create-ailk 0.25.1 → 0.27.0

package/templates/apps/web/lib/hub-session/sign-in-gate.tsx

@@ -10,25 +10,36 @@
  * route and starts a flow the visitor did not ask for.
  *
  * #8790 — the gate reads as one of the site's inner pages, not a bare
- * full-height stop: the site's inner-page header (the back arrow at the start
- * edge, the mark centred — the shape `Nav bar="bare"` draws, composed here
- * from the same `NavBackLink` and `siteLogo()`), a heading at the label size
- * (`heading-2`), and an optional quiet prospect line a site turns on by
- * adding `account.gate.prospectPrompt` + `prospectLink` + `prospectHref`
- * to its messages — absent, the shipped default, renders nothing.
- * The document title is the account page's job (`generateMetadata` there
- * reads the session and names this state "Sign in · <site>").
+ * full-height stop: the back arrow at the start edge (`NavBackLink`), then the
+ * card. The document title is the account page's job (`generateMetadata`
+ * there reads the session and names this state "Sign in · <site>").
+ *
+ * The one card (#9662, operator 2026-10-24): the single hub action sits in
+ * `AuthCard`'s frame — the site's mark in the 48px tile, "Sign in to <site>"
+ * (`SITE_NAME`, the deployment's own name, never the request's), the
+ * "Don't have an account? Sign up" line to this site's own sign-in route with
+ * `prompt=create`, which lands on the hub's sign-up screen and returns here
+ * (#9912 D1), and the Terms + Privacy acknowledgement on this site's own
+ * policy routes. A site that fills `account.gate.prospectPrompt` +
+ * `prospectLink` + `prospectHref` replaces the toggle line with its own. The
+ * acknowledgement is built here rather than from the `(auth)` group's
+ * builder: a spoke carries no `(auth)` group (create-ailk's
+ * `SPOKE_REMOVAL_SEEDS`).
  *
  * Not configured (`hubSessionConfig()` is `null`: a client id, secret or
- * session secret missing), it renders the account area's existing "sign-in
- * isn't available yet" state, whose one action leads back to the site.
+ * session secret missing), the card says "sign-in isn't available yet" and
+ * its one action leads back to the site.
  */
 import { localeHref } from "@working-theory/ui";
+import { AuthCard } from "@working-theory/ui/blocks";
 import { NavBackLink } from "@working-theory/ui/chrome";
-import { Button, Heading, Link, Text } from "@working-theory/ui/primitives";
+import { Button, Link, Text } from "@working-theory/ui/primitives";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
+
+import { SITE_NAME } from "../site-brand";
 import { siteLogo } from "../site-logo";
+
 import { hubSessionConfig } from "./config";
 import { HUB_SESSION_FALLBACK_PATH } from "./session";
 
@@ -46,89 +57,105 @@ export async function HubSignInGate({
   requestHeaders,
 }: HubSignInGateProps): Promise<ReactElement> {
   const t = await getTranslations({ locale, namespace: "account.gate" });
-  const configured = hubSessionConfig() !== null;
+  const signIn = await getTranslations({ locale, namespace: "signIn" });
+  const config = hubSessionConfig();
   const next =
     requestHeaders.get("x-pathname") ??
     localeHref(locale, HUB_SESSION_FALLBACK_PATH);
+  const signInHref = `${HUB_SIGN_IN_ROUTE}?next=${encodeURIComponent(next)}`;
   const home = localeHref(locale, "/");
   // The three prospect keys are optional extensions of the typed catalog (the
   // shipped en.json carries none — every leaf must be a non-empty string), so
   // presence is the switch; hence the cast on `has`.
   type Key = Parameters<typeof t.has>[0];
   const has = (key: string): boolean => t.has(key as Key);
-  const prospect =
-    has("prospectPrompt") && has("prospectLink") && has("prospectHref")
+  // Only a configured gate offers a way in; the not-configured state has none.
+  const prospect = !config
+    ? undefined
+    : has("prospectPrompt") && has("prospectLink") && has("prospectHref")
       ? {
           prompt: t("prospectPrompt" as Key),
           linkLabel: t("prospectLink" as Key),
           href: t("prospectHref" as Key),
         }
-      : null;
+      : {
+          prompt: signIn("prospectPrompt"),
+          linkLabel: signIn("prospectLink"),
+          href: `${signInHref}&prompt=create`,
+        };
 
   return (
     <div
       className="flex min-h-screen flex-col"
       data-testid="account-sign-in-gate"
     >
-      {/* The site's inner-page header: back arrow at the start, the mark centred (#8790 AC-1). */}
+      {/* The site's inner-page header: the back arrow at the start (#8790 AC-1); the card carries the mark (#9662). */}
       <header
-        className="grid h-16 grid-cols-[1fr_auto_1fr] items-center px-5 md:px-8"
+        className="flex h-16 items-center px-5 md:px-8"
         data-testid="account-sign-in-gate-header"
       >
-        <div className="justify-self-start">
-          <NavBackLink href={home} label={t("homeLink")} />
-        </div>
-        <Link
-          href={home}
-          variant="unstyled"
-          className="inline-flex h-7 items-center [&>img]:h-full [&>img]:w-auto [&>img]:object-contain"
-          data-testid="account-sign-in-gate-mark"
-        >
-          {siteLogo()}
-        </Link>
-        <div />
+        <NavBackLink href={home} label={t("homeLink")} />
       </header>
-      <div className="flex flex-1 flex-col items-center justify-center gap-4 py-section text-center">
-        <Heading level={1} visual={2}>
-          {configured ? t("hubHeadline") : t("emptyHeadline")}
-        </Heading>
-        <Text variant="body-sm" tone="muted" className="max-w-xs">
-          {configured ? t("hubDescription") : t("emptyDescription")}
-        </Text>
-        {configured ? (
-          // The primary action: 44px on a phone, 36px from md up.
-          <Button asChild className="max-md:min-h-11">
-            <Link
-              href={`${HUB_SIGN_IN_ROUTE}?next=${encodeURIComponent(next)}`}
-              variant="bare"
-              data-testid="account-hub-sign-in"
-            >
-              {t("hubSignIn")}
-            </Link>
-          </Button>
-        ) : (
-          <Button asChild variant="secondary" className="max-md:min-h-11">
-            <Link
-              href={home}
-              variant="bare"
-              data-testid="account-sign-in-gate-home"
-            >
-              {t("homeLink")}
-            </Link>
-          </Button>
-        )}
-        {configured && prospect ? (
-          // A wrapping div carries the hook: `Text` forwards no data-* attributes.
-          <div data-testid="account-sign-in-gate-prospect">
-            <Text as="p" variant="body-sm" tone="muted">
-              {prospect.prompt}{" "}
-              <Link href={prospect.href} variant="inline">
-                {prospect.linkLabel}
-              </Link>
-              .
-            </Text>
-          </div>
-        ) : null}
+      <div className="flex flex-1 flex-col items-center md:justify-center md:py-section">
+        {/* AuthShell's 400px column: the cap sits on the wrapper, never on the card (AuthShell.tsx). */}
+        <div className="w-full max-w-100">
+          <AuthCard
+            intent="sign-in"
+            footer="none"
+            // The page's one heading (#7894): the gate is the whole page.
+            headingLevel={1}
+            logo={siteLogo()}
+            labels={{
+              signInHeading: config
+                ? t("hubHeadline", { site: SITE_NAME })
+                : t("emptyHeadline"),
+            }}
+            subhead={config ? t("hubDescription") : t("emptyDescription")}
+            {...(prospect ? { prospect } : {})}
+            body={
+              config ? (
+                // The primary action: full width at `big` (44px).
+                <Button asChild size="big" className="w-full">
+                  <Link
+                    href={signInHref}
+                    variant="bare"
+                    data-testid="account-hub-sign-in"
+                  >
+                    {t("hubSignIn")}
+                  </Link>
+                </Button>
+              ) : (
+                <Button
+                  asChild
+                  variant="secondary"
+                  size="big"
+                  className="w-full"
+                >
+                  <Link
+                    href={home}
+                    variant="bare"
+                    data-testid="account-sign-in-gate-home"
+                  >
+                    {t("homeLink")}
+                  </Link>
+                </Button>
+              )
+            }
+            footnote={
+              <Text as="p" variant="caption">
+                {signIn("acknowledgement")}{" "}
+                <Link variant="inline" href={localeHref(locale, "/terms")}>
+                  {signIn("termsLink")}
+                </Link>{" "}
+                {signIn("acknowledgementAnd")}{" "}
+                <Link variant="inline" href={localeHref(locale, "/privacy")}>
+                  {signIn("privacyLink")}
+                </Link>
+                {signIn("acknowledgementEnd")}
+              </Text>
+            }
+          />
+        </div>
       </div>
     </div>
   );

