create-ailk 0.25.1 → 0.27.0

package/templates/apps/web/app/api/auth/hub/authorize/route.ts

@@ -12,6 +12,7 @@
  *       ?response_type=code&client_id=…&redirect_uri=…&state=…
  *       &code_challenge=…&code_challenge_method=S256
  *       [&login_hint=<email>]   (optional, #8757 D9 — see below)
+ *       [&prompt=create]        (optional, #9912 D3 — see below)
  *
  *   - a malformed query is a 400 and NEVER a redirect;
  *   - no Better Auth session: the six validated keys are sealed into a short
@@ -41,6 +42,15 @@
  * route rebuilds the query from the ref, so the hint is gone after sign-in —
  * and with a session it is ignored.
  *
+ * `prompt=create` (#9912 D3) is the spoke's "Sign up": read beside
+ * `login_hint` by the same once-only rule (repeated → 400, before the session
+ * read). On the no-session branch exactly `create` sends the visitor to
+ * `/sign-up?next=<the same continue path>` instead of `/sign-in`, with no
+ * `email`; any other value does nothing. It never enters the ref — so a
+ * password sign-up, which ends with no session, comes back through the
+ * continuation to `/sign-in` — nor a code or a cookie, and with a session it
+ * is ignored: the person has an account, and the spoke signs them in.
+ *
  * `BETTER_AUTH_URL` pins the `Origin` sent with the cookie-authenticated write
  * (Node's `fetch` sets none). Unset, the step answers 503: it needs a pinned
  * origin, exactly as the emailed link does.
@@ -124,6 +134,9 @@ export async function GET(request: Request): Promise<Response> {
   // #8757 D9 — the optional hint: the same once-only rule; refused → dropped.
   const hints = url.searchParams.getAll("login_hint");
   if (hints.length > 1) return json(400, "invalid_request");
+  // #9912 D3 — the sign-up hint, by the same rule; only `create` acts.
+  const prompts = url.searchParams.getAll("prompt");
+  if (prompts.length > 1) return json(400, "invalid_request");
   const parsed = hubAuthorizeQuerySchema.safeParse(raw);
   if (!parsed.success) return json(400, "invalid_request");
   const query = parsed.data;
@@ -138,6 +151,7 @@ export async function GET(request: Request): Promise<Response> {
     const ref = mintContinuation(canonical.toString(), resolveSecret());
     if (ref.length > CONTINUATION_REF_MAX) return json(400, "invalid_request");
     const signIn = new URLSearchParams({ next: `${CONTINUE_PATH}/${ref}` });
+    if (prompts[0] === "create") return see(`/sign-up?${signIn.toString()}`);
     if (hint.success) signIn.set("email", hint.data);
     return see(`/sign-in?${signIn.toString()}`);
   }

package/templates/apps/web/app/api/hub-session/__tests__/routes.test.ts

@@ -16,6 +16,10 @@
  *
  * #8757 D9 (AC-6): a valid single `?email=` on the sign-in route becomes the
  * authorize URL's `login_hint`; the sealed flow cookie never carries it.
+ *
+ * #9912 D2 (AC-1): exactly one `?prompt=create` rides to the hub as
+ * `prompt=create`, so the hub sends a visitor with no session to /sign-up;
+ * any other value adds nothing, and the flow cookie's keys are unchanged.
  */
 
 import { createHash } from "node:crypto";
@@ -204,6 +208,53 @@ describe("GET /api/hub-session/sign-in — the hinted email (#8757 D9)", () => {
   });
 });
 
