create-ailk 0.25.1 → 0.27.0

package/templates/apps/web/lib/__tests__/relay.test.ts

@@ -10,10 +10,17 @@
 //
 // Spec: docs/specs/7644-the-browser-talks-only-to-spec.md §5.1 AC-1 to AC-4.
 
-import { handleRelay, RELAY_ROUTES } from "../relay";
+import { BOT_CHECKED_ROUTES, handleRelay, RELAY_ROUTES } from "../relay";
 import { __resetRelayRateLimit, __relayRateLimitBucketCount } from "../relay";
 import { TOPOLOGY } from "../topology.generated";
 
+// #9889 — the booking bot check's verdict. `checkBotId` reads Vercel's
+// request context, which jest has none of, so every case decides it here.
+const checkBotIdMock = jest.fn();
+jest.mock("botid/server", () => ({
+  checkBotId: (...args: unknown[]) => checkBotIdMock(...args),
+}));
+
 const HUB = "https://hub.example";
 const SITE = "https://spoke.example";
 const K1 = "K1";
@@ -27,6 +34,8 @@ const ENV_KEYS = [
   "NEXT_PUBLIC_API_URL",
   "AILK_SPOKE_KEY",
   "AILK_VISITOR_FORWARD_KEY",
+  "VERCEL",
+  "AILK_BOOKING_BOT_CHECK",
 ] as const;
 const priorEnv = new Map<string, string | undefined>(
   ENV_KEYS.map((name) => [name, process.env[name]]),
@@ -885,3 +894,282 @@ describe("the per-visitor rate limit (#7707)", () => {
     );
   });
 });
+
+// The booking bot check (#9889, spec
+// docs/specs/9889-the-booking-bot-check-vercel-spec.md §5.1 AC-1 to AC-5).
+describe("the booking bot check (#9889)", () => {
+  const BOOK = "/v1/schedule/book";
+  const BOT = {
+    isHuman: false,
+    isBot: true,
+    isVerifiedBot: false,
+    bypassed: false,
+  };
+  const HUMAN = {
+    isHuman: true,
+    isBot: false,
+    isVerifiedBot: false,
+    bypassed: false,
+  };
+
+  let warnSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    checkBotIdMock.mockReset();
+    process.env.VERCEL = "1";
+    warnSpy = jest.spyOn(console, "warn").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  describe("AC-1 — a bot verdict is refused before the hub is called", () => {
+    it.each([
+      ["a bot", BOT],
+      ["a verified bot", { ...BOT, isVerifiedBot: true }],
+    ])("%s answers 403 bot_detected", async (_label, verdict) => {
+      checkBotIdMock.mockResolvedValue(verdict);
+      const res = await handleRelay(relayRequest(BOOK));
+      expect(res.status).toBe(403);
+      expect(await errorCode(res)).toBe("bot_detected");
+      expect(res.headers.get("cache-control")).toBe("no-store");
+      expect(fetchMock).not.toHaveBeenCalled();
+      expect(checkBotIdMock).toHaveBeenCalledTimes(1);
+      expect(checkBotIdMock.mock.calls[0]).toEqual([]);
+      expect(warnSpy).toHaveBeenCalledTimes(1);
+      expect(warnSpy).toHaveBeenCalledWith("[relay] bot refused", {
+        path: BOOK,
+        outcome: "bot-detected",
+      });
+    });
+  });
+
+  describe("AC-2 — a human verdict forwards exactly as with the check off", () => {
+    it("the same URL, method, body and headers, and no BotID header", async () => {
+      checkBotIdMock.mockResolvedValue(HUMAN);
+      const botIdHeaders = {
+        "x-is-human": "{}",
+        "x-path": BOOK,
+        "x-method": "POST",
+      };
+
+      delete process.env.VERCEL;
+      expect((await handleRelay(relayRequest(BOOK, { headers: botIdHeaders }))).status).toBe(201);
+      process.env.VERCEL = "1";
+      expect((await handleRelay(relayRequest(BOOK, { headers: botIdHeaders }))).status).toBe(201);
+
+      expect(checkBotIdMock).toHaveBeenCalledTimes(1);
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      const [off, on] = fetchMock.mock.calls.map(([url, init]) => ({
+        url,
+        method: init.method,
+        body: init.body,
+        headers: [...new Headers(init.headers).entries()],
+      }));
+      expect(on).toEqual(off);
+      const names = (on?.headers ?? []).map(([name]) => name);
