create-ailk 0.19.0 → 0.20.0

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/hub-mode.test.tsx

@@ -25,11 +25,16 @@
  *     there is no subscription without reading `subscription.me`.
  *   - #8217 AC-1 (spec docs/specs/8217-spoke-billing-spoke-checkout-reads-spec.md
  *     D10–D12): Billing reads the seam's `loadSpokeBilling` — the plan, the
- *     card and Manage in Stripe for a subscription; the plain none line with
+ *     card and Manage billing for a subscription; the plain none line with
  *     no button for none or a spoke without the action (`null`); the
  *     unreadable line; the error row for a failed read — and never calls
  *     `subscription.me` or `member.billing` itself. `openBillingPortal`
  *     redirects to the loader's portal URL, and to nothing without one.
+ *   - #8431 AC-4 (spec docs/specs/8431-account-security-tab-human-sign-spec.md
+ *     D1–D3): Security says the hub manages sign-in and links to the hub's
+ *     own Security page, offers no password control and never reads the
+ *     seam's accounts; Log out POSTs the spoke's sign-out endpoint, never
+ *     Better Auth, and lands on `/account` only when it succeeded.
  */
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -73,6 +78,7 @@ jest.mock("next/headers", () => ({
 
 const mockReadSession = jest.fn();
 const mockLoadSpokeBilling = jest.fn();
+const mockReadOwnAccounts = jest.fn();
 // eslint-disable-next-line no-restricted-syntax -- #507: the seam is generated per build (#7894 D8); its `signIn: "hub"` render is the boundary under test, and no env or HTTP surface selects it.
 jest.mock("../../../../../lib/topology.generated", () => ({
   __esModule: true,
@@ -86,6 +92,8 @@ jest.mock("../../../../../lib/topology.generated", () => ({
   registerSiteStores: () => Promise.resolve(),
   // #8217 D7 — the billing render's loader; `null` is a spoke without the action.
   loadSpokeBilling: (...args: unknown[]) => mockLoadSpokeBilling(...args),
+  // #8431 D2a — a spoke has no local accounts; Security must never ask.
+  readOwnAccounts: (...args: unknown[]) => mockReadOwnAccounts(...args),
 }));
 
 const mockLeadsSubmit = jest.fn();
@@ -126,18 +134,20 @@ jest.mock("@working-theory/api-client", () => ({
 }));
 
 const mockUpdateUser = jest.fn();
+const mockSignOut = jest.fn();
 jest.mock("better-auth/react", () => ({
   __esModule: true,
   createAuthClient: () => ({
-    signOut: jest.fn(),
+    signOut: (...args: unknown[]) => mockSignOut(...args),
     updateUser: (...args: unknown[]) => mockUpdateUser(...args),
   }),
 }));
 
 const mockRedirect = jest.fn();
+const mockPush = jest.fn();
 jest.mock("next/navigation", () => ({
   __esModule: true,
-  useRouter: () => ({ push: jest.fn(), refresh: jest.fn(), replace: jest.fn() }),
+  useRouter: () => ({ push: mockPush, refresh: jest.fn(), replace: jest.fn() }),
   usePathname: () => "/account/general",
   redirect: (...args: unknown[]) => mockRedirect(...args),
 }));
@@ -196,6 +206,9 @@ beforeEach(() => {
   mockRedirect.mockReset();
   mockCookieSet.mockReset();
   mockUpdateUser.mockReset();
+  mockReadOwnAccounts.mockReset().mockResolvedValue(null);
+  mockSignOut.mockReset();
+  mockPush.mockReset();
 });
 
 afterEach(() => {
@@ -235,27 +248,17 @@ describe("AC-5 — General and Billing on a hub-mode spoke (#8232)", () => {
       mockMemberRead.mockResolvedValue({ ok: true, body: [] });
     });
 
