create-ailk 0.27.0 → 0.28.0

package/templates/apps/web/lib/__tests__/hub-children.fixtures.ts

@@ -0,0 +1,278 @@
+/**
+ * Shared cases for the hub child-card tests (#10121).
+ *
+ * Each hub's test lives beside its route
+ * (`app/[locale]/<hub>/__tests__/hub-children.test.tsx`) so a scaffold that
+ * drops a gated hub drops its test with it (#10157). This module imports no
+ * route, so it ships to every scaffold and type-checks without any hub.
+ *
+ * `renderPage`/`renderPageMetadata` are mocked at the
+ * `@working-theory/page-renderer` boundary in each test file, the /templates
+ * test shape: each assertion inspects the sections a hub hands `renderPage`.
+ * The JSON-LD is built from those same sections with the real `buildJsonLd`,
+ * as `renderPage` does, so the cards and the ItemList are compared on one
+ * input per hub.
+ */
+import { buildJsonLd } from "@working-theory/schema";
+import type { ReactElement } from "react";
+
+export type Section = {
+  type: string;
+  id?: string;
+  data?: Record<string, unknown>;
+};
+export type Loaders = {
+  getMdxSource: jest.Mock;
+  getPageSections: jest.Mock;
+  getMdxSlugs: jest.Mock;
+};
+export type HubPage = (
+  props: {
+    params: Promise<{ locale: string }>;
+  } & Loaders,
+) => Promise<ReactElement>;
+export type RenderPageMock = jest.Mock<Promise<string>, unknown[]>;
+
+/** [route, page, list type, child type, body rule] — one row per hub. */
+export type HubRow = [
+  string,
+  HubPage,
+  string,
+  string,
+  "sections" | "mdx-body" | "composed",
+];
+
+export const HERO: Section = {
+  type: "hero",
+  id: "hero",
+  data: { headline: "Hub" },
+};
+export const CLOSING: Section = {
+  type: "cta",
+  id: "closing",
+  data: { headline: "Go" },
+};
+
+/** Loaders for one hub: its seed, its declared sections, and its children. */
+export function loaders(
+  listType: string,
+  childType: string,
+  children: Record<string, { title?: string; description?: string } | null>,
+  declared: Section[],
+  hubSections = true,
+): Loaders {
+  return {
+    getMdxSource: jest.fn(async (type: string, slug: string) => {
+      if (type === listType) {
+        return {
+          frontmatter: {
+            type,
+            slug,
+            title: "Hub",
+            description: "The hub.",
+            ...(hubSections && { sections: declared }),
+          },
+          body: "",
+        };
+      }
+      if (type !== childType) return null;
+      const child = children[slug];
+      return child === null || child === undefined
+        ? null
+        : { frontmatter: { type, slug, ...child }, body: "" };
+    }),
+    getPageSections: jest.fn(async () => declared),
+    getMdxSlugs: jest.fn(async (type: string) =>
+      type === childType ? Object.keys(children) : [],
+    ),
+  };
+}
+
+/** Renders a hub and returns the one input it handed `renderPage`. */
+export async function renderInput(
+  mockRenderPage: RenderPageMock,
+  page: HubPage,
+  l: Loaders,
+) {
+  mockRenderPage.mockClear();
+  await page({ params: Promise.resolve({ locale: "en" }), ...l });
+  expect(mockRenderPage).toHaveBeenCalledTimes(1);
+  return mockRenderPage.mock.calls[0]?.[0] as {
+    type: string;
+    slug: string;
+    bodyMode?: string;
+    trailing?: { props: { sections: Section[] } };
+    getPageSections: (fm: unknown) => Promise<Section[]>;
+  };
+}
+
+export const titlesOf = (section: unknown) =>
+  (section as { data: { items: { title: string }[] } } | null)?.data.items.map(
+    (i) => i.title,
+  );
+
+/** The five cases every hub meets, registered as one `describe` per hub. */
+export function describeHub(
+  [route, page, listType, childType, body]: HubRow,
+  mockRenderPage: RenderPageMock,
+): void {
+  describe(`/${route} hub`, () => {
+    // Out of slug order on purpose, plus one slug that does not load.