+      for (const name of Object.keys(botIdHeaders)) {
+        expect(names).not.toContain(name);
+      }
+    });
+  });
+
+  describe("AC-3 — a check that cannot decide fails closed", () => {
+    function expectUnavailable(error: string): void {
+      expect(fetchMock).not.toHaveBeenCalled();
+      expect(errorSpy).toHaveBeenCalledTimes(1);
+      expect(errorSpy).toHaveBeenCalledWith("[relay] bot check failed", {
+        path: BOOK,
+        outcome: "bot-check-failed",
+        error,
+      });
+    }
+
+    it("a throw answers 503 and logs the error's name, never its message", async () => {
+      checkBotIdMock.mockRejectedValue(new Error("token abc"));
+      const res = await handleRelay(relayRequest(BOOK));
+      expect(res.status).toBe(503);
+      expect(await errorCode(res)).toBe("bot_check_unavailable");
+      expectUnavailable("Error");
+      expect(JSON.stringify(errorSpy.mock.calls)).not.toContain("token abc");
+    });
+
+    it.each([
+      ["an empty verdict", {}],
+      [
+        "Vercel's error answer",
+        {
+          isHuman: undefined,
+          isBot: undefined,
+          isVerifiedBot: undefined,
+          bypassed: undefined,
+        },
+      ],
+      ["a non-boolean isBot", { ...HUMAN, isBot: "false" }],
+    ])("%s answers 503 InvalidVerdictError", async (_label, verdict) => {
+      checkBotIdMock.mockResolvedValue(verdict);
+      const res = await handleRelay(relayRequest(BOOK));
+      expect(res.status).toBe(503);
+      expect(await errorCode(res)).toBe("bot_check_unavailable");
+      expectUnavailable("InvalidVerdictError");
+    });
+
+    describe("with fake timers", () => {
+      beforeEach(() => {
+        jest.useFakeTimers({
+          doNotFake: ["nextTick", "queueMicrotask", "setImmediate"],
+        });
+      });
+      afterEach(() => {
+        jest.useRealTimers();
+      });
+
+      it("no verdict within 5 000 ms answers 503 TimeoutError", async () => {
+        checkBotIdMock.mockReturnValue(new Promise(() => {}));
+        const pending = handleRelay(relayRequest(BOOK));
+        await jest.advanceTimersByTimeAsync(5_000);
+        const res = await pending;
+        expect(res.status).toBe(503);
+        expect(await errorCode(res)).toBe("bot_check_unavailable");
+        expectUnavailable("TimeoutError");
+      });
+
+      it("a check that settles in time leaves no timer pending", async () => {
+        checkBotIdMock.mockResolvedValue(BOT);
+        const res = await handleRelay(relayRequest(BOOK));
+        expect(res.status).toBe(403);
+        expect(jest.getTimerCount()).toBe(0);
+      });
+    });
+  });
+
+  describe("AC-4 — the switch", () => {
+    it.each([
+      ["VERCEL=1, AILK_BOOKING_BOT_CHECK=off", "1", "off"],
+      ['VERCEL=1, AILK_BOOKING_BOT_CHECK=" OFF "', "1", " OFF "],
+      ["VERCEL unset, switch unset", undefined, undefined],
+    ])("%s forwards with no BotID call", async (_label, vercel, check) => {
+      checkBotIdMock.mockResolvedValue(BOT);
+      if (vercel === undefined) delete process.env.VERCEL;
+      else process.env.VERCEL = vercel;
+      if (check === undefined) delete process.env.AILK_BOOKING_BOT_CHECK;
+      else process.env.AILK_BOOKING_BOT_CHECK = check;
+      const res = await handleRelay(relayRequest(BOOK));
+      expect(res.status).toBe(201);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+      expect(checkBotIdMock).not.toHaveBeenCalled();
+    });
+
+    it.each(["on", "0"])(
+      "VERCEL=1, AILK_BOOKING_BOT_CHECK=%s keeps the check on",
+      async (check) => {
+        checkBotIdMock.mockResolvedValue(BOT);
+        process.env.AILK_BOOKING_BOT_CHECK = check;
+        const res = await handleRelay(relayRequest(BOOK));
+        expect(res.status).toBe(403);
+        expect(await errorCode(res)).toBe("bot_detected");