-    it("renders the name and photo form and the deletion button, with no link to the hub's settings", async () => {
+    it("renders the name and photo form, with no link to the hub's settings", async () => {
       await renderGeneral();
       expect(screen.getByTestId("account-general-form")).toBeInTheDocument();
       expect(screen.getByLabelText("Name")).toHaveValue("Ada Lovelace");
       // No hub read carries the photo, so the field starts empty (C5).
       expect(screen.getByLabelText("Photo")).toHaveValue("");
-      expect(screen.getByTestId("account-deletion-request")).toBeInTheDocument();
       expect(screen.queryByTestId("account-settings-manage-on-hub")).not.toBeInTheDocument();
       expect(screen.queryByTestId("account-privacy-manage-on-hub")).not.toBeInTheDocument();
       expect(document.querySelector(`a[href^="${HUB}"]`)).toBeNull();
     });
 
-    it("the Security tab's sign-in line reads the hub, by the same name read (D7, moved from General)", async () => {
-      const { default: SecurityPage } = await import("../security/page");
-      render(await SecurityPage({ params: Promise.resolve({ locale: "en" }) }));
-      expect(screen.getByTestId("account-signin-method")).toHaveTextContent(
-        "You sign in through hub.example.com.",
-      );
-      expect(document.querySelector(`a[href^="${HUB}"]`)).toBeNull();
-    });
-
     it("saves the name through member.updateProfile with the Bearer credential, then re-seals the session", async () => {
       mockUpdateProfile.mockResolvedValue({ ok: true, body: { name: "Ada King", image: null } });
       mockHubMe.mockResolvedValue({ ok: true, body: { user: { ...USER, name: "Ada King" }, billingCustomerId: null } });
@@ -275,10 +278,32 @@ describe("AC-5 — General and Billing on a hub-mode spoke (#8232)", () => {
         user: { name: "Ada King" },
       });
     });
+  });
 
-    it("the deletion request goes through the member API and names the hub operator", async () => {
-      mockRequestDeletion.mockResolvedValue({ ok: true, body: { sentTo: "hub-operator" } });
+  describe("a hub that answers no member route (the fixture's 404)", () => {
+    it("shows the name read-only and offers no save", async () => {
       await renderGeneral();
+      expect(screen.getByTestId("account-general-name-text")).toHaveTextContent("Ada Lovelace");
+      expect(screen.queryByTestId("account-general-form")).not.toBeInTheDocument();
+      expect(screen.queryByLabelText("Photo")).not.toBeInTheDocument();
+      expect(document.querySelector(`a[href^="${HUB}"]`)).toBeNull();
+      expect(mockUpdateUser).not.toHaveBeenCalled();
+    });
+  });
+
+  // #8438 D16 — Request account deletion moved to Privacy; the hub-mode
+  // deletion coverage above moves with it, expectations unchanged.
+  describe("Privacy's deletion block on a hub-mode spoke (moved from General, #8438 D16)", () => {
+    async function renderPrivacy(): Promise<void> {
+      const { default: PrivacyPage } = await import("../privacy/page");
+      render(await PrivacyPage({ params: Promise.resolve({ locale: "en" }) }));
+    }
+
+    it("a hub that answers the member routes: the deletion request goes through the member API and names the hub operator", async () => {
+      mockMemberRead.mockResolvedValue({ ok: true, body: [] });
+      mockRequestDeletion.mockResolvedValue({ ok: true, body: { sentTo: "hub-operator" } });
+      await renderPrivacy();
+      expect(screen.getByTestId("account-deletion-request")).toBeInTheDocument();
       await act(async () => {
         fireEvent.click(screen.getByTestId("account-deletion-request"));
       });
@@ -286,19 +311,12 @@ describe("AC-5 — General and Billing on a hub-mode spoke (#8232)", () => {
       await waitFor(() => expect(screen.getByRole("status")).toHaveTextContent("Sent to the hub operator."));
       expect(mockLeadsSubmit).not.toHaveBeenCalled();
     });
-  });
 
