create-ailk 0.26.0 → 0.28.0

package/templates/apps/web/app/[locale]/(auth)/sign-up/__tests__/page.test.tsx

@@ -6,27 +6,41 @@
  * provider body. A failed link lands back here with `?error=<code>`, mapped
  * to fixed copy and never echoed.
  *
+ * #9912 D4, D5: the page reads `?next=` through `resolveNextPath`, as
+ * `/sign-in` does. The "Sign in" toggle (open and closed card) carries it, and
+ * the password, Google and magic-link paths each hand it to Better Auth as
+ * `callbackURL`, the magic link's failed-link return keeping it too. A `next`
+ * resolveNextPath refuses, or none, gives `/account` and the bare links.
+ *
  * `next-intl/server` is mocked globally (apps/web/__tests__/setup.ts) against
  * the real en.json.
  */
 import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 
 const mockGetActiveProviderIds = jest.fn();
+const mockIsSignUpOpen = jest.fn();
 // eslint-disable-next-line no-restricted-syntax -- #507: auth-env.ts is a pure env-introspection module with no external boundary to mock instead.
 jest.mock("../../../../../lib/auth-env", () => ({
   __esModule: true,
   getActiveProviderIds: () => mockGetActiveProviderIds(),
-  isSignUpOpen: () => true,
+  isSignUpOpen: () => mockIsSignUpOpen(),
   isResetAvailable: () => false,
   resetSendConfigured: () => false,
 }));
 
+const mockSocial = jest.fn();
+const mockSignUpEmail = jest.fn();
+const mockFetch = jest.fn();
 jest.mock("better-auth/react", () => ({
   __esModule: true,
   createAuthClient: () => ({
-    signIn: { social: jest.fn(), email: jest.fn() },
-    signUp: { email: jest.fn() },
-    $fetch: jest.fn(),
+    signIn: {
+      social: (...args: unknown[]) => mockSocial(...args),
+      email: jest.fn(),
+    },
+    signUp: { email: (...args: unknown[]) => mockSignUpEmail(...args) },
+    $fetch: (...args: unknown[]) => mockFetch(...args),
   }),
 }));
 
@@ -46,6 +60,10 @@ async function renderSignUp(
 
 beforeEach(() => {
   mockGetActiveProviderIds.mockReset();
+  mockIsSignUpOpen.mockReset().mockReturnValue(true);
+  mockSocial.mockReset().mockResolvedValue({ data: {}, error: null });
+  mockSignUpEmail.mockReset().mockResolvedValue({ data: {}, error: null });
+  mockFetch.mockReset().mockResolvedValue({ data: {}, error: null });
 });
 
 describe("the method (D6)", () => {
@@ -106,3 +124,178 @@ describe("the failed-link notice (D6)", () => {
     expect(screen.queryByTestId("sign-up-link-notice")).toBeNull();
   });
 });
+
+/** A continue path as the hub's authorize step hands it (#8146). */
+const CONTINUATION = "/api/auth/hub/continue/AbC-123_xyz";
+
+/** The three values `resolveNextPath` refuses that a toggle must never echo. */
+const REFUSED: ReadonlyArray<[string, string]> = [
+  ["a protocol-relative next", "//evil.example"],
+  ["an absolute next", "https://evil.example/x"],
+  ["a backslash next", "/\\evil.example"],
+];
+
+/** Each query that carries no `next` a toggle may echo: the refused three, and none. */
+const UNCARRIED: Array<[string, Record<string, string>]> = [
+  ...REFUSED.map(([label, next]): [string, Record<string, string>] => [
+    label,
+    { next },
+  ]),
+  ["no next", {}],
+];
+
+/** The completion cases with no `next` to honour: one refused, and none. */
+const TO_ACCOUNT: Array<[string, Record<string, string>]> = [
+  ["a refused next", { next: "//evil.example" }],
+  ["no next", {}],
+];
+
+describe("the Sign in toggle keeps the next (#9912 D4)", () => {
+  beforeEach(() => {
+    mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+  });
+
+  it("carries a validated next on the open card", async () => {
+    await renderSignUp({ next: "/account/billing" });
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/sign-in?next=%2Faccount%2Fbilling",
+    );
+  });
+
+  it("carries a validated next on the closed (invitation) card", async () => {
+    mockIsSignUpOpen.mockReturnValue(false);
+    await renderSignUp({ next: "/account/billing" });
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/sign-in?next=%2Faccount%2Fbilling",
+    );
+  });
+
+  it.each(UNCARRIED)(
+    "%s gives the bare /sign-in on the open card",
+    async (_label, query) => {
+      await renderSignUp(query);
+      expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+        "href",
+        "/sign-in",
+      );
+    },
+  );
+
+  it.each(UNCARRIED)(
+    "%s gives the bare /sign-in on the closed card",
+    async (_label, query) => {
+      mockIsSignUpOpen.mockReturnValue(false);
+      await renderSignUp(query);
+      expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+        "href",
+        "/sign-in",
+      );
+    },
+  );
+});
+
+describe("sign-up completion follows the validated next (#9912 D5)", () => {
+  async function tickTerms(): Promise<void> {
+    await userEvent.setup().click(screen.getByTestId("consent-account_terms"));
+  }
+
+  async function submitPassword(): Promise<void> {
+    const user = userEvent.setup();
+    await tickTerms();
+    await user.type(screen.getByTestId("auth-email"), "ada@example.com");
+    await user.type(
+      screen.getByTestId("auth-password"),
+      "correct horse battery staple",
+    );
+    await user.click(screen.getByTestId("auth-submit"));
+  }
+
+  async function clickGoogle(): Promise<void> {
+    await tickTerms();
+    await userEvent.setup().click(screen.getByTestId("auth-social-google"));
+  }
+
+  async function submitLink(): Promise<void> {
+    const user = userEvent.setup();
+    await tickTerms();
+    await user.type(screen.getByTestId("auth-email"), "ada@example.com");
+    await user.click(screen.getByTestId("auth-submit"));
+  }
+
+  describe("with a continuation next", () => {
+    it("password: signUp.email's callbackURL is the next", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+      await renderSignUp({ next: CONTINUATION });
+      await submitPassword();
+      expect(mockSignUpEmail).toHaveBeenCalledTimes(1);
+      expect(mockSignUpEmail.mock.calls[0][0]).toMatchObject({
+        callbackURL: CONTINUATION,
+      });
+    });
+
+    it("Google: signIn.social's callbackURL is the next", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+      await renderSignUp({ next: CONTINUATION });
+      await clickGoogle();
+      expect(mockSocial).toHaveBeenCalledTimes(1);
+      expect(mockSocial.mock.calls[0][0]).toMatchObject({
+        provider: "google",
+        callbackURL: CONTINUATION,
+      });
+    });
+
+    it("magic link: the request's callbackURL is the next and its failed-link return keeps it", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "magic-link"]);
+      await renderSignUp({ next: CONTINUATION });
+      await submitLink();
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+      const [path, init] = mockFetch.mock.calls[0] as [
+        string,
+        { body: Record<string, unknown> },
+      ];
+      expect(path).toBe("/sign-in/magic-link");
+      expect(init.body.callbackURL).toBe(CONTINUATION);
+      expect(init.body.errorCallbackURL).toBe(
+        `/sign-up?next=${encodeURIComponent(CONTINUATION)}`,
+      );
+    });
+  });
+
+  describe.each(TO_ACCOUNT)("with %s", (_label, query) => {
+    it("password: callbackURL /account", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+      await renderSignUp(query);
+      await submitPassword();
+      expect(mockSignUpEmail).toHaveBeenCalledTimes(1);
+      expect(mockSignUpEmail.mock.calls[0][0]).toMatchObject({
+        callbackURL: "/account",
+      });
+    });
+
+    it("Google: callbackURL /account", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+      await renderSignUp(query);
+      await clickGoogle();
+      expect(mockSocial).toHaveBeenCalledTimes(1);
+      expect(mockSocial.mock.calls[0][0]).toMatchObject({
+        provider: "google",
+        callbackURL: "/account",
+      });
+    });
+
+    it("magic link: callbackURL /account and the bare /sign-up return", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "magic-link"]);
+      await renderSignUp(query);
+      await submitLink();
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+      const [, init] = mockFetch.mock.calls[0] as [
+        string,
+        { body: Record<string, unknown> },
+      ];
+      expect(init.body.callbackURL).toBe("/account");
+      expect(init.body.errorCallbackURL).toBe("/sign-up");
+    });
+  });
+});

package/templates/apps/web/app/[locale]/(auth)/sign-up/page.tsx

@@ -19,6 +19,13 @@
  * keeps its invitation copy inside that frame — never a form the server
  * would refuse (operator, 2026-10-24).
  *
+ * `?next=` (#9912 D4, D5) is read through `resolveNextPath`, the call
+ * `/sign-in` makes. The validated `next` is where every method completes —
+ * the password verification link, the magic link and Google — and both the
+ * "Sign in" toggle and the failed-link return carry it, so a buyer sent here
+ * by a spoke's round trip ends back on the spoke. A refused or absent `next`
+ * gives `/account` and the bare links, as before.
+ *
  * `AuthShell` (the (auth) group's layout) owns the 400px column; the card
  * carries the site's mark (#8790 D3).
  */
@@ -38,13 +45,17 @@ import { getActiveProviderIds, isSignUpOpen } from "../../../../lib/auth-env";
 import { consentPoliciesFor } from "../../../../lib/consent-policies";
 import { siteLogo } from "../../../../lib/site-logo";
 import { legalFootnote } from "../legal-footnote";
+import { hrefWithNext, resolveNextPath } from "../sign-in/next-path";
 import { resolveSignInCardText } from "../sign-in/sign-in-text";
 
 import { SignUpCard, type SignUpProvider } from "./sign-up-card";
 
 interface Props {
   params: Promise<{ locale: string }>;
-  searchParams?: Promise<{ error?: string | string[] }>;
+  searchParams?: Promise<{
+    next?: string | string[];
+    error?: string | string[];
+  }>;
 }
 
 /**
@@ -79,13 +90,15 @@ export default async function SignUpPage({
   searchParams,
 }: Props): Promise<ReactElement> {
   const { locale } = await params;
+  const { next: rawNext, error } = (await searchParams) ?? {};
   const t = await getTranslations({ locale, namespace: "auth" });
-  const signInHref = localeHref(locale, "/sign-in");
+  const fallback = localeHref(locale, "/account");
+  const next = resolveNextPath(rawNext, fallback);
   // The toggle line to /sign-in, and the acknowledgement /sign-in shares.
   const prospect = {
     prompt: t("signUpFooterPrompt"),
     linkLabel: t("signUpFooterLink"),
-    href: signInHref,
+    href: hrefWithNext(localeHref(locale, "/sign-in"), next, fallback),
   };
   const footnote = legalFootnote(
     locale,
@@ -122,8 +135,7 @@ export default async function SignUpPage({
     : active.includes("email")
       ? "password"
       : "sso";
-  const noticeKey =
-    method === "magic-link" ? linkNoticeKey((await searchParams)?.error) : null;
+  const noticeKey = method === "magic-link" ? linkNoticeKey(error) : null;
 
   const labels: AuthCardLabels = {
     signUpHeading: t("signUpHeading"),
@@ -156,7 +168,7 @@ export default async function SignUpPage({
       logo={siteLogo()}
       providers={providers}
       method={method}
-      next={localeHref(locale, "/account")}
+      next={next}
       prospect={prospect}
       footnote={footnote}
       labels={labels}
@@ -170,7 +182,11 @@ export default async function SignUpPage({
       agreementPolicies={consentPoliciesFor(locale)}
       agreementsLegend={t("signUpAgreementsLegend")}
       locale={locale}
-      errorCallbackURL={localeHref(locale, "/sign-up")}
+      errorCallbackURL={hrefWithNext(
+        localeHref(locale, "/sign-up"),
+        next,
+        fallback,
+      )}
       {...(noticeKey ? { linkNotice: t(noticeKey) } : {})}
       linkLabels={{
         sentHeading: t("sentHeading"),

package/templates/apps/web/app/[locale]/(authed)/account/artifacts/[pieceId]/versions/[version]/file/route.ts

@@ -17,7 +17,8 @@
  * sandbox `Content-Security-Policy` and `Cache-Control: private, no-store` —
  * so the file is never a document on this origin and never cached on the way.
  * A hub answer missing any of the five is refused 502 rather than served
- * without it.
+ * without it — and so is one whose safety headers carry the wrong value
+ * (#8320, #9965 D8): presence alone is not the hub's promise.
  *
  * The params are shape-checked before any call (a malformed piece id or a
  * version that is not a whole number from 1 is a 404 with no call). A
@@ -43,6 +44,59 @@ const FILE_HEADER_NAMES: Record<keyof MemberFileHeaders, string> = {
   cacheControl: "Cache-Control",
 };
 
+/**
+ * HTTP's own whitespace — SP and HTAB, never JS `\s`. A browser reads any
+ * other byte (a non-breaking space among them) as part of the token, so a
+ * check that trimmed or split on it would pass a value it does not describe.
+ */
+const HTTP_VALUE = /^[\t\x20-\x7e]*$/;
+const httpTrim = (value: string) => value.replace(/^[ \t]+|[ \t]+$/g, "");
+
+/**
+ * The CSP's directives by name, or `null` for two policies joined or a
+ * directive named twice — a browser enforces the first copy, so a check that
+ * read a later one could pass a policy it does not describe.
+ */
+function cspDirectives(policy: string): Map<string, string> | null {
+  // `Headers.get` joins two CSP headers with ", " — a second policy the hub
+  // never sent (#9965 SEC-9965-16).
+  if (policy.includes(",")) return null;
+  const directives = new Map<string, string>();
+  for (const part of policy.split(";")) {
+    const [name = "", ...rest] = httpTrim(part).split(/[ \t]+/);
+    if (!name) continue;
+    if (directives.has(name)) return null;
+    directives.set(name, rest.join(" "));
+  }
+  return directives;
+}
+
+/**
+ * Whether each safety header carries the value the hub sends (D8). Every
+ * comparison is case-insensitive and trimmed of SP and HTAB, and a value
+ * carrying any byte outside visible ASCII, SP and HTAB is refused before it
+ * is parsed. `Content-Type` is not checked: the other four contain it.
+ */
+const SAFE_VALUE: Partial<
+  Record<keyof MemberFileHeaders, (value: string) => boolean>
+> = {
+  contentTypeOptions: (value) => value === "nosniff",
+  contentDisposition: (value) => /^attachment[ \t]*(;|$)/.test(value),
+  contentSecurityPolicy: (value) => {
+    const directives = cspDirectives(value);
+    const sandbox = directives?.get("sandbox");
+    return (
+      sandbox !== undefined &&
+      !sandbox.split(" ").includes("allow-scripts") &&
+      directives?.get("default-src") === "'none'"
+    );
+  },
+  cacheControl: (value) => {
+    const directives = value.split(",").map((part) => part.trim());
+    return directives.includes("private") && directives.includes("no-store");
+  },
+};
+
 function refusal(status: number): Response {
   return new Response(null, {
     status,
@@ -90,7 +144,12 @@ export async function GET(
     string,
   ][]) {
     const value = headers[key];
-    if (value === null) {
+    const check = SAFE_VALUE[key];
+    const safe =
+      value !== null &&
+      (check === undefined ||
+        (HTTP_VALUE.test(value) && check(httpTrim(value).toLowerCase())));
+    if (!safe) {
       await stream.cancel();
       return refusal(502);
     }

package/templates/apps/web/app/[locale]/(authed)/account/artifacts/__tests__/file-route.test.ts

@@ -14,6 +14,8 @@
  *     unchanged;
  *   - a hub answer missing any of the five is refused 502, its stream
  *     cancelled — never bytes on this origin without them;
+ *   - so is one carrying a safety header with the wrong value (#8320, #9965
+ *     D8): presence is not enough;
  *   - malformed params are a 404 with no call — and `locale`, which Next
  *     always passes, never makes a real request fail;
  *   - refusals map to a status with no body and `private, no-store`;
@@ -140,6 +142,85 @@ describe("the version file read", () => {
     },
   );
 
+  it.each([
+    [
+      "an inline Content-Disposition",
+      { contentDisposition: "inline; filename=a.pdf" },
+    ],
+    [
+      "X-Content-Type-Options other than nosniff",
+      { contentTypeOptions: "sniff" },
+    ],
+    [
+      "a Content-Security-Policy with no sandbox",
+      { contentSecurityPolicy: "default-src *" },
+    ],
+    [
+      "a sandbox that allows scripts",
+      { contentSecurityPolicy: "default-src 'none'; sandbox allow-scripts" },
+    ],
+    [
+      "a sandbox with default-src other than 'none'",
+      { contentSecurityPolicy: "default-src *; sandbox" },
+    ],
+    [
+      "two CSP headers, joined (the hub's plus default-src *)",
+      { contentSecurityPolicy: "default-src 'none'; sandbox, default-src *" },
+    ],
+    [
+      "a repeated sandbox directive, whose first copy allows scripts",
+      {
+        contentSecurityPolicy:
+          "sandbox allow-scripts; sandbox; default-src 'none'",
+      },
+    ],
+    // HTTP whitespace is SP and HTAB only: a browser reads a non-breaking
+    // space as part of the token, so a value JS would trim to the safe one
+    // is not the safe one.
+    [
+      "an attachment Content-Disposition with a non-breaking space",
+      { contentDisposition: "attachment\u00a0; filename=x.html" },
+    ],
+    [
+      "nosniff followed by a non-breaking space",
+      { contentTypeOptions: "nosniff\u00a0" },
+    ],
+    [
+      "a CSP whose directives are split by non-breaking spaces",
+      { contentSecurityPolicy: "default-src\u00a0'none'; sandbox\u00a0" },
+    ],
+    [
+      "a public, cacheable Cache-Control",
+      { cacheControl: "public, max-age=3600" },
+    ],
+    [
+      "a Cache-Control without no-store",
+      { cacheControl: "private, max-age=60" },
+    ],
+  ])("refuses 502 with no bytes on %s", async (_case, headers) => {
+    const result = fileResult(headers);
+    const cancel = jest.spyOn(result.body.stream as ReadableStream, "cancel");
+    mockArtifactFile.mockResolvedValue(result);
+    const res = await get();
+    expect(cancel).toHaveBeenCalled();
+    await expectBodylessRefusal(res, 502);
+  });
+
+  it("serves the hub's own attachment policy, compared case-insensitively", async () => {
+    mockArtifactFile.mockResolvedValue(
+      fileResult({
+        contentDisposition: 'Attachment; filename="brief-v2.pdf"',
+        contentTypeOptions: "NoSniff",
+        contentSecurityPolicy:
+          "default-src 'none'; sandbox; frame-ancestors 'none'; form-action 'none'; base-uri 'none'",
+        cacheControl: "no-store, Private",
+      }),
+    );
+    const res = await get();
+    expect(res.status).toBe(200);
+    await expect(res.text()).resolves.toBe("%PDF-1.7 bytes");
+  });
+
   it.each([
     ["a version of 0", PIECE, "0"],
     ["a version that is not a number", PIECE, "abc"],

package/templates/apps/web/app/[locale]/(authed)/account/connect/__tests__/page.test.tsx

@@ -0,0 +1,197 @@
+/**
+ * Tests for /[locale]/account/connect — the hub's consent page (#9966 D2;
+ * AC-4).
+ *
+ * Covers:
+ *   1. A ref that opens and a client the registry answers for renders the
+ *      spoke's registry name, its origin and the signed-in email, and one
+ *      form posting `ref` alone to `/api/auth/hub/authorize`.
+ *   2. A forged ref, a missing ref, a client the registry does not answer for
+ *      and a ref whose `redirect_uri` is on another origin each render
+ *      `hubConnect.unavailable` and no form.
+ *   3. `generateMetadata` answers `referrer: "same-origin"` and `noindex`.
+ *   4. A spoke build is a 404.
+ */
+import { render, screen } from "@testing-library/react";
+
+jest.mock("next-intl/server", () => {
+  const msgs: unknown = require("../../../../../../messages/en.json");
+  const dig = (obj: unknown, path: string): unknown =>
+    path.split(".").reduce<unknown>(
+      (acc, k) => (acc !== null && typeof acc === "object" ? (acc as Record<string, unknown>)[k] : undefined),
+      obj,
+    );
+  return {
+    __esModule: true,
+    getTranslations: async (arg: string | { namespace?: string; locale?: string }) => {
+      const ns = typeof arg === "string" ? arg : (arg.namespace ?? "");
+      const messages = dig(msgs, ns);
+      return (key: string, values?: Record<string, unknown>): string => {
+        const value = dig(messages, key);
+        if (typeof value !== "string") return `${ns}.${key}`;
+        return value.replace(/\{(\w+)\}/g, (m, name: string) =>
+          values && name in values ? String(values[name]) : m,
+        );
+      };
+    },
+  };
+});
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn().mockResolvedValue(new Headers()),
+  cookies: jest.fn().mockResolvedValue({ toString: () => "session=abc" }),
+}));
+
+const mockSecret = "k".repeat(43);
+const mockGetSession = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth.ts's lazy Better-Auth singleton has no HTTP/DB boundary a unit test of the session fields can mock without standing up Prisma.
+jest.mock("../../../../../../auth", () => ({
+  __esModule: true,
+  auth: { api: { getSession: (...args: unknown[]) => mockGetSession(...args) } },
+  resolveSecret: () => mockSecret,
+}));
+
+const mockClientInfo = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  hubSignIn: { clientInfo: (...args: unknown[]) => mockClientInfo(...args) },
+  subscription: { me: jest.fn(), portalSession: jest.fn() },
+  visitorForwardHeaders: () => undefined,
+}));
+
+class NotFound extends Error {}
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  notFound: () => {
+    throw new NotFound();
+  },
+  redirect: jest.fn(),
+}));
+
+const mockTopology: { value: "hub" | "spoke" } = { value: "hub" };
+// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426), not a runtime input; the seam IS the boundary between a hub and a spoke build, and no env or HTTP surface selects it.
+jest.mock("../../../../../../lib/topology.generated", () => {
+  const real = jest.requireActual("../../../../../../lib/topology.generated") as Record<string, unknown>;
+  return {
+    ...real,
+    __esModule: true,
+    get TOPOLOGY() {
+      return mockTopology.value;
+    },
+  };
+});
+
+import { mintContinuation } from "../../../../../api/auth/hub/continuation";
+import Page, { generateMetadata } from "../page";
+
+const SPOKE_ORIGIN = "https://spoke.example.com";
+const SPOKE_CALLBACK = `${SPOKE_ORIGIN}/api/hub-session/callback`;
+
+function query(overrides: Record<string, string> = {}): string {
+  return new URLSearchParams({
+    response_type: "code",
+    client_id: "spoke_abc",
+    redirect_uri: SPOKE_CALLBACK,
+    state: "s".repeat(43),
+    code_challenge: "c".repeat(43),
+    code_challenge_method: "S256",
+    ...overrides,
+  }).toString();
+}
+
+const SESSION = {
+  user: { id: "user_1", name: "Ada", email: "ada@example.com", emailVerified: true },
