create-ailk 0.19.0 → 0.19.1

package/templates/apps/web/app/[locale]/(authed)/account/settings-frame.tsx

@@ -4,15 +4,22 @@
  *
  * `memberSettingsFrame` supplies the member's half of the shared
  * `AccountSettingsFrame` (@working-theory/templates/account, spec 8339 D2):
- * `standalone: false` (the member area already renders inside AppShell's
- * own `<main>`), Back to the Inbox, and the four tabs in the reference's
- * order. Every member settings page calls it and renders the result through
- * `AccountSettingsFrame` (General, via the shared `AccountSettings`) or
- * directly (Security, Notifications, Billing).
+ * `standalone: true` — the Admin's shape, full height and flush, because the
+ * account layout renders these routes outside its AppShell (#8430) — Back to
+ * the Inbox, and the tabs of `SETTINGS_ROUTES`. Every member settings page
+ * calls it and renders the result through `AccountSettingsFrame` (General,
+ * via the shared `AccountSettings`) or directly (Security, Notifications,
+ * Billing).
  *
  * `SettingsSection` stays as it is: contributed sections
  * (`accountSettingsSections`, `accountBillingSections`) still use it, as do
  * General's and Billing's own trailing content.
+ *
+ * #8441 — `SETTINGS_ROUTES` is the ONE place the settings routes are named:
+ * the tabs here and `isSettingsPath` (which `account-frame.tsx` takes these
+ * routes out of its shell with) both read it, so a tab added here is a tab
+ * that renders outside the shell — never a second `<main>` nested in the
+ * shell's. Adding a tab is one line here (plus its page and message).
  */
 
 import type { AccountSettingsFrameProps, AccountSettingsTab } from "@working-theory/templates/account";
@@ -29,42 +36,43 @@ import type { ReactElement, ReactNode } from "react";
  * own `t` with `as unknown as Translate`. */
 export type Translate = (key: string, values?: Record<string, unknown>) => string;
 
+/** User settings' tabs, in the reference's order (#8339 D7) — each one a
+ * route that renders outside the account shell (#8430, #8441). */
+export const SETTINGS_ROUTES = [
+  { key: "general", path: "/account/general", titleKey: "settings.general.title", icon: UserRound },
+  { key: "security", path: "/account/security", titleKey: "settings.security.title", icon: ShieldCheck },
+  { key: "notifications", path: "/account/notifications", titleKey: "settings.notifications.title", icon: Bell },
+  { key: "billing", path: "/account/billing", titleKey: "settings.billing.title", icon: CreditCard },
+] as const;
+
+export type SettingsTabKey = (typeof SETTINGS_ROUTES)[number]["key"];
+
+/** Whether `pathname` is one of `SETTINGS_ROUTES`: the request locale's
+ * `/<locale>` prefix removed, then the rest compared whole — so a sub-route
+ * (`/account/billing/history`) is not a settings route unless it is listed. */
+export function isSettingsPath(pathname: string, locale: string): boolean {
+  const prefix = `/${locale}`;
+  const bare =
+    pathname === prefix || pathname.startsWith(`${prefix}/`) ? pathname.slice(prefix.length) : pathname;
+  return SETTINGS_ROUTES.some(({ path }) => path === bare);
+}
+
 /** The member's half of `AccountSettingsFrameProps` — every settings page's
  * `frame` prop, less `name` (the caller's own session) and `children`. */
 export function memberSettingsFrame(
   locale: string,
   t: Translate,
-  active: "general" | "security" | "notifications" | "billing",
+  active: SettingsTabKey,
 ): Omit<AccountSettingsFrameProps, "name" | "children"> {
-  const tabs: readonly AccountSettingsTab[] = [
-    {
-      key: "general",
-      label: t("settings.general.title"),
-      href: localeHref(locale, "/account/general"),
-      icon: <Icon icon={UserRound} size="sm" decorative className="shrink-0" />,
-    },
-    {
-      key: "security",
-      label: t("settings.security.title"),
-      href: localeHref(locale, "/account/security"),
-      icon: <Icon icon={ShieldCheck} size="sm" decorative className="shrink-0" />,
-    },
-    {
-      key: "notifications",
-      label: t("settings.notifications.title"),
-      href: localeHref(locale, "/account/notifications"),
-      icon: <Icon icon={Bell} size="sm" decorative className="shrink-0" />,
-    },
-    {
-      key: "billing",
-      label: t("settings.billing.title"),
-      href: localeHref(locale, "/account/billing"),
-      icon: <Icon icon={CreditCard} size="sm" decorative className="shrink-0" />,
-    },
-  ];
+  const tabs: readonly AccountSettingsTab[] = SETTINGS_ROUTES.map(({ key, path, titleKey, icon }) => ({
+    key,
+    label: t(titleKey),
+    href: localeHref(locale, path),
+    icon: <Icon icon={icon} size="sm" decorative className="shrink-0" />,
+  }));
 
