create-ailk 0.26.0 → 0.28.0

package/templates/apps/web/app/[locale]/(authed)/account/connect/page.tsx

@@ -0,0 +1,152 @@
+/**
+ * /[locale]/account/connect — the hub asks a person once per spoke before it
+ * tells that spoke who they are (#9966 D2, #7978).
+ *
+ * The authorize step (`app/api/auth/hub/authorize/route.ts`) sends a signed-in
+ * person here when the API answers `consent_required`, with the six validated
+ * authorize keys sealed as `ref`. This page opens the ref, names the spoke
+ * from the registry (`hubSignIn.clientInfo`) — never from the query — and
+ * offers one Continue: a same-origin form POST of `ref` back to the authorize
+ * route, which alone sends `consent: true`. Cancel goes to `/account`.
+ *
+ * The form renders only when the ref's `redirect_uri` is on the origin the
+ * registry names, so the page never names one site while the code goes to
+ * another. Anything that does not hold — a ref that does not open, a client
+ * the registry does not answer for — renders `hubConnect.unavailable` and no
+ * form. A spoke carries no hub routes, so a spoke build is a 404. `noindex`,
+ * and `referrer: same-origin`, which keeps the ref out of any cross-site
+ * Referer while the browser still sends the real `Origin` on Continue.
+ */
+
+import { hubSignIn } from "@working-theory/api-client";
+import { localeHref } from "@working-theory/ui";
+import { Button, Heading, Input, Link, Text } from "@working-theory/ui/primitives";
+import { hubAuthorizeQuerySchema, type HubAuthorizeQuery } from "@working-theory/validation";
+import type { Metadata } from "next";
+import { notFound } from "next/navigation";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { resolveSecret } from "../../../../../auth";
+import { TOPOLOGY } from "../../../../../lib/topology.generated";
+import { openContinuation } from "../../../../api/auth/hub/continuation";
+import { accountSession } from "../account-data";
+
+/** The authorize route's POST — the one request that says yes. */
+const AUTHORIZE_PATH = "/api/auth/hub/authorize";
+
+const QUERY_KEYS = [
+  "response_type",
+  "client_id",
+  "redirect_uri",
+  "state",
+  "code_challenge",
+  "code_challenge_method",
+] as const;
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  searchParams: Promise<{ ref?: string | string[] }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "hubConnect" });
+  return {
+    title: t("metaTitle"),
+    robots: { index: false, follow: false },
+    referrer: "same-origin",
+  };
+}
+
+/** The sealed authorize query, or `null` when the ref does not open or parse. */
+function openQuery(ref: string | string[] | undefined): HubAuthorizeQuery | null {
+  if (typeof ref !== "string") return null;
+  const search = openContinuation(ref, resolveSecret());
+  if (search === null) return null;
+  const params = new URLSearchParams(search);
+  const raw: Record<string, string | undefined> = {};
+  for (const key of QUERY_KEYS) raw[key] = params.get(key) ?? undefined;
+  const parsed = hubAuthorizeQuerySchema.safeParse(raw);
+  return parsed.success ? parsed.data : null;
+}
+
+function originOf(url: string): string | null {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+
+/** The spoke's registry name and origin, or `null` when it cannot be read. */
+async function readClient(clientId: string): Promise<{ name: string; origin: string } | null> {
+  try {
+    const res = await hubSignIn.clientInfo(clientId);
+    return res.ok ? { name: res.body.name, origin: res.body.origin } : null;
+  } catch {
+    return null;
+  }
+}
+
+export default async function HubConnectPage({ params, searchParams }: Props): Promise<ReactElement> {
+  if (TOPOLOGY === "spoke") notFound();
+  const { locale } = await params;
+  const { ref } = await searchParams;
+  const t = await getTranslations({ locale, namespace: "hubConnect" });
+
+  const query = openQuery(ref);
+  const client = query ? await readClient(query.client_id) : null;
+  const session = await accountSession(locale);
+  const ready =
+    typeof ref === "string" &&
+    query !== null &&
+    client !== null &&
+    session !== null &&
+    originOf(query.redirect_uri) === client.origin;
+
+  if (!ready) {
+    return (
+      <div className="flex max-w-3xl flex-col gap-6 py-8" data-testid="hub-connect-unavailable">
+        <div>
+          <Heading level={1} visual={2}>
+            {t("unavailable.title")}
+          </Heading>
+          <Text as="p" variant="body-sm" tone="muted" className="mt-block-tight">
+            {t("unavailable.body")}
+          </Text>
+        </div>
+        <Link href={localeHref(locale, "/account")} data-testid="hub-connect-back">
+          {t("unavailable.back")}
+        </Link>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex max-w-3xl flex-col gap-8 py-8" data-testid="hub-connect">
+      <div>
+        <Heading level={1} visual={2}>
+          {t("title", { name: client.name })}
+        </Heading>
+        <Text as="p" variant="body-sm" tone="muted" className="mt-block-tight">
+          {t("lead", { origin: client.origin, email: session.ctx.user.email })}
+        </Text>
+      </div>
+      <form
+        method="post"
+        action={AUTHORIZE_PATH}
+        className="flex flex-wrap items-center gap-4"
+        data-testid="hub-connect-form"
+      >
+        <Input type="hidden" name="ref" value={ref} />
+        <Button type="submit" size="big" data-testid="hub-connect-continue">
+          {t("continue")}
+        </Button>
+        <Link href={localeHref(locale, "/account")} data-testid="hub-connect-cancel">
+          {t("cancel")}
+        </Link>
+      </form>
+    </div>
+  );
+}

package/templates/apps/web/app/[locale]/about/__tests__/about-routes.test.tsx

@@ -329,7 +329,7 @@ describe("the sitemap and llms.txt advertise /about/<slug>, never a bare /<slug>
 
   it("sitemap.xml: one <loc> ending in /about/sam-henry, none ending in a bare /sam-henry", async () => {
     const stubAdapter = makeStubAdapter();
-    const GET = createSitemapHandler({ getContentAdapter: () => stubAdapter });
+    const GET = createSitemapHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [] });
     const response = await GET();
     const text = await response.text();
     const locs = Array.from(text.matchAll(/<loc>([^<]*)<\/loc>/g)).map(
@@ -341,7 +341,7 @@ describe("the sitemap and llms.txt advertise /about/<slug>, never a bare /<slug>
 
   it("llms.txt: names a URL ending in /about/sam-henry", async () => {
     const stubAdapter = makeStubAdapter();
-    const GET = createLlmsHandler({ getContentAdapter: () => stubAdapter });
+    const GET = createLlmsHandler({ getContentAdapter: () => stubAdapter, getDocsPages: () => [] });
     const response = await GET();
     const text = await response.text();
     expect(text).toContain("URL: https://site.example/about/sam-henry");

package/templates/apps/web/app/[locale]/careers/[slug]/[action]/page.tsx

@@ -21,6 +21,16 @@
  * are shared across requests for 15 seconds per server instance, as
  * /contact's are (#8731). Full-screen (`isMagnetWalkPath` matches the path),
  * so it draws its own back arrow, and `noindex, follow` like the walk.
+ *
+ * #10054 D4 — a posting may name its magnet (`applicationFlow`). The page
+ * reads it through the same shared read, keyed per flow (the keys are only
+ * slugs content names: the posting must exist before any read), and renders
+ * its step 1 when it maps; the submission then records the flow beside the
+ * posting (`apply.actions.ts` D6). A flow the hub answers absent — any non-ok
+ * answer below 500, as the walk's `readMagnet` reads it — or whose step 1
+ * does not map falls back to the Job application and is logged with the two
+ * slugs. A failed read (5xx, a throw) falls back silently, as a down hub
+ * always has.
  */
 import { flows, leads } from "@working-theory/api-client";
 import { flowRouteMetadata } from "@working-theory/metadata";
@@ -33,6 +43,7 @@ import {
 } from "@working-theory/ui";
 import { NavBackLink } from "@working-theory/ui/chrome";
 import {
+  flowSlugSchema,
   JOB_APPLICATION_FLOW_SLUG,
   type FlowConfig,
 } from "@working-theory/validation";
@@ -41,7 +52,7 @@ import { notFound } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
-import { postingTitle } from "../../../../../lib/posting-title";
+import { postingForApply, type ApplyPosting } from "../../../../../lib/posting-title";
 import { contactFormText } from "../../../contact/contact-form-text";
 import { readSiteContactEmail } from "../../../contact/site-contact-email";
 import { captureLeadAction } from "../apply.actions";
@@ -94,51 +105,91 @@ function readAccepting(): Promise<boolean> {
   });
 }
 
-/** The served Job application magnet's config, or `null` for any failed read. */
-function readJobApplicationMagnet(): Promise<FlowConfig | null> {
-  return sharedHubRead("job-application-magnet", async () => {
+type MagnetConfigRead =
+  | { kind: "ok"; config: FlowConfig }
+  | { kind: "absent" }
+  | { kind: "failed" };
+
+/**
+ * A served magnet's config: `absent` for a non-ok answer below 500, `failed`
+ * for a 5xx or a throw. Never called with a slug content did not name.
+ */
+function readMagnetConfig(flowSlug: string): Promise<MagnetConfigRead> {
+  return sharedHubRead(`magnet:${flowSlug}`, async () => {
     try {
-      const res = await flows.get(JOB_APPLICATION_FLOW_SLUG);
-      return res.ok ? res.body : null;
+      const res = await flows.get(flowSlug);
+      if (res.ok) return { kind: "ok", config: res.body };
+      return res.status >= 500 ? { kind: "failed" } : { kind: "absent" };
     } catch {
-      return null;
+      return { kind: "failed" };
     }
   });
 }
 
-/** The posting's title, or `null` for a segment pair this page does not serve. */
-async function titleFor(
+type ApplicationForm = ReturnType<typeof jobApplicationFormFallback>;
+
+/**
+ * The form a posting's page draws (D4), and the flow it records when that is
+ * the posting's own; with none named, exactly the Job application path.
+ */
+async function applicationForm(
+  slug: string,
+  { applicationFlow: named }: ApplyPosting,
+  locale: string,
+): Promise<{ view: ApplicationForm; applicationFlow?: string }> {
+  if (named !== undefined && named !== JOB_APPLICATION_FLOW_SLUG) {
+    const read: MagnetConfigRead = flowSlugSchema.safeParse(named).success
+      ? await readMagnetConfig(named)
+      : { kind: "absent" };
+    const view = read.kind === "ok" ? jobApplicationFormFromConfig(read.config, locale) : null;
+    if (view) return { view, applicationFlow: named };
+    if (read.kind !== "failed") {
+      console.warn("[careers] application flow unavailable — falling back to job-application", {
+        posting: slug,
+        flow: named,
+        reason: read.kind === "ok" ? "unmappable" : "absent",
+      });
+    }
+  }
+  const read = await readMagnetConfig(JOB_APPLICATION_FLOW_SLUG);
+  return {
+    view:
+      (read.kind === "ok" ? jobApplicationFormFromConfig(read.config, locale) : null) ??
+      jobApplicationFormFallback(locale),
+  };
+}
+
+/** The posting, or `null` for a segment pair this page does not serve. */
+async function postingFor(
   slug: string,
   action: string,
   locale: string,
-): Promise<string | null> {
+): Promise<ApplyPosting | null> {
   if (action !== "apply" || !POSTING_SLUG_RE.test(slug)) return null;
-  return postingTitle(slug, locale);
+  return postingForApply(slug, locale);
 }
 
 export async function generateMetadata({ params }: Props): Promise<Metadata> {
   const { locale, slug, action } = await params;
-  const title = await titleFor(slug, action, locale);
-  return title === null ? flowRouteMetadata() : flowRouteMetadata({ title });
+  const posting = await postingFor(slug, action, locale);
+  return posting === null ? flowRouteMetadata() : flowRouteMetadata({ title: posting.title });
 }
 
 export default async function Page({ params }: Props): Promise<ReactElement> {
   const { locale, slug, action } = await params;
-  const title = await titleFor(slug, action, locale);
-  if (title === null) notFound();
+  const posting = await postingFor(slug, action, locale);
+  if (posting === null) notFound();
+  const { title } = posting;
 
-  const [accepting, t, tCareers, tFlow, magnet] = await Promise.all([
+  const [accepting, t, tCareers, tFlow, { view, applicationFlow }] = await Promise.all([
     readAccepting(),
     getTranslations({ locale, namespace: "contact" }),
     getTranslations({ locale, namespace: "careers" }),
     getTranslations({ locale, namespace: "flow" }),
-    readJobApplicationMagnet(),
+    applicationForm(slug, posting, locale),
   ]);
   const text = contactFormText(t);
   const contactEmail = readSiteContactEmail();
-  const view =
-    (magnet ? jobApplicationFormFromConfig(magnet, locale) : null) ??
-    jobApplicationFormFallback(locale);
 
   return (
     <main id="main" data-testid="job-apply">
@@ -155,7 +206,11 @@ export default async function Page({ params }: Props): Promise<ReactElement> {
           </Heading>
           {accepting ? (
             <LeadCaptureForm
-              action={captureLeadAction.bind(null, slug)}
+              action={
+                applicationFlow === undefined
+                  ? captureLeadAction.bind(null, slug)
+                  : captureLeadAction.bind(null, { job: slug, flow: applicationFlow })
+              }
               text={
                 view.consentStatement
                   ? { ...text, consentStatement: view.consentStatement }

package/templates/apps/web/app/[locale]/careers/[slug]/apply.actions.ts

@@ -25,13 +25,19 @@
  * the API so (`consent: true`, #9130): the hub requires it of a
  * `flow:job-application` lead and records `payload.consent` itself.
  *
+ * #10054 D6 — a posting that names its own magnet binds `{ job, flow }`
+ * instead: the flow, slug-checked, is written as `payload.applicationFlow`
+ * beside `job`, and no form field overrides it. The source stays
+ * `flow:job-application`, so the hub still records consent.
+ *
  * Checks, before any write: the honeypot (a filled one answers success and
  * sends nothing); first name, last name and email required; a LinkedIn URL,
  * when given, an http(s) URL — a bare domain gains `https://`, the flow
  * engine's `url` idiom; the terms box ticked, as the form block requires; and
  * the per-visitor limit /contact runs, in /contact's own bucket so a visitor's
- * lead posts stay at 30 per 10 minutes however they are split (skipped when
- * no client address is readable). Outcomes map as /contact's do: the API's
+ * lead posts stay at 30 per 10 minutes however they are split (with no
+ * readable client address, /contact's shared, wider bucket — never skipped,
+ * #9967). Outcomes map as /contact's do: the API's
  * `lead_capture_not_configured` or an unreachable API is `unavailable`, any
  * other refusal the generic error.
  */
@@ -44,6 +50,7 @@ import {
 import {
   accountEmailHintSchema,
   flowLeadSource,
+  flowSlugSchema,
   JOB_APPLICATION_FLOW_SLUG,
   leadSubmitNextSchema,
 } from "@working-theory/validation";
@@ -52,15 +59,13 @@ import { getLocale, getTranslations } from "next-intl/server";
 import { z } from "zod";
 
 import { accountInviteHref } from "../../../../lib/account-invite";
+import { runBotCheck } from "../../../../lib/bot-check";
 import {
   consentVisitorHeader,
   readConsentVisitor,
 } from "../../../../lib/consent-visitor";
 import { writeLead } from "../../../../src/lib/lead-write";
-import {
-  checkRateLimit,
-  clientIpFromHeaders,
-} from "../../../../src/lib/rate-limit";
+import { takeVisitorLimit } from "../../../../src/lib/rate-limit";
 
 const GENERIC_ERROR = "Something went wrong, please try again.";
 const RATE_LIMITED =
@@ -69,6 +74,8 @@ const CONSENT_REQUIRED = "Please accept the terms to send your application.";
 
 const RATE_LIMIT_MAX_CALLS = 30;
 const RATE_LIMIT_WINDOW_MS = 10 * 60 * 1000;
+/** Outside a request scope there is no address: the shared bucket. */
+const NO_HEADERS = { get: () => null };
 
 const SOURCE = flowLeadSource(JOB_APPLICATION_FLOW_SLUG);
 const JOB_SLUG_RE = /^[a-z0-9][a-z0-9-]{0,127}$/;
@@ -84,6 +91,7 @@ const RESERVED_FIELDS = new Set([
   "consent",
   "name",
   "job",
+  "applicationFlow",
   "source",
   LEAD_CAPTURE_HONEYPOT,
 ]);
@@ -191,8 +199,22 @@ async function successState(
   }
 }
 
+/**
+ * The bound posting: today's string `job`, or `{ job, flow }` (D6). `null`
+ * for anything else — a bound argument comes back from the browser, so its
+ * type is checked, not only its text.
+ */
+function readPosting(posting: unknown): { job: string; applicationFlow?: string } | null {
+  if (typeof posting === "string") return JOB_SLUG_RE.test(posting) ? { job: posting } : null;
+  if (typeof posting !== "object" || posting === null) return null;
+  const { job, flow } = posting as { job?: unknown; flow?: unknown };
+  if (typeof job !== "string" || !JOB_SLUG_RE.test(job)) return null;
+  if (!flowSlugSchema.safeParse(flow).success) return null;
+  return { job, applicationFlow: flow as string };
+}
+
 export async function captureLeadAction(
-  job: string,
+  posting: string | { job: string; flow: string },
   _prevState: LeadCaptureFormState,
   formData: FormData,
 ): Promise<LeadCaptureFormState> {
@@ -200,10 +222,11 @@ export async function captureLeadAction(
   if (typeof honeypot === "string" && honeypot !== "")
     return { kind: "success" };
 
-  // A bound argument comes back from the browser: check its type, not only its text.
-  if (typeof job !== "string" || !JOB_SLUG_RE.test(job)) {
+  const attribution = readPosting(posting);
+  if (attribution === null) {
     return { kind: "error", message: GENERIC_ERROR };
   }
+  const { job, applicationFlow } = attribution;
 
   const fieldErrors: Record<string, string> = {};
   if (formData.get("consent") !== "true")
@@ -238,6 +261,7 @@ export async function captureLeadAction(
     ...(phone !== undefined && { phone }),
     ...(linkedin_url !== undefined && { linkedin_url }),
     job,
+    ...(applicationFlow !== undefined && { applicationFlow }),
   };
 
   let requestHeaders: Awaited<ReturnType<typeof headers>> | undefined;
@@ -247,16 +271,13 @@ export async function captureLeadAction(
     // No request scope — no forwarding, and the visitor is "unknown".
   }
 
-  const visitor = requestHeaders
-    ? clientIpFromHeaders(requestHeaders)
-    : "unknown";
   if (
-    visitor !== "unknown" &&
-    !checkRateLimit(
-      `contact:${visitor}`,
+    !takeVisitorLimit(
+      "contact",
+      requestHeaders ?? NO_HEADERS,
       RATE_LIMIT_MAX_CALLS,
       RATE_LIMIT_WINDOW_MS,
-    )
+    ).allowed
   ) {
     return { kind: "error", message: RATE_LIMITED };
   }
@@ -282,6 +303,15 @@ export async function captureLeadAction(
     // No request scope — submit with no visitor-link header.
   }
 
+  // #9255 D4 — the spoke edge's bot check, immediately before the write.
+  const botCheck = await runBotCheck({
+    source: "bot-check",
+    target: "captureLeadAction",
+    scope: "write",
+  });
+  if (botCheck === "bot") return { kind: "error", message: GENERIC_ERROR };
+  if (botCheck === "unavailable") return { kind: "unavailable" };
+
   const res = await writeLead(
     { source: SOURCE, email, page: "careers", consent: true, payload },
     init,

package/templates/apps/web/app/[locale]/careers/[slug]/page.tsx

@@ -1,5 +1,5 @@
 // JobPosting detail page. Reads the JobPosting MDX for the given slug, renders via
-// next-mdx-remote/rsc, and emits a JSON-LD <script>. Unknown slugs 404 through renderPage.
+// @working-theory/page-renderer, and emits a JSON-LD <script>. Unknown slugs 404 through renderPage.
 // Careers list at /careers links here; each job posting lives at /careers/<slug>.
 //
 // Under the posting, inside <main>, an Apply button (#8849 D8) opens
@@ -9,7 +9,11 @@
 // form this page used to draw under `#apply`. The posting's JSON-LD
 // ApplyAction targets the same URL (#8849 D3). The page makes no hub read.
 import type { getMdxSource as defaultGetMdxSource } from "@working-theory/page-renderer";
-import { renderPage, renderPageMetadata } from "@working-theory/page-renderer";
+import {
+  getMdxSource as loadMdxSource,
+  renderPage,
+  renderPageMetadata,
+} from "@working-theory/page-renderer";
 import { Button, Container, Link, localeHref } from "@working-theory/ui";
 import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
@@ -32,12 +36,25 @@ export default async function Page({
   getMdxSource,
 }: Props): Promise<ReactElement> {
   const { locale, slug } = await params;
+  // A page that composes `sections[]` renders them (JSON-LD is built from
+  // the same sections); a prose page renders its MDX body — the rule
+  // /vs/[slug] applies (#10122).
+  const source = await (getMdxSource ?? loadMdxSource)(
+    "JobPosting",
+    slug,
+    locale,
+  );
+  const composed =
+    source !== null &&
+    Array.isArray((source.frontmatter as { sections?: unknown[] }).sections) &&
+    ((source.frontmatter as { sections?: unknown[] }).sections?.length ?? 0) >
+      0;
   const t = await getTranslations({ locale, namespace: "careers" });
   return renderPage({
     type: "JobPosting",
     slug,
     locale,
-    bodyMode: "mdx-body",
+    ...(composed ? {} : { bodyMode: "mdx-body" as const }),
     trailing: (
       <Container className="pb-section">
         <Button asChild size="big">