+    const children = {
+      zeta: { title: "Zeta", description: "Zeta page." },
+      alpha: { title: "Alpha", description: "Alpha page." },
+      gone: null,
+      beta: { title: "Beta" },
+    };
+
+    it("generates one card per child page, sorted by slug, before the closing CTA", async () => {
+      const input = await renderInput(
+        mockRenderPage,
+        page,
+        loaders(listType, childType, children, [HERO, CLOSING]),
+      );
+      expect(input.type).toBe(listType);
+      expect(input.slug).toBe(route);
+
+      const sections = await input.getPageSections({});
+      expect(sections.map((s) => s.type)).toEqual(["hero", "items", "cta"]);
+      const items = (sections[1]?.data as { items: unknown[] }).items;
+      expect(items).toEqual([
+        expect.objectContaining({
+          title: "Alpha",
+          description: "Alpha page.",
+          link: expect.objectContaining({ href: `/${route}/alpha` }),
+        }),
+        expect.objectContaining({
+          title: "Beta",
+          description: "",
+          link: expect.objectContaining({ href: `/${route}/beta` }),
+        }),
+        expect.objectContaining({
+          title: "Zeta",
+          link: expect.objectContaining({ href: `/${route}/zeta` }),
+        }),
+      ]);
+    });
+
+    it("lists the same pages in the CollectionPage ItemList as in the cards", async () => {
+      const input = await renderInput(
+        mockRenderPage,
+        page,
+        loaders(listType, childType, children, [HERO, CLOSING]),
+      );
+      const sections = await input.getPageSections({});
+      const jsonLd = buildJsonLd({
+        type: listType,
+        slug: route,
+        title: "Hub",
+        description: "The hub.",
+        locale: "en",
+        sections,
+      } as never) as unknown as {
+        mainEntity: { itemListElement: { name?: string }[] };
+      };
+      expect(jsonLd.mainEntity.itemListElement.map((e) => e.name)).toEqual([
+        "Alpha",
+        "Beta",
+        "Zeta",
+      ]);
+    });
+
+    it("gives an already-linked child no second card", async () => {
+      const authored: Section = {
+        type: "items",
+        id: "authored",
+        data: {
+          items: [
+            {
+              title: "Alpha (hand-written)",
+              link: { label: "Read", href: `/en/${route}/alpha/` },
+            },
+            {
+              title: "Zeta (hand-written)",
+              link: {
+                label: "Read",
+                href: `https://example.com/${route}/zeta?x=1`,
+              },
+            },
+          ],
+        },
+      };
+      const input = await renderInput(
+        mockRenderPage,
+        page,
+        loaders(listType, childType, children, [HERO, authored, CLOSING]),
+      );
+      const sections = await input.getPageSections({});
+      const titles = (s: Section | undefined) =>
+        (s?.data as { items: { title: string }[] }).items.map((i) => i.title);
+      if (body === "mdx-body") {
+        // A prose hub never renders its declared sections, so links there do
+        // not count: every child gets a visible card after the body.
+        expect(sections.map((s) => s.type)).toEqual([
+          "hero",
+          "items",
+          "items",
+          "cta",
+        ]);
+        expect(titles(sections[2])).toEqual(["Alpha", "Beta", "Zeta"]);
+      } else {
+        // The missing child continues the authored grid: one list, no duplicate.
+        expect(sections.map((s) => s.id)).toEqual([
+          "hero",
+          "authored",
+          "closing",
+        ]);
+        expect(titles(sections[1])).toEqual([
+          "Alpha (hand-written)",
+          "Zeta (hand-written)",
+          "Beta",
+        ]);
+      }
+    });
+
+    it("renders its authored sections unchanged with zero child pages", async () => {
+      const input = await renderInput(
+        mockRenderPage,
+        page,
+        loaders(listType, childType, {}, [HERO, CLOSING]),
+      );
+      expect(await input.getPageSections({})).toEqual([HERO, CLOSING]);
+      expect(input.trailing).toBeUndefined();
+    });
+
+    it("keeps the hub's body rule, rendering the cards after a prose body", async () => {
+      const prose = await renderInput(
+        mockRenderPage,
+        page,
+        loaders(listType, childType, children, [], false),
+      );
+      if (body === "sections") {
+        expect(prose.bodyMode).toBeUndefined();
+        expect(prose.trailing).toBeUndefined();
+      } else {
+        // A prose seed renders its MDX body, with the cards after it.
+        expect(prose.bodyMode).toBe("mdx-body");
+        expect(prose.trailing?.props.sections.map((s) => s.type)).toEqual([
+          "items",
+        ]);
+        expect(await prose.getPageSections({})).toEqual(
+          prose.trailing?.props.sections,
+        );
+      }
+
+      const composed = await renderInput(
+        mockRenderPage,
+        page,
+        loaders(listType, childType, children, [HERO, CLOSING]),
+      );
+      if (body === "mdx-body") {
+        expect(composed.bodyMode).toBe("mdx-body");
+      } else {
+        expect(composed.bodyMode).toBeUndefined();
+        expect(composed.trailing).toBeUndefined();
+      }
+    });
+  });
+}

package/templates/apps/web/lib/__tests__/nav-label-keys.test.ts

@@ -0,0 +1,138 @@
+/**
+ * @jest-environment node
+ */
+// #10045 — every nav/footer key resolves from the `nav` messages namespace by
+// key (D1), and a key missing from any locale's messages file fails the build
+// naming the key and the file (D2).
+import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  findMissingNavLabels,
+  formatMissingNavLabels,
+} from "../nav-label-check";
+import {
+  collectNavLabelKeys,
+  navMessageKeys,
+  usedNavLabelKeys,
+} from "../nav-label-keys";
+
+describe("collectNavLabelKeys", () => {
+  it("collects labelKey, headingKey and descKey at any depth", () => {
+    const keys = collectNavLabelKeys(
+      [
+        {
+          labelKey: "product",
+          path: "/p",
+          flyout: {
+            features: [
+              { labelKey: "featureA", descKey: "featureADesc", path: "/a" },
+            ],
+            groups: [
+              {
+                headingKey: "groupHeading",
+                items: [{ labelKey: "groupItem", path: "/g" }],
+              },
+            ],
+          },
+        },
+      ],
+      [
+        {
+          headingKey: "footerHeading",
+          items: [{ labelKey: "footerItem", path: "/f" }],
+        },
+      ],
+    );
+    expect([...keys].sort()).toEqual(
+      [
+        "featureA",
+        "featureADesc",
+        "footerHeading",
+        "footerItem",
+        "groupHeading",
+        "groupItem",
+        "product",
+      ].sort(),
+    );
+  });
+
+  it("ignores non-string key fields and other string properties", () => {
+    const keys = collectNavLabelKeys([
+      { labelKey: 3, path: "/x", title: "nope" },
+    ]);
+    expect([...keys]).toEqual([]);
+  });
+});
+
+describe("navMessageKeys", () => {
+  it("returns every string key of the nav namespace", () => {
+    expect(
+      navMessageKeys({ nav: { a: "A", b: "B", nested: { c: "C" } } }),
+    ).toEqual(["a", "b"]);
+  });
+
+  it("is empty when there is no nav namespace", () => {
+    expect(navMessageKeys({})).toEqual([]);
+    expect(navMessageKeys(undefined)).toEqual([]);
+  });
+});
+
+describe("findMissingNavLabels", () => {
+  function fixture(files: Record<string, unknown>): string {
+    const dir = mkdtempSync(join(tmpdir(), "nav-labels-"));