   return {
-    standalone: false,
+    standalone: true,
     back: { label: t("settings.back"), href: localeHref(locale, "/account") },
     railLabel: t("settings.title"),
     accountLabel: t("settings.account"),

package/templates/apps/web/app/[locale]/(authed)/account/sign-in-method.ts

@@ -1,6 +1,6 @@
 /**
  * account/sign-in-method.ts (server code) — how a member signs in, for User settings ›
- * General's Sign-in section (#8232, spec
+ * Security's sign-in block (#8232, spec
  * docs/specs/8232-member-settings-account-general-and-spec.md D7).
  *
  * One of the account tree's TWO topology seams (roadmap D1; the other is

package/templates/apps/web/auth.ts

@@ -324,6 +324,24 @@ export function createAuth(deps: CreateAuthDeps = {}) {
   const sendResetPassword = makeSendResetPassword({
     prisma,
     send: authEmailTransport,
+    /**
+     * Who is signed in on the reset request (#8431 D4) — the Security tab's
+     * Set password, for a person with no password yet. Read through THIS
+     * instance (assigned below; the callback runs only during a request, by
+     * which time it exists), never a second one, and never by verifying the
+     * cookie by hand. `disableRefresh`: the mail callback runs in the
+     * background after the response, where a refresh's cookie write would
+     * throw and drop the mail. No request (a server-side call carries no
+     * cookie) or no `api` (a test double of `betterAuth`) is no session.
+     */
+    sessionUserId: async (request) => {
+      if (request === undefined || Reflect.get(instance, "api") === undefined) return null;
+      const session = await instance.api.getSession({
+        headers: request.headers,
+        query: { disableRefresh: true },
+      });
+      return session?.user.id ?? null;
+    },
   });
   const sendVerificationEmail = makeSendVerificationEmail({
     send: authEmailTransport,
@@ -419,7 +437,7 @@ export function createAuth(deps: CreateAuthDeps = {}) {
     }
   };
 
-  return betterAuth({
+  const instance = betterAuth({
     database: prismaAdapter(prisma, {
       provider: "postgresql",
     }),
@@ -643,6 +661,7 @@ export function createAuth(deps: CreateAuthDeps = {}) {
         ]
       : [nextCookies()],
   });
+  return instance;
 }
 
 // Lazy singleton: resolved on first access, not at module-load time.

package/templates/apps/web/lib/__tests__/auth-email.test.ts

@@ -152,6 +152,90 @@ describe("sendResetPassword (§ D14 — the credential-account check)", () => {
   });
 });
 
