create-ailk 0.21.0 → 0.23.0

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/popups.test.tsx

@@ -67,6 +67,11 @@ const mockMemberSendMessage = jest.fn();
 const mockMemberBook = jest.fn();
 jest.mock("@working-theory/api-client", () => ({
   __esModule: true,
+  // #8765 D7 — no agreement outstanding, so the Inbox loads.
+  consent: {
+    accountAgreements: () =>
+      Promise.resolve({ ok: true, body: { agreements: [], complete: true } }),
+  },
   waitlistSignups: { me: jest.fn() },
   subscription: { me: (...args: unknown[]) => mockNotFound(...args) },
   member: {

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/privacy.test.tsx

@@ -8,6 +8,8 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { act, fireEvent, render, screen, waitFor, within } from "@testing-library/react";
+import { consentStatementText } from "@working-theory/ui/blocks";
+import { ACCOUNT_TERMS_STATEMENT } from "@working-theory/validation";
 
 jest.mock("next-intl/server", () => {
   const msgs: unknown = require("../../../../../messages/en.json");
@@ -121,9 +123,9 @@ function agreementPurpose(overrides: Partial<{ id: string; state: unknown }> = {
     required: true,
     signUp: true,
     description: "Account terms.",
-    statement: "You agree to our Terms and Privacy Policy.",
-    policyHref: "/terms",
-    policyVersion: 1,
+    statement: ACCOUNT_TERMS_STATEMENT,
+    policyHref: "/working-agreement",
+    policyVersion: 2,
     state: overrides.state === undefined ? null : overrides.state,
     effective: false,
   };
@@ -274,14 +276,14 @@ describe("AC-4 — account-privacy-agreements (read-only)", () => {
       ok({
         purposes: [
           agreementPurpose({
-            state: { granted: true, at: "2026-10-01T12:00:00.000Z", source: "sign_up", policyVersion: 1 },
+            state: { granted: true, at: "2026-10-01T12:00:00.000Z", source: "sign_up", policyVersion: 2 },
           }),
         ],
       }),
     );
     await renderPage();
     const row = screen.getByTestId("account-privacy-agreement-account_terms");
-    expect(within(row).getByText("Version 1")).toBeInTheDocument();
+    expect(within(row).getByText("Version 2")).toBeInTheDocument();
     expect(within(row).getByText("Accepted Oct 1, 2026")).toBeInTheDocument();
     expect(within(row).queryByRole("switch")).not.toBeInTheDocument();
     expect(within(row).queryByRole("button")).not.toBeInTheDocument();
@@ -292,6 +294,43 @@ describe("AC-4 — account-privacy-agreements (read-only)", () => {
     await renderPage();
     expect(screen.getByTestId("account-privacy-agreement-account_terms-accepted")).toHaveTextContent("None yet");
   });
+
+  // #8765 D11 / AC-5 (#8761) — the statement renders with its three links.
+  it.each(["en", "fr"])(
+    "%s: the statement is the Contact sentence with no markdown, linking Terms, Privacy Policy and Working Agreement",
+    async (locale) => {
+      mockConsents.mockResolvedValue(ok({ purposes: [agreementPurpose()] }));
+      await renderPage(locale);
+      const statement = screen.getByTestId("account-privacy-agreement-account_terms-statement");
+      expect(statement.textContent).toBe(consentStatementText(ACCOUNT_TERMS_STATEMENT));
+      expect(statement.textContent).not.toContain("[");
+      expect(statement.textContent).not.toContain("](");
+      const prefix = locale === "en" ? "" : `/${locale}`;
+      const links = (["terms", "privacy", "working_agreement"] as const).map((key) => {
+        const link = within(statement).getByTestId(`consent-policy-link-${key}`);
+        return [link.textContent, link.getAttribute("href")];
+      });
+      expect(links).toEqual([
+        ["Terms", `${prefix}/terms`],
+        ["Privacy Policy", `${prefix}/privacy`],
+        ["Working Agreement", `${prefix}/working-agreement`],
+      ]);
+    },
+  );
+
+  it("no retired card policy link renders, and the policy link is the summary's, to /privacy", async () => {
+    mockConsents.mockResolvedValue(ok({ purposes: [agreementPurpose()] }));
+    await renderPage();
+    expect(
+      document.querySelector('[data-testid^="account-agreements-prompt-"][data-testid$="-policy"]'),
+    ).toBeNull();
+    const policyLinks = screen.getAllByText("Read our privacy policy");
+    expect(policyLinks).toHaveLength(1);
+    expect(within(screen.getByTestId("account-privacy-summary")).getByTestId("account-privacy-policy")).toHaveAttribute(
+      "href",
+      "/privacy",
+    );
+  });
 });
 