+    mkdirSync(join(dir, "site"));
+    for (const [name, body] of Object.entries(files)) {
+      writeFileSync(join(dir, name), JSON.stringify(body));
+    }
+    return dir;
+  }
+
+  it("reports nothing when every key is present", () => {
+    const dir = fixture({
+      "en.json": { nav: { home: "Home" } },
+      "site/en.json": {},
+    });
+    expect(findMissingNavLabels(dir, ["home"])).toEqual([]);
+  });
+
+  it("names the missing key and the messages file", () => {
+    const dir = fixture({
+      "en.json": { nav: { home: "Home", websiteRebuild: "Website rebuild" } },
+      "fr.json": { nav: { home: "Accueil" } },
+      "site/en.json": {},
+    });
+    const missing = findMissingNavLabels(dir, ["home", "websiteRebuild"]);
+    expect(missing).toEqual([
+      { key: "websiteRebuild", file: join(dir, "fr.json") },
+    ]);
+    const message = formatMissingNavLabels(missing);
+    expect(message).toContain('"websiteRebuild"');
+    expect(message).toContain(join(dir, "fr.json"));
+  });
+
+  it("accepts a key the site overlay adds (messages/site/<locale>.json)", () => {
+    const dir = fixture({
+      "en.json": { nav: { home: "Home" } },
+      "site/en.json": { nav: { aiGrowthPlatform: "AI growth platform" } },
+    });
+    expect(findMissingNavLabels(dir, ["aiGrowthPlatform"])).toEqual([]);
+  });
+
+  it("falls back to the English overlay for a locale with no overlay of its own", () => {
+    const dir = fixture({
+      "en.json": { nav: {} },
+      "fr.json": { nav: {} },
+      "site/en.json": { nav: { aiGrowthPlatform: "AI growth platform" } },
+    });
+    expect(findMissingNavLabels(dir, ["aiGrowthPlatform"])).toEqual([]);
+  });
+
+  it("every key nav-config.ts and the layout use exists in every shipped locale", () => {
+    const keys = usedNavLabelKeys();
+    expect(
+      findMissingNavLabels(join(__dirname, "..", "..", "messages"), keys),
+    ).toEqual([]);
+  });
+});

package/templates/apps/web/lib/__tests__/newsletter.actions.test.ts

@@ -10,6 +10,13 @@ import { subscribeNewsletterAction } from "../newsletter.actions.js";
 // `flows.get` answers 404 by default — a Free build with no flow route — so
 // the #6730 cases below take `leads.subscribe`; the #8847 cases serve the
 // newsletter magnet.
+// #9255 — the write bot check's verdict. `checkBotId` reads Vercel's
+// request context, which jest has none of, so every case decides it here.
+const checkBotIdMock = jest.fn();
+jest.mock("botid/server", () => ({
+  checkBotId: (...args: unknown[]) => checkBotIdMock(...args),
+}));
+
 jest.mock("@working-theory/api-client", () => ({
   flows: {
     get: jest.fn().mockResolvedValue({ ok: false, status: 404, body: {} }),
@@ -258,10 +265,25 @@ describe("subscribeNewsletterAction — through the newsletter magnet (#8847 D11
     expect(mockSubscribe).not.toHaveBeenCalled();
   });
 
+  // On Vercel, where the edge-set address is read (#9967 D1); the bot check
+  // has its own suite below.