+        expect(fetchMock).not.toHaveBeenCalled();
+      },
+    );
+
+    describe("in production, off Vercel", () => {
+      const env = process.env as Record<string, string | undefined>;
+      const priorNodeEnv = env.NODE_ENV;
+      beforeEach(() => {
+        env.NODE_ENV = "production";
+        delete process.env.VERCEL;
+      });
+      afterEach(() => {
+        env.NODE_ENV = priorNodeEnv;
+      });
+
+      async function twoBookings(): Promise<void> {
+        await jest.isolateModulesAsync(async () => {
+          const fresh = await import("../relay");
+          for (let i = 0; i < 2; i++) {
+            const res = await fresh.handleRelay(relayRequest(BOOK));
+            expect(res.status).toBe(201);
+          }
+        });
+      }
+
+      it("warns once per process that the check is not running", async () => {
+        await twoBookings();
+        expect(checkBotIdMock).not.toHaveBeenCalled();
+        expect(warnSpy).toHaveBeenCalledTimes(1);
+        expect(warnSpy).toHaveBeenCalledWith(
+          "[relay] booking bot check inactive",
+          { outcome: "not-on-vercel" },
+        );
+      });
+
+      it("with the switch off, warns nothing", async () => {
+        process.env.AILK_BOOKING_BOT_CHECK = "off";
+        await twoBookings();
+        expect(checkBotIdMock).not.toHaveBeenCalled();
+        expect(warnSpy).not.toHaveBeenCalled();
+      });
+    });
+  });
+
+  describe("AC-5 — only the booking, and only after the local refusals", () => {
+    beforeEach(() => {
+      checkBotIdMock.mockResolvedValue(BOT);
+    });
+
+    it.each(ENTRIES.filter((e) => e.path !== BOOK))(
+      "$method $path forwards with no BotID call",
+      async (entry) => {
+        const res = await handleRelay(entryRequest(entry));
+        expect(res.status).toBe(201);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(checkBotIdMock).not.toHaveBeenCalled();
+      },
+    );
+
+    it("a cross-site booking answers 403 cross_site with no BotID call", async () => {
+      const res = await handleRelay(
+        relayRequest(BOOK, { headers: { "sec-fetch-site": "cross-site" } }),
+      );
+      expect(res.status).toBe(403);
+      expect(await errorCode(res)).toBe("cross_site");
+      expect(checkBotIdMock).not.toHaveBeenCalled();
+    });
+
+    it("an over-budget booking answers 429 with no BotID call", async () => {
+      const visitor = { "x-forwarded-for": "203.0.113.9" };
+      for (let i = 0; i < 8; i++) {
+        await handleRelay(relayRequest("/v1/leads/submit", { headers: visitor }));
+      }
+      const res = await handleRelay(relayRequest(BOOK, { headers: visitor }));
+      expect(res.status).toBe(429);
+      expect(await errorCode(res)).toBe("rate_limited");
+      expect(checkBotIdMock).not.toHaveBeenCalled();
+    });
+
+    it("a non-JSON booking answers 415 with no BotID call", async () => {
+      const res = await handleRelay(
+        relayRequest(BOOK, { headers: { "content-type": "text/plain" } }),
+      );
+      expect(res.status).toBe(415);
+      expect(checkBotIdMock).not.toHaveBeenCalled();
+    });
+
+    it("an oversized booking answers 413 with no BotID call", async () => {
+      const res = await handleRelay(
+        relayRequest(BOOK, { body: "x".repeat(1_048_577) }),
+      );
+      expect(res.status).toBe(413);
+      expect(checkBotIdMock).not.toHaveBeenCalled();
+    });
+
+    it("BOT_CHECKED_ROUTES is the booking pair, frozen, and RELAY_ROUTES' own entry", () => {
+      expect(BOT_CHECKED_ROUTES).toEqual([{ method: "POST", path: BOOK }]);
+      expect(Object.isFrozen(BOT_CHECKED_ROUTES)).toBe(true);
+      expect(BOT_CHECKED_ROUTES[0]).toBe(
+        RELAY_ROUTES.find((r) => r.method === "POST" && r.path === BOOK),
+      );
+    });
+  });
+});