+describe("sendResetPassword — the signed-in carve-out (#8431 D4)", () => {
+  const USER = { id: "user_1", email: "person@example.com" };
+  const RESET_URL = "https://site.example/api/auth/reset-password/tok";
+  const REQUEST = { headers: new Headers({ cookie: "session=abc" }) } as Request;
+
+  it("sends ONE password-reset to the account's own address when the session is that person's", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { lines, log } = makeLog();
+    const sessionUserId = jest.fn().mockResolvedValue("user_1");
+    const cb = makeSendResetPassword({ prisma: makePrisma(false), send, log, sessionUserId });
+
+    await cb({ user: USER, url: RESET_URL }, REQUEST);
+
+    expect(sessionUserId).toHaveBeenCalledWith(REQUEST);
+    expect(send).toHaveBeenCalledTimes(1);
+    const [rawBody] = send.mock.calls[0] as [string];
+    expect(JSON.parse(rawBody)).toEqual({
+      kind: "password-reset",
+      userId: "user_1",
+      to: "person@example.com",
+      url: RESET_URL,
+      expiresInMinutes: 60,
+    });
+    expect(lines.some((l) => l.fields.reason === "self_service_set")).toBe(true);
+    expect(JSON.stringify(lines)).not.toContain("person@example.com");
+  });
+
+  it.each<[string, () => Promise<string | null>]>([
+    ["another person's id", () => Promise.resolve("user_2")],
+    ["null (no session)", () => Promise.resolve(null)],
+    ["a rejection", () => Promise.reject(new Error("db down"))],
+  ])("sends NOTHING and logs no address when the session lookup answers %s", async (_label, impl) => {
+    const send = jest.fn();
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(false), send, log, sessionUserId: jest.fn(impl) });
+
+    await expect(cb({ user: USER, url: RESET_URL }, REQUEST)).resolves.toBeUndefined();
+
+    expect(send).not.toHaveBeenCalled();
+    expect(lines.some((l) => l.fields.reason === "no_credential_account")).toBe(true);
+    expect(JSON.stringify(lines)).not.toContain("person@example.com");
+  });
+
+  it("logs the failed lookup's kind only", async () => {
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({
+      prisma: makePrisma(false),
+      send: jest.fn(),
+      log,
+      sessionUserId: jest.fn().mockRejectedValue(new Error("person@example.com broke")),
+    });
+    await cb({ user: USER, url: RESET_URL }, REQUEST);
+    expect(lines).toEqual([
+      {
+        level: "warn",
+        fields: {
+          userId: "user_1",
+          kind: "password-reset",
+          reason: "no_credential_account",
+          errorKind: "session_lookup_failed",
+        },
+      },
+    ]);
+  });
+
+  it("with no sessionUserId it sends nothing, as before", async () => {
+    const send = jest.fn();
+    const { log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(false), send, log });
+    await cb({ user: USER, url: RESET_URL }, REQUEST);
+    expect(send).not.toHaveBeenCalled();
+  });
+
+  it("a person WITH a password never needs the session lookup", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { log } = makeLog();
+    const sessionUserId = jest.fn();
+    const cb = makeSendResetPassword({ prisma: makePrisma(true), send, log, sessionUserId });
+    await cb({ user: USER, url: RESET_URL });
+    expect(sessionUserId).not.toHaveBeenCalled();
+    expect(send).toHaveBeenCalledTimes(1);
+  });
+});
+
 describe("the § D12 PII boundary", () => {
   it("never logs the address, the token or the assembled link", async () => {
     const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });

package/templates/apps/web/lib/auth-email.ts

@@ -200,6 +200,12 @@ async function dispatch(
 
 export interface ResetPasswordDeps extends DispatchDeps {
   prisma: AuthEmailPrisma;
+  /**
+   * The id of the person signed in on `request`, or `null` (#8431 D4). Set,
+   * it lets a signed-in person ask for their OWN first password — the
+   * Security tab's Set password. Unset, the § D14 guard is unchanged.
+   */
+  sessionUserId?: (request: Request | undefined) => Promise<string | null>;
 }
 
 /**
@@ -217,17 +223,29 @@ export interface ResetPasswordDeps extends DispatchDeps {
  * address does not exist": the second is the enumeration AC-1 forbids and the
  * first is nearly as useful to an attacker, since it maps a site's users to
  * their identity provider.
+ *
+ * THE ONE CARVE-OUT (#8431 D4). A person with no password who is SIGNED IN
+ * may set one from their Security tab, by the same emailed link: the mail
+ * goes out when `deps.sessionUserId(request)` is that same person's id. The
+ * concern above is an ANONYMOUS request adding a password path around
+ * someone's identity provider; a request carrying that person's own live
+ * session is that person. The anonymous path is unchanged and silent, the
+ * link still goes only to the account's own address, and a failed session
+ * lookup counts as no session.
  */
 export function makeSendResetPassword(deps: ResetPasswordDeps) {
   const { prisma, send } = deps;
   const log = deps.log ?? defaultLog;
-  return async function sendResetPassword({
-    user,
-    url,
-  }: {
-    user: { id: string; email: string };
-    url: string;
-  }): Promise<void> {
+  return async function sendResetPassword(
+    {
+      user,
+      url,
+    }: {
+      user: { id: string; email: string };
+      url: string;
+    },
+    request?: Request,
+  ): Promise<void> {
     let hasPassword: { id: string } | null;
     try {
       hasPassword = await prisma.account.findFirst({
@@ -245,12 +263,29 @@ export function makeSendResetPassword(deps: ResetPasswordDeps) {
     }
 
