create-ailk 0.20.0 → 0.22.0

package/templates/apps/api/src/routes/consent/__tests__/account.test.ts

@@ -0,0 +1,386 @@
+/**
+ * @file account.test.ts
+ * @description The sign-up agreements' evidence route and the account-level
+ * reading (#8765 D2, D5; AC-2, AC-3 and AC-4, route parts).
+ *
+ * External dependency boundaries mocked:
+ *   - @working-theory/database (via moduleNameMapper -> prisma-client.js mock;
+ *     prisma singleton via __mocks__/prisma.ts), driven by the in-memory
+ *     ledger double
+ *   - `resolveSiteWorkspaceId` — the seam to the deployment's site workspace
+ *
+ * The real `services/consent.ts` writer and `lib/consent-store.ts` reader run
+ * over the ledger double. The auth preHandler is replaced by a hook that sets
+ * the fields it sets (`userId`, `sessionTenant`, `hubSession`), so user `u1`'s
+ * cookie session, spoke `S1`'s hub credential for `u1` and a personal token
+ * are each one line.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../../lib/prisma.js");
+
+const mockResolveSiteWorkspaceId = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/site.js", () => ({
+  resolveSiteWorkspaceId: () => mockResolveSiteWorkspaceId(),
+}));
+
+import { createHash } from "node:crypto";
+
+import {
+  CONTACT_FORM_TERMS_STATEMENT,
+  SITE_CONSENT_CONFIG_DEFAULTS,
+  siteConsentConfigSchema,
+} from "@working-theory/validation";
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+import {
+  armConsentLedger,
+  type ConsentLedgerDouble,
+} from "../../../lib/__tests__/consent-ledger-double.js";
+import { prisma } from "../../../lib/prisma.js";
+import * as consentService from "../../../services/consent.js";
+import { consentAccountRoutes, consentSignUpRoute } from "../index.js";
+
+/** The deployment's own site workspace. */
+const W = "wksp_01920000-0000-7000-8000-0000000000a1";
+/** Spoke S1's own workspace — never where an account-level row is written. */
+const S1_WS = "wksp_01920000-0000-7000-8000-0000000000b1";
+const S1 = "spoke_01920000-0000-7000-8000-0000000000b1";
+const U1 = "user_01920000-0000-7000-8000-0000000000a1";
+
+const sha256 = (text: string) =>
+  createHash("sha256").update(text).digest("hex");
+
+type Caller = "cookie" | "hub" | "token" | "none";
+
+let double: ConsentLedgerDouble;
+let app: FastifyInstance;
+
+async function build(caller: Caller): Promise<FastifyInstance> {
+  const instance = Fastify();
+  instance.decorateRequest("userId", undefined);
+  instance.decorateRequest("sessionTenant", undefined);
+  instance.decorateRequest("hubSession", undefined);
+  instance.addHook("onRequest", async (request) => {
+    // eslint-disable-next-line no-restricted-syntax -- the test stands in for the auth preHandler, which assigns decorated fields the bare Fastify type does not declare
+    const c = request as unknown as Record<string, unknown>;
+    if (caller === "none") return;
+    c["userId"] = U1;
+    if (caller === "cookie") c["sessionTenant"] = { sessionRowId: "s" };
+    if (caller === "hub") c["hubSession"] = { spokeId: S1, workspaceId: S1_WS };
+  });
+  await instance.register(consentSignUpRoute);
+  await instance.register(consentAccountRoutes);
+  await instance.ready();
+  return instance;
+}
+
+/** The registry with `account_terms` moved to `version`, everything else the default. */
+function registryAt(version: number) {
+  return siteConsentConfigSchema.parse({
+    ...SITE_CONSENT_CONFIG_DEFAULTS,
+    purposes: SITE_CONSENT_CONFIG_DEFAULTS.purposes.map((p) =>
+      p.id === "account_terms" ? { ...p, policyVersion: version } : p,
+    ),
+  });
+}
+
+const getAccount = (query = "") =>
+  app.inject({ method: "GET", url: `/v1/consent/account${query}` });
+const postAccount = (payload: unknown) =>
