESET",
+  "BETTER_AUTH_URL",
+  "BETTER_AUTH_SECRET",
+] as const;
+
+let contentRoot: string;
+
+beforeEach(() => {
+  process.env = { ...ENV };
+  for (const key of ENV_KEYS) delete process.env[key];
+  contentRoot = mkdtempSync(join(tmpdir(), "ailk-security-"));
+  process.env.AILK_CONTENT_ROOT = contentRoot;
+  writeFileSync(join(contentRoot, "_site.mdx"), '---\nsiteName: "Test"\n---\n');
+  mockGetSession.mockReset().mockResolvedValue(SESSION);
+  mockListUserAccounts.mockReset().mockResolvedValue([]);
+  mockRequestPasswordReset.mockReset().mockResolvedValue({ data: { status: true }, error: null });
+  mockSignOut.mockReset().mockResolvedValue({ data: { success: true }, error: null });
+  mockPush.mockReset();
+  mockRefresh.mockReset();
+  mockSeam.stale = false;
+});
+
+afterEach(() => {
+  rmSync(contentRoot, { recursive: true, force: true });
+  process.env = ENV;
+});
+
+async function renderPage(locale = "en"): Promise<void> {
+  render(await Page({ params: Promise.resolve({ locale }) }));
+}
+
+/** The five `resetSendConfigured()` conjuncts (C1). */
+function enableReset(): void {
+  process.env.AILK_AUTH_PASSWORD_RESET = "true";
+  process.env.AUTH_EMAIL_SERVER = "smtp://x";
+  process.env.AUTH_EMAIL_FROM = "site@example.com";
+  process.env.AUTH_EMAIL_WEBHOOK_SECRET = "w".repeat(32);
+  process.env.BETTER_AUTH_URL = BASE_URL;
+  process.env.BETTER_AUTH_SECRET = "s".repeat(32);
+}
+
+function enableGoogle(): void {
+  process.env.GOOGLE_CLIENT_ID = "id";
+  process.env.GOOGLE_CLIENT_SECRET = "secret";
+}
+
+function enableGitHub(): void {
+  process.env.GITHUB_CLIENT_ID = "id";
+  process.env.GITHUB_CLIENT_SECRET = "secret";
+}
+
+describe("the frame (D7, D8)", () => {
+  it("renders in the settings frame with Security current", async () => {
+    await renderPage();
+    expect(screen.getByRole("heading", { level: 1 })).toHaveTextContent("Security");
+    expect(screen.getByTestId("account-settings-back")).toHaveAttribute("href", "/account");
+    expect(screen.getByTestId("account-settings-rail-security")).toHaveAttribute("aria-current", "page");
+    expect(screen.getByTestId("account-settings-rail-general")).not.toHaveAttribute("aria-current");
+  });
+});
+
+describe("the standalone shape (#8430)", () => {
+  it("takes the screen as the Admin's settings do: the rail column and the pane are the page's own landmarks", async () => {
+    await renderPage();
+    const settings = screen.getByTestId("account-settings");
+    expect(settings).toHaveClass("min-h-screen");
+    const column = within(settings).getByRole("complementary");
+    expect(column.firstElementChild).toBe(screen.getByTestId("account-settings-back"));
+    expect(column).toContainElement(screen.getByTestId("account-settings-rail"));
+    expect(within(settings).getByRole("main")).toContainElement(
+      screen.getByRole("heading", { level: 1 }),
+    );
+  });
+});
+
+describe("AC-2 — a site or hub that can email a password link", () => {
+  beforeEach(enableReset);
+
+  it("with no password: Not set, the create note and Set password — read from the session's own accounts", async () => {
+    await renderPage();
+    expect(screen.getByRole("heading", { level: 2 })).toHaveTextContent("Sign-in methods");
+    expect(screen.getByTestId("account-security-password-status")).toHaveTextContent("Not set");
+    expect(screen.getByTestId("account-security-password-note")).toHaveTextContent(
+      "We'll email ada@example.com a secure link to create your password.",
+    );