-  describe("a hub that answers no member route (the fixture's 404)", () => {
-    it("shows the name read-only and offers no save and no deletion path", async () => {
-      await renderGeneral();
-      expect(screen.getByTestId("account-general-name-text")).toHaveTextContent("Ada Lovelace");
-      expect(screen.queryByTestId("account-general-form")).not.toBeInTheDocument();
-      expect(screen.queryByLabelText("Photo")).not.toBeInTheDocument();
+    it("a hub that answers no member route: offers no deletion path", async () => {
+      await renderPrivacy();
       expect(screen.queryByTestId("account-deletion-request")).not.toBeInTheDocument();
       expect(screen.queryByTestId("account-deletion-support")).not.toBeInTheDocument();
       expect(screen.getByText("This site can't take deletion requests right now.")).toBeInTheDocument();
-      expect(document.querySelector(`a[href^="${HUB}"]`)).toBeNull();
-      expect(mockUpdateUser).not.toHaveBeenCalled();
     });
   });
 
@@ -326,6 +344,77 @@ describe("AC-5 — General and Billing on a hub-mode spoke (#8232)", () => {
   });
 });
 
+describe("#8431 AC-4 — Security on a hub-mode spoke", () => {
+  const realFetch = Object.getOwnPropertyDescriptor(globalThis, "fetch");
+  const mockFetch = jest.fn();
+
+  beforeEach(() => {
+    mockFetch.mockReset();
+    Object.defineProperty(globalThis, "fetch", { value: mockFetch, writable: true, configurable: true });
+  });
+
+  afterEach(() => {
+    if (realFetch) Object.defineProperty(globalThis, "fetch", realFetch);
+    else Reflect.deleteProperty(globalThis, "fetch");
+  });
+
+  async function renderSecurity(): Promise<void> {
+    const { default: SecurityPage } = await import("../security/page");
+    render(await SecurityPage({ params: Promise.resolve({ locale: "en" }) }));
+  }
+
+  it("says the hub manages sign-in and links to the hub's Security page — no password control", async () => {
+    await renderSecurity();
+    expect(screen.getByTestId("account-security-hub").textContent).toBe(
+      "Your sign-in is managed at hub.example.com.",
+    );
+    const links = screen.getAllByTestId("account-security-hub-link");
+    expect(links).toHaveLength(1);
+    expect(links[0]).toHaveAttribute("href", `${HUB}/account/security`);
+    expect(screen.getByTestId("account-security-log-out")).toBeInTheDocument();
+    expect(screen.queryByTestId("account-security-password")).not.toBeInTheDocument();
+    expect(screen.queryByTestId("account-security-sentence")).not.toBeInTheDocument();
+    expect(screen.queryByText(/other devices/i)).toBeNull();
+    expect(mockReadOwnAccounts).not.toHaveBeenCalled();
+  });
+
+  it("with the hub config absent says 'our main site' and links nowhere", async () => {
+    delete process.env.AILK_HUB_CLIENT_SECRET;
+    await renderSecurity();
+    expect(screen.getByTestId("account-security-hub").textContent).toBe(
+      "Your sign-in is managed by our main site.",
+    );
+    expect(screen.queryByTestId("account-security-hub-link")).not.toBeInTheDocument();
+    expect(screen.getByTestId("account-security-log-out")).toBeInTheDocument();
+  });
+
+  it("Log out POSTs the spoke's sign-out endpoint, never Better Auth, and on a 204 lands on /account", async () => {
+    mockFetch.mockResolvedValue({ ok: true, status: 204 });
+    await renderSecurity();
+    await act(async () => {
+      fireEvent.click(screen.getByTestId("account-security-log-out"));
+    });
+    expect(mockFetch).toHaveBeenCalledTimes(1);
+    expect(mockFetch).toHaveBeenCalledWith("/api/hub-session/sign-out", {
+      method: "POST",
+      credentials: "same-origin",
+    });
+    expect(mockSignOut).not.toHaveBeenCalled();
+    expect(mockPush).toHaveBeenCalledWith("/account");
+  });
+
+  it("a refused sign-out (403) navigates nowhere and shows the error", async () => {
+    mockFetch.mockResolvedValue({ ok: false, status: 403 });
+    await renderSecurity();
+    await act(async () => {
+      fireEvent.click(screen.getByTestId("account-security-log-out"));
+    });
+    expect(mockPush).not.toHaveBeenCalled();
+    expect(mockSignOut).not.toHaveBeenCalled();
+    expect(screen.getByTestId("account-security-log-out-error")).toBeInTheDocument();
+  });
+});
+
 describe("#8217 AC-1 — Billing on a hub-mode spoke reads the seam's spoke billing (D10–D12)", () => {
   const VISA = { brand: "visa", last4: "4242", expMonth: 4, expYear: 2030 };
   const PORTAL_URL = "https://billing.stripe.com/p/session/test_fake";
@@ -347,7 +436,7 @@ describe("#8217 AC-1 — Billing on a hub-mode spoke reads the seam's spoke bill
     expect(mockMemberBilling).not.toHaveBeenCalled();
   });
 