+  app.inject({
+    method: "POST",
+    url: "/v1/consent/account",
+    payload: payload as object,
+  });
+
+beforeEach(() => {
+  jest.restoreAllMocks();
+  jest.clearAllMocks();
+  double = armConsentLedger(prisma);
+  mockResolveSiteWorkspaceId.mockResolvedValue(W);
+});
+
+afterEach(async () => {
+  await app?.close();
+});
+
+describe("GET /v1/consent/sign-up (D2)", () => {
+  const get = (query = "") =>
+    app.inject({ method: "GET", url: `/v1/consent/sign-up${query}` });
+
+  beforeEach(async () => {
+    app = await build("none");
+  });
+
+  it("answers anonymously with W and one account_terms entry at version 2, its statement and its sha256", async () => {
+    const res = await get();
+    expect(res.statusCode).toBe(200);
+    expect(res.headers["cache-control"]).toBe("no-store");
+    expect(res.json()).toEqual({
+      ok: true,
+      data: {
+        workspaceId: W,
+        agreements: [
+          {
+            purposeId: "account_terms",
+            policyVersion: 2,
+            locale: "en",
+            statement: CONTACT_FORM_TERMS_STATEMENT,
+            statementHash: sha256(CONTACT_FORM_TERMS_STATEMENT),
+          },
+        ],
+      },
+    });
+  });
+
+  it("reads the default locale en, and records the locale the statement was read in", async () => {
+    const plain = (await get()).json().data.agreements[0];
+    const fr = (await get("?locale=fr")).json().data.agreements[0];
+    expect(plain.locale).toBe("en");
+    // The registry declares only English, so a French reader read English.
+    expect(fr).toEqual(plain);
+  });
+
+  it("is the evidence the writer stamps: the hash of the statement a grant records", async () => {
+    const evidence = (await get()).json().data.agreements[0];
+    await app.close();
+    app = await build("cookie");
+    await postAccount({ purposeIds: ["account_terms"] });
+    expect(double.ledger[0]?.statement).toBe(evidence.statement);
+    expect(
+      consentService.consentStatementHash(double.ledger[0]!.statement),
+    ).toBe(evidence.statementHash);
+  });
+
+  it("refuses a malformed query with 400 invalid_input", async () => {
+    for (const query of ["?locale=not_a_locale", "?workspaceId=x"]) {
+      const res = await get(query);
+      expect(res.statusCode).toBe(400);
+      expect(res.json().error.code).toBe("invalid_input");
+    }
+  });
+
+  it("answers 503 tenant_unresolved, uncached, when the site workspace does not resolve", async () => {
+    mockResolveSiteWorkspaceId.mockResolvedValue(null);
+    const res = await get();
+    expect(res.statusCode).toBe(503);
+    expect(res.json().error.code).toBe("tenant_unresolved");
+    expect(res.headers["cache-control"]).toBe("no-store");
+  });
+});
+
+describe("GET/POST /v1/consent/account (D5) — AC-2", () => {
+  it("asks a user with no user rows: complete false, one entry never accepted", async () => {
+    app = await build("cookie");
+    const res = await getAccount();
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data).toEqual({
+      complete: false,
+      agreements: [
+        {
+          id: "account_terms",
+          statement: CONTACT_FORM_TERMS_STATEMENT,
+          policyVersion: 2,
+          acceptedVersion: null,
+          acceptedAt: null,
+          current: false,
+        },
+      ],
+    });
+  });
+
+  it("POST writes one dated user row in W and answers complete; a second POST adds nothing", async () => {
+    app = await build("cookie");
+    const res = await postAccount({ purposeIds: ["account_terms"] });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.complete).toBe(true);
+    expect(double.ledger).toHaveLength(1);
+    expect(double.ledger[0]).toMatchObject({
+      workspaceId: W,
+      subjectType: "user",
+      subjectId: U1,
+      personId: null,
+      purposeId: "account_terms",
+      granted: true,
+      source: "account_settings",
+      sourceRef: null,
+      policyVersion: 2,
+      statement: CONTACT_FORM_TERMS_STATEMENT,
+    });
+    expect(double.ledger[0]?.createdAt).toBeInstanceOf(Date);
+    const [entry] = res.json().data.agreements;
+    expect(entry).toMatchObject({
+      acceptedVersion: 2,
+      acceptedAt: double.ledger[0]!.createdAt.toISOString(),
+      current: true,
+    });
+
+    const again = await postAccount({ purposeIds: ["account_terms"] });
+    expect(again.statusCode).toBe(200);
+    expect(again.json().data.complete).toBe(true);
+    expect(double.ledger).toHaveLength(1);
+  });
+
+  it("the same POST from S1's credential writes in W, with sourceRef spoke:S1", async () => {
+    app = await build("hub");
+    const res = await postAccount({ purposeIds: ["account_terms"] });
+    expect(res.statusCode).toBe(200);
+    expect(double.ledger).toHaveLength(1);
+    expect(double.ledger[0]).toMatchObject({
+      workspaceId: W,
+      subjectType: "user",
+      subjectId: U1,
+      sourceRef: `spoke:${S1}`,
+    });
+  });
+
+  it("refuses a purpose that is not a sign-up agreement with 404 purpose_unknown, writing nothing — even beside a valid one", async () => {
+    app = await build("cookie");
+    for (const purposeIds of [
+      ["service_terms"],
+      ["account_terms", "service_terms"],
+      ["nope"],
+    ]) {
+      const res = await postAccount({ purposeIds });
+      expect(res.statusCode).toBe(404);
+      expect(res.json().error.code).toBe("purpose_unknown");
+    }
+    expect(double.ledger).toHaveLength(0);
+  });
+
+  it("refuses a malformed body with 400 invalid_input", async () => {
+    app = await build("cookie");
+    for (const body of [
+      {},
+      { purposeIds: [] },
+      { purposeIds: ["account_terms"], userId: U1 },
+      { purposeIds: ["account_terms"], locale: "not_a_locale" },
+    ]) {
+      const res = await postAccount(body);
+      expect(res.statusCode).toBe(400);
+      expect(res.json().error.code).toBe("invalid_input");
+    }
+    expect(double.ledger).toHaveLength(0);
+  });
+
+  it("refuses a personal token and an anonymous caller with 401, before any read", async () => {
+    for (const caller of ["token", "none"] as const) {
+      app = await build(caller);
+      expect((await getAccount()).statusCode).toBe(401);
+      expect(
+        (await postAccount({ purposeIds: ["account_terms"] })).statusCode,
+      ).toBe(401);
+      await app.close();
+    }
+    app = await build("cookie");
+    expect(prisma.$queryRaw).not.toHaveBeenCalled();
+    expect(double.ledger).toHaveLength(0);
+  });
+
+  it("answers 503 tenant_unresolved when the site workspace does not resolve", async () => {
+    mockResolveSiteWorkspaceId.mockResolvedValue(null);
+    app = await build("cookie");
+    expect((await getAccount()).statusCode).toBe(503);
+    const res = await postAccount({ purposeIds: ["account_terms"] });
+    expect(res.statusCode).toBe(503);
+    expect(res.json().error.code).toBe("tenant_unresolved");
+    expect(double.ledger).toHaveLength(0);
+  });
+
+  it("reads a newest row that is not a grant as never accepted", async () => {
+    app = await build("cookie");
+    await postAccount({ purposeIds: ["account_terms"] });
+    double.ledger.push({
+      ...double.ledger[0]!,
+      id: "cnsnt_00000000-0000-7000-8000-0000000000f1",
+      granted: false,
+      createdAt: new Date(Date.UTC(2026, 9, 13)),
+    });
+    expect((await getAccount()).json().data.agreements[0]).toMatchObject({
+      acceptedVersion: null,
