create-ailk 0.21.0 → 0.22.0

package/templates/apps/web/lib/hub-session/__tests__/sign-in-gate.test.tsx

@@ -0,0 +1,111 @@
+/**
+ * HubSignInGate (#7894 D10) as #8790 AC-1/AC-2 shape it: the site's inner-page
+ * header (back arrow + mark), a label-size heading, the one hub sign-in
+ * action, and a prospect line only when the site's messages carry it.
+ */
+import { render, screen } from "@testing-library/react";
+import en from "../../../messages/en.json";
+import { HubSignInGate } from "../sign-in-gate";
+
+type Gate = Record<string, string>;
+let gateMessages: Gate;
+
+jest.mock("next-intl/server", () => ({
+  __esModule: true,
+  getTranslations: jest.fn(async () => {
+    const t = (key: string) => gateMessages[key] ?? `copy:${key}`;
+    t.has = (key: string) => key in gateMessages;
+    return t;
+  }),
+}));
+
+const mockConfig = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; hubSessionConfig() is a pure env read
+jest.mock("../config", () => ({
+  __esModule: true,
+  hubSessionConfig: () => mockConfig(),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; siteLogo() reads the site's brand files
+jest.mock("../../site-logo", () => ({
+  __esModule: true,
+  siteLogo: () => (
+    <img src="/logomark.svg" alt="Site" data-testid="site-mark" />
+  ),
+}));
+
+async function renderGate(pathname?: string): Promise<void> {
+  const requestHeaders = new Headers();
+  if (pathname) requestHeaders.set("x-pathname", pathname);
+  render(await HubSignInGate({ locale: "en", requestHeaders }));
+}
+
+beforeEach(() => {
+  gateMessages = { ...(en.account.gate as Gate) };
+  mockConfig.mockReset().mockReturnValue({ clientId: "spoke_1" });
+});
+
+describe("<HubSignInGate/> (#8790 AC-1)", () => {
+  it("wears the site's inner-page header: a back arrow to the home and the mark", async () => {
+    await renderGate("/account");
+    const header = screen.getByTestId("account-sign-in-gate-header");
+    const back = screen.getByTestId("nav-back-link");
+    expect(header).toContainElement(back);
+    expect(back).toHaveAttribute("href", "/");
+    expect(back).toHaveAccessibleName(en.account.gate.homeLink);
+    expect(screen.getByTestId("account-sign-in-gate-mark")).toContainElement(
+      screen.getByTestId("site-mark"),
+    );
+  });
+
+  it("sets the heading at the label size and offers the one sign-in action", async () => {
+    await renderGate("/account/settings");
+    const heading = screen.getByRole("heading", { level: 1 });
+    expect(heading).toHaveTextContent(en.account.gate.hubHeadline);
+    expect(heading).toHaveClass("text-heading-2");
+    expect(screen.getByTestId("account-hub-sign-in")).toHaveAttribute(
+      "href",
+      "/api/hub-session/sign-in?next=%2Faccount%2Fsettings",
+    );
+  });
+
+  it("renders no prospect line by default (the shipped messages carry no prospect keys)", async () => {
+    await renderGate();
+    expect(screen.queryByTestId("account-sign-in-gate-prospect")).toBeNull();
+  });
+});
+
+describe("<HubSignInGate/> prospect line (#8790 AC-2)", () => {
+  it("renders the line and its link when the site fills all three keys", async () => {
+    gateMessages.prospectPrompt = "New here?";
+    gateMessages.prospectLink = "See if we fit";
+    gateMessages.prospectHref = "/fit";
+    await renderGate();
+    const line = screen.getByTestId("account-sign-in-gate-prospect");
+    expect(line).toHaveTextContent("New here? See if we fit.");
+    expect(screen.getByRole("link", { name: "See if we fit" })).toHaveAttribute(
+      "href",
+      "/fit",
+    );
+  });
+
+  it("renders nothing when any of the three keys is absent", async () => {
+    gateMessages.prospectPrompt = "New here?";
+    gateMessages.prospectLink = "See if we fit";
+    await renderGate();
+    expect(screen.queryByTestId("account-sign-in-gate-prospect")).toBeNull();
+  });
+
+  it("keeps the not-configured state when the hub is not configured", async () => {
+    mockConfig.mockReturnValue(null);
+    await renderGate();
+    expect(screen.getByRole("heading", { level: 1 })).toHaveTextContent(
+      en.account.gate.emptyHeadline,
+    );
+    expect(screen.getByTestId("account-sign-in-gate-home")).toHaveAttribute(
+      "href",
+      "/",
+    );
+    expect(screen.queryByTestId("account-hub-sign-in")).toBeNull();
+  });
+});

package/templates/apps/web/lib/hub-session/sign-in-gate.tsx

@@ -1,6 +1,6 @@
 /**
  * HubSignInGate — the signed-out account gate of a spoke that signs in
- * through its hub (#7894 D10).
+ * through its hub (#7894 D10; #8790 AC-1/AC-2).
  *
  * A Server Component, rendered by the `(authed)` layout through the generated
  * gate seam (`signed-out-gate.generated.tsx`, its `signIn: "hub"` render). It
@@ -9,16 +9,26 @@
  * link is a plain anchor (the `Link` primitive), so nothing prefetches the
  * route and starts a flow the visitor did not ask for.
  *
+ * #8790 — the gate reads as one of the site's inner pages, not a bare
+ * full-height stop: the site's inner-page header (the back arrow at the start
+ * edge, the mark centred — the shape `Nav bar="bare"` draws, composed here
+ * from the same `NavBackLink` and `siteLogo()`), a heading at the label size
+ * (`heading-2`), and an optional quiet prospect line a site turns on by
+ * adding `account.gate.prospectPrompt` + `prospectLink` + `prospectHref`
+ * to its messages — absent, the shipped default, renders nothing.
+ * The document title is the account page's job (`generateMetadata` there
+ * reads the session and names this state "Sign in · <site>").
+ *
  * Not configured (`hubSessionConfig()` is `null`: a client id, secret or
  * session secret missing), it renders the account area's existing "sign-in
  * isn't available yet" state, whose one action leads back to the site.
  */
-
 import { localeHref } from "@working-theory/ui";
+import { NavBackLink } from "@working-theory/ui/chrome";
 import { Button, Heading, Link, Text } from "@working-theory/ui/primitives";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
-
+import { siteLogo } from "../site-logo";
 import { hubSessionConfig } from "./config";
 import { HUB_SESSION_FALLBACK_PATH } from "./session";
 
@@ -40,40 +50,86 @@ export async function HubSignInGate({
   const next =
     requestHeaders.get("x-pathname") ??
     localeHref(locale, HUB_SESSION_FALLBACK_PATH);
+  const home = localeHref(locale, "/");
+  // The three prospect keys are optional extensions of the typed catalog (the
+  // shipped en.json carries none — every leaf must be a non-empty string), so
+  // presence is the switch; hence the cast on `has`.
+  type Key = Parameters<typeof t.has>[0];
+  const has = (key: string): boolean => t.has(key as Key);
+  const prospect =
+    has("prospectPrompt") && has("prospectLink") && has("prospectHref")
+      ? {
+          prompt: t("prospectPrompt" as Key),
+          linkLabel: t("prospectLink" as Key),
+          href: t("prospectHref" as Key),
+        }
+      : null;
 
   return (
     <div
-      className="flex min-h-screen flex-col items-center justify-center gap-4 py-section text-center"
+      className="flex min-h-screen flex-col"
       data-testid="account-sign-in-gate"
     >
-      <Heading level={1} visual={4}>
-        {configured ? t("hubHeadline") : t("emptyHeadline")}
-      </Heading>
-      <Text variant="body-sm" tone="muted" className="max-w-xs">
-        {configured ? t("hubDescription") : t("emptyDescription")}
-      </Text>
-      {configured ? (
-        // The primary action: 44px on a phone, 36px from md up.
-        <Button asChild className="max-md:min-h-11">
-          <Link
-            href={`${HUB_SIGN_IN_ROUTE}?next=${encodeURIComponent(next)}`}
-            variant="bare"
-            data-testid="account-hub-sign-in"
-          >
-            {t("hubSignIn")}
-          </Link>
-        </Button>
-      ) : (
-        <Button asChild variant="secondary" className="max-md:min-h-11">
-          <Link
-            href={localeHref(locale, "/")}
-            variant="bare"
-            data-testid="account-sign-in-gate-home"
-          >
-            {t("homeLink")}
-          </Link>
-        </Button>
-      )}
+      {/* The site's inner-page header: back arrow at the start, the mark centred (#8790 AC-1). */}
+      <header
+        className="grid h-16 grid-cols-[1fr_auto_1fr] items-center px-5 md:px-8"
+        data-testid="account-sign-in-gate-header"
+      >
+        <div className="justify-self-start">
+          <NavBackLink href={home} label={t("homeLink")} />
+        </div>
+        <Link
+          href={home}
+          variant="unstyled"
+          className="inline-flex h-7 items-center [&>img]:h-full [&>img]:w-auto [&>img]:object-contain"
+          data-testid="account-sign-in-gate-mark"
+        >
+          {siteLogo()}
+        </Link>
+        <div />
+      </header>
+      <div className="flex flex-1 flex-col items-center justify-center gap-4 py-section text-center">
+        <Heading level={1} visual={2}>
+          {configured ? t("hubHeadline") : t("emptyHeadline")}
+        </Heading>
+        <Text variant="body-sm" tone="muted" className="max-w-xs">
+          {configured ? t("hubDescription") : t("emptyDescription")}
+        </Text>
+        {configured ? (
+          // The primary action: 44px on a phone, 36px from md up.
+          <Button asChild className="max-md:min-h-11">
+            <Link
+              href={`${HUB_SIGN_IN_ROUTE}?next=${encodeURIComponent(next)}`}
+              variant="bare"
+              data-testid="account-hub-sign-in"
+            >
+              {t("hubSignIn")}
+            </Link>
+          </Button>
+        ) : (
+          <Button asChild variant="secondary" className="max-md:min-h-11">
+            <Link
+              href={home}
+              variant="bare"
+              data-testid="account-sign-in-gate-home"
+            >
+              {t("homeLink")}
+            </Link>
+          </Button>
+        )}
+        {configured && prospect ? (
+          // A wrapping div carries the hook: `Text` forwards no data-* attributes.
+          <div data-testid="account-sign-in-gate-prospect">
+            <Text as="p" variant="body-sm" tone="muted">
+              {prospect.prompt}{" "}
+              <Link href={prospect.href} variant="inline">
+                {prospect.linkLabel}
+              </Link>
+              .
+            </Text>
+          </div>
+        ) : null}
+      </div>
     </div>
   );
 }

package/templates/apps/web/lib/prisma-for-auth.ts

@@ -9,6 +9,14 @@
  * `lib/license-key-store.ts`, which hands `prismaForAuth.siteSetting` to the
  * licence client's SiteSetting store for the ONE deployment-wide
  * `license.renewed_key` row (#6677 DD-6 — a narrow, named exception).
+ *
+ * A third use rides on `auth.ts`'s own (#8765 D4, SEC-8765-K):
+ * `lib/sign-up-agreements.ts`'s account hook writes the new user's `sign_up`
+ * consent grants through `consentGrant.createMany` on the transaction client
+ * Better Auth's sign-up transaction runs on — only rows for the user that
+ * transaction is creating, never a read and never any other row. It imports
+ * nothing from here; it reaches the client through the adapter.
+ *
  * Every other business-logic caller goes through apps/api, never the
  * database directly (architecture.yaml `apps/web` may_not_import_from
  * `database`; the single-file singleton here is the documented exception,