package/templates/apps/web/lib/auth-email.ts

@@ -37,12 +37,24 @@ import { createHmac } from "node:crypto";
 
 import { authEmail } from "@working-theory/api-client";
 
-/** The four fixed kinds the relay will send. A caller picks no copy. */
+import { isSignUpOpen } from "./auth-env";
+import {
+  bindLinkAgreements,
+  signUpMetadata,
+  type LinkAgreements,
+  type LinkAgreementsStore,
+} from "./sign-up-agreements";
+
+/**
+ * The five fixed kinds the relay will send. A caller picks no copy: a sign-up
+ * link sends agreement ids and a locale, which the API names itself (#9720).
+ */
 export type AuthEmailKind =
   | "password-reset"
   | "email-verification"
   | "password-changed"
-  | "magic-link";
+  | "magic-link"
+  | "magic-link-sign-up";
 
 export interface AuthEmailPayload {
   kind: AuthEmailKind;
@@ -50,6 +62,8 @@ export interface AuthEmailPayload {
   to: string;
   url?: string;
   expiresInMinutes?: number;
+  agreements?: string[];
+  locale?: string;
 }
 
 export interface AuthEmailRequest {
@@ -116,6 +130,10 @@ export function buildAuthEmailRequest(
     ...(payload.expiresInMinutes !== undefined
       ? { expiresInMinutes: payload.expiresInMinutes }
       : {}),
+    ...(payload.agreements !== undefined
+      ? { agreements: payload.agreements }
+      : {}),
+    ...(payload.locale !== undefined ? { locale: payload.locale } : {}),
   });
   const timestamp = String(Math.floor(Date.now() / 1000));
   const signature = `sha256=${createHmac("sha256", secret)
@@ -365,7 +383,7 @@ export const MAGIC_LINK_TTL_SECONDS = 300;
  */
 export interface MagicLinkEndpointContext {
   context: {
-    internalAdapter: {
+    internalAdapter: LinkAgreementsStore & {
       findUserByEmail(
         email: string,
       ): Promise<{ user: { id: string; email: string } } | null>;
@@ -390,14 +408,32 @@ export interface MagicLinkEndpointContext {
  * branches cost one indexed read; the send goes to `runInBackgroundOrAwait`,
  * which `auth.ts`'s `backgroundTasks.handler` runs after the response.
  *
+ * A SIGN-UP REQUEST (#9667 D4) — one whose `metadata` carries the agreements,
+ * which `lib/sign-up-agreements.ts`'s plugin has already checked — binds them
+ * to the token, then mails the address whether or not it has an account: a
+ * sign-in link to an existing account, a sign-up link to a new address (whose
+ * `userId` is the fixed sentinel `"sign-up"`; the relay only logs it). The
+ * sign-up link is its own kind, `magic-link-sign-up`, carrying the agreement
+ * ids and locale the binding holds, so the email says an account will be
+ * created and names what it records (#9720 D6). The kind is picked from two
+ * values already in hand, inside the same deferred send, so the answer and
+ * its timing do not depend on it. A failed binding mails only an existing
+ * account. A sign-in request is unchanged: an unknown address gets nothing.
+ *
  * NOTHING HERE THROWS, so a known and an unknown address both reach the
  * plugin's `{ status: true }`.
  */
-function makeSendMagicLink(deps: DispatchDeps) {
+function makeSendMagicLink(deps: MagicLinkDeps) {
   const { send } = deps;
   const log = deps.log ?? defaultLog;
+  const bind = deps.bind ?? bindLinkAgreements;
   return async function sendMagicLink(
-    data: { email: string; url: string; token: string },
+    data: {
+      email: string;
+      url: string;
+      token: string;
+      metadata?: Record<string, unknown>;
+    },
     ctx?: MagicLinkEndpointContext,
   ): Promise<void> {
     let found: { user: { id: string; email: string } } | null;
@@ -413,37 +449,83 @@ function makeSendMagicLink(deps: DispatchDeps) {
       return;
     }
 