+  const LIMIT_ENV_KEYS = ["VERCEL", "AILK_BOT_CHECK"] as const;
+  const priorLimitEnv = new Map(LIMIT_ENV_KEYS.map((name) => [name, process.env[name]]));
+  beforeEach(() => {
+    process.env.VERCEL = "1";
+    process.env.AILK_BOT_CHECK = "off";
+  });
+  afterEach(() => {
+    for (const [name, value] of priorLimitEnv) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  });
+
   it("forwards the visitor's address to the step route, and refuses a visitor's 31st post in ten minutes (security review)", async () => {
     servedMagnet();
     mockHeaders.mockResolvedValue({
-      get: (name: string) => (name === "x-forwarded-for" ? "203.0.113.9" : null),
+      get: (name: string) => (name === "x-vercel-forwarded-for" ? "198.51.100.7" : null),
     });
     mockSubmitStep.mockResolvedValue({
       ok: true,
@@ -273,7 +295,7 @@ describe("subscribeNewsletterAction — through the newsletter magnet (#8847 D11
       expect(await subscribeNewsletterAction(null, formWith(`a${i}@b.co`))).toEqual({ kind: "success" });
     }
     expect(mockSubmitStep.mock.calls[0]![2]).toEqual({
-      headers: expect.objectContaining({ "x-forwarded-for": "203.0.113.9" }),
+      headers: expect.objectContaining({ "x-forwarded-for": "198.51.100.7" }),
     });
 
     expect(await subscribeNewsletterAction(null, formWith("late@b.co"))).toMatchObject({
@@ -283,6 +305,46 @@ describe("subscribeNewsletterAction — through the newsletter magnet (#8847 D11
     expect(mockSubmitStep).toHaveBeenCalledTimes(30);
   });
 
+  it("off Vercel, never forwards a client-sent x-forwarded-for to the step route (#9967 D1)", async () => {
+    delete process.env.VERCEL;
+    servedMagnet();
+    mockHeaders.mockResolvedValue({
+      get: (name: string) => (name === "x-forwarded-for" ? "203.0.113.9" : null),
+    });
+    mockSubmitStep.mockResolvedValue({
+      ok: true,
+      status: 200,
+      body: { sessionId: "s1", nextStepKey: null, completed: true },
+    });
+
+    expect(await subscribeNewsletterAction(null, formWith("a@b.co"))).toEqual({ kind: "success" });
+    const stepInit = mockSubmitStep.mock.calls[0]![2] as { headers?: Record<string, string> } | undefined;
+    expect(stepInit?.headers?.["x-forwarded-for"]).toBeUndefined();
+  });
+
+  it("with no readable address, every post shares one bucket at ten times the limit, never skipped (#9967 D1)", async () => {
+    servedMagnet();
+    let n = 0;
+    mockHeaders.mockImplementation(async () => {
+      n += 1;
+      return { get: (name: string) => (name === "x-forwarded-for" ? `10.0.${n >> 8}.${n & 255}` : null) };
+    });
+    mockSubmitStep.mockResolvedValue({
+      ok: true,
+      status: 200,
+      body: { sessionId: "s1", nextStepKey: null, completed: true },
+    });
+
+    for (let i = 0; i < 300; i += 1) {
+      expect(await subscribeNewsletterAction(null, formWith(`a${i}@b.co`))).toEqual({ kind: "success" });
+    }
+    expect(await subscribeNewsletterAction(null, formWith("late@b.co"))).toMatchObject({
+      kind: "error",
+      message: expect.any(String),
+    });
+    expect(mockSubmitStep).toHaveBeenCalledTimes(300);
+  });
+
   it("with flows.get 404 (a Free build) the same post calls leads.subscribe and not submitStep", async () => {
     mockSubscribe.mockResolvedValueOnce({ ok: true, body: { id: "subscr_1", persisted: "db" } });
 
@@ -291,3 +353,117 @@ describe("subscribeNewsletterAction — through the newsletter magnet (#8847 D11
     expect(mockSubmitStep).not.toHaveBeenCalled();
   });
 });
+
+// #9255 D4 — the write bot check runs once per signup, on whichever write
+// path the signup takes: the magnet's `flows.submitStep` or the Free path's
+// `leads.subscribe` (spec docs/specs/9255-an-edge-bot-challenge-in-spec.md
+// §5.1 AC-2).