+};
+
+beforeEach(() => {
+  mockTopology.value = "hub";
+  mockGetSession.mockReset().mockResolvedValue(SESSION);
+  mockClientInfo.mockReset().mockResolvedValue({
+    ok: true,
+    body: { clientId: "spoke_abc", name: "Acme Studio", origin: SPOKE_ORIGIN },
+  });
+});
+
+async function renderPage(ref?: string | string[]): Promise<void> {
+  const element = await Page({
+    params: Promise.resolve({ locale: "en" }),
+    searchParams: Promise.resolve(ref === undefined ? {} : { ref }),
+  });
+  render(element);
+}
+
+function expectUnavailable(): void {
+  expect(screen.getByTestId("hub-connect-unavailable")).toBeTruthy();
+  expect(screen.getByText("This sign-in can't continue")).toBeTruthy();
+  expect(screen.queryByTestId("hub-connect-form")).toBeNull();
+  expect(document.querySelector("form")).toBeNull();
+}
+
+describe("the consent page (#9966 D2, AC-4)", () => {
+  it("names the spoke from the registry and posts the ref alone to the authorize route", async () => {
+    const ref = mintContinuation(query(), mockSecret);
+
+    await renderPage(ref);
+
+    expect(screen.getByRole("heading", { level: 1 }).textContent).toBe("Sign in to Acme Studio?");
+    expect(screen.getByText(/https:\/\/spoke\.example\.com will see your name/).textContent).toContain(
+      "ada@example.com",
+    );
+    expect(mockClientInfo).toHaveBeenCalledWith("spoke_abc");
+    const form = screen.getByTestId("hub-connect-form") as HTMLFormElement;
+    expect(form.getAttribute("method")).toBe("post");
+    expect(form.getAttribute("action")).toBe("/api/auth/hub/authorize");
+    const fields = Array.from(form.querySelectorAll("input"));
+    expect(fields.map((f) => [f.type, f.name, f.value])).toEqual([["hidden", "ref", ref]]);
+    expect(screen.getByTestId("hub-connect-continue").textContent).toBe("Continue");
+    expect(screen.getByTestId("hub-connect-cancel").getAttribute("href")).toBe("/account");
+  });
+
+  it.each([
+    ["a forged ref", () => "x".repeat(80)],
+    ["no ref", () => undefined],
+    ["two refs", () => [mintContinuation(query(), mockSecret), mintContinuation(query(), mockSecret)]],
+    ["a ref sealing a query that fails the schema", () => mintContinuation(query({ code_challenge_method: "plain" }), mockSecret)],
+  ])("%s renders unavailable and no form", async (_name, ref) => {
+    await renderPage(ref());
+    expectUnavailable();
+  });
+
+  it("a client the registry does not answer for renders unavailable and no form", async () => {
+    mockClientInfo.mockResolvedValue({ ok: false, status: 404, body: null });
+    await renderPage(mintContinuation(query(), mockSecret));
+    expectUnavailable();
+  });
+
+  it("a registry read that throws renders unavailable and no form", async () => {
+    mockClientInfo.mockRejectedValue(new Error("network"));
+    await renderPage(mintContinuation(query(), mockSecret));
+    expectUnavailable();
+  });
+
+  it("a ref whose redirect_uri is on another origin than the registry names renders unavailable (SEC-9966-10)", async () => {
+    await renderPage(
+      mintContinuation(query({ redirect_uri: "https://other.example.com/api/hub-session/callback" }), mockSecret),
+    );
+    expectUnavailable();
+  });
+
+  it("generateMetadata keeps the ref out of a cross-site Referer and the page out of the index", async () => {
+    const metadata = await generateMetadata({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve({}),
+    });
+    expect(metadata).toEqual({
+      title: "Sign in to a site",
+      robots: { index: false, follow: false },
+      referrer: "same-origin",
+    });
+  });
+
+  it("a spoke build is a 404", async () => {
+    mockTopology.value = "spoke";
+    await expect(renderPage(mintContinuation(query(), mockSecret))).rejects.toBeInstanceOf(NotFound);
+    expect(mockClientInfo).not.toHaveBeenCalled();
+  });
+});