+      acceptedAt: null,
+      current: false,
+    });
+  });
+
+  it("logs { event, outcome } only", async () => {
+    app = await build("cookie");
+    const lines: unknown[] = [];
+    const capture = ((obj: unknown) => {
+      lines.push(obj);
+    }) as never;
+    jest.spyOn(app.log, "info").mockImplementation(capture);
+    jest.spyOn(app.log, "warn").mockImplementation(capture);
+    await postAccount({ purposeIds: ["account_terms"] });
+    await postAccount({ purposeIds: ["service_terms"] });
+    const ours = lines.filter(
+      (l) => typeof l === "object" && l !== null && "event" in l,
+    );
+    expect(ours).toEqual([
+      { event: "account-agreements", outcome: "saved" },
+      { event: "account-agreements", outcome: "purpose_unknown" },
+    ]);
+  });
+});
+
+describe("GET /v1/consent/account — AC-3 (route)", () => {
+  it("a grant at version 2 in W reads complete from S1's credential", async () => {
+    app = await build("cookie");
+    await postAccount({ purposeIds: ["account_terms"] });
+    await app.close();
+    app = await build("hub");
+    const res = await getAccount();
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.complete).toBe(true);
+    expect(res.json().data.agreements[0]).toMatchObject({
+      acceptedVersion: 2,
+      current: true,
+    });
+  });
+});
+
+describe("GET/POST /v1/consent/account — AC-4 (route)", () => {
+  it("a bump to version 3 asks again; accepting appends a row and keeps the old one unchanged", async () => {
+    app = await build("cookie");
+    await postAccount({ purposeIds: ["account_terms"] });
+    const before = structuredClone(double.ledger[0]);
+
+    jest
+      .spyOn(consentService, "consentConfigForSite")
+      .mockResolvedValue(registryAt(3));
+
+    const read = (await getAccount()).json().data;
+    expect(read.complete).toBe(false);
+    expect(read.agreements[0]).toMatchObject({
+      policyVersion: 3,
+      acceptedVersion: 2,
+      current: false,
+    });
+
+    const res = await postAccount({ purposeIds: ["account_terms"] });
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.complete).toBe(true);
+    expect(double.ledger).toHaveLength(2);
+    expect(double.ledger[0]).toEqual(before);
+    expect(double.ledger[1]).toMatchObject({
+      subjectType: "user",
+      subjectId: U1,
+      policyVersion: 3,
+      granted: true,
+    });
+    // The append-only double offers no way to change a stored row: the
+    // ledger delegate is append and read only, so an update would throw.
+    for (const method of [
+      "update",
+      "updateMany",
+      "upsert",
+      "delete",
+      "deleteMany",
+    ]) {
+      expect(method in prisma.consentGrant).toBe(false);
+    }
+  });
+});

package/templates/apps/api/src/routes/consent/account.ts

@@ -0,0 +1,266 @@
+/**
+ * The sign-up agreements: their evidence, and the account-level reading
+ * (#8765, spec docs/specs/8765-sign-up-refuses-without-the-spec.md D2, D5).
+ *
+ *   GET  /v1/consent/sign-up?locale=
+ *       Anonymous and keyless. `{ workspaceId, agreements: [{ purposeId,
+ *       policyVersion, locale, statement, statementHash }] }` — one entry per
+ *       `signUp` agreement of the site registry, its statement resolved by
+ *       `resolveConsentStatement` for `locale` (default `en`) and hashed by
+ *       `consentStatementHash`: the same evidence `recordPersonConsent`
+ *       stamps, from the same functions. `Cache-Control: no-store`.
+ *   GET  /v1/consent/account?locale=
+ *       The caller's sign-up agreements: `{ agreements: [{ id, statement,
+ *       policyVersion, acceptedVersion, acceptedAt, current }], complete }`,
+ *       folded from the caller's `user`-subject rows (`userPlatformRows`).