package/templates/apps/web/lib/prisma-for-auth.ts

@@ -14,8 +14,11 @@
  * `lib/sign-up-agreements.ts`'s account hook writes the new user's `sign_up`
  * consent grants through `consentGrant.createMany` on the transaction client
  * Better Auth's sign-up transaction runs on — only rows for the user that
- * transaction is creating, never a read and never any other row. It imports
- * nothing from here; it reaches the client through the adapter.
+ * transaction is creating, never a read and never any other row. A
+ * magic-link sign-up (#9667 D5) writes the same rows from the session hook,
+ * on the transaction the adapter opens for them, for the user that verify
+ * just created. It imports nothing from here; it reaches the client through
+ * the adapter.
  *
  * Every other business-logic caller goes through apps/api, never the
  * database directly (architecture.yaml `apps/web` may_not_import_from

package/templates/apps/web/lib/relay.ts

@@ -35,12 +35,20 @@
  *     and only as strong as the platform: it holds only where the site's edge
  *     overwrites `x-forwarded-for` and `x-real-ip` (Vercel does; a bare
  *     self-hosted Next server does not).
+ *   - A BOT CHECK ON THE BOOKING (#9889). `POST /v1/schedule/book` asks
+ *     Vercel BotID (`checkBotId`) for a verdict after every refusal above and
+ *     before the hub is called. Only a human verdict forwards; a bot is
+ *     `403 bot_detected`, and a check that throws, answers no boolean or
+ *     takes over 5 seconds is `503 bot_check_unavailable` — either way the
+ *     hub is never called. It runs only on Vercel (`VERCEL=1`), unless
+ *     `AILK_BOOKING_BOT_CHECK=off`.
  *
  * NO SECRET IS LOGGED. A failure logs `{ path, outcome }` and nothing else.
  */
 import { isIP } from "node:net";
 
 import { relayToApi, visitorForwardHeaders } from "@working-theory/api-client";
+import { checkBotId } from "botid/server";
 
 import { browserApiOrigin } from "./api-origin.generated";
 import { readConsentVisitorFromCookieHeader } from "./consent-visitor";
@@ -69,15 +77,92 @@ function route(method: RelayMethod, path: string): RelayRoute {
  */
 const SESSION_ROUTE = route("POST", "/v1/commerce/invoices");
 
+/** The booking pair, the one route the bot check guards (#9889 D1). */
+const BOOK_ROUTE = route("POST", "/v1/schedule/book");
+
 export const RELAY_ROUTES: readonly RelayRoute[] = Object.freeze([
   route("POST", "/v1/leads/submit"),
   route("POST", "/v1/leads/subscribe"),
   route("POST", "/v1/leads/callback"),
   route("GET", "/v1/schedule/availability"),
-  route("POST", "/v1/schedule/book"),
+  BOOK_ROUTE,
   SESSION_ROUTE,
 ]);
 