     if (!hasPassword) {
-      log.warn({
+      let sessionUserId: string | null = null;
+      let lookupFailed = false;
+      if (deps.sessionUserId) {
+        try {
+          sessionUserId = await deps.sessionUserId(request);
+        } catch {
+          lookupFailed = true;
+        }
+      }
+      if (sessionUserId !== user.id) {
+        log.warn({
+          userId: user.id,
+          kind: "password-reset",
+          reason: "no_credential_account",
+          ...(lookupFailed ? { errorKind: "session_lookup_failed" } : {}),
+        });
+        return; // no send; the endpoint's 200 body is unchanged
+      }
+      log.info({
         userId: user.id,
         kind: "password-reset",
-        reason: "no_credential_account",
+        reason: "self_service_set",
       });
-      return; // no send; the endpoint's 200 body is unchanged
     }
 
     await dispatch(

package/templates/apps/web/lib/topology.generated.ts

@@ -9,6 +9,8 @@
 // on this topology (#8070).
 // loadSpokeBilling reaches the spoke billing action only on a spoke that
 // signs in through its hub and carries commerce (#8217); elsewhere, null.
+// readOwnAccounts lists the signed-in person's own sign-in accounts through
+// Better Auth on a hub (#8431); a spoke has none here, so it answers null.
 
 export const TOPOLOGY: "hub" | "spoke" = "hub";
 export const UNSERVED_MCP_TOOLS: readonly string[] = [];
@@ -32,6 +34,13 @@ export async function readSession(headers: Headers): Promise<SiteSession> {
   return auth.api.getSession({ headers });
 }
 
+export async function readOwnAccounts(
+  headers: Headers,
+): Promise<ReadonlyArray<{ providerId: string }> | null> {
+  const { auth } = await import("../auth");
+  return auth.api.listUserAccounts({ headers });
+}
+
 export async function registerSiteStores(): Promise<void> {
   const { registerLicenseKeyStore } = await import("./license-key-store");
   await registerLicenseKeyStore();

package/templates/apps/web/messages/en.json

@@ -630,6 +630,7 @@
       "forYou": "For you",
       "settings": "Settings",
       "signOut": "Log out",
+      "signOutFailed": "We couldn't log you out. You're still signed in; try again.",
       "help": "Help",
       "contactSupport": "Contact support",
       "helpCenter": "Help center",
@@ -715,26 +716,65 @@
         "saveError": "We couldn't save your changes. Try again.",
         "photoInvalid": "Enter a link that starts with https://.",
         "unverified": "Confirm your email address first, then try again.",
-        "unavailable": "Profile changes aren't available on this site yet."
+        "unavailable": "Profile changes aren't available on this site yet.",
+        "contact": {
+          "title": "Contact details",
+          "lead": "Kept on this site, for the people you work with here.",
+          "givenName": "First name",
+          "familyName": "Last name",
+          "telephone": "Phone",
+          "address": "Address",
+          "companyName": "Company",
+          "jobTitle": "Job title",
+          "save": "Save contact details",
+          "saving": "Saving…",
+          "saved": "Saved.",
+          "addressIncomplete": "Fill in the address line, city, state or region, postal code and country, or clear the whole address.",
+          "unavailable": "Contact details aren't available on this site right now.",
+          "errors": {
+            "telephone": "Enter the phone number with its country code.",
+            "invalid": "Some of these details couldn't be saved. Check them and try again.",
+            "unverified": "Confirm your email address first, then try again.",
+            "unavailable": "Contact details can't be saved on this site yet.",
+            "failed": "We couldn't save your contact details. Try again."
+          }
+        }
       },
       "security": {
-        "title": "Security"
+        "title": "Security",
+        "methodsHeading": "Sign-in methods",
+        "passwordLabel": "Password",
+        "passwordSet": "Set",
+        "passwordNotSet": "Not set",
+        "setHint": "Add a password so you can also sign in with your email and password.",
+        "changeHint": "Change the password you sign in with.",
+        "setNote": "We'll email {email} a secure link to create your password.",
+        "changeNote": "We'll email {email} a secure link to change your password.",
+        "setButton": "Set password",
+        "changeButton": "Change password",
+        "sending": "Sending…",
+        "sent": "Link sent. It works once, for an hour. Saving a password signs you out everywhere.",
+        "sendFailed": "We couldn't send the email. Try again in a few minutes.",
+        "logOut": "Log out",
+        "logOutFailed": "Log out didn't finish. Try again.",
+        "signsInWith": "You sign in with {methods}.",
+        "signedInAs": "You're signed in as {email}.",
+        "methods": {
+          "google": "Google",
+          "github": "GitHub",
+          "magicLink": "a link sent to {email}",
+          "password": "your email and password"
+        },
+        "managedAt": "Your sign-in is managed at {hub}.",
+        "managedUnnamed": "Your sign-in is managed by our main site.",
+        "manageOnHub": "Manage sign-in on {hub}",
+        "passwordUnavailable": "We couldn't check your password settings."
       },
       "notifications": {
         "title": "Notifications"
       },
       "signIn": {
-        "lead": "How you sign in to this site.",
-        "methods": {
-          "google": "Google",
-          "github": "GitHub",
-          "magicLink": "Email sign-in link",
-          "password": "Password"
-        },
-        "available": "Available",
-        "none": "No sign-in method is configured.",
-        "viaHub": "You sign in through {hub}.",
-        "viaHubUnnamed": "You sign in through our main site."
+        "lead": "How you sign in to this site."
       },
       "privacy": {
         "lead": "Cookies and your data.",
@@ -757,7 +797,7 @@
         "accessEnds": "Access ends {date}",
         "card": "{brand} ending in {last4}, expires {month}/{year}",
         "noCard": "No card on file",
-        "manage": "Manage in Stripe",
+        "manage": "Manage billing",
         "none": "You don't have a subscription.",
         "unavailable": "We couldn't load your billing details.",
         "unreadable": "Some of your billing is with another Stripe account, so it isn't shown here.",

package/templates/database/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @working-theory/database
 
+## 0.40.0
+
+### Minor Changes
+
+- [#8497](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8497) [`52df359`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/52df359fb2a4d1aff488136126dba16d13e49a26) Thanks [@samuelhenry](https://github.com/samuelhenry)! - Contact details on the client record ([#8435](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8435), spec docs/specs/8435-contact-details-on-the-client-spec.md).
+
+  A Person now carries a given name, a family name, an E.164 telephone, a six-part address, a company name and a job title, with the two columns that say who last saved them by hand. `callbacks` and `subscribers` gain a `person_id` foreign key. A capture fills only a blank field of an uncurated Person; the operator edits the contact from the Person page and a client edits their own on the site, from the account General tab. A magnet field's `mapsTo` tag names the contact field it fills: `email`, `name`, `givenName`, `familyName`, `phone`, `address`, `company`, `jobTitle`. Additive; the migration (`20261014120000_person_contact`, its second half the idempotent backfill) deploys before the code.
+
+- [#8490](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/pull/8490) [`64adcf9`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/64adcf9b58a3f3be3b42782e14018234b263b9bc) Thanks [@samuelhenry](https://github.com/samuelhenry)! - The consent ledger ([#8438](https://github.com/working-theory-labs/ai-launch-kit-internal/issues/8438), the API half). The per-site consent registry gains a kind (`agreement` · `consent` · `preference`), a plain description, a policy link and a policy version per purpose, and its platform default now declares `service_terms`, `account_terms` and `analytics_cookies`; a registry stored before this change still parses and means what it meant. `consent_grants` becomes the one ledger: each row names its source (`cookie_banner` · `sign_up` · `magnet` · `account_settings` · `email_unsubscribe` · `api`), its policy version and, when known, its Person, and the database refuses to change or truncate a stored row. A new `consent_visitor_links` table joins a banner visitor to the Person a later form identifies. `@working-theory/api-client` gains `consent.recordCookieChoice`, `consent.unsubscribe`, `member.consents` and `member.setConsent`; `@working-theory/validation` gains their wire schemas and the `platform-consents` permission. Run the new migration before deploying code that writes the ledger.
+
+### Patch Changes
+
+- Updated dependencies [[`52df359`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/52df359fb2a4d1aff488136126dba16d13e49a26), [`64adcf9`](https://github.com/Working-Theory-Labs/ai-launch-kit-internal/commit/64adcf9b58a3f3be3b42782e14018234b263b9bc)]:
+  - @working-theory/validation@0.40.0
+  - @working-theory/ids@0.13.0
+
 ## 0.39.0
 
 ### Minor Changes