+ *       `acceptedVersion`/`acceptedAt` come from the newest row when it is a
+ *       grant, else `null`; `current` is a grant at the registry's version;
+ *       `complete` is every entry current.
+ *   POST /v1/consent/account
+ *       `{ purposeIds, locale? }` — every id must be a `signUp` agreement
+ *       (`404 purpose_unknown` with NOTHING written, all ids checked before
+ *       any write); each is written through `recordPersonConsent` against
+ *       subject `user` / the caller, no Person, source `account_settings`,
+ *       with `sourceRef: spoke:<id>` for a hub credential (SEC-8765-A). A
+ *       grant already at the current version adds nothing. Answers the GET
+ *       body.
+ *
+ * The agreement belongs to the User account, a login shared by every site
+ * that signs in through this hub (C3), so the workspace is ALWAYS
+ * `resolveSiteWorkspaceId()` — the deployment's own site, where its `User`
+ * rows live — never a key, body or query value; `null` is
+ * `503 tenant_unresolved`. One row there answers the hub and every spoke.
+ *
+ * Callers. The evidence route: the web's own server, stamping the grant it
+ * writes inside Better Auth's sign-up transaction (`apps/web/lib/
+ * sign-up-agreements.ts`, D3, D4). Registered at the top level in its own
+ * rate-limited scope (`signupevidence`), outside every module gate. The
+ * account pair: `memberCaller` — the hub's own cookie session or a hub
+ * credential (the account layout's interstitial, D7); a personal `ApiToken`
+ * is `401 unauthorized`. There is no verified-email floor: the agreement is
+ * about the `User` row, and no Person is read or created. Registered in
+ * `authScope` unconditionally (auth and consent are never-gate surfaces),
+ * and both are in `HUB_SESSION_ROUTES`. Logs `{ event: "account-agreements",
+ * outcome }` only.
+ *
+ * MCP parity note: no MCP twin — the evidence route is part of the sign-up
+ * flow and the account pair is identity-bound; the anonymous MCP surface is
+ * identity-blind (tests/parity/README.md).
+ */
+import {
+  accountAgreementsBodySchema,
+  accountAgreementsQuerySchema,
+  accountAgreementsResponseSchema,
+  consentSignUpQuerySchema,
+  consentSignUpResponseSchema,
+  resolveConsentStatement,
+  signUpAgreements,
+  type AccountAgreementsResponse,
+  type SiteConsentConfig,
+} from "@working-theory/validation";
+import type { FastifyPluginAsync, FastifyReply, FastifyRequest } from "fastify";
+import type { z } from "zod";
+
+import { userPlatformRows } from "../../lib/consent-store.js";
+import { resolveSiteWorkspaceId } from "../../lib/site.js";
+import { memberCaller } from "../../middleware/auth.js";
+import {
+  consentConfigForSite,
+  consentStatementHash,
+  recordPersonConsent,
+} from "../../services/consent.js";
+
+const EVENT = "account-agreements";
+
+function refuse(
+  reply: FastifyReply,
+  status: number,
+  code: string,
+  message: string,
+) {
+  return reply.status(status).send({ ok: false, error: { code, message } });
+}
+
+function send<T extends z.ZodTypeAny>(
+  reply: FastifyReply,
+  schema: T,
+  data: unknown,
+) {
+  const parsed = schema.safeParse(data);
+  if (!parsed.success) {
+    return refuse(
+      reply,
+      500,
+      "internal_error",
+      "Response failed contract validation",
+    );
+  }
+  return reply.send({ ok: true, data: parsed.data });
+}
+
+function log(request: FastifyRequest, outcome: string): void {
+  if (outcome === "saved" || outcome === "unchanged") {
+    request.log.info({ event: EVENT, outcome }, "[consent] account agreements");
+  } else {
+    request.log.warn({ event: EVENT, outcome }, "[consent] refused");
+  }
+}
+
+function refuseUnresolved(request: FastifyRequest, reply: FastifyReply) {
+  log(request, "tenant_unresolved");
+  return refuse(
+    reply,
+    503,
+    "tenant_unresolved",
+    "This site cannot take this request.",
+  );
+}
+
+/** The caller's sign-up agreements in the site workspace (D5). */
