create-ailk 0.19.0 → 0.20.0

package/templates/apps/web/app/[locale]/unsubscribe/__tests__/unsubscribe.test.tsx

@@ -0,0 +1,158 @@
+/**
+ * Tests for /[locale]/unsubscribe (#8438 D17, AC-3 unsubscribe).
+ */
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+
+/**
+ * One interpolating translator for both halves of the page: the server half
+ * (`getTranslations`, the heading and lead) and the client island
+ * (`useTranslations`, whose done line formats `{description}` in). The
+ * workspace's mapped `next-intl` stub ignores ICU values, so it is replaced
+ * here, the way this file already replaces `next-intl/server`.
+ */
+function mockTranslator(ns: string): (key: string, values?: Record<string, unknown>) => string {
+  const msgs: unknown = require("../../../../messages/en.json");
+  const dig = (obj: unknown, path: string): unknown =>
+    path.split(".").reduce<unknown>(
+      (acc, k) => (acc !== null && typeof acc === "object" ? (acc as Record<string, unknown>)[k] : undefined),
+      obj,
+    );
+  const messages = dig(msgs, ns);
+  return (key, values) => {
+    const value = dig(messages, key);
+    if (typeof value !== "string") return `${ns}.${key}`;
+    return value.replace(/\{(\w+)\}/g, (m, name: string) =>
+      values && name in values ? String(values[name]) : m,
+    );
+  };
+}
+
+jest.mock("next-intl/server", () => ({
+  __esModule: true,
+  getTranslations: async (arg: string | { namespace?: string; locale?: string }) =>
+    mockTranslator(typeof arg === "string" ? arg : (arg.namespace ?? "")),
+}));
+
+jest.mock("next-intl", () => ({
+  __esModule: true,
+  useTranslations: (ns: string) => mockTranslator(ns),
+}));
+
+const mockUnsubscribe = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  consent: { unsubscribe: (...args: unknown[]) => mockUnsubscribe(...args) },
+  visitorForwardHeaders: () => undefined,
+}));
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue(new Headers()),
+}));
+
+import Page, { generateMetadata } from "../page";
+
+const ok = <T,>(body: T) => ({ ok: true, body });
+const refusal = (status: number) => ({ ok: false, status, body: null });
+
+beforeEach(() => {
+  mockUnsubscribe.mockReset();
+});
+
+async function renderPage(token: string | undefined): Promise<void> {
+  render(
+    await Page({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve(token === undefined ? {} : { t: token }),
+    }),
+  );
+}
+
+describe("metadata — noindex, no-referrer (D17, SEC-8438-9)", () => {
+  it("is noindex and sends no-referrer", async () => {
+    const meta = await generateMetadata({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve({}),
+    });
+    expect(meta.robots).toEqual({ index: false, follow: true });
+    expect(meta.referrer).toBe("no-referrer");
+  });
+});
+
+describe("the page performs no write on GET", () => {
+  it("renders with no call to unsubscribeAction", async () => {
+    await renderPage("tok_1");
+    expect(mockUnsubscribe).not.toHaveBeenCalled();
+    expect(screen.getByTestId("unsubscribe-page")).toBeInTheDocument();
+    expect(screen.getByRole("heading", { level: 1 })).toHaveTextContent("Unsubscribe");
+    expect(screen.getByText("Stop these emails?")).toBeInTheDocument();
+  });
+});
+
+describe("with no token", () => {
+  it("shows the invalid-link line and no button", async () => {
+    await renderPage(undefined);
+    expect(screen.getByTestId("unsubscribe-invalid")).toHaveTextContent("This link isn't valid.");
+    expect(screen.queryByTestId("unsubscribe-button")).not.toBeInTheDocument();
+    expect(mockUnsubscribe).not.toHaveBeenCalled();
+  });
+});
+
+describe("clicking Unsubscribe", () => {
+  it("a changed answer shows the done line with the purpose's description", async () => {
+    mockUnsubscribe.mockResolvedValue(
+      ok({ purpose: { id: "marketing_email", description: "product news and offers" }, changed: true }),
+    );
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(mockUnsubscribe).toHaveBeenCalledWith({ token: "tok_1" });
+    expect(await screen.findByTestId("unsubscribe-done")).toHaveTextContent(
+      "You're unsubscribed from product news and offers.",
+    );
+  });
+
+  it("changed: false shows the already-unsubscribed line, with no second write implied", async () => {
+    mockUnsubscribe.mockResolvedValue(
+      ok({ purpose: { id: "marketing_email", description: "product news and offers" }, changed: false }),
+    );
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(await screen.findByTestId("unsubscribe-already")).toHaveTextContent(
+      "You were already unsubscribed.",
+    );
+  });
+
+  it("any 400 shows the invalid-link line", async () => {
+    mockUnsubscribe.mockResolvedValue(refusal(400));
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(await screen.findByTestId("unsubscribe-invalid")).toHaveTextContent("This link isn't valid.");
+  });
+
+  it("a 429 (rate-limited) shows the unavailable line, never the invalid-link line", async () => {
+    mockUnsubscribe.mockResolvedValue(refusal(429));
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(await screen.findByTestId("unsubscribe-unavailable")).toHaveTextContent(
+      "Unsubscribing isn't available right now.",
+    );
+    expect(screen.queryByTestId("unsubscribe-invalid")).not.toBeInTheDocument();
+  });
+
+  it("a 5xx shows the unavailable line", async () => {
+    mockUnsubscribe.mockResolvedValue(refusal(503));
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(await screen.findByTestId("unsubscribe-unavailable")).toHaveTextContent(
+      "Unsubscribing isn't available right now.",
+    );
+  });
+
+  it("a thrown error shows the unavailable line, never a crash", async () => {
+    mockUnsubscribe.mockRejectedValue(new TypeError("fetch failed"));
+    await renderPage("tok_1");
+    await userEvent.click(screen.getByTestId("unsubscribe-button"));
+    expect(await screen.findByTestId("unsubscribe-unavailable")).toBeInTheDocument();
+  });
+});

