create-ailk 0.5.0 → 0.6.0

package/templates/apps/web/lib/__tests__/auth-email.test.ts

@@ -0,0 +1,214 @@
+/**
+ * @file auth-email.test.ts — Better Auth's three mail callbacks (#5962 § D3).
+ *
+ * Written before the implementation. The transport is INJECTED, so nothing
+ * here mocks an internal module and nothing here sends mail.
+ *
+ * What the suite pins, in the order the design depends on it:
+ *   - ONE serialization: the bytes that are signed are the bytes that are
+ *     sent. A key-order or whitespace drift between signer and sender is the
+ *     whole failure mode the raw-string seam exists to make impossible.
+ *   - the signature is HMAC-SHA256 over `<timestamp>.<body>`, so the
+ *     timestamp cannot be swapped independently of the body it authenticates.
+ *   - the credential-account check (§ D14): a user with no `credential`
+ *     account gets NO reset mail, and the suppression is silent — same return,
+ *     no throw, log-only. An OAuth-only user who completes a reset would
+ *     otherwise silently gain a password path around their IdP.
+ *   - the § D12 PII boundary on every log line: a userId, a kind, a reason and
+ *     an error KIND. Never the address, never the token, never the link.
+ *   - nothing throws. A failed notification must never fail the password
+ *     change it reports.
+ */
+
+import type { AuthEmailLog } from "../auth-email";
+import {
+  buildAuthEmailRequest,
+  makeSendResetPassword,
+  makeSendVerificationEmail,
+  makeSendPasswordChangedNotice,
+} from "../auth-email";
+
+const ORIGINAL_ENV = process.env;
+
+type LogLine = { level: string; fields: Record<string, unknown> };
+
+function makeLog(): { lines: LogLine[]; log: AuthEmailLog } {
+  const lines: LogLine[] = [];
+  const record =
+    (level: string) =>
+    (fields: Record<string, unknown>): void => {
+      lines.push({ level, fields });
+    };
+  return { lines, log: { warn: record("warn"), info: record("info") } };
+}
+
+/** A prisma double exposing only what these callbacks touch. */
+function makePrisma(hasCredential: boolean) {
+  return {
+    account: {
+      findFirst: jest.fn().mockResolvedValue(
+        hasCredential ? { id: "acct_1" } : null,
+      ),
+    },
+    verification: { deleteMany: jest.fn().mockResolvedValue({ count: 2 }) },
+  };
+}
+
+beforeEach(() => {
+  process.env = { ...ORIGINAL_ENV };
+  process.env.AUTH_EMAIL_WEBHOOK_SECRET = "webhook-secret";
+  process.env.AUTH_EMAIL_FROM = "noreply@site.example";
+  process.env.BETTER_AUTH_URL = "https://site.example";
+});
+
+afterAll(() => {
+  process.env = ORIGINAL_ENV;
+});
+
+describe("buildAuthEmailRequest()", () => {
+  it("signs the EXACT string it returns as the body", () => {
+    const req = buildAuthEmailRequest(
+      { kind: "password-reset", userId: "user_1", to: "a@b.test", url: "https://site.example/r" },
+      "webhook-secret",
+    );
+
+    const { createHmac } = require("node:crypto") as typeof import("node:crypto");
+    const timestamp = req.headers["x-ailk-auth-email-timestamp"];
+    const expected = `sha256=${createHmac("sha256", "webhook-secret")
+      .update(`${timestamp}.${req.rawBody}`, "utf8")
+      .digest("hex")}`;
+
+    expect(req.headers["x-ailk-auth-email-signature"]).toBe(expected);
+    // And the body really is a single string, not an object re-serialized later.