+/**
+ * The entries the bot check guards (#9889 D1, D4). The locale layout passes
+ * the same list to `BotIdClient`, so the browser protects exactly the pairs
+ * the server checks: a checked pair the client does not protect would carry
+ * no challenge header and be refused as a bot.
+ */
+export const BOT_CHECKED_ROUTES: readonly RelayRoute[] = Object.freeze([
+  BOOK_ROUTE,
+]);
+
+/** The longest the relay waits for a verdict; the library's own fetch has no bound. */
+const BOT_CHECK_TIMEOUT_MS = 5_000;
+
+/**
+ * True when the booking bot check runs (#9889 D2): on Vercel, unless
+ * `AILK_BOOKING_BOT_CHECK` is `off`. Unset, empty or any other value leaves
+ * it on, so a typo fails toward protection. Read on every call, never cached.
+ */
+export function bookingBotCheckOn(): boolean {
+  return process.env.VERCEL === "1" && !botCheckSwitchedOff();
+}
+
+function botCheckSwitchedOff(): boolean {
+  return process.env.AILK_BOOKING_BOT_CHECK?.trim().toLowerCase() === "off";
+}
+
+let warnedBotCheckInactive = false;
+
+/**
+ * Called when the check is off. Off Vercel it cannot run (D2): a production
+ * site whose switch is not `off` logs that once per process, so an owner who
+ * believes it is on can find out. It never refuses.
+ */
+function warnBotCheckInactiveOnce(): void {
+  if (warnedBotCheckInactive || process.env.NODE_ENV !== "production") return;
+  if (botCheckSwitchedOff()) return;
+  warnedBotCheckInactive = true;
+  console.warn("[relay] booking bot check inactive", {
+    outcome: "not-on-vercel",
+  });
+}
+
+function namedError(name: string): Error {
+  const err = new Error(name);
+  err.name = name;
+  return err;
+}
+
+/**
+ * BotID's verdict on this request (D1, D3): `true` for a bot, `false` for a
+ * human. Throws `TimeoutError` past `BOT_CHECK_TIMEOUT_MS` and
+ * `InvalidVerdictError` when `isBot` is not a boolean, as `checkBotId` returns
+ * for an error answer from Vercel.
+ */
+async function isBotVerdict(): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const verdict = await Promise.race([
+      checkBotId(),
+      new Promise<never>((_resolve, reject) => {
+        timer = setTimeout(
+          () => reject(namedError("TimeoutError")),
+          BOT_CHECK_TIMEOUT_MS,
+        );
+      }),
+    ]);
+    const isBot = (verdict as { isBot?: unknown } | undefined)?.isBot;
+    if (typeof isBot !== "boolean") throw namedError("InvalidVerdictError");
+    return isBot;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 /**
  * The three lead routes (#8438 D11, D12): a visitor's banner choice is
  * linked to a Person only through these — a booking has no consent writer.
@@ -466,6 +551,36 @@ export async function handleRelay(request: Request): Promise<Response> {
     return refusal(502, "relay_unreachable", "The site could not reach its API");
   }
 
+  if (BOT_CHECKED_ROUTES.includes(entry)) {
+    if (bookingBotCheckOn()) {
+      let isBot: boolean;
+      try {
+        isBot = await isBotVerdict();
+      } catch (err) {
+        // The error's name only — never its message (#9889 D1).
+        console.error("[relay] bot check failed", {
+          path: entry.path,
+          outcome: "bot-check-failed",
+          error: err instanceof Error ? err.name : "unknown",
+        });
+        return refusal(
+          503,
+          "bot_check_unavailable",
+          "The booking check is unavailable",
+        );
+      }
+      if (isBot) {
+        console.warn("[relay] bot refused", {
+          path: entry.path,
+          outcome: "bot-detected",
+        });
+        return refusal(403, "bot_detected", "Request refused");
+      }
+    } else {
+      warnBotCheckInactiveOnce();
+    }
+  }
+
   try {
     const result = await relayToApi(
       entry.method === "GET" ? `${entry.path}${url.search}` : entry.path,