package/templates/apps/web/app/[locale]/unsubscribe/page.tsx

@@ -0,0 +1,54 @@
+/**
+ * /[locale]/unsubscribe — the one unsubscribe landing every signed link
+ * calls (#8438 D17, NEW). Public, `noindex`, `referrer: no-referrer` so the
+ * `?t=` token never leaks through a Referer header off this page (D17,
+ * SEC-8438-9).
+ *
+ * RSC: reads `?t=` and renders the heading, the lead and the one
+ * interactive piece (`UnsubscribeButton`, "use client") that posts
+ * `unsubscribeAction(token)` ON CLICK — never on this GET, so a mail
+ * scanner's prefetch writes nothing. The island gets the token and nothing
+ * else: it reads its own strings, because anything callable handed across
+ * this server→client edge fails Flight serialization (the scaffold matrix's
+ * `GET /unsubscribe -> 500`; `__tests__/unsubscribe-rsc-boundary.test.tsx`).
+ */
+
+import { Heading, Text } from "@working-theory/ui/primitives";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { UnsubscribeButton } from "./unsubscribe-button";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  searchParams: Promise<{ t?: string }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "unsubscribe" });
+  return {
+    title: t("title"),
+    robots: { index: false, follow: true },
+    referrer: "no-referrer",
+  };
+}
+
+export default async function UnsubscribePage({ params, searchParams }: Props): Promise<ReactElement> {
+  const { locale } = await params;
+  const { t: token } = await searchParams;
+  const t = await getTranslations({ locale, namespace: "unsubscribe" });
+
+  return (
+    <div className="mx-auto flex max-w-md flex-col gap-4 px-4 py-16" data-testid="unsubscribe-page">
+      <Heading level={1} visual={2}>
+        {t("title")}
+      </Heading>
+      <Text as="p" variant="body">
+        {t("lead")}
+      </Text>
+      <UnsubscribeButton token={token ?? null} />
+    </div>
+  );
+}