-    if (!found) {
+    // A sign-up request (#9667 D2, D4): `metadata` carries the agreements,
+    // which the sign-up-agreements plugin has already checked. The binding
+    // is written whether or not the address has an account, so the work
+    // before the response never depends on it.
+    let binding: LinkAgreements | null = null;
+    const signUp = isSignUpOpen() ? signUpMetadata(data) : null;
+    if (signUp) {
+      try {
+        binding = await bind(
+          ctx.context.internalAdapter,
+          data.token,
+          signUp,
+          MAGIC_LINK_TTL_SECONDS,
+        );
+      } catch {
+        log.warn({
+          kind: "magic-link",
+          reason: "send_failed",
+          errorKind: "bind_failed",
+        });
+      }
+    }
+
+    // A new address has no user yet; the relay only logs `userId`, so a
+    // sign-up link carries the fixed sentinel and the binding's ids, never
+    // the request's (#9720 D6).
+    let payload: AuthEmailPayload;
+    if (found) {
+      payload = {
+        kind: "magic-link",
+        userId: found.user.id,
+        to: found.user.email,
+        url: data.url,
+      };
+    } else if (binding) {
+      payload = {
+        kind: "magic-link-sign-up",
+        userId: "sign-up",
+        to: data.email,
+        url: data.url,
+        agreements: binding.agreements,
+        locale: binding.locale,
+      };
+    } else {
       // No address in the line — the PII boundary holds for unknown addresses
       // too, and they are the ones an enumerator types.
       log.info({ kind: "magic-link", reason: "no_account" });
       return;
     }
 
-    const { user } = found;
     // Not awaited: `runInBackgroundOrAwait` never rejects, and `dispatch`
     // swallows its own failures into a log line.
-    void ctx.context.runInBackgroundOrAwait(
-      dispatch(
-        { kind: "magic-link", userId: user.id, to: user.email, url: data.url },
-        { send, log },
-      ),
-    );
+    void ctx.context.runInBackgroundOrAwait(dispatch(payload, { send, log }));
   };
 }
 
+interface MagicLinkDeps extends DispatchDeps {
+  /** Binds a sign-up request's agreements to its token (#9667 D4). */
+  bind?: typeof bindLinkAgreements;
+}
+
 /**
  * The options `auth.ts` hands Better Auth's `magicLink()` plugin (#7435 § D2).
  *
- * `disableSignUp: true` is defence in depth behind § D3: even a leaked token
- * for an address with no account cannot create one. `storeToken: "hashed"`
- * keeps a database read from yielding a live sign-in token. `allowedAttempts`
- * is left unset — the plugin consumes atomically regardless and warns on any
- * value but 1.
+ * `disableSignUp` follows `isSignUpOpen()`, read when `createAuth()` builds
+ * the plugin — the moment and the predicate `emailAndPassword.disableSignUp`
+ * uses, so the two methods never disagree (#9667 D1). Closed, it is defence
+ * in depth behind § D3: even a leaked token for an address with no account
+ * cannot create one. Open, the verify creates the account only for a token
+ * with an agreements binding (`lib/sign-up-agreements.ts`). `storeToken:
+ * "hashed"` keeps a database read from yielding a live sign-in token.
+ * `allowedAttempts` is left unset — the plugin consumes atomically regardless
+ * and warns on any value but 1.
  */
-export function makeMagicLinkOptions(deps: DispatchDeps) {
+export function makeMagicLinkOptions(deps: MagicLinkDeps) {
   return {
-    disableSignUp: true,
+    disableSignUp: !isSignUpOpen(),
     expiresIn: MAGIC_LINK_TTL_SECONDS,
     storeToken: "hashed" as const,
     sendMagicLink: makeSendMagicLink(deps),

package/templates/apps/web/lib/hub-session/__tests__/sign-in-gate.test.tsx

@@ -1,10 +1,17 @@
 /**
- * HubSignInGate (#7894 D10) as #8790 AC-1/AC-2 shape it: the site's inner-page
- * header (back arrow + mark), a label-size heading, the one hub sign-in
- * action, and a prospect line only when the site's messages carry it.
+ * HubSignInGate (#7894 D10) as #8790 AC-1/AC-2 and #9662 shape it: the site's
+ * inner-page header (the back arrow), then the one hub sign-in action inside
+ * the one card's frame — the mark in the tile, "Sign in to <site>", the toggle
+ * line to the hub's /sign-up (or the site's own prospect line when its
+ * messages carry one), and the Terms + Privacy acknowledgement.
+ *
+ * #9912 D1: that toggle reaches the hub's /sign-up through the same round trip
+ * as Sign in — this site's own sign-in route with `prompt=create` and the
+ * same `next` — so completing sign-up returns the buyer here.
  */
-import { render, screen } from "@testing-library/react";
+import { render, screen, within } from "@testing-library/react";
 import en from "../../../messages/en.json";
+import { SITE_NAME } from "../../site-brand";
 import { HubSignInGate } from "../sign-in-gate";
 
 type Gate = Record<string, string>;
@@ -12,9 +19,15 @@ let gateMessages: Gate;
 
 jest.mock("next-intl/server", () => ({
   __esModule: true,
-  getTranslations: jest.fn(async () => {
-    const t = (key: string) => gateMessages[key] ?? `copy:${key}`;
-    t.has = (key: string) => key in gateMessages;
+  getTranslations: jest.fn(async ({ namespace }: { namespace: string }) => {
+    const messages: Gate =
+      namespace === "signIn" ? (en.signIn as Gate) : gateMessages;
+    const t = (key: string, values?: Record<string, string>) =>
+      (messages[key] ?? `copy:${key}`).replace(
+        /\{(\w+)\}/g,
+        (_match, name: string) => values?.[name] ?? `{${name}}`,
+      );
+    t.has = (key: string) => key in messages;
     return t;
   }),
 }));
@@ -42,58 +55,113 @@ async function renderGate(pathname?: string): Promise<void> {
 
 beforeEach(() => {
   gateMessages = { ...(en.account.gate as Gate) };
-  mockConfig.mockReset().mockReturnValue({ clientId: "spoke_1" });
+  mockConfig
+    .mockReset()
+    .mockReturnValue({ clientId: "spoke_1", hubOrigin: "https://hub.example" });
 });
 
-describe("<HubSignInGate/> (#8790 AC-1)", () => {
-  it("wears the site's inner-page header: a back arrow to the home and the mark", async () => {
+describe("<HubSignInGate/> (#8790 AC-1; #9662)", () => {
+  it("wears the site's inner-page header: a back arrow to the home; the mark is the card's tile (#9662)", async () => {
     await renderGate("/account");
     const header = screen.getByTestId("account-sign-in-gate-header");
     const back = screen.getByTestId("nav-back-link");
     expect(header).toContainElement(back);
     expect(back).toHaveAttribute("href", "/");
     expect(back).toHaveAccessibleName(en.account.gate.homeLink);
-    expect(screen.getByTestId("account-sign-in-gate-mark")).toContainElement(
+    expect(header).not.toContainElement(screen.getByTestId("site-mark"));
+    expect(screen.getByTestId("auth-card-logo")).toContainElement(
       screen.getByTestId("site-mark"),
     );
   });
 
-  it("sets the heading at the label size and offers the one sign-in action", async () => {
+  it("titles the card 'Sign in to <site>' from the deployment's own name and offers the one sign-in action inside it", async () => {
     await renderGate("/account/settings");
-    const heading = screen.getByRole("heading", { level: 1 });
-    expect(heading).toHaveTextContent(en.account.gate.hubHeadline);
-    expect(heading).toHaveClass("text-heading-2");
-    expect(screen.getByTestId("account-hub-sign-in")).toHaveAttribute(
+    // The gate is the whole page, so the card's heading is its one h1.
+    expect(
+      screen.getByRole("heading", {
+        level: 1,
+        name: `Sign in to ${SITE_NAME}`,
+      }),
+    ).toBeInTheDocument();
+    const action = screen.getByTestId("account-hub-sign-in");
+    expect(screen.getByTestId("auth-card")).toContainElement(action);
+    expect(action).toHaveAttribute(
       "href",
       "/api/hub-session/sign-in?next=%2Faccount%2Fsettings",
     );
   });
 
-  it("renders no prospect line by default (the shipped messages carry no prospect keys)", async () => {
+  it("carries the toggle line to the hub's /sign-up and the acknowledgement on this site's policy routes (#9662)", async () => {
     await renderGate();
-    expect(screen.queryByTestId("account-sign-in-gate-prospect")).toBeNull();
+    expect(screen.getByTestId("auth-card-prospect")).toHaveTextContent(
+      /^Don't have an account\? Sign up$/,
+    );
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/api/hub-session/sign-in?next=%2Faccount&prompt=create",
+    );
+    expect(screen.getByTestId("account-hub-sign-in")).toHaveAttribute(
+      "href",
+      "/api/hub-session/sign-in?next=%2Faccount",
+    );
+    const footnote = screen.getByTestId("auth-card-footnote");
+    expect(footnote).toHaveTextContent(
+      /^You acknowledge that you read, and agree to our Terms of Service and our Privacy Policy\.$/,
+    );
+    expect(
+      within(footnote).getByRole("link", { name: "Terms of Service" }),
+    ).toHaveAttribute("href", "/terms");
+    expect(
+      within(footnote).getByRole("link", { name: "Privacy Policy" }),
+    ).toHaveAttribute("href", "/privacy");
+  });
+
+  it("starts Sign up with the requested path as next, the Sign in button's own URL plus prompt=create (#9912 D1, AC-1)", async () => {
+    await renderGate("/account/billing");
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/api/hub-session/sign-in?next=%2Faccount%2Fbilling&prompt=create",
+    );
+    expect(screen.getByTestId("account-hub-sign-in")).toHaveAttribute(
+      "href",
+      "/api/hub-session/sign-in?next=%2Faccount%2Fbilling",
+    );
   });
 });
 
 describe("<HubSignInGate/> prospect line (#8790 AC-2)", () => {
-  it("renders the line and its link when the site fills all three keys", async () => {
+  it("replaces the toggle line with the site's own when it fills all three keys", async () => {
     gateMessages.prospectPrompt = "New here?";
     gateMessages.prospectLink = "See if we fit";
     gateMessages.prospectHref = "/fit";
     await renderGate();
-    const line = screen.getByTestId("account-sign-in-gate-prospect");
-    expect(line).toHaveTextContent("New here? See if we fit.");
+    // The card's line ends on its link — no trailing period (#9662).
+    expect(screen.getByTestId("auth-card-prospect")).toHaveTextContent(
+      /^New here\? See if we fit$/,
+    );
     expect(screen.getByRole("link", { name: "See if we fit" })).toHaveAttribute(
       "href",
       "/fit",
     );
   });
 
-  it("renders nothing when any of the three keys is absent", async () => {
+  it("keeps the toggle line when any of the three keys is absent", async () => {
+    gateMessages.prospectPrompt = "New here?";
+    gateMessages.prospectLink = "See if we fit";
+    await renderGate();
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/api/hub-session/sign-in?next=%2Faccount&prompt=create",
+    );
+  });
+
+  it("draws no prospect line in the not-configured state, even with the site's three keys", async () => {
+    mockConfig.mockReturnValue(null);
     gateMessages.prospectPrompt = "New here?";
     gateMessages.prospectLink = "See if we fit";
+    gateMessages.prospectHref = "/fit";
     await renderGate();
-    expect(screen.queryByTestId("account-sign-in-gate-prospect")).toBeNull();
+    expect(screen.queryByTestId("auth-card-prospect")).toBeNull();
   });
 
   it("keeps the not-configured state when the hub is not configured", async () => {
@@ -102,6 +170,7 @@ describe("<HubSignInGate/> prospect line (#8790 AC-2)", () => {
     expect(screen.getByRole("heading", { level: 1 })).toHaveTextContent(
       en.account.gate.emptyHeadline,
     );
+    expect(screen.queryByTestId("auth-card-prospect")).toBeNull();
     expect(screen.getByTestId("account-sign-in-gate-home")).toHaveAttribute(
       "href",
       "/",