+    expect(screen.getByTestId("account-security-password-request")).toHaveTextContent("Set password");
+    expect(mockListUserAccounts).toHaveBeenCalledTimes(1);
+    expect(mockListUserAccounts.mock.calls[0]?.[0]).toEqual({ headers: expect.any(Headers) });
+    expect(document.querySelector('input[type="password"]')).toBeNull();
+    expect(screen.getByTestId("account-security-log-out")).toBeInTheDocument();
+  });
+
+  it("with a credential account: Set, the change note and Change password", async () => {
+    mockListUserAccounts.mockResolvedValue([{ providerId: "google" }, { providerId: "credential" }]);
+    await renderPage();
+    expect(screen.getByTestId("account-security-password-status")).toHaveTextContent("Set");
+    expect(screen.getByTestId("account-security-password-note")).toHaveTextContent(
+      "We'll email ada@example.com a secure link to change your password.",
+    );
+    expect(screen.getByTestId("account-security-password-request")).toHaveTextContent("Change password");
+  });
+
+  it("a failed accounts read renders the error row in the block's place, with Log out still rendered", async () => {
+    const errorSpy = jest.spyOn(console, "error").mockImplementation(() => {});
+    mockListUserAccounts.mockRejectedValue(new TypeError("db down"));
+    await renderPage();
+    expect(within(screen.getByTestId("account-signin-method")).getByTestId("inbox-error")).toHaveTextContent(
+      "We couldn't check your password settings.",
+    );
+    expect(screen.queryByTestId("account-security-password")).not.toBeInTheDocument();
+    expect(screen.getByTestId("account-security-log-out")).toBeInTheDocument();
+    expect(errorSpy.mock.calls.map((args) => args.join(" "))).toEqual([
+      "[account] read failed source=security-password errName=TypeError",
+    ]);
+    errorSpy.mockRestore();
+  });
+
+  it.each([
+    ["en", `${BASE_URL}/reset-password`],
+    ["fr", `${BASE_URL}/fr/reset-password`],
+  ])("Set password (%s) requests a link for the session's own address with the server-built redirectTo", async (locale, redirectTo) => {
+    await renderPage(locale);
+    await act(async () => {
+      fireEvent.click(screen.getByTestId("account-security-password-request"));
+    });
+    expect(mockRequestPasswordReset).toHaveBeenCalledTimes(1);
+    expect(mockRequestPasswordReset).toHaveBeenCalledWith({ email: "ada@example.com", redirectTo });
+    expect(screen.getByTestId("account-security-password-sent")).toBeInTheDocument();
+  });
+
+  it("a refused request shows the error, not the sent line", async () => {
+    mockRequestPasswordReset.mockResolvedValue({ data: null, error: { status: 429 } });
+    await renderPage();
+    await act(async () => {
+      fireEvent.click(screen.getByTestId("account-security-password-request"));
+    });
+    expect(screen.getByTestId("account-security-password-error")).toBeInTheDocument();
+    expect(screen.queryByTestId("account-security-password-sent")).not.toBeInTheDocument();
+  });
+
+  it("with Google configured as well, no provider list renders", async () => {
+    enableGoogle();
+    await renderPage();
+    expect(screen.getByTestId("account-security-password")).toBeInTheDocument();
+    expect(screen.queryByText(/Google/)).not.toBeInTheDocument();
+  });
+
+  it("a seam rendered before #8431 (no accounts reader) degrades to the sentence, never the error row (D2b)", async () => {
+    mockSeam.stale = true;
+    await renderPage();
+    // The five reset conjuncts include the email link's four, so a site that
+    // can email a password link always offers the email link too.