package/templates/apps/web/app/[locale]/unsubscribe/unsubscribe-button.tsx

@@ -0,0 +1,73 @@
+"use client"; // owns the click → unsubscribeAction → result state
+
+/**
+ * UnsubscribeButton — the unsubscribe page's one interactive piece (#8438
+ * D17). Posts `unsubscribeAction(token)` on click only — never on render,
+ * so a mail scanner's GET prefetch of the page writes nothing.
+ *
+ * Reads its own strings through `useTranslations` (the island idiom
+ * `FlowStepperClient` uses) rather than taking them as props: the done line
+ * needs the purpose's description formatted in, and a formatting FUNCTION
+ * handed across from the page (a Server Component) cannot be serialized
+ * into the Flight payload — the scaffold matrix's `GET /unsubscribe -> 500`
+ * (`unsubscribe-rsc-boundary.test.tsx` holds the regression).
+ */
+
+import { Button, InlineMessage } from "@working-theory/ui/primitives";
+import { useTranslations } from "next-intl";
+import { useState, useTransition, type ReactElement } from "react";
+
+import { unsubscribeAction, type UnsubscribeResult } from "./unsubscribe.actions";
+
+export function UnsubscribeButton({ token }: { token: string | null }): ReactElement {
+  const t = useTranslations("unsubscribe");
+  const [result, setResult] = useState<UnsubscribeResult | null>(null);
+  const [pending, startTransition] = useTransition();
+
+  if (token === null || result?.kind === "invalid") {
+    return (
+      <InlineMessage variant="error" role="alert" data-testid="unsubscribe-invalid">
+        {t("invalid")}
+      </InlineMessage>
+    );
+  }
+
+  if (result?.kind === "done") {
+    return (
+      <InlineMessage variant="success" role="status" data-testid="unsubscribe-done">
+        {t("done", { description: result.description })}
+      </InlineMessage>
+    );
+  }
+
+  if (result?.kind === "already") {
+    return (
+      <InlineMessage variant="success" role="status" data-testid="unsubscribe-already">
+        {t("already")}
+      </InlineMessage>
+    );
+  }
+
+  if (result?.kind === "unavailable") {
+    return (
+      <InlineMessage variant="error" role="alert" data-testid="unsubscribe-unavailable">
+        {t("unavailable")}
+      </InlineMessage>
+    );
+  }
+
+  return (
+    <Button
+      type="button"
+      disabled={pending}
+      onClick={() => {
+        startTransition(async () => {
+          setResult(await unsubscribeAction(token));
+        });
+      }}
+      data-testid="unsubscribe-button"
+    >
+      {t("button")}
+    </Button>
+  );
+}

package/templates/apps/web/app/[locale]/unsubscribe/unsubscribe.actions.ts

@@ -0,0 +1,55 @@
+"use server";
+
+/**
+ * unsubscribeAction — the unsubscribe page's one write (#8438 D9, D17).
+ *
+ * Calls `POST /v1/consent/unsubscribe` (`consent.unsubscribe`) through
+ * `@working-theory/api-client`, carrying the visitor-forward headers a
+ * spoke attaches today — the same idiom `contact.actions.ts` uses. Never
+ * writes anything on its own: the page's GET never calls this, so a mail
+ * scanner's prefetch of the link changes nothing (D17).
+ *
+ * The token is the only authority (D9) — this action never names an email,
+ * a workspace or a person.
+ */
+
+import { consent, visitorForwardHeaders } from "@working-theory/api-client";
+import { headers } from "next/headers";
+
+export type UnsubscribeResult =
+  | { kind: "done"; description: string }
+  | { kind: "already" }
+  | { kind: "invalid" }
+  | { kind: "unavailable" };
+
+export async function unsubscribeAction(token: string): Promise<UnsubscribeResult> {
+  let init: { headers: Record<string, string> } | undefined;
+  try {
+    const forwarded = visitorForwardHeaders(
+      await headers(),
+      process.env.AILK_VISITOR_FORWARD_KEY,
+    );
+    if (forwarded) init = { headers: forwarded };
+  } catch {
+    // No request scope to read — call with no forwarding.
+  }
+
+  try {
+    const res = init
+      ? await consent.unsubscribe({ token }, init)
+      : await consent.unsubscribe({ token });
+    if (!res.ok) {
+      // 429 is transient (a rate limit), never the token's fault — "invalid"
+      // would tell a visitor the link itself is bad when retrying would work.
+      if (res.status >= 400 && res.status < 500 && res.status !== 429) return { kind: "invalid" };
+      return { kind: "unavailable" };
+    }
+    if (!res.body.changed) return { kind: "already" };
+    return { kind: "done", description: res.body.purpose.description };
+  } catch (err) {
+    // The api-client never attaches the request payload to a thrown error,
+    // so logging `err` carries no token.
+    console.error("[unsubscribeAction]", err);
+    return { kind: "unavailable" };
+  }
+}