-  it("a subscription renders the plan, the card and Manage in Stripe", async () => {
+  it("a subscription renders the plan, the card and Manage billing", async () => {
     mockLoadSpokeBilling.mockResolvedValue(
       stub({ kind: "subscription", status: "active", planName: "Pro", paymentMethod: VISA, unreadable: false }),
     );
@@ -356,7 +445,7 @@ describe("#8217 AC-1 — Billing on a hub-mode spoke reads the seam's spoke bill
     expect(card).toHaveTextContent("Pro");
     expect(card).toHaveTextContent("Active");
     expect(card).toHaveTextContent("visa ending in 4242, expires 04/2030");
-    expect(screen.getByTestId("account-billing-manage")).toHaveTextContent("Manage in Stripe");
+    expect(screen.getByTestId("account-billing-manage")).toHaveTextContent("Manage billing");
     expect(screen.queryByTestId("account-billing-none")).not.toBeInTheDocument();
     expect(screen.queryByTestId("account-billing-unreadable")).not.toBeInTheDocument();
   });

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/item.test.tsx

@@ -9,8 +9,12 @@
  *   2. An unknown kind, or an id the kind did not load, is a not-found —
  *      never an empty frame.
  *   3. A failed read renders an error with Retry (D12's posture).
+ *   4. A message whose `action` is `onboarding` has an Open onboarding
+ *      action to the locale's `/account/onboarding`; a message with no
+ *      action has none (#8515 D6, AC-4).
  *
- * The `purchase` kind reads `member.purchases` (#8231 D5).
+ * The `purchase` kind reads `member.purchases` (#8231 D5); the `message`
+ * kind reads `member.messages`.
  */
 import { fireEvent, render, screen, within } from "@testing-library/react";
 
@@ -52,11 +56,15 @@ jest.mock("../../../../../auth", () => ({
 
 const mockSignupMe = jest.fn();
 const mockMemberPurchases = jest.fn();
+const mockMemberMessages = jest.fn();
 jest.mock("@working-theory/api-client", () => ({
   __esModule: true,
   waitlistSignups: { me: (...args: unknown[]) => mockSignupMe(...args) },
   subscription: { me: jest.fn() },
-  member: { purchases: (...args: unknown[]) => mockMemberPurchases(...args) },
+  member: {
+    purchases: (...args: unknown[]) => mockMemberPurchases(...args),
+    messages: (...args: unknown[]) => mockMemberMessages(...args),
+  },
 }));
 
 const mockNotFound = jest.fn(() => {
@@ -85,9 +93,30 @@ const PURCHASE = {
   purchasedAt: "2026-09-04T10:00:00.000Z",
 };
 