+async function accountReading(
+  workspaceId: string,
+  userId: string,
+  config: SiteConsentConfig,
+  locale: string,
+): Promise<AccountAgreementsResponse> {
+  const rows = await userPlatformRows(workspaceId, userId);
+  const newest = new Map(rows.map((row) => [row.purposeId, row]));
+  const agreements = signUpAgreements(config).map((purpose) => {
+    const row = newest.get(purpose.id);
+    const grant = row?.granted === true ? row : null;
+    return {
+      id: purpose.id,
+      statement: resolveConsentStatement(purpose, locale).statement,
+      policyVersion: purpose.policyVersion,
+      acceptedVersion: grant?.policyVersion ?? null,
+      acceptedAt: grant === null ? null : grant.at.toISOString(),
+      current: grant !== null && grant.policyVersion === purpose.policyVersion,
+    };
+  });
+  return { agreements, complete: agreements.every((a) => a.current) };
+}
+
+/** `GET /v1/consent/sign-up` — top level, its own rate-limited scope (D2). */
+export const consentSignUpRoute: FastifyPluginAsync = async (fastify) => {
+  fastify.get("/v1/consent/sign-up", async (request, reply) => {
+    reply.header("Cache-Control", "no-store");
+    const query = consentSignUpQuerySchema.safeParse(request.query);
+    if (!query.success) {
+      return refuse(reply, 400, "invalid_input", "The request was not valid.");
+    }
+    const locale = query.data.locale ?? "en";
+
+    const workspaceId = await resolveSiteWorkspaceId();
+    if (workspaceId === null) return refuseUnresolved(request, reply);
+
+    const config = await consentConfigForSite(workspaceId);
+    const agreements = signUpAgreements(config).map((purpose) => {
+      const resolved = resolveConsentStatement(purpose, locale);
+      return {
+        purposeId: purpose.id,
+        policyVersion: purpose.policyVersion,
+        locale: resolved.locale,
+        statement: resolved.statement,
+        statementHash: consentStatementHash(resolved.statement),
+      };
+    });
+    return send(reply, consentSignUpResponseSchema, {
+      workspaceId,
+      agreements,
+    });
+  });
+};
+
+/** `GET`/`POST /v1/consent/account` — in `authScope`, unconditionally (D5). */
+export const consentAccountRoutes: FastifyPluginAsync = async (fastify) => {
+  fastify.get("/v1/consent/account", async (request, reply) => {
+    const userId = memberCaller(request);
+    if (userId === null) {
+      log(request, "unauthorized");
+      return reply.status(401).send({ error: "unauthorized" });
+    }
+    const query = accountAgreementsQuerySchema.safeParse(request.query);
+    if (!query.success) {
+      log(request, "invalid_input");
+      return refuse(reply, 400, "invalid_input", "The request was not valid.");
+    }
+    const workspaceId = await resolveSiteWorkspaceId();
+    if (workspaceId === null) return refuseUnresolved(request, reply);
+
+    const config = await consentConfigForSite(workspaceId);
+    return send(
+      reply,
+      accountAgreementsResponseSchema,
+      await accountReading(
+        workspaceId,
+        userId,
+        config,
+        query.data.locale ?? "en",
+      ),
+    );
+  });
+
+  fastify.post("/v1/consent/account", async (request, reply) => {
+    const userId = memberCaller(request);
+    if (userId === null) {
+      log(request, "unauthorized");
+      return reply.status(401).send({ error: "unauthorized" });
+    }
+    const body = accountAgreementsBodySchema.safeParse(request.body);
+    if (!body.success) {
+      log(request, "invalid_input");
+      return refuse(reply, 400, "invalid_input", "The request was not valid.");
+    }
+    const locale = body.data.locale ?? "en";
+    const workspaceId = await resolveSiteWorkspaceId();
+    if (workspaceId === null) return refuseUnresolved(request, reply);
+
+    const config = await consentConfigForSite(workspaceId);
+    // Every id is checked before any write, so a refusal writes nothing.
+    const agreementIds = new Set(signUpAgreements(config).map((p) => p.id));
+    const purposeIds = [...new Set(body.data.purposeIds)];
+    if (!purposeIds.every((id) => agreementIds.has(id))) {
+      log(request, "purpose_unknown");
+      return refuse(
+        reply,
+        404,
+        "purpose_unknown",
+        "That agreement can't be accepted here.",
+      );
+    }
+
+    let changed = false;
+    for (const purposeId of purposeIds) {
+      const result = await recordPersonConsent({
+        workspaceId,
+        personId: null,
+        purposeId,
+        granted: true,
+        source: "account_settings",
+        ...(request.hubSession !== undefined && {
+          sourceRef: `spoke:${request.hubSession.spokeId}`,
+        }),
+        locale,
+        config,
+        subject: { subjectType: "user", subjectId: userId },
+      });
+      if (!result.ok) {
+        log(request, result.code);
+        return refuse(
+          reply,
+          result.code === "purpose_unknown" ? 404 : 400,
+          result.code,
+          "That agreement can't be accepted here.",
+        );
+      }
+      changed ||= result.changed;
+    }
+
+    log(request, changed ? "saved" : "unchanged");
+    return send(
+      reply,
+      accountAgreementsResponseSchema,
+      await accountReading(workspaceId, userId, config, locale),
+    );
+  });
+};

package/templates/apps/api/src/routes/consent/index.ts

@@ -1,18 +1,26 @@
 /**
  * The consent routes (#8438, spec
- * docs/specs/8438-consent-registry-and-ledger-step-spec.md D5, D8, D9).
+ * docs/specs/8438-consent-registry-and-ledger-step-spec.md D5, D8, D9; #8765,
+ * spec docs/specs/8765-sign-up-refuses-without-the-spec.md D2, D5).
  *
  *   cookie.ts       POST /v1/consent/cookie       — the banner's log
  *   unsubscribe.ts  POST /v1/consent/unsubscribe  — a signed link's landing
+ *   account.ts      GET  /v1/consent/sign-up      — the sign-up agreements'
+ *                   evidence (anonymous)
+ *                   GET/POST /v1/consent/account  — the caller's account-level
+ *                   sign-up agreements (cookie session or hub credential)
  *   platform.ts     GET/POST /v1/consent/platform — the Admin owner's
  *                   consents to Working Theory (multi-tenant module only)
  *
- * The first two are the never-gated privacy floor: registered at the top
- * level, each in its OWN rate-limited scope (`consent`, `unsubscribe`) so
- * filling one never blocks the other, and both on the forwarded-visitor
- * route list (`middleware/rate-limit.ts`). This barrel re-exports exactly
- * those two; the platform routes belong to the multi-tenant slice and are
- * loaded only through `server.ts`'s slice table.
+ * The first two and the evidence route are the never-gated floor: registered
+ * at the top level, each in its OWN rate-limited scope (`consent`,
+ * `unsubscribe`, `signupevidence`) so filling one never blocks another; the
+ * first two are also on the forwarded-visitor route list
+ * (`middleware/rate-limit.ts`). The account pair registers in `authScope`,
+ * unconditionally. This barrel re-exports those four plugins; the platform
+ * routes belong to the multi-tenant slice and are loaded only through
+ * `server.ts`'s slice table.
  */
+export { consentAccountRoutes, consentSignUpRoute } from "./account.js";
 export { consentCookieRoute } from "./cookie.js";
 export { consentUnsubscribeRoute } from "./unsubscribe.js";