package/templates/apps/web/app/robots.txt/route.ts

@@ -8,28 +8,31 @@
  *     (comma-separated paths, e.g. "/admin/,/private/")
  *   - STEALTH=true disallows every path for every crawler — layer 1 of the
  *     three-layer stealth posture (#884, #7374); it subsumes any
- *     AILK_ROBOTS_DISALLOW paths
+ *     AILK_ROBOTS_DISALLOW paths and drops the Sitemap line, so a hidden
+ *     site advertises no URLs (#8519). STEALTH is read through the shared
+ *     parse (#8511), so 1, yes and on count too, and an unknown value throws.
  */
 
+import { parseStealth } from "@working-theory/web-i18n/stealth";
+
 import { resolveBaseUrl } from "../../src/lib/routes";
 
 export function GET(): Response {
   const baseUrl = resolveBaseUrl();
   const disallowEnv = process.env["AILK_ROBOTS_DISALLOW"] ?? "";
+  const stealth = parseStealth(process.env["STEALTH"]);
 
-  const disallowPaths =
-    process.env["STEALTH"] === "true"
-      ? ["/"]
-      : disallowEnv
-          .split(",")
-          .map((p) => p.trim())
-          .filter((p) => p.length > 0);
+  const disallowPaths = stealth
+    ? ["/"]
+    : disallowEnv
+        .split(",")
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0);
 
   const lines = [
     "User-agent: *",
     ...disallowPaths.map((p) => `Disallow: ${p}`),
-    "",
-    `Sitemap: ${baseUrl}/sitemap.xml`,
+    ...(stealth ? [] : ["", `Sitemap: ${baseUrl}/sitemap.xml`]),
   ];
 
   return new Response(lines.join("\n"), {

package/templates/apps/web/auth.ts

@@ -324,6 +324,24 @@ export function createAuth(deps: CreateAuthDeps = {}) {
   const sendResetPassword = makeSendResetPassword({
     prisma,
     send: authEmailTransport,
+    /**
+     * Who is signed in on the reset request (#8431 D4) — the Security tab's
+     * Set password, for a person with no password yet. Read through THIS
+     * instance (assigned below; the callback runs only during a request, by
+     * which time it exists), never a second one, and never by verifying the
+     * cookie by hand. `disableRefresh`: the mail callback runs in the
+     * background after the response, where a refresh's cookie write would
+     * throw and drop the mail. No request (a server-side call carries no
+     * cookie) or no `api` (a test double of `betterAuth`) is no session.
+     */
+    sessionUserId: async (request) => {
+      if (request === undefined || Reflect.get(instance, "api") === undefined) return null;
+      const session = await instance.api.getSession({
+        headers: request.headers,
+        query: { disableRefresh: true },
+      });
+      return session?.user.id ?? null;
+    },
   });
   const sendVerificationEmail = makeSendVerificationEmail({
     send: authEmailTransport,
@@ -419,7 +437,7 @@ export function createAuth(deps: CreateAuthDeps = {}) {
     }
   };
 
-  return betterAuth({
+  const instance = betterAuth({
     database: prismaAdapter(prisma, {
       provider: "postgresql",
     }),
@@ -643,6 +661,7 @@ export function createAuth(deps: CreateAuthDeps = {}) {
         ]
       : [nextCookies()],
   });
+  return instance;
 }
 
 // Lazy singleton: resolved on first access, not at module-load time.