+const MESSAGE = {
+  id: "int_plain",
+  subject: "Hello",
+  body: "A note.",
+  file: null,
+  action: null,
+  createdAt: "2026-10-14T09:00:00.000Z",
+  readAt: null,
+};
+const MESSAGES = [
+  MESSAGE,
+  {
+    ...MESSAGE,
+    id: "int_onboarding",
+    subject: "Your onboarding questions",
+    body: "Open this message in your account and choose Open onboarding.",
+    action: "onboarding",
+  },
+];
+
 beforeEach(() => {
   mockGetSession.mockReset().mockResolvedValue(SESSION);
   mockMemberPurchases.mockReset().mockResolvedValue({ ok: true, body: { items: [PURCHASE] } });
+  mockMemberMessages.mockReset().mockResolvedValue({ ok: true, body: { items: MESSAGES } });
   mockSignupMe.mockReset();
   mockNotFound.mockClear();
   mockRefresh.mockReset();
@@ -139,3 +168,29 @@ describe("one Inbox item", () => {
     expect(mockRefresh).toHaveBeenCalledTimes(1);
   });
 });
+
+describe("a message's onboarding action (#8515 D6, AC-4)", () => {
+  it("an onboarding message links to the locale's onboarding page", async () => {
+    await renderItem("message", "int_onboarding", "fr");
+    const links = screen
+      .getAllByRole("link", { name: "Open onboarding" })
+      .map((link) => link.getAttribute("href"));
+    expect(links.length).toBeGreaterThan(0);
+    expect(links.every((href) => href === "/fr/account/onboarding")).toBe(true);
+    expect(screen.getByTestId("account-item-action-onboarding-desk")).toHaveAttribute(
+      "href",
+      "/fr/account/onboarding",
+    );
+    // The body stays plain text.
+    expect(
+      screen.getByText("Open this message in your account and choose Open onboarding.").closest("a"),
+    ).toBeNull();
+  });
+
+  it("a message with no action has no onboarding link", async () => {
+    await renderItem("message", "int_plain", "fr");
+    expect(screen.getByRole("heading", { level: 1 })).toHaveTextContent("Hello");
+    expect(screen.queryByRole("link", { name: "Open onboarding" })).not.toBeInTheDocument();
+    expect(screen.queryByTestId("account-item-action-onboarding-desk")).not.toBeInTheDocument();
+  });
+});