+describe("subscribeNewsletterAction — the write bot check (#9255)", () => {
+  const BOT = { isHuman: false, isBot: true, isVerifiedBot: false, bypassed: false };
+  const HUMAN = { ...BOT, isHuman: true, isBot: false };
+  const BOT_ENV_KEYS = ["VERCEL", "AILK_BOT_CHECK", "AILK_BOOKING_BOT_CHECK"] as const;
+  const priorBotEnv = new Map(BOT_ENV_KEYS.map((name) => [name, process.env[name]]));
+
+  let botLogSpies: jest.SpyInstance[] = [];
+
+  beforeEach(() => {
+    checkBotIdMock.mockReset();
+    for (const name of BOT_ENV_KEYS) delete process.env[name];
+    process.env.VERCEL = "1";
+    botLogSpies = [
+      jest.spyOn(console, "warn").mockImplementation(() => undefined),
+      jest.spyOn(console, "error").mockImplementation(() => undefined),
+    ];
+  });
+
+  afterEach(() => {
+    for (const [name, value] of priorBotEnv) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+    for (const spy of botLogSpies) spy.mockRestore();
+  });
+
+  function servedMagnet(): void {
+    const { completionEmail: _omitted, ...body } = newsletterFlowConfig;
+    mockFlowsGet.mockResolvedValue({ ok: true, status: 200, body });
+  }
+  afterEach(() => {
+    mockFlowsGet.mockResolvedValue({ ok: false, status: 404, body: {} });
+  });
+
+  const PATHS = [
+    {
+      path: "the magnet's flows.submitStep",
+      serve: servedMagnet,
+      write: () => mockSubmitStep,
+      answer: { ok: true, status: 200, body: { sessionId: "s1", nextStepKey: null, completed: true } },
+    },
+    {
+      path: "the Free path's leads.subscribe",
+      serve: () => undefined,
+      write: () => mockSubscribe,
+      answer: { ok: true, body: { id: "subscr_1", persisted: "db" } },
+    },
+  ];
+
+  it.each(PATHS)("$path: a bot gets the generic error, and nothing is sent", async ({ serve }) => {
+    serve();
+    checkBotIdMock.mockResolvedValue(BOT);
+    expect(await subscribeNewsletterAction(null, formWith("a@b.co"))).toStrictEqual({
+      kind: "error",
+      message: "Something went wrong, please try again.",
+    });
+    expect(checkBotIdMock).toHaveBeenCalledTimes(1);
+    expect(mockSubmitStep).not.toHaveBeenCalled();
+    expect(mockSubscribe).not.toHaveBeenCalled();
+  });
+
+  it.each(PATHS)("$path: a check that fails is unavailable, and nothing is sent", async ({ serve }) => {
+    serve();
+    checkBotIdMock.mockRejectedValue(new Error("boom"));
+    expect(await subscribeNewsletterAction(null, formWith("a@b.co"))).toStrictEqual({
+      kind: "unavailable",
+    });
+    expect(checkBotIdMock).toHaveBeenCalledTimes(1);
+    expect(mockSubmitStep).not.toHaveBeenCalled();
+    expect(mockSubscribe).not.toHaveBeenCalled();
+  });
+
+  it.each(PATHS)(
+    "$path: a human is checked once and sends exactly what the check off sends",
+    async ({ serve, write, answer }) => {
+      serve();
+      checkBotIdMock.mockResolvedValue(HUMAN);
+      write().mockResolvedValue(answer);
+      delete process.env.VERCEL;
+      await subscribeNewsletterAction(null, formWith("a@b.co"));
+      process.env.VERCEL = "1";
+      expect(await subscribeNewsletterAction(null, formWith("a@b.co"))).toEqual({ kind: "success" });
+      expect(checkBotIdMock).toHaveBeenCalledTimes(1);
+      expect(write()).toHaveBeenCalledTimes(2);
+      expect(write().mock.calls[1]).toEqual(write().mock.calls[0]);
+    },
+  );
+
+  it.each(PATHS)("$path: a filled honeypot answers success with no check", async ({ serve }) => {
+    serve();
+    checkBotIdMock.mockResolvedValue(BOT);
+    const fd = formWith("a@b.co");
+    fd.append("ailk_hp", "spam");
+    expect(await subscribeNewsletterAction(null, fd)).toEqual({ kind: "success" });
+    expect(checkBotIdMock).not.toHaveBeenCalled();
+  });
+
+  it.each(PATHS)("$path: a post without consent answers the consent error with no check", async ({ serve }) => {
+    serve();
+    checkBotIdMock.mockResolvedValue(BOT);
+    const fd = new FormData();
+    fd.append("email", "a@b.co");
+    expect(await subscribeNewsletterAction(null, fd)).toEqual({
+      kind: "error",
+      fieldErrors: { consent: "Please accept the terms to subscribe." },
+    });
+    expect(checkBotIdMock).not.toHaveBeenCalled();
+  });
+});