create-ailk 0.19.0 → 0.20.0

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/agreements-prompt.test.tsx

@@ -0,0 +1,281 @@
+/**
+ * Tests for AgreementsPrompt (#8438 D13) and the carried-agreement cookie
+ * `acceptCarriedAgreementsAction` consumes — exercised here because this
+ * prompt is its one caller.
+ */
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+
+const mockRefresh = jest.fn();
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  useRouter: () => ({ refresh: mockRefresh }),
+}));
+
+const mockAcceptCarried = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- test-seam mock: the Server Action module is a "use server" boundary; the component only passes it through.
+jest.mock("../agreements-actions", () => ({
+  __esModule: true,
+  acceptCarriedAgreementsAction: (...args: unknown[]) => mockAcceptCarried(...args),
+}));
+
+const mockSetConsent = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- test-seam mock: the Server Action module is a "use server" boundary; the component only passes it through.
+jest.mock("../privacy/actions", () => ({
+  __esModule: true,
+  setConsentAction: (...args: unknown[]) => mockSetConsent(...args),
+}));
+
+import { AgreementsPrompt, type MissingAgreement } from "../agreements-prompt";
+
+const LABELS = {
+  titleNew: "Please accept our terms",
+  titleUpdated: "We've updated our terms",
+  accept: "Accept",
+  error: "We couldn't save that. Try again.",
+  policyLink: "Read our privacy policy",
+};
+
+const AGREEMENT: MissingAgreement = {
+  id: "account_terms",
+  statement: "You agree to our Terms and Privacy Policy.",
+  policyHref: "/terms",
+  version: 1,
+  hadPriorGrant: false,
+};
+
+beforeEach(() => {
+  mockRefresh.mockReset();
+  mockAcceptCarried.mockReset();
+  mockSetConsent.mockReset();
+});
+
+describe("AgreementsPrompt — with nothing missing", () => {
+  it("renders nothing and calls nothing", () => {
+    render(<AgreementsPrompt missing={[]} labels={LABELS} />);
+    expect(screen.queryByTestId("account-agreements-prompt")).not.toBeInTheDocument();
+    expect(mockAcceptCarried).not.toHaveBeenCalled();
+  });
+});
+
+describe("AgreementsPrompt — the carried-cookie fast path (D13)", () => {
+  it("tries it once on mount, with every missing id", async () => {
+    mockAcceptCarried.mockResolvedValue({ accepted: false });
+    render(<AgreementsPrompt missing={[AGREEMENT]} labels={LABELS} />);
+    await waitFor(() => expect(mockAcceptCarried).toHaveBeenCalledWith(["account_terms"]));
+    expect(mockAcceptCarried).toHaveBeenCalledTimes(1);
+  });
+
+  it("on accept, hides and refreshes — the card never shows", async () => {
+    mockAcceptCarried.mockResolvedValue({ accepted: true });
+    render(<AgreementsPrompt missing={[AGREEMENT]} labels={LABELS} />);
+    await waitFor(() => expect(mockRefresh).toHaveBeenCalledTimes(1));
+    expect(screen.queryByTestId("account-agreements-prompt")).not.toBeInTheDocument();
+  });
+
+  it("on a failed check, shows the card with the statement and policy link", async () => {
+    mockAcceptCarried.mockResolvedValue({ accepted: false });
+    render(<AgreementsPrompt missing={[AGREEMENT]} labels={LABELS} />);
+    expect(await screen.findByTestId("account-agreements-prompt")).toBeInTheDocument();
+    expect(screen.getByText("Please accept our terms")).toBeInTheDocument();
+    expect(screen.getByText("You agree to our Terms and Privacy Policy.")).toBeInTheDocument();
+    expect(screen.getByTestId("account-agreements-prompt-account_terms-policy")).toHaveAttribute(
+      "href",
+      "/terms",
+    );
+  });
+
+  it("shows the 'updated' title when any missing agreement had a prior grant", async () => {
+    mockAcceptCarried.mockResolvedValue({ accepted: false });
+    render(<AgreementsPrompt missing={[{ ...AGREEMENT, hadPriorGrant: true }]} labels={LABELS} />);
+    expect(await screen.findByText("We've updated our terms")).toBeInTheDocument();
+  });
+
+  it("a rejected check still shows the card, rather than throwing", async () => {