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/layout-sign-out.test.tsx

@@ -0,0 +1,146 @@
+/**
+ * The account layout hands the generated seam's sign-out wiring to the client
+ * frame (#8465): a client component cannot import `topology.generated.ts`, so
+ * the server layout reads `SIGN_OUT_ENDPOINT` / `SIGN_IN_PATH` and passes them
+ * as props — the signed-in Nav's own pattern. Also pins that the Help center
+ * href is rendered only for an https URL (the #8467 review's Low finding).
+ */
+import { render } from "@testing-library/react";
+import type { ReactElement } from "react";
+
+jest.mock("next-intl/server", () => ({
+  __esModule: true,
+  getTranslations: async (arg: { namespace?: string }) => (key: string) =>
+    `${arg.namespace}.${key}`,
+}));
+
+let mockSeam: {
+  SIGN_IN_PATH: string | null;
+  SIGN_OUT_ENDPOINT: string | null;
+} = {
+  SIGN_IN_PATH: "/sign-in",
+  SIGN_OUT_ENDPOINT: null,
+};
+// eslint-disable-next-line no-restricted-syntax -- #507: the seam is generated per build (#7894 D8); its `signIn: "hub"` render is the boundary under test, and no env or HTTP surface selects it.
+jest.mock("../../../../../lib/topology.generated", () => ({
+  __esModule: true,
+  get SIGN_IN_PATH() {
+    return mockSeam.SIGN_IN_PATH;
+  },
+  get SIGN_OUT_ENDPOINT() {
+    return mockSeam.SIGN_OUT_ENDPOINT;
+  },
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- #507: test-seam mock; the layout under test composes these account modules and the suite asserts only the sign-out endpoint it forwards
+jest.mock("../account-data", () => ({
+  __esModule: true,
+  accountSession: async () => ({
+    ctx: { user: { name: "Ada", email: "ada@example.com" }, t: {} },
+  }),
+  loadForYou: async () => ({ items: [], now: "2026-10-12T00:00:00.000Z" }),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- #507: test-seam mock; the layout under test composes these account modules and the suite asserts only the sign-out endpoint it forwards
+jest.mock("../for-you-labels", () => ({
+  __esModule: true,
+  forYouLabels: () => ({}),
+}));
+// eslint-disable-next-line no-restricted-syntax -- #507: test-seam mock; the layout under test composes these account modules and the suite asserts only the sign-out endpoint it forwards
+jest.mock("../../../../../lib/site-logo", () => ({
+  __esModule: true,
+  siteLogo: () => null,
+}));
+
+const mockFrame = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: test-seam mock; the layout under test composes these account modules and the suite asserts only the sign-out endpoint it forwards
+jest.mock("../account-frame", () => ({
+  __esModule: true,
+  AccountFrame: (props: Record<string, unknown>) => {
+    mockFrame(props);
+    return null;
+  },
+}));
+
+import AccountLayout from "../layout";
+
+const ENV = process.env;
+
+async function renderLayout(locale = "en"): Promise<Record<string, unknown>> {
+  const node = (await AccountLayout({
+    children: null,
+    params: Promise.resolve({ locale }),
+  })) as ReactElement;
+  render(node);
+  return mockFrame.mock.calls[0]![0] as Record<string, unknown>;
+}
+
+beforeEach(() => {
+  mockFrame.mockReset();
+  mockSeam = { SIGN_IN_PATH: "/sign-in", SIGN_OUT_ENDPOINT: null };
+  process.env = { ...ENV };
+  delete process.env.AILK_HELP_CENTER_URL;
+});
+
+afterEach(() => {
+  process.env = ENV;
+});
+
+describe("sign-out wiring (#8465)", () => {
+  it("passes the endpoint and the localized sign-in path on a hub sign-in spoke", async () => {
+    mockSeam = {
+      SIGN_IN_PATH: "/account",
+      SIGN_OUT_ENDPOINT: "/api/hub-session/sign-out",
+    };
+    const props = await renderLayout("fr");
+    expect(props.signOutEndpoint).toBe("/api/hub-session/sign-out");
+    expect(props.signInHref).toBe("/fr/account");
+  });
+
+  it("falls back to the home when the seam names no sign-in path", async () => {
+    mockSeam = {
+      SIGN_IN_PATH: null,
+      SIGN_OUT_ENDPOINT: "/api/hub-session/sign-out",
+    };
+    expect((await renderLayout()).signInHref).toBe("/");
+  });
+
+  it("passes neither on a hub or a single site (no endpoint)", async () => {
+    const props = await renderLayout();
+    expect(props).not.toHaveProperty("signOutEndpoint");
+    expect(props).not.toHaveProperty("signInHref");
+  });
+
+  it("carries the failed-sign-out label to the frame", async () => {
+    const props = await renderLayout();
+    expect((props.labels as Record<string, string>).signOutFailed).toBe(
+      "account.frame.signOutFailed",
+    );
+  });
+});
+
+describe("Help center href (#8467 review, Low)", () => {
+  const helpItems = (
+    props: Record<string, unknown>,
+  ): { id: string; href: string }[] =>
+    props.helpItems as { id: string; href: string }[];
+
+  it("renders an https URL", async () => {
+    process.env.AILK_HELP_CENTER_URL = "https://help.example.com";
+    expect(helpItems(await renderLayout()).map((i) => i.id)).toContain(
+      "help-center",
+    );
+  });
+
+  it.each([
+    "javascript:alert(1)",
+    "http://help.example.com",
+    "not a url",
+    "data:text/html,x",
+  ])("drops %s", async (value) => {
+    process.env.AILK_HELP_CENTER_URL = value;
+    expect(helpItems(await renderLayout()).map((i) => i.id)).not.toContain(
+      "help-center",
+    );
+  });
+});