 describe("AC-4 — a failed consents read", () => {

package/templates/apps/web/app/[locale]/(authed)/account/account-frame.tsx

@@ -21,7 +21,8 @@
  * mismatch, a 5xx, a network error) leaves the cookie valid, so the frame
  * stays on the page and says so, never routing away with a live session.
  * Without an endpoint (a hub or a single site) nothing changes: Better Auth,
- * then home.
+ * then home. That logic is the exported `useAccountSignOut`, so the
+ * agreements interstitial's Sign out ends the session the same way (#8765 D7).
  *
  * #8231 D1, as amended by #8334 — the rail reads Inbox, a Library group
  * holding Artifacts, and the footer's ?. Settings is not a rail row: it lives
@@ -120,6 +121,71 @@ export interface AccountFrameProps {
   children: ReactNode;
 }
 
+export interface AccountSignOutOptions {
+  locale: string;
+  /** The seam's `SIGN_OUT_ENDPOINT`; absent or `null`: Better Auth signs out (#8465). */
+  signOutEndpoint?: string | null | undefined;
+  /** Where a hub sign-out lands; defaults to the site home. */
+  signInHref?: string | undefined;
+}
+
+export interface AccountSignOut {
+  onSignOut: () => void;
+  /** True after a hub sign-out was refused or failed: the session is still live. */
+  signOutFailed: boolean;
+}
+
+/**
+ * The account area's Log out — the frame's, and the agreements
+ * interstitial's Sign out (#8765 D7), so both end the session the same way.
+ * With an endpoint (a spoke that signs in through its hub) it POSTs it and
+ * navigates to the sign-in page only on a 2xx; a refused or failed sign-out
+ * sets `signOutFailed` and navigates nowhere (#8465). Without one, Better
+ * Auth signs out, then home.
+ */
+export function useAccountSignOut({
+  locale,
+  signOutEndpoint,
+  signInHref,
+}: AccountSignOutOptions): AccountSignOut {
+  const router = useRouter();
+  const [signOutFailed, setSignOutFailed] = useState(false);
+  const homeHref = localeHref(locale, "/");
+
+  const onSignOut = (): void => {
+    void (async () => {
+      setSignOutFailed(false);
+      if (signOutEndpoint) {
+        // A refused or failed sign-out leaves the session cookie valid, so the
+        // page must not pretend otherwise by navigating away (#8465).
+        try {
+          const res = await fetch(signOutEndpoint, { method: "POST", credentials: "same-origin" });
+          if (!res.ok) {
+            setSignOutFailed(true);
+            return;
+          }
+        } catch {
+          setSignOutFailed(true);
+          return;
+        }
+        router.push(signInHref ?? homeHref);
+        router.refresh();
+        return;
+      }
+      try {
+        await authClient.signOut();
+      } catch {
+        // The refresh below re-reads the session either way: a sign-out that
+        // failed lands the person back on a page that still knows them.
+      }
+      router.push(homeHref);
+      router.refresh();
+    })();
+  };
+
+  return { onSignOut, signOutFailed };
+}
+
 export function AccountFrame({
   locale,
   user,
@@ -131,12 +197,11 @@ export function AccountFrame({
   signInHref,
   children,
 }: AccountFrameProps): ReactElement {
-  const router = useRouter();
   const pathname = usePathname();
   const searchParams = useSearchParams();
   const [dismissed] = useForYouDismissed(ACCOUNT_PERSIST_KEY);
   const [topBarActions, setTopBarActions] = useState<HTMLElement | null>(null);
-  const [signOutFailed, setSignOutFailed] = useState(false);
+  const { onSignOut, signOutFailed } = useAccountSignOut({ locale, signOutEndpoint, signInHref });
 
   const homeHref = localeHref(locale, "/");
   const inboxHref = localeHref(locale, "/account");
@@ -162,37 +227,6 @@ export function AccountFrame({
   // #8233 D4 — the Inbox route's New lives in the top bar; nowhere else.
   const onInboxRoute = pathname === inboxHref;
 
-  const onSignOut = (): void => {
-    void (async () => {
-      setSignOutFailed(false);
-      if (signOutEndpoint) {
-        // A refused or failed sign-out leaves the session cookie valid, so the
-        // page must not pretend otherwise by navigating away (#8465).
-        try {
-          const res = await fetch(signOutEndpoint, { method: "POST", credentials: "same-origin" });
-          if (!res.ok) {
-            setSignOutFailed(true);
-            return;
-          }
-        } catch {
-          setSignOutFailed(true);
-          return;
-        }
-        router.push(signInHref ?? homeHref);
-        router.refresh();
-        return;
-      }
-      try {
-        await authClient.signOut();
-      } catch {
-        // The refresh below re-reads the session either way: a sign-out that
-        // failed lands the person back on a page that still knows them.
-      }
-      router.push(homeHref);
-      router.refresh();
-    })();
-  };
-
   const {
     home,
     inbox,

package/templates/apps/web/app/[locale]/(authed)/account/actions.ts

@@ -33,14 +33,6 @@
  * `redirect()` throws `NEXT_REDIRECT` by design — called OUTSIDE any
  * try/catch (mirrors `checkout.actions.ts`'s idiom) so a catch never
  * swallows the navigation this action exists to perform.
- *
- * This file does NOT hold the carried sign-up-agreement consume step
- * (`acceptCarriedAgreementsAction`, #8438 D13) — that lives in this
- * directory's own `agreements-actions.ts` instead, deliberately kept apart
- * from this file's `billing-source.ts` import: that module pulls in
- * `account-data.ts`, `@working-theory/ui` and `lucide-react`, a far heavier
- * footprint than the small, self-contained cookie codec needs. See
- * `agreements-actions.ts`'s own header.
  */
 
 import { redirect } from "next/navigation";

package/templates/apps/web/app/[locale]/(authed)/account/agreements-actions.ts

@@ -1,170 +1,58 @@
 "use server";
 
 /**
- * account/agreements-actions.ts — the account home's carried
- * sign-up-agreement CONSUME step (#8438 D13, spec
- * docs/specs/8438-consent-registry-and-ledger-step-spec.md C6).
+ * account/agreements-actions.ts — the account interstitial's one write
+ * (#8765 D7, spec docs/specs/8765-sign-up-refuses-without-the-spec.md).
  *
- * `apps/web` never touches the database (the ledger writer is `apps/api`),
- * and Better Auth creates the user from the sign-up card before any Person
- * exists to record a grant against. So the card remembers which agreements
- * the person ticked, in a short-lived, signed, email-bound cookie — this
- * file's `acceptCarriedAgreementsAction`, called once on the account home's
- * first signed-in render (`agreements-prompt.tsx`), decodes it and writes
- * each missing agreement with `via: "sign_up"`, then deletes the cookie
- * either way (single-use).
+ * `acceptAccountAgreementsAction` posts the sign-up agreements the
+ * interstitial (`agreements-prompt.tsx`) showed to `POST /v1/consent/account`
+ * (`consent.acceptAccountAgreements`), with the caller's forwarded cookie —
+ * or, on a spoke that signs in through its hub, the hub credential
+ * `forwardedCookieInit` returns — so the grant is account-level: subject
+ * `user`, in the deployment's site workspace, read by the hub and every
+ * spoke alike (C3). The API appends only when no grant exists at the current
+ * version, so a double click adds nothing.
  *
- * The MINT side, `rememberSignUpAgreementsAction`, lives in
- * `(auth)/sign-up/sign-up.actions.ts` instead of here, deliberately:
- * `(auth)/**` is one of the sign-in SEEDS a sign-in-less spoke drops
- * (`SPOKE_REMOVAL_SEEDS`, `packages/create-ailk/src/topology.ts` D4), and
- * `agreements-prompt.tsx` — this directory's own file, not a sign-in path —
- * must never reach into a dropped seed, or the scaffolder's own
- * dangling-import check (`spokeExclusions`) refuses the spoke build. So the
- * two sides duplicate the small cookie codec (encode there, decode here)
- * rather than share a module, precisely so each side's dependencies stay
- * native to where it lives.
+ * It answers `{ ok }` only; the interstitial refreshes on `ok` and the
+ * layout's next read decides whether the account loads. A refusal or a throw
+ * is `{ ok: false }`, never a throw, so the interstitial shows its error line.
  *
  * Kept as its OWN file, separate from this directory's `actions.ts`
  * (Billing's `openBillingPortal`): that file imports `billing-source.ts`,
- * which pulls in `account-data.ts`, `@working-theory/ui` and
- * `lucide-react` — a far heavier footprint than this small, self-contained
- * cookie codec needs. Keeping it apart means a test (or a bundler) that
- * reaches this file touches nothing from that tree.
- *
- * Cookie value: `<id>@<version>,…|<issuedAtMs>|<sha256(lowercased email)>|
- * <HMAC-SHA256 over the rest>`, keyed by `BETTER_AUTH_SECRET` — the same
- * dev fallback `apps/web/auth.ts`'s own `resolveSecret()` publishes when it
- * is unset. That secret is read directly HERE rather than importing
- * `resolveSecret` from `auth.ts`: that module statically imports the
- * ESM-only `better-auth` package, which every broad page-level test suite
- * that renders the account area would then have to mock. Verified with a
- * constant-time comparison; never trusted without it.
+ * which pulls in `account-data.ts`, `@working-theory/ui` and `lucide-react`.
  */
 
-import { createHash, createHmac, timingSafeEqual } from "node:crypto";
-
-import { member } from "@working-theory/api-client";
-import { cookies, headers } from "next/headers";
+import { consent } from "@working-theory/api-client";
+import { getLocale } from "next-intl/server";
 
 import { forwardedCookieInit } from "../../../../lib/server-api";
-import { readSession } from "../../../../lib/topology.generated";
-
-const SECURE_COOKIE_NAME = "__Host-ailk-signup-agreements";
-const DEV_COOKIE_NAME = "ailk-signup-agreements";
-const MAX_AGE_MS = 60 * 60 * 1000;
-
-/** Mirrors `sign-up.actions.ts`'s own copy — see that file's header. */
-const DEV_FALLBACK_SECRET =
-  "ailk-dev-fallback-secret-published-in-this-repo-never-use-in-production";
-
-/** Mirrors `sign-up.actions.ts`'s own copy exactly — see that file's header. */
-function signUpAgreementsSecret(): string {
-  const configured = process.env.BETTER_AUTH_SECRET;
-  if (configured) return configured;
-  const isBuildPhase = process.env.NEXT_PHASE === "phase-production-build";
-  if (process.env.NODE_ENV === "production" && !isBuildPhase) {
-    throw new Error(
-      "BETTER_AUTH_SECRET is required in production: it verifies the carried sign-up-agreement cookie.",
-    );
-  }
-  return DEV_FALLBACK_SECRET;
-}
-
-function cookieName(): string {
-  return process.env.NODE_ENV === "production" ? SECURE_COOKIE_NAME : DEV_COOKIE_NAME;
-}
-
-function emailHash(email: string): string {
-  return createHash("sha256").update(email.trim().toLowerCase()).digest("hex");
-}
-
-function sign(payload: string): string {
-  return createHmac("sha256", signUpAgreementsSecret()).update(payload).digest("hex");
-}
-
-/** Constant-time string equality — never a `===` on attacker-reachable input. */
-function safeEqual(a: string, b: string): boolean {
-  const bufA = Buffer.from(a);
-  const bufB = Buffer.from(b);
-  return bufA.length === bufB.length && timingSafeEqual(bufA, bufB);
-}
 
-interface CarriedPurpose {
-  id: string;
-  version: number;
+/** PII-safe: the status or the error's name, never the ids' owner. */
+function logAcceptFailed(reason: string): void {
+  console.error("[account]", {
+    event: "account-agreements",
+    outcome: "accept_failed",
+    reason,
+  });
 }
 
-interface DecodedCarriedAgreements {
-  purposes: CarriedPurpose[];
-  emailHash: string;
+export interface AcceptAccountAgreementsResult {
+  ok: boolean;
 }
 
-/** Verifies the HMAC and the one-hour window; `null` on any failure. */
-function decodeCarriedAgreements(value: string): DecodedCarriedAgreements | null {
-  const parts = value.split("|");
-  if (parts.length !== 4) return null;
-  const [purposesPart, issuedAtPart, emailHashPart, signature] = parts as [
-    string,
-    string,
-    string,
-    string,
-  ];
-  if (!safeEqual(sign(`${purposesPart}|${issuedAtPart}|${emailHashPart}`), signature)) {
-    return null;
-  }
-
-  const issuedAtMs = Number(issuedAtPart);
-  if (!Number.isFinite(issuedAtMs) || Date.now() - issuedAtMs > MAX_AGE_MS) return null;
-
-  const purposes: CarriedPurpose[] = [];
-  for (const entry of purposesPart.split(",")) {
-    const [id, versionStr] = entry.split("@");
-    const version = Number(versionStr);
-    if (!id || !Number.isFinite(version)) return null;
-    purposes.push({ id, version });
+export async function acceptAccountAgreementsAction(
+  purposeIds: string[],
+): Promise<AcceptAccountAgreementsResult> {
+  try {
+    const locale = await getLocale();
+    const res = await consent.acceptAccountAgreements(
+      { purposeIds, locale },
+      await forwardedCookieInit(),
+    );
+    if (!res.ok) logAcceptFailed(String(res.status));
+    return { ok: res.ok };
+  } catch (err) {
+    logAcceptFailed(err instanceof Error ? err.name : "unknown");
+    return { ok: false };
   }
-  if (purposes.length === 0) return null;
-
-  return { purposes, emailHash: emailHashPart };
-}
-
-export interface AcceptCarriedAgreementsResult {
-  accepted: boolean;
-}
-
-/**
- * Consumes the sign-up card's carried-agreement cookie — see the file
- * header for the mint/consume split. Writes every id in `missingPurposeIds`
- * with `via: "sign_up"` only when the cookie is valid, fresh, bound to the
- * signed-in (verified) session's own email, and covers every one of those
- * ids; otherwise writes nothing. The cookie is deleted either way once
- * found, so this never runs twice for the same cookie.
- */
-export async function acceptCarriedAgreementsAction(
-  missingPurposeIds: string[],
-): Promise<AcceptCarriedAgreementsResult> {
-  const store = await cookies();
-  const name = cookieName();
-  const raw = store.get(name)?.value;
-  if (!raw) return { accepted: false };
-  store.delete(name);
-
-  const decoded = decodeCarriedAgreements(raw);
-  if (!decoded) return { accepted: false };
-
-  const session = await readSession(await headers());
-  if (!session || !session.user.emailVerified) return { accepted: false };
-  if (decoded.emailHash !== emailHash(session.user.email)) return { accepted: false };
-
-  const carriedIds = new Set(decoded.purposes.map((p) => p.id));
-  if (!missingPurposeIds.every((id) => carriedIds.has(id))) return { accepted: false };
-
-  const init = await forwardedCookieInit();
-  const results = await Promise.all(
-    missingPurposeIds.map((purposeId) =>
-      member.setConsent({ purposeId, granted: true, via: "sign_up" }, init),
-    ),
-  );
-  return { accepted: results.every((r) => r.ok) };
 }

package/templates/apps/web/app/[locale]/(authed)/account/agreements-gate.ts

@@ -0,0 +1,61 @@
+/**
+ * The account area's sign-up agreement gate (#8765 D7, spec
+ * docs/specs/8765-sign-up-refuses-without-the-spec.md).
+ *
+ * `outstandingAgreements(ctx)` is the one read the layout and the Inbox
+ * page share: `GET /v1/consent/account` for the caller, `cache()`d per
+ * request (keyed on the context `accountSession`, itself cached, hands
+ * both). The layout shows the interstitial in place of the account while
+ * it answers anything; the Inbox page awaits it before any loader and
+ * renders nothing meanwhile, because the App Router renders a page beside
+ * its layout even when the layout never renders it — and the Inbox's
+ * `member.messages` read stamps `readAt`.
+ *
+ * `[]` when none is outstanding (the read answered `complete: true`, or an
+ * older hub answered 404). It fails closed (SEC-8765-C): any other answer —
+ * a thrown read, a 401, 403, 429 or 5xx — is the registry's own agreements
+ * from the same constant the API reads (#8438 C1), logged `read_failed`.
+ */
+
+import { consent } from "@working-theory/api-client";
+import type { AccountContext } from "@working-theory/templates/account";
+import {
+  resolveConsentStatement,
+  SITE_CONSENT_CONFIG_DEFAULTS,
+  signUpAgreements,
+} from "@working-theory/validation";
+import { cache } from "react";
+
+import type { AgreementsInterstitialAgreement } from "./agreements-prompt";
+
+export const outstandingAgreements = cache(
+  async (ctx: AccountContext): Promise<AgreementsInterstitialAgreement[]> => {
+    try {
+      const res = await consent.accountAgreements(ctx.init, {
+        locale: ctx.locale,
+      });
+      if (res.ok) {
+        if (res.body.complete) return [];
+        return res.body.agreements
+          .filter((agreement) => !agreement.current)
+          .map(({ id, statement, acceptedVersion }) => ({
+            id,
+            statement,
+            acceptedVersion,
+          }));
+      }
+      if (res.status === 404) return [];
+    } catch {
+      // Falls through to the registry's own agreements below.
+    }
+    console.error("[account]", {
+      event: "account-agreements",
+      outcome: "read_failed",
+    });
+    return signUpAgreements(SITE_CONSENT_CONFIG_DEFAULTS).map((purpose) => ({
+      id: purpose.id,
+      statement: resolveConsentStatement(purpose, ctx.locale).statement,
+      acceptedVersion: null,
+    }));
+  },
+);