+    expect(screen.getByTestId("account-security-sentence")).toHaveTextContent(
+      "You sign in with a link sent to ada@example.com or your email and password.",
+    );
+    expect(screen.queryByTestId("account-security-password")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("inbox-error")).not.toBeInTheDocument();
+    expect(screen.getByTestId("account-security-log-out")).toBeInTheDocument();
+    expect(mockListUserAccounts).not.toHaveBeenCalled();
+  });
+});
+
+describe("AC-3 — a site that cannot email a password link shows one sentence", () => {
+  it.each([
+    ["Google alone", [enableGoogle], "You sign in with Google."],
+    ["Google and GitHub", [enableGoogle, enableGitHub], "You sign in with Google or GitHub."],
+    [
+      "the email link alone",
+      [
+        () => {
+          process.env.AUTH_EMAIL_WEBHOOK_SECRET = "w".repeat(32);
+          process.env.AUTH_EMAIL_FROM = "site@example.com";
+          process.env.BETTER_AUTH_URL = BASE_URL;
+          process.env.BETTER_AUTH_SECRET = "s".repeat(32);
+        },
+      ],
+      "You sign in with a link sent to ada@example.com.",
+    ],
+    [
+      "the password method without the reset flag",
+      [
+        () => {
+          process.env.AUTH_EMAIL_SERVER = "smtp://x";
+          process.env.AUTH_EMAIL_FROM = "site@example.com";
+        },
+      ],
+      "You sign in with your email and password.",
+    ],
+  ])("%s", async (_label, arrange, sentence) => {
+    for (const step of arrange) step();
+    await renderPage();
+    expect(screen.getByTestId("account-security-sentence")).toHaveTextContent(sentence);
+    expect(screen.queryByText("You're signed in as ada@example.com.")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("account-security-password")).not.toBeInTheDocument();
+    expect(screen.queryByText("Sign-in methods")).not.toBeInTheDocument();
+    expect(screen.queryByText("Available")).not.toBeInTheDocument();
+    expect(mockListUserAccounts).not.toHaveBeenCalled();
+    expect(screen.getByTestId("account-security-log-out")).toBeInTheDocument();
+  });
+
+  it("with no configured method it names the signed-in address (C5)", async () => {
+    await renderPage();
+    expect(screen.getByTestId("account-security-sentence")).toHaveTextContent(
+      "You're signed in as ada@example.com.",
+    );
+  });
+
+  it("the old Sign-in keys are gone and every added key carries its D5 value", () => {
+    const msgs = require("../../../../../messages/en.json") as {
+      account: { settings: { signIn: Record<string, unknown>; security: Record<string, unknown> } };
+    };
+    const { signIn, security } = msgs.account.settings;
+    expect(Object.keys(signIn)).toEqual(["lead"]);
+    expect(security).toEqual({
+      title: "Security",
+      methodsHeading: "Sign-in methods",
+      passwordLabel: "Password",
+      passwordSet: "Set",
+      passwordNotSet: "Not set",
+      setHint: "Add a password so you can also sign in with your email and password.",
+      changeHint: "Change the password you sign in with.",
+      setNote: "We'll email {email} a secure link to create your password.",
+      changeNote: "We'll email {email} a secure link to change your password.",
+      setButton: "Set password",
+      changeButton: "Change password",
+      sending: "Sending…",
+      sent: "Link sent. It works once, for an hour. Saving a password signs you out everywhere.",
+      sendFailed: "We couldn't send the email. Try again in a few minutes.",
+      logOut: "Log out",
+      logOutFailed: "Log out didn't finish. Try again.",
+      signsInWith: "You sign in with {methods}.",
+      signedInAs: "You're signed in as {email}.",
+      methods: {
+        google: "Google",
+        github: "GitHub",
+        magicLink: "a link sent to {email}",
+        password: "your email and password",
+      },
+      managedAt: "Your sign-in is managed at {hub}.",
+      managedUnnamed: "Your sign-in is managed by our main site.",
+      manageOnHub: "Manage sign-in on {hub}",
+      passwordUnavailable: "We couldn't check your password settings.",
+    });
+  });
+});
+
+describe("AC-4 — Log out on a site", () => {
+  it.each([
+    ["en", "/sign-in"],
+    ["fr", "/fr/sign-in"],
+  ])("(%s) signs out through Better Auth once and lands on the sign-in page", async (locale, href) => {
+    enableGoogle();
+    await renderPage(locale);
+    await act(async () => {
+      fireEvent.click(screen.getByTestId("account-security-log-out"));
+    });
+    expect(mockSignOut).toHaveBeenCalledTimes(1);
+    expect(mockPush).toHaveBeenCalledWith(href);
+    expect(mockRefresh).toHaveBeenCalledTimes(1);
+  });
+
+  it("a refused sign-out navigates nowhere and shows the error", async () => {
+    mockSignOut.mockResolvedValue({ data: null, error: { status: 500 } });
+    await renderPage();
+    await act(async () => {
+      fireEvent.click(screen.getByTestId("account-security-log-out"));
+    });
+    expect(mockPush).not.toHaveBeenCalled();
+    expect(screen.getByTestId("account-security-log-out-error")).toBeInTheDocument();
+  });
+
+  it.each([
+    ["password", enableReset],
+    ["sentence", enableGoogle],
+  ])("the %s variant has no 'other devices' control", async (_label, arrange) => {
+    arrange();
+    await renderPage();
+    expect(screen.queryByText(/other devices/i)).toBeNull();
+  });
+});