+describe("GET /api/hub-session/sign-in — the sign-up hint (#9912 D2)", () => {
+  function startWith(query: string): { authorize: URL; payload: Record<string, unknown> } {
+    const res = signIn(new Request(`${SITE}/api/hub-session/sign-in?${query}`));
+    expect(res.status).toBe(303);
+    const flow = cookieValue(res, "ailk-hub-flow");
+    if (flow === undefined) throw new Error("no flow cookie");
+    const payload = unseal(flow, SESSION_SECRET, "flow", "ailk-hub-flow");
+    if (payload === null || typeof payload !== "object") throw new Error("flow did not open");
+    return {
+      authorize: new URL(res.headers.get("location") ?? ""),
+      payload: payload as Record<string, unknown>,
+    };
+  }
+
+  it("?next=/account&prompt=create → the authorize URL carries prompt=create; the flow cookie keeps exactly its five keys", () => {
+    const { authorize, payload } = startWith("next=/account&prompt=create");
+    expect(authorize.pathname).toBe("/api/auth/hub/authorize");
+    expect(authorize.searchParams.getAll("prompt")).toEqual(["create"]);
+    // The six keys are untouched beside it.
+    expect(authorize.searchParams.get("response_type")).toBe("code");
+    expect(authorize.searchParams.get("code_challenge_method")).toBe("S256");
+    expect(Object.keys(payload).sort()).toEqual(
+      ["expiresAt", "next", "state", "v", "verifier"],
+    );
+    expect(payload.next).toBe("/account");
+    expect(JSON.stringify(payload)).not.toContain("create");
+  });
+
+  it("forwards the hint beside a valid login_hint", () => {
+    const { authorize } = startWith("next=/account&prompt=create&email=a%40b.example");
+    expect(authorize.searchParams.get("prompt")).toBe("create");
+    expect(authorize.searchParams.get("login_hint")).toBe("a@b.example");
+  });
+
+  it.each([
+    ["another OIDC value", "next=/account&prompt=login"],
+    ["an empty value", "next=/account&prompt="],
+    ["a repeated value", "next=/account&prompt=create&prompt=create"],
+    ["a cased value", "next=/account&prompt=Create"],
+    ["no value", "next=/account"],
+  ])("%s → no prompt", (_label, query) => {
+    const { authorize, payload } = startWith(query);
+    expect(authorize.searchParams.has("prompt")).toBe(false);
+    expect(payload).not.toHaveProperty("prompt");
+  });
+});
+
 describe("GET /api/hub-session/callback", () => {
   function exchangeOk(): void {
     mockExchange.mockResolvedValue({

package/templates/apps/web/app/api/hub-session/sign-in/route.ts

@@ -15,6 +15,12 @@
  * the address typed. A refused or repeated value is dropped. The hint goes on
  * the authorize URL only — never into the sealed flow cookie.
  *
+ * Sign-up hint (#9912 D2): exactly one `?prompt=create` (the gate's "Sign up")
+ * rides to the hub as `prompt=create`, so a visitor with no hub session lands
+ * on its sign-up screen instead of sign-in; the round trip is otherwise the
+ * same. Any other value, an empty or a repeated one adds nothing, and the hint
+ * never enters the flow cookie.
+ *
  * Nothing here logs the state, the verifier or the challenge.
  */
 import { createHash, randomBytes } from "node:crypto";
@@ -55,6 +61,12 @@ function emailHint(params: URLSearchParams): string | undefined {
   return parsed.success ? parsed.data : undefined;
 }
 
+/** #9912 D2 — `"create"` when the one `prompt` is exactly that, else none. */
+function signUpHint(params: URLSearchParams): "create" | undefined {
+  const values = params.getAll("prompt");
+  return values.length === 1 && values[0] === "create" ? "create" : undefined;
+}
+
 // platform-decisions-waiver: api-versioning — sign-in redirect endpoint, not a versioned API contract (spec 7894 §7)
 export function GET(request: Request): Response {
   if (SIGN_IN_PROVIDER !== "hub") return new Response(null, { status: 404 });
@@ -84,6 +96,7 @@ export function GET(request: Request): Response {
     code_challenge: challenge,
     code_challenge_method: "S256",
   });
+  if (signUpHint(params) !== undefined) query.set("prompt", "create");
   const loginHint = emailHint(params);
   if (loginHint !== undefined) query.set("login_hint", loginHint);
   authorize.search = query.toString();