package/templates/apps/web/jest.config.cjs

@@ -89,6 +89,9 @@ module.exports = {
       "<rootDir>/node_modules/@working-theory/site-config/dist/schema/index.js",
     "^@working-theory/validation$": "<rootDir>/node_modules/@working-theory/validation/dist/index.js",
     "^@working-theory/web-i18n$": "<rootDir>/node_modules/@working-theory/web-i18n/dist/index.js",
+    // The Edge-safe `./stealth` subpath (#8511) → source, like the root entry.
+    "^@working-theory/web-i18n/stealth$":
+      "<rootDir>/node_modules/@working-theory/web-i18n/dist/stealth-metadata.js",
     // The dependency-free tenancy-constants subpath (database/tenancy.ts).
     // Mapped to source like every sibling above; `database/dist` is not
     // built in this workspace pre-`pnpm build`.

package/templates/apps/web/lib/__tests__/auth-email.test.ts

@@ -152,6 +152,90 @@ describe("sendResetPassword (§ D14 — the credential-account check)", () => {
   });
 });
 
+describe("sendResetPassword — the signed-in carve-out (#8431 D4)", () => {
+  const USER = { id: "user_1", email: "person@example.com" };
+  const RESET_URL = "https://site.example/api/auth/reset-password/tok";
+  const REQUEST = { headers: new Headers({ cookie: "session=abc" }) } as Request;
+
+  it("sends ONE password-reset to the account's own address when the session is that person's", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { lines, log } = makeLog();
+    const sessionUserId = jest.fn().mockResolvedValue("user_1");
+    const cb = makeSendResetPassword({ prisma: makePrisma(false), send, log, sessionUserId });
+
+    await cb({ user: USER, url: RESET_URL }, REQUEST);
+
+    expect(sessionUserId).toHaveBeenCalledWith(REQUEST);
+    expect(send).toHaveBeenCalledTimes(1);
+    const [rawBody] = send.mock.calls[0] as [string];
+    expect(JSON.parse(rawBody)).toEqual({
+      kind: "password-reset",
+      userId: "user_1",
+      to: "person@example.com",
+      url: RESET_URL,
+      expiresInMinutes: 60,
+    });
+    expect(lines.some((l) => l.fields.reason === "self_service_set")).toBe(true);
+    expect(JSON.stringify(lines)).not.toContain("person@example.com");
+  });
+
+  it.each<[string, () => Promise<string | null>]>([
+    ["another person's id", () => Promise.resolve("user_2")],
+    ["null (no session)", () => Promise.resolve(null)],
+    ["a rejection", () => Promise.reject(new Error("db down"))],
+  ])("sends NOTHING and logs no address when the session lookup answers %s", async (_label, impl) => {
+    const send = jest.fn();
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(false), send, log, sessionUserId: jest.fn(impl) });
+
+    await expect(cb({ user: USER, url: RESET_URL }, REQUEST)).resolves.toBeUndefined();
+
+    expect(send).not.toHaveBeenCalled();
+    expect(lines.some((l) => l.fields.reason === "no_credential_account")).toBe(true);
+    expect(JSON.stringify(lines)).not.toContain("person@example.com");
+  });
+
+  it("logs the failed lookup's kind only", async () => {
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({
+      prisma: makePrisma(false),
+      send: jest.fn(),
+      log,
+      sessionUserId: jest.fn().mockRejectedValue(new Error("person@example.com broke")),
+    });
+    await cb({ user: USER, url: RESET_URL }, REQUEST);
+    expect(lines).toEqual([
+      {
+        level: "warn",
+        fields: {
+          userId: "user_1",
+          kind: "password-reset",
+          reason: "no_credential_account",
+          errorKind: "session_lookup_failed",
+        },
+      },
+    ]);
+  });
+
+  it("with no sessionUserId it sends nothing, as before", async () => {
+    const send = jest.fn();
+    const { log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(false), send, log });
+    await cb({ user: USER, url: RESET_URL }, REQUEST);
+    expect(send).not.toHaveBeenCalled();
+  });
+
+  it("a person WITH a password never needs the session lookup", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { log } = makeLog();
+    const sessionUserId = jest.fn();
+    const cb = makeSendResetPassword({ prisma: makePrisma(true), send, log, sessionUserId });
+    await cb({ user: USER, url: RESET_URL });
+    expect(sessionUserId).not.toHaveBeenCalled();
+    expect(send).toHaveBeenCalledTimes(1);
+  });
+});
+
 describe("the § D12 PII boundary", () => {
   it("never logs the address, the token or the assembled link", async () => {
     const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });