create-ailk 0.19.1 → 0.20.0

package/templates/apps/web/app/[locale]/(auth)/sign-up/sign-up-card.tsx

@@ -19,21 +19,41 @@
  * launch lands on `errors.email` (the social row sits inside the password form
  * beside the email field). The SSO body has no fields, so the same message is
  * rendered as an `Alert` above the card for `method="sso"`.
+ *
+ * #8438 D13 — the site's sign-up agreements. `AuthCard` has no slot to render
+ * inside and no external "disabled" hook (packages/ui is not this unit's to
+ * change), so the card composes its own `ConsentGroup` below `AuthCard` and
+ * GATES every entry point from the outside: the password submit and every
+ * provider's click both run through this component's own closures, which do
+ * nothing until every required agreement is ticked. A wrapping div's
+ * `aria-disabled` + `pointer-events-none` styling carries the same state
+ * visually for a mouse/touch pointer in a real browser.
  */
 
 import {
   AuthCard,
+  ConsentGroup,
   type AuthCardLabels,
   type AuthSubmitData,
 } from "@working-theory/ui/blocks";
 import { Alert, AlertDescription } from "@working-theory/ui/primitives";
-import type { ReactElement } from "react";
+import { useState, type MouseEvent, type ReactElement } from "react";
 
 import { authClient, useAuthCardFlow } from "../use-auth-card-flow";
 
+import { rememberSignUpAgreementsAction } from "./sign-up.actions";
+
 /** The OAuth providers this page can launch — a subset of AuthCard's. */
 export type SignUpProvider = "google" | "github";
 
+/** One site agreement asked at sign-up (#8438 D1's `signUp` purposes). */
+export interface SignUpAgreement {
+  id: string;
+  required: boolean;
+  /** Resolved to the active locale, link tokens included (D1). */
+  statement: string;
+}
+
 export interface SignUpCardProps {
   /** Active OAuth providers, exactly as auth-env reports them. */
   providers: SignUpProvider[];
@@ -49,8 +69,16 @@ export interface SignUpCardProps {
   notConfiguredSubhead: string;
   /** Translated error copy. */
   errorLabels: { signUpFailed: string; providerFailed: string };
+  /** The site's `signUp` agreements — always at least `account_terms`. */
+  agreements: SignUpAgreement[];
+  /** Policy key → href, for the statements' inline links (D1/D3). */
+  agreementPolicies: Record<string, string>;
+  /** The consent fieldset's legend (`auth.signUp.agreementsLegend`). */
+  agreementsLegend: string;
 }
 
+const AGREEMENTS_FIELD_NAME = "agreements";
+
 export function SignUpCard({
   providers,
   method,
@@ -59,6 +87,9 @@ export function SignUpCard({
   labels,
   notConfiguredSubhead,
   errorLabels,
+  agreements,
+  agreementPolicies,
+  agreementsLegend,
 }: SignUpCardProps): ReactElement {
   const { errors, providerError, launchProvider, submitPassword } =
     useAuthCardFlow(next, {
@@ -66,25 +97,62 @@ export function SignUpCard({
       passwordFailed: errorLabels.signUpFailed,
     });
 
+  const requiredAgreementIds = agreements.filter((a) => a.required).map((a) => a.id);
+  const [ticked, setTicked] = useState<ReadonlySet<string>>(new Set());
+  const allAgreed = requiredAgreementIds.every((id) => ticked.has(id));
+
+  // `ConsentGroup`'s checkboxes are uncontrolled, by design (#5275), and
+  // always start unticked (no `defaults` are ever passed here) — so a click
+  // on one is always a plain toggle of the LOCAL record below; this never
+  // reads the Radix root's own post-click DOM state, which a same-tick
+  // ancestor listener could still see as stale.
+  function handleAgreementsClick(event: MouseEvent<HTMLDivElement>): void {
+    const target = (event.target as HTMLElement).closest<HTMLElement>('[role="checkbox"]');
+    if (!target?.id) return;
+    const purposeId = target.id.slice(`${AGREEMENTS_FIELD_NAME}.`.length);
+    setTicked((previous) => {
+      const updated = new Set(previous);
+      if (updated.has(purposeId)) updated.delete(purposeId);
+      else updated.add(purposeId);
+      return updated;
+    });
+  }
+
   const notConfigured = method === "sso" && providers.length === 0;
 
   const providerButtons = providers.map((provider) => ({
     provider,
-    onClick: () => void launchProvider(provider),
+    // Gated: a provider launch that would create the account is refused
+    // until every required agreement is ticked, exactly as the password
+    // submit below. No remember-cookie here — Better Auth's own OAuth
+    // callback carries no form data this component could read an email
+    // from, so the account home's explicit "Otherwise" card asks instead.
+    onClick: () => {
+      if (!allAgreed) return;
+      void launchProvider(provider);
+    },
   }));
 
   const handleSubmit = (data: AuthSubmitData): void => {
-    // Better Auth requires a `name` on email sign-up; this card collects
-    // none, so the address doubles as the display name until the person
-    // sets one.
-    void submitPassword(
-      authClient.signUp.email({
-        email: data.email,
-        password: data.password ?? "",
-        name: data.email,
-        callbackURL: next,
-      }),
-    );
+    if (!allAgreed) return;
+    void (async () => {
+      try {
+        await rememberSignUpAgreementsAction(data.email, requiredAgreementIds);
+      } catch {
+        // Convenience only — see sign-up.actions.ts's file header.
+      }
+      // Better Auth requires a `name` on email sign-up; this card collects
+      // none, so the address doubles as the display name until the person
+      // sets one.
+      await submitPassword(
+        authClient.signUp.email({
+          email: data.email,
+          password: data.password ?? "",
+          name: data.email,
+          callbackURL: next,
+        }),
+      );
+    })();
   };
 
   return (
@@ -94,16 +162,31 @@ export function SignUpCard({
           <AlertDescription>{providerError}</AlertDescription>
         </Alert>
       ) : null}
-      <AuthCard
-        intent="sign-up"
-        method={method}
-        signInHref={signInHref}
-        {...(notConfigured ? { subhead: notConfiguredSubhead } : {})}
-        providers={providerButtons}
-        onSubmit={handleSubmit}
-        errors={errors}
-        labels={labels}
-      />
+      <div
+        aria-disabled={!allAgreed}
+        className={allAgreed ? undefined : "pointer-events-none opacity-60"}
+        data-testid="sign-up-card-gate"
+      >
+        <AuthCard
+          intent="sign-up"
+          method={method}
+          signInHref={signInHref}
+          {...(notConfigured ? { subhead: notConfiguredSubhead } : {})}
+          providers={providerButtons}
+          onSubmit={handleSubmit}
+          errors={errors}
+          labels={labels}
+        />
+      </div>
+      {/* eslint-disable-next-line -- delegated-click capture over ConsentGroup's own real `role="checkbox"` descendants (Radix), which are themselves already keyboard-operable and dispatch a native click on Enter/Space; this wrapper adds no interactive semantics of its own and is never itself focused. (Bare directive, not named rules: `jsx-a11y/*` is registered in this monorepo's own lint but not in a scaffolded site's trimmed eslint config — see agreements-prompt.tsx's identical note on `react-hooks/exhaustive-deps`.) */}
+      <div onClick={handleAgreementsClick} data-testid="sign-up-agreements">
+        <ConsentGroup
+          name={AGREEMENTS_FIELD_NAME}
+          legend={agreementsLegend}
+          purposes={agreements}
+          policies={agreementPolicies}
+        />
+      </div>
     </div>
   );
 }

package/templates/apps/web/app/[locale]/(auth)/sign-up/sign-up.actions.ts

@@ -0,0 +1,125 @@
+"use server";
+
+/**
+ * sign-up.actions.ts — mints the sign-up card's carried-agreement cookie
+ * (#8438 D13, spec
+ * docs/specs/8438-consent-registry-and-ledger-step-spec.md C6).
+ *
+ * `apps/web` never touches the database (the ledger writer is `apps/api`),
+ * and Better Auth creates the user from THIS app before any Person exists to
+ * record a grant against. So the card remembers which agreements the person
+ * ticked, in a short-lived, signed, email-bound cookie — the account home's
+ * first signed-in visit (`(authed)/account/actions.ts`'s
+ * `acceptCarriedAgreementsAction`) consumes it, one write per agreement,
+ * then deletes it either way (single-use).
+ *
+ * The CONSUME side lives in the account area, not here, deliberately:
+ * `(auth)/**` is one of the sign-in seeds a sign-in-less spoke drops
+ * (`SPOKE_REMOVAL_SEEDS`, `packages/create-ailk/src/topology.ts` D4), so a
+ * file OUTSIDE `(auth)` (the account home's `agreements-prompt.tsx`) must
+ * never import FROM here — doing so once failed the scaffolder's own
+ * dangling-import check (`spokeExclusions`) for exactly this reason. This
+ * file is reached only from `sign-up-card.tsx`, its own directory sibling,
+ * so it carries no such obligation. The two files duplicate the small
+ * cookie codec (encode here, decode there) rather than share a module,
+ * precisely so each side's dependencies stay native to where it lives.
+ *
+ * Cookie value: `<id>@<version>,…|<issuedAtMs>|<sha256(lowercased email)>|
+ * <HMAC-SHA256 over the rest>`, keyed by `BETTER_AUTH_SECRET` — the same
+ * dev fallback `apps/web/auth.ts`'s own `resolveSecret()` publishes when it
+ * is unset; production refuses to mint without one. That secret is read
+ * directly HERE rather than importing `resolveSecret` from `auth.ts`: that
+ * module statically imports the `better-auth` ESM package, which every
+ * broad page-level test suite that renders `/sign-up` would then have to
+ * add to its `../../../../auth` mock. `__Host-` prefixed, httpOnly,
+ * `Secure`, one hour, `SameSite=Lax` — the `__Host-` prefix needs `Secure`,
+ * so development over plain `http://localhost` uses the unprefixed name
+ * instead (SEC-8438-5).
+ */
+
+import { createHash, createHmac } from "node:crypto";
+
+import { consentPurposeById, SITE_CONSENT_CONFIG_DEFAULTS } from "@working-theory/validation";
+import { cookies } from "next/headers";
+
+const SECURE_COOKIE_NAME = "__Host-ailk-signup-agreements";
+const DEV_COOKIE_NAME = "ailk-signup-agreements";
+const MAX_AGE_SECONDS = 60 * 60;
+
+/** The string `auth.ts`'s own `resolveSecret()` publishes — see file header. */
+const DEV_FALLBACK_SECRET =
+  "ailk-dev-fallback-secret-published-in-this-repo-never-use-in-production";
+
+/** Mirrors `auth.ts`'s `resolveSecret()` exactly, without importing it. */
+function signUpAgreementsSecret(): string {
+  const configured = process.env.BETTER_AUTH_SECRET;
+  if (configured) return configured;
+  const isBuildPhase = process.env.NEXT_PHASE === "phase-production-build";
+  if (process.env.NODE_ENV === "production" && !isBuildPhase) {
+    throw new Error(
+      "BETTER_AUTH_SECRET is required in production: it signs the carried sign-up-agreement cookie.",
+    );
+  }
+  return DEV_FALLBACK_SECRET;
+}
+
+function cookieName(): string {
+  return process.env.NODE_ENV === "production" ? SECURE_COOKIE_NAME : DEV_COOKIE_NAME;
+}
+
+function emailHash(email: string): string {
+  return createHash("sha256").update(email.trim().toLowerCase()).digest("hex");
+}
+
+function sign(payload: string): string {
+  return createHmac("sha256", signUpAgreementsSecret()).update(payload).digest("hex");
+}
+
+interface CarriedPurpose {
+  id: string;
+  version: number;
+}
+
+function encodeCarriedAgreements(
+  purposes: CarriedPurpose[],
+  email: string,
+  issuedAtMs: number,
+): string {
+  const purposesPart = purposes.map((p) => `${p.id}@${p.version}`).join(",");
+  const payload = `${purposesPart}|${issuedAtMs}|${emailHash(email)}`;
+  return `${payload}|${sign(payload)}`;
+}
+
+/**
+ * Mints the carried-agreement cookie from the ticked `signUp` agreements,
+ * read back from the registry for their CURRENT version — never trusting a
+ * version the client might assert. Purposes the registry no longer marks
+ * `signUp` are dropped. Never throws: a failed mint just means the account
+ * home's first visit asks explicitly instead (D13's "Otherwise" card).
+ */
+export async function rememberSignUpAgreementsAction(
+  email: string,
+  purposeIds: string[],
+): Promise<void> {
+  try {
+    const config = SITE_CONSENT_CONFIG_DEFAULTS;
+    const purposes: CarriedPurpose[] = [];
+    for (const id of purposeIds) {
+      const purpose = consentPurposeById(config, id);
+      if (purpose?.signUp) purposes.push({ id: purpose.id, version: purpose.policyVersion });
+    }
+    if (purposes.length === 0) return;
+
+    const value = encodeCarriedAgreements(purposes, email, Date.now());
+    const cookieStore = await cookies();
+    cookieStore.set(cookieName(), value, {
+      httpOnly: true,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      path: "/",
+      maxAge: MAX_AGE_SECONDS,
+    });
+  } catch {
+    // Convenience only — see file header.
+  }
+}

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/agreements-prompt.test.tsx

@@ -0,0 +1,281 @@
+/**
+ * Tests for AgreementsPrompt (#8438 D13) and the carried-agreement cookie
+ * `acceptCarriedAgreementsAction` consumes — exercised here because this
+ * prompt is its one caller.
+ */
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+
+const mockRefresh = jest.fn();
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  useRouter: () => ({ refresh: mockRefresh }),
+}));
+
+const mockAcceptCarried = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- test-seam mock: the Server Action module is a "use server" boundary; the component only passes it through.
+jest.mock("../agreements-actions", () => ({
+  __esModule: true,
+  acceptCarriedAgreementsAction: (...args: unknown[]) => mockAcceptCarried(...args),
+}));
+
+const mockSetConsent = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- test-seam mock: the Server Action module is a "use server" boundary; the component only passes it through.
+jest.mock("../privacy/actions", () => ({
+  __esModule: true,
+  setConsentAction: (...args: unknown[]) => mockSetConsent(...args),
+}));
+
+import { AgreementsPrompt, type MissingAgreement } from "../agreements-prompt";
+
+const LABELS = {
+  titleNew: "Please accept our terms",
+  titleUpdated: "We've updated our terms",
+  accept: "Accept",
+  error: "We couldn't save that. Try again.",
+  policyLink: "Read our privacy policy",
+};
+
+const AGREEMENT: MissingAgreement = {
+  id: "account_terms",
+  statement: "You agree to our Terms and Privacy Policy.",
+  policyHref: "/terms",
+  version: 1,
+  hadPriorGrant: false,
+};
+
+beforeEach(() => {
+  mockRefresh.mockReset();
+  mockAcceptCarried.mockReset();
+  mockSetConsent.mockReset();
+});
+
+describe("AgreementsPrompt — with nothing missing", () => {
+  it("renders nothing and calls nothing", () => {
+    render(<AgreementsPrompt missing={[]} labels={LABELS} />);
+    expect(screen.queryByTestId("account-agreements-prompt")).not.toBeInTheDocument();
+    expect(mockAcceptCarried).not.toHaveBeenCalled();
+  });
+});
+
+describe("AgreementsPrompt — the carried-cookie fast path (D13)", () => {
+  it("tries it once on mount, with every missing id", async () => {
+    mockAcceptCarried.mockResolvedValue({ accepted: false });
+    render(<AgreementsPrompt missing={[AGREEMENT]} labels={LABELS} />);
+    await waitFor(() => expect(mockAcceptCarried).toHaveBeenCalledWith(["account_terms"]));
+    expect(mockAcceptCarried).toHaveBeenCalledTimes(1);
+  });
+
+  it("on accept, hides and refreshes — the card never shows", async () => {
+    mockAcceptCarried.mockResolvedValue({ accepted: true });
+    render(<AgreementsPrompt missing={[AGREEMENT]} labels={LABELS} />);
+    await waitFor(() => expect(mockRefresh).toHaveBeenCalledTimes(1));
+    expect(screen.queryByTestId("account-agreements-prompt")).not.toBeInTheDocument();
+  });
+
+  it("on a failed check, shows the card with the statement and policy link", async () => {
+    mockAcceptCarried.mockResolvedValue({ accepted: false });
+    render(<AgreementsPrompt missing={[AGREEMENT]} labels={LABELS} />);
+    expect(await screen.findByTestId("account-agreements-prompt")).toBeInTheDocument();
+    expect(screen.getByText("Please accept our terms")).toBeInTheDocument();
+    expect(screen.getByText("You agree to our Terms and Privacy Policy.")).toBeInTheDocument();
+    expect(screen.getByTestId("account-agreements-prompt-account_terms-policy")).toHaveAttribute(
+      "href",
+      "/terms",
+    );
+  });
+
+  it("shows the 'updated' title when any missing agreement had a prior grant", async () => {
+    mockAcceptCarried.mockResolvedValue({ accepted: false });
+    render(<AgreementsPrompt missing={[{ ...AGREEMENT, hadPriorGrant: true }]} labels={LABELS} />);
+    expect(await screen.findByText("We've updated our terms")).toBeInTheDocument();
+  });
+
+  it("a rejected check still shows the card, rather than throwing", async () => {
+    mockAcceptCarried.mockRejectedValue(new Error("down"));
+    render(<AgreementsPrompt missing={[AGREEMENT]} labels={LABELS} />);
+    expect(await screen.findByTestId("account-agreements-prompt")).toBeInTheDocument();
+  });
+});
+
+describe("AgreementsPrompt — the explicit Accept button", () => {
+  async function showCard(): Promise<void> {
+    mockAcceptCarried.mockResolvedValue({ accepted: false });
+    render(<AgreementsPrompt missing={[AGREEMENT]} labels={LABELS} />);
+    await screen.findByTestId("account-agreements-prompt");
+  }
+
+  it("posts every missing id through setConsentAction, then refreshes", async () => {
+    mockSetConsent.mockResolvedValue({ ok: true, dateLine: "Given Oct 12, 2026" });
+    await showCard();
+    fireEvent.click(screen.getByTestId("account-agreements-prompt-accept"));
+    await waitFor(() => expect(mockSetConsent).toHaveBeenCalledWith("account_terms", true));
+    await waitFor(() => expect(mockRefresh).toHaveBeenCalledTimes(1));
+  });
+
+  it("a failed answer shows the error and keeps the card", async () => {
+    mockSetConsent.mockResolvedValue({ ok: false, message: "nope" });
+    await showCard();
+    fireEvent.click(screen.getByTestId("account-agreements-prompt-accept"));
+    expect(await screen.findByTestId("account-agreements-prompt-error")).toHaveTextContent(
+      "We couldn't save that. Try again.",
+    );
+    expect(screen.getByTestId("account-agreements-prompt")).toBeInTheDocument();
+    expect(mockRefresh).not.toHaveBeenCalled();
+  });
+});
+
+// ── acceptCarriedAgreementsAction's own cookie checks (D13 C6) ────────────────
+//
+// The real action, loaded past the mock above — exercising the HMAC, the
+// one-hour window and the email-hash binding with real `node:crypto`.
+
+// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426 D5), not a runtime input; the seam IS the boundary between a hub and a spoke build, and there is no env or HTTP surface that selects it.
+jest.mock("../../../../../lib/topology.generated", () => ({
+  __esModule: true,
+  readSession: jest.fn(),
+}));
+
+const mockMemberSetConsent = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  member: { setConsent: (...args: unknown[]) => mockMemberSetConsent(...args) },
+}));
+
+const mockCookieGet = jest.fn();
+const mockCookieDelete = jest.fn();
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  cookies: jest.fn().mockResolvedValue({
+    get: (...args: unknown[]) => mockCookieGet(...args),
+    delete: (...args: unknown[]) => mockCookieDelete(...args),
+    toString: () => "",
+  }),
+  headers: jest.fn().mockResolvedValue(new Headers()),
+}));
+
+describe("acceptCarriedAgreementsAction (the real module, D13 C6)", () => {
+  const COOKIE_NAME = "ailk-signup-agreements"; // NODE_ENV !== "production" in jest
+  const EMAIL = "ada@example.com";
+
+  async function remember(email: string, purposeIds: string[]): Promise<string | undefined> {
+    const { rememberSignUpAgreementsAction } = jest.requireActual(
+      "../../../(auth)/sign-up/sign-up.actions",
+    ) as typeof import("../../../(auth)/sign-up/sign-up.actions");
+    await rememberSignUpAgreementsAction(email, purposeIds);
+    expect(mockCookieSet).toHaveBeenCalledTimes(1);
+    return mockCookieSet.mock.calls[0]?.[1] as string | undefined;
+  }
+
+  const mockCookieSet = jest.fn();
+
+  beforeEach(() => {
+    mockCookieGet.mockReset();
+    mockCookieDelete.mockReset();
+    mockCookieSet.mockReset();
+    mockMemberSetConsent.mockReset().mockResolvedValue({ ok: true, body: { purpose: {} } });
+    (jest.requireMock("../../../../../lib/topology.generated") as { readSession: jest.Mock }).readSession.mockReset();
+  });
+
+  // Minting goes through `cookies().set`, which the outer `cookies()` mock
+  // does not define — reassign it per test so `remember()` can capture the
+  // value, without disturbing the delete-tracking mock the "real action"
+  // suite shares.
+  beforeEach(() => {
+    const headersModule = jest.requireMock("next/headers") as {
+      cookies: jest.Mock;
+    };
+    headersModule.cookies.mockResolvedValue({
+      get: (...args: unknown[]) => mockCookieGet(...args),
+      set: (...args: unknown[]) => mockCookieSet(...args),
+      delete: (...args: unknown[]) => mockCookieDelete(...args),
+      toString: () => "",
+    });
+  });
+
+  async function accept(missingPurposeIds: string[]) {
+    const { acceptCarriedAgreementsAction } = jest.requireActual(
+      "../agreements-actions",
+    ) as typeof import("../agreements-actions");
+    return acceptCarriedAgreementsAction(missingPurposeIds);
+  }
+
+  it("a valid, fresh cookie whose email matches writes every missing purpose with via sign_up, then deletes the cookie", async () => {
+    const value = await remember(EMAIL, ["account_terms"]);
+    mockCookieGet.mockReturnValue({ value });
+    (jest.requireMock("../../../../../lib/topology.generated") as { readSession: jest.Mock }).readSession.mockResolvedValue({
+      user: { email: EMAIL, emailVerified: true },
+    });
+
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: true });
+    expect(mockMemberSetConsent).toHaveBeenCalledWith(
+      { purposeId: "account_terms", granted: true, via: "sign_up" },
+      expect.anything(),
+    );
+    expect(mockCookieDelete).toHaveBeenCalledWith(COOKIE_NAME);
+  });
+
+  it("a flipped character in the cookie fails the HMAC — posts nothing, deletes it, not accepted", async () => {
+    const value = await remember(EMAIL, ["account_terms"]);
+    const tampered = `${value?.slice(0, -1)}${value?.slice(-1) === "0" ? "1" : "0"}`;
+    mockCookieGet.mockReturnValue({ value: tampered });
+
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: false });
+    expect(mockMemberSetConsent).not.toHaveBeenCalled();
+    expect(mockCookieDelete).toHaveBeenCalledWith(COOKIE_NAME);
+  });
+
+  it("another email's hash is refused, even with a verified session", async () => {
+    const value = await remember("someone-else@example.com", ["account_terms"]);
+    mockCookieGet.mockReturnValue({ value });
+    (jest.requireMock("../../../../../lib/topology.generated") as { readSession: jest.Mock }).readSession.mockResolvedValue({
+      user: { email: EMAIL, emailVerified: true },
+    });
+
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: false });
+    expect(mockMemberSetConsent).not.toHaveBeenCalled();
+  });
+
+  it("an unverified session email is refused even when the hash would match", async () => {
+    const value = await remember(EMAIL, ["account_terms"]);
+    mockCookieGet.mockReturnValue({ value });
+    (jest.requireMock("../../../../../lib/topology.generated") as { readSession: jest.Mock }).readSession.mockResolvedValue({
+      user: { email: EMAIL, emailVerified: false },
+    });
+
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: false });
+  });
+
+  it("a cookie that does not cover every missing id is refused", async () => {
+    const value = await remember(EMAIL, ["account_terms"]);
+    mockCookieGet.mockReturnValue({ value });
+    (jest.requireMock("../../../../../lib/topology.generated") as { readSession: jest.Mock }).readSession.mockResolvedValue({
+      user: { email: EMAIL, emailVerified: true },
+    });
+
+    const result = await accept(["account_terms", "another_agreement"]);
+    expect(result).toEqual({ accepted: false });
+    expect(mockMemberSetConsent).not.toHaveBeenCalled();
+  });
+
+  it("an issuedAt more than an hour old is refused", async () => {
+    jest.useFakeTimers().setSystemTime(new Date("2026-10-12T00:00:00.000Z"));
+    const value = await remember(EMAIL, ["account_terms"]);
+    jest.setSystemTime(new Date("2026-10-12T01:00:01.000Z"));
+    mockCookieGet.mockReturnValue({ value });
+
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: false });
+    jest.useRealTimers();
+  });
+
+  it("no cookie present is refused, with no delete call", async () => {
+    mockCookieGet.mockReturnValue(undefined);
+    const result = await accept(["account_terms"]);
+    expect(result).toEqual({ accepted: false });
+    expect(mockCookieDelete).not.toHaveBeenCalled();
+  });
+});