package/templates/apps/web/auth.ts

@@ -459,7 +459,9 @@ export function createAuth(deps: CreateAuthDeps = {}) {
     /**
      * The sign-up grants (#8765 D4): the user hook decides whether the new
      * user carries agreements, the account hook writes them on the captured
-     * transaction client. No other database hook is installed.
+     * transaction client. A magic-link sign-up creates no Account, so the
+     * session hook writes its grants, in their own transaction, before the
+     * session exists (#9667 D5). No other database hook is installed.
      */
     databaseHooks: signUpAgreementHooks(),
     secret: resolveSecret(),
@@ -671,9 +673,11 @@ export function createAuth(deps: CreateAuthDeps = {}) {
     /**
      * `magicLink` only when its predicate holds (#7435 § D2): absent, its
      * `/sign-in/magic-link` and `/magic-link/verify` endpoints do not exist.
-     * Sign-in only — the callback mails existing users and nobody else, and
-     * `disableSignUp` refuses to create one even for a live token
-     * (lib/auth-email.ts).
+     * Sign-in only while sign-up is closed — the callback mails existing users
+     * and nobody else, and `disableSignUp` refuses to create one even for a
+     * live token (lib/auth-email.ts). While `isSignUpOpen()` a request
+     * carrying the agreements is a sign-up: its token is bound to them, and
+     * the verify creates the account only for a token so bound (#9667).
      *
      * `signUpAgreementsPlugin` always (#8765 D3): while sign-up is open,
      * `/sign-up/email` without every sign-up agreement is refused before the

package/templates/apps/web/i18n/request.ts

@@ -4,6 +4,14 @@
 // English when no catalog exists (e.g. a locale is enabled in project.yaml
 // but its messages/<locale>.json has not been translated yet).
 //
+// The site's own strings (#9401 D8) live in messages/site/<locale>.json, an
+// overlay the template ships as `{}` and never changes, so `create-ailk
+// update` keeps a site's edit of it. It falls back to the English overlay,
+// then to nothing, and merges add-only: a key the template catalog already
+// has keeps the template's value. The merge builds new objects, descends only
+// into plain objects, takes only string leaves and skips prototype keys, so
+// it can neither mutate the imported catalog nor pollute `Object.prototype`.
+//
 // Spec: docs/internal/specs/i18n-phase1-s2-next-intl-foundation-spec.md
 
 import type { AbstractIntlMessages } from "next-intl";
@@ -11,6 +19,42 @@ import { getRequestConfig } from "next-intl/server";
 
 const DEFAULT_LOCALE = "en";
 
+const UNSAFE_KEYS: ReadonlySet<string> = new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+]);
+
+type Catalog = Record<string, unknown>;
+
+function isCatalog(value: unknown): value is Catalog {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** `base` with every key of `overlay` it lacks added — new objects, never a mutation. */
+function mergeAddOnly(base: Catalog, overlay: Catalog): Catalog {
+  const out: Catalog = { ...base };
+  for (const [key, value] of Object.entries(overlay)) {
+    if (UNSAFE_KEYS.has(key)) continue;
+    const has = Object.prototype.hasOwnProperty.call(base, key);
+    if (typeof value === "string") {
+      if (!has) out[key] = value;
+    } else if (isCatalog(value)) {
+      if (!has) out[key] = mergeAddOnly({}, value);
+      else if (isCatalog(base[key])) out[key] = mergeAddOnly(base[key], value);
+    }
+  }
+  return out;
+}
+
+async function loadSiteOverlay(locale: string): Promise<Catalog> {
+  const mod =
+    (await import(`../messages/site/${locale}.json`).catch(() => null)) ??
+    (await import(`../messages/site/${DEFAULT_LOCALE}.json`).catch(() => null));
+  const overlay: unknown = mod ? (mod.default ?? mod) : null;
+  return isCatalog(overlay) ? overlay : {};
+}
+
 export default getRequestConfig(async ({ requestLocale }) => {
   // requestLocale is the modern API (next-intl >= 3.22). It resolves the
   // active locale from the request, validated by middleware.
@@ -32,5 +76,9 @@ export default getRequestConfig(async ({ requestLocale }) => {
     messages = (fallback.default ?? fallback) as AbstractIntlMessages;
   }
 
-  return { locale, messages };
+  const overlay = await loadSiteOverlay(locale);
+  return {
+    locale,
+    messages: mergeAddOnly(messages, overlay) as AbstractIntlMessages,
+  };
 });

package/templates/apps/web/lib/__tests__/account-config.test.ts

@@ -26,6 +26,8 @@
  *      401/403) is `false`, any other failure rejects. The popups are bound
  *      in the route (`account/new-popups.tsx`, tested beside it): this file
  *      imports nothing under `(authed)`.
+ *   8. #9401 AC-11 — the template's `site-contributions.ts` stub ships no
+ *      Billing section either; a site fills it.
  */
 
 const mockSignupMe = jest.fn();
@@ -68,6 +70,7 @@ import {
   accountSettingsSections,
   type AccountNewRead,
 } from "../account-config";
+import { siteBillingSections } from "../site-contributions";
 
 const INIT = { headers: { cookie: "session=abc" } };
 
@@ -166,6 +169,10 @@ describe("account-config exports (AC-6)", () => {
     expect(accountBillingSections).toEqual([]);
   });
 
+  it("ships no site Billing section either: the stub is the site's to fill (#9401 AC-11, D7)", () => {
+    expect(siteBillingSections).toEqual([]);
+  });
+
   it("ships the base kinds and the member kinds in their sections (#8231 D4–D6)", () => {
     expect(accountInboxKinds.map((k) => [k.kind, k.section])).toEqual([
       ["result", "updates"],

package/templates/apps/web/lib/__tests__/auth-email.test.ts

@@ -451,3 +451,279 @@ describe("sendMagicLink — existing users only, deferred (#7435 § D3, AC-2)",
     });
   });
 });
+
+// ── #9667 — a magic link can create the account (D1, D4) ───────────────────
+
+describe("sendMagicLink — the sign-up branch on an open site (#9667 D1, D4)", () => {
+  const AGREED = { agreements: ["account_terms"], locale: "en" };
+
+  it("disableSignUp follows AILK_AUTH_SIGNUP_OPEN", () => {
+    delete process.env.AILK_AUTH_SIGNUP_OPEN;
+    expect(makeMagicLinkOptions({ send: jest.fn() }).disableSignUp).toBe(true);
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    expect(makeMagicLinkOptions({ send: jest.fn() }).disableSignUp).toBe(false);
+  });
+
+  it("binds, then mails ONE sign-up email to an unknown address with userId \"sign-up\" (#9720 AC-1)", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn().mockResolvedValue({ ok: true });
+    const bind = jest.fn().mockResolvedValue(AGREED);
+    const { lines, log } = makeLog();
+    const { ctx, background } = makeCtx(null);
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink(
+      { email: "new@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      ctx,
+    );
+    await Promise.all(background);
+
+    expect(bind).toHaveBeenCalledWith(
+      ctx.context.internalAdapter,
+      "MLTOKEN",
+      AGREED,
+      MAGIC_LINK_TTL_SECONDS,
+    );
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(JSON.parse(send.mock.calls[0]![0] as string)).toEqual({
+      kind: "magic-link-sign-up",
+      userId: "sign-up",
+      to: "new@example.com",
+      url: LINK,
+      agreements: ["account_terms"],
+      locale: "en",
+    });
+    const serialized = JSON.stringify(lines);
+    expect(serialized).not.toContain("new@example.com");
+    expect(serialized).not.toContain("MLTOKEN");
+  });
+
+  it("binds, then mails the account, for a known address", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn().mockResolvedValue({ ok: true });
+    const bind = jest.fn().mockResolvedValue(AGREED);
+    const { log } = makeLog();
+    const { ctx, background } = makeCtx({ id: "user_1", email: "person@example.com" });
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink(
+      { email: "Person@Example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      ctx,
+    );
+    await Promise.all(background);
+
+    expect(bind).toHaveBeenCalledTimes(1);
+    expect(JSON.parse(send.mock.calls[0]![0] as string)).toMatchObject({
+      userId: "user_1",
+      to: "person@example.com",
+    });
+  });
+
+  it("a failed binding sends nothing to an unknown address and logs bind_failed", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn();
+    const bind = jest.fn().mockRejectedValue(new Error("db down for new@example.com"));
+    const { lines, log } = makeLog();
+    const { ctx, runInBackgroundOrAwait } = makeCtx(null);
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await expect(
+      sendMagicLink(
+        { email: "new@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+        ctx,
+      ),
+    ).resolves.toBeUndefined();
+
+    expect(runInBackgroundOrAwait).not.toHaveBeenCalled();
+    expect(send).not.toHaveBeenCalled();
+    expect(lines[0]).toEqual({
+      level: "warn",
+      fields: { kind: "magic-link", reason: "send_failed", errorKind: "bind_failed" },
+    });
+    const serialized = JSON.stringify(lines);
+    expect(serialized).not.toContain("new@example.com");
+    expect(serialized).not.toContain("MLTOKEN");
+  });
+
+  it("a sign-in request (no metadata) on an open site still sends nothing to an unknown address", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn();
+    const bind = jest.fn();
+    const { lines, log } = makeLog();
+    const { ctx, runInBackgroundOrAwait } = makeCtx(null);
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink({ email: "nobody@example.com", url: LINK, token: "MLTOKEN" }, ctx);
+
+    expect(bind).not.toHaveBeenCalled();
+    expect(runInBackgroundOrAwait).not.toHaveBeenCalled();
+    expect(send).not.toHaveBeenCalled();
+    expect(lines).toEqual([
+      { level: "info", fields: { kind: "magic-link", reason: "no_account" } },
+    ]);
+  });
+});
+
+// ── #9720 — the sign-up email names the agreements (D6) ────────────────────
+
+describe("sendMagicLink — the sign-up kind (#9720 D6)", () => {
+  const AGREED = { agreements: ["account_terms"], locale: "en" };
+
+  it("takes the agreements and locale from the binding, not the request", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn().mockResolvedValue({ ok: true });
+    const bind = jest
+      .fn()
+      .mockResolvedValue({ agreements: ["account_terms"], locale: "fr" });
+    const { log } = makeLog();
+    const { ctx, background } = makeCtx(null);
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink(
+      { email: "new@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      ctx,
+    );
+    await Promise.all(background);
+
+    expect(JSON.parse(send.mock.calls[0]![0] as string)).toEqual({
+      kind: "magic-link-sign-up",
+      userId: "sign-up",
+      to: "new@example.com",
+      url: LINK,
+      agreements: ["account_terms"],
+      locale: "fr",
+    });
+  });
+
+  it("a known address on a sign-up request gets exactly the sign-in body (AC-2)", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn().mockResolvedValue({ ok: true });
+    const bind = jest.fn().mockResolvedValue(AGREED);
+    const { log } = makeLog();
+    const { ctx, background } = makeCtx({ id: "user_1", email: "person@example.com" });
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink(
+      { email: "Person@Example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      ctx,
+    );
+    await Promise.all(background);
+
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(JSON.parse(send.mock.calls[0]![0] as string)).toEqual({
+      kind: "magic-link",
+      userId: "user_1",
+      to: "person@example.com",
+      url: LINK,
+    });
+  });
+
+  it("on a closed site binds nothing: a known address gets the sign-in body, an unknown one nothing (AC-2)", async () => {
+    delete process.env.AILK_AUTH_SIGNUP_OPEN;
+    const bind = jest.fn().mockResolvedValue(AGREED);
+
+    const knownSend = jest.fn().mockResolvedValue({ ok: true });
+    const known = makeCtx({ id: "user_1", email: "person@example.com" });
+    await makeMagicLinkOptions({ send: knownSend, log: makeLog().log, bind }).sendMagicLink(
+      { email: "person@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      known.ctx,
+    );
+    await Promise.all(known.background);
+
+    const unknownSend = jest.fn();
+    const unknown = makeCtx(null);
+    await makeMagicLinkOptions({ send: unknownSend, log: makeLog().log, bind }).sendMagicLink(
+      { email: "new@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      unknown.ctx,
+    );
+
+    expect(bind).not.toHaveBeenCalled();
+    expect(JSON.parse(knownSend.mock.calls[0]![0] as string)).toEqual({
+      kind: "magic-link",
+      userId: "user_1",
+      to: "person@example.com",
+      url: LINK,
+    });
+    expect(unknownSend).not.toHaveBeenCalled();
+    expect(unknown.runInBackgroundOrAwait).not.toHaveBeenCalled();
+  });
+
+  it("a known and an unknown address answer the same, after the same work, while the send never settles (AC-2)", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const never = () => new Promise(() => undefined);
+
+    for (const user of [{ id: "user_1", email: "person@example.com" }, null]) {
+      const send = jest.fn(never);
+      const bind = jest.fn().mockResolvedValue(AGREED);
+      const { ctx, findUserByEmail, runInBackgroundOrAwait } = makeCtx(user);
+      const { sendMagicLink } = makeMagicLinkOptions({ send, log: makeLog().log, bind });
+
+      await expect(
+        sendMagicLink(
+          { email: "someone@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+          ctx,
+        ),
+      ).resolves.toBeUndefined();
+
+      expect(findUserByEmail).toHaveBeenCalledTimes(1);
+      expect(bind).toHaveBeenCalledTimes(1);
+      expect(runInBackgroundOrAwait).toHaveBeenCalledTimes(1);
+    }
+  });
+
+  it("logs the sign-up send with no address, token or agreement (AC-3)", async () => {
+    process.env.AILK_AUTH_SIGNUP_OPEN = "true";
+    const send = jest.fn().mockResolvedValue({ ok: true });
+    const bind = jest.fn().mockResolvedValue(AGREED);
+    const { lines, log } = makeLog();
+    const { ctx, background } = makeCtx(null);
+    const { sendMagicLink } = makeMagicLinkOptions({ send, log, bind });
+
+    await sendMagicLink(
+      { email: "new@example.com", url: LINK, token: "MLTOKEN", metadata: AGREED },
+      ctx,
+    );
+    await Promise.all(background);
+
+    expect(lines).toEqual([
+      {
+        level: "info",
+        fields: { userId: "sign-up", kind: "magic-link-sign-up", reason: "sent" },
+      },
+    ]);
+    const serialized = JSON.stringify(lines);
+    expect(serialized).not.toContain("new@example.com");
+    expect(serialized).not.toContain("MLTOKEN");
+    expect(serialized).not.toContain("account_terms");
+  });
+
+  it("signs a sign-up body that carries the agreements and locale (AC-3)", () => {
+    const req = buildAuthEmailRequest(
+      {
+        kind: "magic-link-sign-up",
+        userId: "sign-up",
+        to: "new@example.com",
+        url: LINK,
+        agreements: ["account_terms"],
+        locale: "en",
+      },
+      "webhook-secret",
+    );
+
+    const { createHmac } = require("node:crypto") as typeof import("node:crypto");
+    const timestamp = req.headers["x-ailk-auth-email-timestamp"];
+    expect(req.headers["x-ailk-auth-email-signature"]).toBe(
+      `sha256=${createHmac("sha256", "webhook-secret")
+        .update(`${timestamp}.${req.rawBody}`, "utf8")
+        .digest("hex")}`,
+    );
+    expect(JSON.parse(req.rawBody)).toEqual({
+      kind: "magic-link-sign-up",
+      userId: "sign-up",
+      to: "new@example.com",
+      url: LINK,
+      agreements: ["account_terms"],
+      locale: "en",
+    });
+  });
+});