+    mockAcceptCarried.mockRejectedValue(new Error("down"));
+    render(<AgreementsPrompt missing={[AGREEMENT]} labels={LABELS} />);
+    expect(await screen.findByTestId("account-agreements-prompt")).toBeInTheDocument();
+  });
+});
+
+describe("AgreementsPrompt — the explicit Accept button", () => {
+  async function showCard(): Promise<void> {
+    mockAcceptCarried.mockResolvedValue({ accepted: false });
+    render(<AgreementsPrompt missing={[AGREEMENT]} labels={LABELS} />);
+    await screen.findByTestId("account-agreements-prompt");
+  }
+
+  it("posts every missing id through setConsentAction, then refreshes", async () => {
+    mockSetConsent.mockResolvedValue({ ok: true, dateLine: "Given Oct 12, 2026" });
+    await showCard();
+    fireEvent.click(screen.getByTestId("account-agreements-prompt-accept"));
+    await waitFor(() => expect(mockSetConsent).toHaveBeenCalledWith("account_terms", true));
+    await waitFor(() => expect(mockRefresh).toHaveBeenCalledTimes(1));
+  });
+
+  it("a failed answer shows the error and keeps the card", async () => {
+    mockSetConsent.mockResolvedValue({ ok: false, message: "nope" });
+    await showCard();
+    fireEvent.click(screen.getByTestId("account-agreements-prompt-accept"));
+    expect(await screen.findByTestId("account-agreements-prompt-error")).toHaveTextContent(
+      "We couldn't save that. Try again.",
+    );
+    expect(screen.getByTestId("account-agreements-prompt")).toBeInTheDocument();
+    expect(mockRefresh).not.toHaveBeenCalled();
+  });
+});
+
+// ── acceptCarriedAgreementsAction's own cookie checks (D13 C6) ────────────────
+//
+// The real action, loaded past the mock above — exercising the HMAC, the
+// one-hour window and the email-hash binding with real `node:crypto`.
+
+// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426 D5), not a runtime input; the seam IS the boundary between a hub and a spoke build, and there is no env or HTTP surface that selects it.
+jest.mock("../../../../../lib/topology.generated", () => ({
+  __esModule: true,
+  readSession: jest.fn(),
+}));
+
+const mockMemberSetConsent = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  member: { setConsent: (...args: unknown[]) => mockMemberSetConsent(...args) },
+}));
+
+const mockCookieGet = jest.fn();
+const mockCookieDelete = jest.fn();
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  cookies: jest.fn().mockResolvedValue({
+    get: (...args: unknown[]) => mockCookieGet(...args),
+    delete: (...args: unknown[]) => mockCookieDelete(...args),
+    toString: () => "",
+  }),
+  headers: jest.fn().mockResolvedValue(new Headers()),
+}));
+
+describe("acceptCarriedAgreementsAction (the real module, D13 C6)", () => {
+  const COOKIE_NAME = "ailk-signup-agreements"; // NODE_ENV !== "production" in jest
+  const EMAIL = "ada@example.com";
+
+  async function remember(email: string, purposeIds: string[]): Promise<string | undefined> {
+    const { rememberSignUpAgreementsAction } = jest.requireActual(
+      "../../../(auth)/sign-up/sign-up.actions",
+    ) as typeof import("../../../(auth)/sign-up/sign-up.actions");
+    await rememberSignUpAgreementsAction(email, purposeIds);
+    expect(mockCookieSet).toHaveBeenCalledTimes(1);
+    return mockCookieSet.mock.calls[0]?.[1] as string | undefined;
+  }
+
+  const mockCookieSet = jest.fn();
+
+  beforeEach(() => {
+    mockCookieGet.mockReset();
+    mockCookieDelete.mockReset();
+    mockCookieSet.mockReset();
+    mockMemberSetConsent.mockReset().mockResolvedValue({ ok: true, body: { purpose: {} } });
+    (jest.requireMock("../../../../../lib/topology.generated") as { readSession: jest.Mock }).readSession.mockReset();
+  });
+
+  // Minting goes through `cookies().set`, which the outer `cookies()` mock
+  // does not define — reassign it per test so `remember()` can capture the
+  // value, without disturbing the delete-tracking mock the "real action"
+  // suite shares.
+  beforeEach(() => {
+    const headersModule = jest.requireMock("next/headers") as {
+      cookies: jest.Mock;
+    };
+    headersModule.cookies.mockResolvedValue({
+      get: (...args: unknown[]) => mockCookieGet(...args),
+      set: (...args: unknown[]) => mockCookieSet(...args),
+      delete: (...args: unknown[]) => mockCookieDelete(...args),
+      toString: () => "",
+    });
+  });
+
+  async function accept(missingPurposeIds: string[]) {
+    const { acceptCarriedAgreementsAction } = jest.requireActual(
+      "../agreements-actions",
+    ) as typeof import("../agreements-actions");
+    return acceptCarriedAgreementsAction(missingPurposeIds);
+  }
+
+  it("a valid, fresh cookie whose email matches writes every missing purpose with via sign_up, then deletes the cookie", async () => {
+    const value = await remember(EMAIL, ["account_terms"]);
+    mockCookieGet.mockReturnValue({ value });
+    (jest.requireMock("../../../../../lib/topology.generated") as { readSession: jest.Mock }).readSession.mockResolvedValue({
+      user: { email: EMAIL, emailVerified: true },
+    });
+
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: true });
+    expect(mockMemberSetConsent).toHaveBeenCalledWith(
+      { purposeId: "account_terms", granted: true, via: "sign_up" },
+      expect.anything(),
+    );
+    expect(mockCookieDelete).toHaveBeenCalledWith(COOKIE_NAME);
+  });
+
+  it("a flipped character in the cookie fails the HMAC — posts nothing, deletes it, not accepted", async () => {
+    const value = await remember(EMAIL, ["account_terms"]);
+    const tampered = `${value?.slice(0, -1)}${value?.slice(-1) === "0" ? "1" : "0"}`;
+    mockCookieGet.mockReturnValue({ value: tampered });
+
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: false });
+    expect(mockMemberSetConsent).not.toHaveBeenCalled();
+    expect(mockCookieDelete).toHaveBeenCalledWith(COOKIE_NAME);
+  });
+
+  it("another email's hash is refused, even with a verified session", async () => {
+    const value = await remember("someone-else@example.com", ["account_terms"]);
+    mockCookieGet.mockReturnValue({ value });
+    (jest.requireMock("../../../../../lib/topology.generated") as { readSession: jest.Mock }).readSession.mockResolvedValue({
+      user: { email: EMAIL, emailVerified: true },
+    });
+
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: false });
+    expect(mockMemberSetConsent).not.toHaveBeenCalled();
+  });
+
+  it("an unverified session email is refused even when the hash would match", async () => {
+    const value = await remember(EMAIL, ["account_terms"]);
+    mockCookieGet.mockReturnValue({ value });
+    (jest.requireMock("../../../../../lib/topology.generated") as { readSession: jest.Mock }).readSession.mockResolvedValue({
+      user: { email: EMAIL, emailVerified: false },
+    });
+
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: false });
+  });
+
+  it("a cookie that does not cover every missing id is refused", async () => {
+    const value = await remember(EMAIL, ["account_terms"]);
+    mockCookieGet.mockReturnValue({ value });
+    (jest.requireMock("../../../../../lib/topology.generated") as { readSession: jest.Mock }).readSession.mockResolvedValue({
+      user: { email: EMAIL, emailVerified: true },
+    });
+
+    const result = await accept(["account_terms", "another_agreement"]);
+    expect(result).toEqual({ accepted: false });
+    expect(mockMemberSetConsent).not.toHaveBeenCalled();
+  });
+
+  it("an issuedAt more than an hour old is refused", async () => {
+    jest.useFakeTimers().setSystemTime(new Date("2026-10-12T00:00:00.000Z"));
+    const value = await remember(EMAIL, ["account_terms"]);
+    jest.setSystemTime(new Date("2026-10-12T01:00:01.000Z"));
+    mockCookieGet.mockReturnValue({ value });
+
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: false });
+    jest.useRealTimers();
+  });
+
+  it("no cookie present is refused, with no delete call", async () => {
+    mockCookieGet.mockReturnValue(undefined);
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: false });
+    expect(mockCookieDelete).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/billing.test.tsx

@@ -131,8 +131,22 @@ describe("the frame (D7)", () => {
   });
 });
 
+describe("the standalone shape (#8430)", () => {
+  it("takes the screen as the Admin's settings do: the rail column and the pane are the page's own landmarks", async () => {
+    await renderPage();
+    const settings = screen.getByTestId("account-settings");
+    expect(settings).toHaveClass("min-h-screen");
+    const column = within(settings).getByRole("complementary");
+    expect(column.firstElementChild).toBe(screen.getByTestId("account-settings-back"));
+    expect(column).toContainElement(screen.getByTestId("account-settings-rail"));
+    expect(within(settings).getByRole("main")).toContainElement(
+      screen.getByRole("heading", { level: 1 }),
+    );
+  });
+});
+
 describe("AC-5 — Billing as the current-plan card (D8)", () => {
-  it("(a) shows the plan, the status, the card and Manage in Stripe under the Current plan heading", async () => {
+  it("(a) shows the plan, the status, the card and Manage billing under the Current plan heading", async () => {
     await renderPage();
     expect(screen.getByText("Current plan")).toBeInTheDocument();
     const card = screen.getByTestId("account-billing-card");
@@ -141,7 +155,7 @@ describe("AC-5 — Billing as the current-plan card (D8)", () => {
     expect(within(card).getByTestId("account-billing-payment")).toHaveTextContent(
       "visa ending in 4242, expires 04/2027",
     );
-    expect(screen.getByTestId("account-billing-manage")).toHaveTextContent("Manage in Stripe");
+    expect(screen.getByTestId("account-billing-manage")).toHaveTextContent("Manage billing");
     expect(screen.queryByTestId("account-billing-none")).not.toBeInTheDocument();
     expect(screen.queryByTestId("account-billing-unreadable")).not.toBeInTheDocument();
   });
@@ -262,7 +276,7 @@ describe("AC-2 (e) — contributed billing sections render after the base conten
   });
 });
 
-describe("#8217 AC-1 — the single site's Manage in Stripe (D10, D11)", () => {
+describe("#8217 AC-1 — the single site's Manage billing (D10, D11)", () => {
   const PORTAL_URL = "https://billing.stripe.com/p/session/test_single_site";
 
   it("mints the portal once through the hub's route with the cookie init, then redirects there", async () => {

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/general.test.tsx

@@ -71,6 +71,8 @@ jest.mock("../../../../../auth", () => ({
 const mockPieces = jest.fn();
 const mockUpdateProfile = jest.fn();
 const mockRequestDeletion = jest.fn();
+const mockContact = jest.fn();
+const mockUpdateContact = jest.fn();
 const mockHubMe = jest.fn();
 const mockLeadsSubmit = jest.fn();
 jest.mock("@working-theory/api-client", () => ({
@@ -83,6 +85,8 @@ jest.mock("@working-theory/api-client", () => ({
     pieces: (...args: unknown[]) => mockPieces(...args),
     updateProfile: (...args: unknown[]) => mockUpdateProfile(...args),
     requestDeletion: (...args: unknown[]) => mockRequestDeletion(...args),
+    contact: (...args: unknown[]) => mockContact(...args),
+    updateContact: (...args: unknown[]) => mockUpdateContact(...args),
   },
   hubSignIn: { me: (...args: unknown[]) => mockHubMe(...args) },
   visitorForwardHeaders: () => null,
@@ -120,8 +124,9 @@ import type { AccountSettingsSection } from "@working-theory/templates/account";
 import { accountSettingsSections } from "../../../../../lib/account-config";
 import { seal } from "../../../../../lib/hub-session/seal";
 import { BillingAnchor } from "../general/billing-anchor";
+import { saveContact } from "../general/contact-actions";
 import Page from "../general/page";
-import { requestAccountDeletion, saveProfile } from "../profile-actions";
+import { saveProfile } from "../profile-actions";
 
 const PHOTO = "https://cdn.example.com/ada.png";
 const SESSION = {
@@ -179,6 +184,8 @@ beforeEach(() => {
   mockPieces.mockReset().mockResolvedValue(ok([]));
   mockUpdateProfile.mockReset().mockResolvedValue(ok({ name: "Ada King", image: PHOTO }));
   mockRequestDeletion.mockReset().mockResolvedValue(ok({ sentTo: "site-operator" }));
+  mockContact.mockReset().mockResolvedValue(ok({ contact: null }));
+  mockUpdateContact.mockReset().mockResolvedValue(ok({ contact: null }));
   mockHubMe.mockReset();
   mockLeadsSubmit.mockReset();
   mockUpdateUser.mockReset().mockResolvedValue({ data: { status: true }, error: null });
@@ -204,7 +211,7 @@ async function clickSave(): Promise<void> {
 // ── 1. The frame (AC-1, AC-4) ──────────────────────────────────────────────────
 
 describe("AC-1 — the frame (D2, D7)", () => {
-  it("renders in the settings frame: Back to the Inbox, and the four tabs with General current", async () => {
+  it("renders in the settings frame: Back to the Inbox, and the five tabs with General current (#8438 D14 adds Privacy)", async () => {
     await renderPage();
     expect(screen.getByTestId("account-settings")).toContainElement(
       screen.getByRole("heading", { level: 1, name: "General" }),
@@ -217,6 +224,7 @@ describe("AC-1 — the frame (D2, D7)", () => {
       ["General", "/account/general"],
       ["Security", "/account/security"],
       ["Notifications", "/account/notifications"],
+      ["Privacy", "/account/privacy"],
       ["Billing", "/account/billing"],
     ]);
     expect(links[0]).toHaveAttribute("aria-current", "page");
@@ -232,6 +240,7 @@ describe("AC-1 — the frame (D2, D7)", () => {
       "href",
       "/fr/account/notifications",
     );
+    expect(screen.getByTestId("account-settings-rail-privacy")).toHaveAttribute("href", "/fr/account/privacy");
     expect(screen.getByTestId("account-settings-rail-billing")).toHaveAttribute("href", "/fr/account/billing");
   });
 
@@ -245,19 +254,19 @@ describe("AC-1 — the frame (D2, D7)", () => {
     }
   });
 
-  it("the pane holds the email read-only, the name and photo inputs, in order before the deletion block", async () => {
+  it("the pane holds the email read-only, the name and photo inputs", async () => {
     await renderPage();
     const pane = screen.getByTestId("account-settings-general");
     expect(within(pane).getByTestId("account-general-email")).toHaveTextContent("ada@example.com");
     expect(within(pane).queryByRole("textbox", { name: "Email" })).not.toBeInTheDocument();
     expect(within(pane).getByLabelText("Name")).toHaveValue("Ada Lovelace");
     expect(within(pane).getByLabelText("Photo")).toHaveValue(PHOTO);
-    const form = within(pane).getByTestId("account-general-form");
-    const deletion = within(pane).getByTestId("account-deletion");
-    expect(form.compareDocumentPosition(deletion) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
-    expect(within(deletion).getByTestId("account-deletion-request")).toHaveTextContent(
-      "Request account deletion",
-    );
+  });
+
+  it("renders no deletion block — Request account deletion moved to Privacy (#8438 D16)", async () => {
+    await renderPage();
+    expect(screen.queryByTestId("account-deletion")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("account-deletion-request")).not.toBeInTheDocument();
   });
 
   it("the photo is never rendered as an image", async () => {
@@ -277,7 +286,7 @@ describe("AC-1 — the frame (D2, D7)", () => {
     expect(within(control).getAllByRole("radio").map((r) => r.textContent)).toEqual(["Light", "Auto", "Dark"]);
   });
 
-  it("a contributed settings section renders after the deletion block (C8)", async () => {
+  it("a contributed settings section renders after the general form (C8)", async () => {
     const section: AccountSettingsSection = {
       id: "extra",
       title: "settings.general.title",
@@ -286,9 +295,9 @@ describe("AC-1 — the frame (D2, D7)", () => {
     accountSettingsSections.push(section);
     try {
       await renderPage();
-      const deletion = screen.getByTestId("account-deletion");
+      const form = screen.getByTestId("account-general-form");
       const extra = screen.getByTestId("account-settings-extra");
-      expect(deletion.compareDocumentPosition(extra) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
+      expect(form.compareDocumentPosition(extra) & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
       expect(screen.getByTestId("extra-body")).toBeInTheDocument();
     } finally {
       accountSettingsSections.splice(accountSettingsSections.indexOf(section), 1);
@@ -296,6 +305,20 @@ describe("AC-1 — the frame (D2, D7)", () => {
   });
 });
 
+describe("the standalone shape (#8430)", () => {
+  it("takes the screen as the Admin's settings do: the rail column and the pane are the page's own landmarks", async () => {
+    await renderPage();
+    const settings = screen.getByTestId("account-settings");
+    expect(settings).toHaveClass("min-h-screen");
+    const column = within(settings).getByRole("complementary");
+    expect(column.firstElementChild).toBe(screen.getByTestId("account-settings-back"));
+    expect(column).toContainElement(screen.getByTestId("account-settings-rail"));
+    expect(within(settings).getByRole("main")).toContainElement(
+      screen.getByRole("heading", { level: 1 }),
+    );
+  });
+});
+
 // ── 2. The profile form on the member path (AC-3) ─────────────────────────────
 
 describe("AC-3 — name and photo through the member API (D4, D8)", () => {
@@ -366,7 +389,6 @@ describe("AC-3 — name and photo through the member API (D4, D8)", () => {
     mockPieces.mockResolvedValue(refusal(503, "tenant_unresolved"));
     await renderPage();
     expect(screen.getByLabelText("Photo")).toBeInTheDocument();
-    expect(screen.getByTestId("account-deletion-request")).toBeInTheDocument();
   });
 });
 
@@ -473,67 +495,146 @@ describe("AC-3 — a single site with no member API (a 404 from the pieces read)
     );
     expect(screen.getByLabelText("Name")).toHaveValue("Ada King");
   });
+});
+
+// ── #8435 D13 (AC-6) — the contact details on this site ───────────────────────
+
+describe("AC-6 — the contact details (#8435 D13)", () => {
+  const CONTACT = {
+    givenName: "Ada",
+    familyName: "Lovelace",
+    telephone: "+442071234567",
+    address: {
+      addressLine1: "1 Analytical Way",
+      addressLine2: null,
+      city: "London",
+      region: "LDN",
+      postalCode: "N1 1AA",
+      country: "GB",
+    },
+    companyName: "Engines Ltd",
+    jobTitle: "Countess",
+  };
 
-  it("points the deletion request at Support, with no Request button (C2, D5)", async () => {
+  it("with the member API, renders the contact section seeded from member.contact", async () => {
+    mockContact.mockResolvedValue(ok({ contact: CONTACT }));
     await renderPage();
-    expect(screen.queryByTestId("account-deletion-request")).not.toBeInTheDocument();
-    expect(screen.getByTestId("account-deletion-support")).toHaveAttribute("href", "/account/support");
-    expect(screen.getByText("To ask for your account to be deleted, contact support.")).toBeInTheDocument();
+    const section = screen.getByTestId("account-contact-section");
+    expect(mockContact).toHaveBeenCalledWith(COOKIE_INIT);
+    expect(within(section).getByTestId("contact-given-name")).toHaveValue("Ada");
+    expect(within(section).getByTestId("contact-company")).toHaveValue("Engines Ltd");
+    expect(within(section).getByTestId("field-addressLine1")).toHaveValue("1 Analytical Way");
+    // The profile form's single "Save changes" button stays unique.
+    expect(screen.getAllByRole("button", { name: "Save changes" })).toHaveLength(1);
+    expect(within(section).getByTestId("contact-details-save")).toHaveTextContent("Save contact details");
   });
-});
 
-// ── 4. The deletion request (AC-4) ────────────────────────────────────────────
+  it("with no confirmed contact yet, the form starts blank", async () => {
+    await renderPage();
+    expect(screen.getByTestId("contact-given-name")).toHaveValue("");
+  });
 
-describe("AC-4 — Request account deletion through the member API (D5)", () => {
-  async function requestDeletion(): Promise<void> {
-    await act(async () => {
-      fireEvent.click(screen.getByTestId("account-deletion-request"));
-    });
-  }
+  it("a failed read renders the section's unavailable line, not the form", async () => {
+    mockContact.mockResolvedValue(refusal(503, "tenant_unresolved"));
+    await renderPage();
+    expect(screen.queryByTestId("contact-details-form")).not.toBeInTheDocument();
+    expect(screen.getByTestId("account-contact-unavailable")).toHaveTextContent(
+      "Contact details aren't available on this site right now.",
+    );
+  });
 
-  it.each([
-    ["site-operator", "Sent to the site operator."],
-    ["hub-operator", "Sent to the hub operator."],
-  ])("an answer naming %s shows %s — the answer picks the line", async (sentTo, line) => {
-    mockRequestDeletion.mockResolvedValue(ok({ sentTo }));
+  it("a read that throws is the same unavailable line", async () => {
+    mockContact.mockRejectedValue(new Error("down"));
     await renderPage();
-    await requestDeletion();
-    expect(mockRequestDeletion).toHaveBeenCalledWith({}, COOKIE_INIT);
-    await waitFor(() => expect(screen.getByRole("status")).toHaveTextContent(line));
-    expect(screen.queryByTestId("account-deletion-request")).not.toBeInTheDocument();
-    expect(mockLeadsSubmit).not.toHaveBeenCalled();
+    expect(screen.getByTestId("account-contact-unavailable")).toBeInTheDocument();
+  });
+
+  it("with no member API (a 404 from the pieces read) the section does not render", async () => {
+    mockPieces.mockResolvedValue(refusal(404, "not_found"));
+    await renderPage();
+    expect(screen.queryByTestId("account-contact-section")).not.toBeInTheDocument();
+    expect(mockContact).not.toHaveBeenCalled();
   });
 
-  it("a refusal shows its line and keeps the button", async () => {
-    mockRequestDeletion.mockResolvedValue(refusal(403, "email_unverified"));
+  it("saving posts all six keys through saveContact and answers Saved", async () => {
+    mockContact.mockResolvedValue(ok({ contact: CONTACT }));
     await renderPage();
-    await requestDeletion();
-    await waitFor(() =>
-      expect(screen.getByRole("alert")).toHaveTextContent("Confirm your email address first, then ask again."),
+    fireEvent.change(screen.getByTestId("contact-company"), { target: { value: "Acme" } });
+    await act(async () => {
+      fireEvent.submit(screen.getByTestId("contact-details-form"));
+    });
+    await waitFor(() => expect(mockUpdateContact).toHaveBeenCalledTimes(1));
+    expect(mockUpdateContact).toHaveBeenCalledWith(
+      {
+        givenName: "Ada",
+        familyName: "Lovelace",
+        telephone: "+442071234567",
+        address: CONTACT.address,
+        companyName: "Acme",
+        jobTitle: "Countess",
+      },
+      COOKIE_INIT,
     );
-    expect(screen.getByTestId("account-deletion-request")).toBeEnabled();
+    expect(await screen.findByTestId("contact-details-message")).toHaveTextContent("Saved.");
+  });
+
+  it("a refused telephone shows its own line and keeps the fields as typed", async () => {
+    mockUpdateContact.mockResolvedValue(refusal(400, "telephone_invalid"));
+    await renderPage();
+    fireEvent.change(screen.getByTestId("contact-company"), { target: { value: "Acme" } });
+    await act(async () => {
+      fireEvent.submit(screen.getByTestId("contact-details-form"));
+    });
+    expect(await screen.findByTestId("contact-details-message")).toHaveTextContent(
+      "Enter the phone number with its country code.",
+    );
+    expect(screen.getByTestId("contact-company")).toHaveValue("Acme");
+  });
+});
+
+describe("AC-6 — saveContact (#8435 D13)", () => {
+  const BODY = {
+    givenName: "Ada",
+    familyName: null,
+    telephone: null,
+    address: null,
+    companyName: null,
+    jobTitle: null,
+  };
+
+  it("calls member.updateContact with forwardedCookieInit()'s init", async () => {
+    mockHeaders.mockResolvedValue(new Headers({ origin: "https://site.example.com" }));
+    await expect(saveContact(BODY)).resolves.toEqual({ ok: true });
+    expect(mockUpdateContact).toHaveBeenCalledWith(BODY, {
+      headers: { cookie: "session=abc", origin: "https://site.example.com" },
+    });
   });
 
   it.each([
+    [refusal(400, "telephone_invalid"), "telephone"],
+    [refusal(400, "invalid_input"), "invalid"],
     [refusal(403, "email_unverified"), "unverified"],
     [refusal(404, "not_found"), "unavailable"],
-    [refusal(503, "not_configured"), "unavailable"],
-    [refusal(503, "delivery_failed"), "unavailable"],
-    [refusal(500, "internal"), "failed"],
-  ])("requestAccountDeletion maps %j to %s", async (answer, reason) => {
-    mockRequestDeletion.mockResolvedValue(answer);
-    await expect(requestAccountDeletion()).resolves.toEqual({ ok: false, reason });
-    expect(mockRequestDeletion).toHaveBeenCalledWith({}, COOKIE_INIT);
+    [refusal(409, "contact_unavailable"), "unavailable"],
+    [refusal(503, "tenant_unresolved"), "unavailable"],
+    [refusal(500, "internal_error"), "failed"],
+  ])("maps %j to %s", async (res, reason) => {
+    mockUpdateContact.mockResolvedValue(res);
+    await expect(saveContact(BODY)).resolves.toEqual({ ok: false, reason });
   });
 
-  it("requestAccountDeletion answers who it went to, and a throw is failed", async () => {
-    mockRequestDeletion.mockResolvedValue(ok({ sentTo: "hub-operator" }));
-    await expect(requestAccountDeletion()).resolves.toEqual({ ok: true, sentTo: "hub-operator" });
-    mockRequestDeletion.mockRejectedValue(new TypeError("fetch failed"));
-    await expect(requestAccountDeletion()).resolves.toEqual({ ok: false, reason: "failed" });
+  it("a throw is failed, and a non-object body makes no call", async () => {
+    mockUpdateContact.mockRejectedValue(new Error("down"));
+    await expect(saveContact(BODY)).resolves.toEqual({ ok: false, reason: "failed" });
+    mockUpdateContact.mockClear();
+    await expect(saveContact(null as never)).resolves.toEqual({ ok: false, reason: "invalid" });
+    expect(mockUpdateContact).not.toHaveBeenCalled();
   });
 });
 
+// The deletion-request cases moved to privacy.test.tsx — Request account
+// deletion now renders on Privacy, not General (#8438 D16).
+
 // ── 5. #billing (AC-6) ────────────────────────────────────────────────────────
 
 describe("AC-6 — BillingAnchor forwards #billing to Billing (D8)", () => {