+    expect(typeof req.rawBody).toBe("string");
+    expect(JSON.parse(req.rawBody)).toMatchObject({
+      kind: "password-reset",
+      userId: "user_1",
+      to: "a@b.test",
+    });
+  });
+
+  it("puts a current unix-seconds timestamp inside the signed material", () => {
+    const req = buildAuthEmailRequest(
+      { kind: "password-changed", userId: "user_1", to: "a@b.test" },
+      "webhook-secret",
+    );
+    const ts = Number(req.headers["x-ailk-auth-email-timestamp"]);
+    expect(Math.abs(Math.floor(Date.now() / 1000) - ts)).toBeLessThan(5);
+  });
+});
+
+describe("sendResetPassword (§ D14 — the credential-account check)", () => {
+  it("sends for a user who HAS a credential account", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { lines, log } = makeLog();
+    const prisma = makePrisma(true);
+
+    const cb = makeSendResetPassword({ prisma, send, log });
+    await cb({ user: { id: "user_1", email: "person@example.com" }, url: "https://site.example/api/auth/reset-password/tok" });
+
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(lines.some((l) => l.fields.reason === "sent")).toBe(true);
+  });
+
+  it("sends NOTHING for a user with no credential account, and does not throw", async () => {
+    const send = jest.fn();
+    const { lines, log } = makeLog();
+    const prisma = makePrisma(false);
+
+    const cb = makeSendResetPassword({ prisma, send, log });
+    await expect(
+      cb({ user: { id: "user_1", email: "person@example.com" }, url: "https://site.example/x" }),
+    ).resolves.toBeUndefined();
+
+    expect(send).not.toHaveBeenCalled();
+    expect(lines.some((l) => l.fields.reason === "no_credential_account")).toBe(
+      true,
+    );
+  });
+
+  it("never throws when the transport fails", async () => {
+    const send = jest.fn().mockRejectedValue(new Error("network"));
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+
+    await expect(
+      cb({ user: { id: "user_1", email: "p@e.test" }, url: "https://site.example/x" }),
+    ).resolves.toBeUndefined();
+    expect(lines.some((l) => l.fields.reason === "send_failed")).toBe(true);
+  });
+
+  it("logs nothing when the relay secret is absent — it does not send blind", async () => {
+    delete process.env.AUTH_EMAIL_WEBHOOK_SECRET;
+    const send = jest.fn();
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+
+    await cb({ user: { id: "user_1", email: "p@e.test" }, url: "https://site.example/x" });
+    expect(send).not.toHaveBeenCalled();
+    expect(lines.some((l) => l.fields.reason === "not_configured")).toBe(true);
+  });
+});
+
+describe("the § D12 PII boundary", () => {
+  it("never logs the address, the token or the assembled link", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { lines, log } = makeLog();
+    const url =
+      "https://site.example/api/auth/reset-password/SECRETTOKEN?callbackURL=%2Freset-password";
+
+    const reset = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+    await reset({ user: { id: "user_1", email: "person@example.com" }, url });
+
+    const verify = makeSendVerificationEmail({ send, log });
+    await verify({ user: { id: "user_1", email: "person@example.com" }, url });
+
+    const notice = makeSendPasswordChangedNotice({ send, log });
+    await notice({ id: "user_1", email: "person@example.com" });
+
+    const serialized = JSON.stringify(lines);
+    expect(serialized).not.toContain("person@example.com");
+    expect(serialized).not.toContain("SECRETTOKEN");
+    expect(serialized).not.toContain("site.example");
+    // What it DOES carry.
+    expect(serialized).toContain("user_1");
+    expect(serialized).toContain("password-reset");
+  });
+
+  it("carries only the tagged error KIND, never a message that can quote an address", async () => {
+    const send = jest.fn().mockResolvedValue({
+      ok: false,
+      status: 400,
+      body: { error: "validation_failed for person@example.com" },
+    });
+    const { lines, log } = makeLog();
+    const cb = makeSendResetPassword({ prisma: makePrisma(true), send, log });
+
+    await cb({ user: { id: "user_1", email: "person@example.com" }, url: "https://site.example/x" });
+    expect(JSON.stringify(lines)).not.toContain("person@example.com");
+  });
+});
+
+describe("makeSendPasswordChangedNotice (§ D17)", () => {
+  it("sends a password-changed body carrying no url", async () => {
+    const send = jest.fn().mockResolvedValue({ ok: true, body: { ok: true } });
+    const { log } = makeLog();
+    const notice = makeSendPasswordChangedNotice({ send, log });
+
+    await notice({ id: "user_1", email: "person@example.com" });
+
+    const [rawBody] = send.mock.calls[0];
+    const parsed = JSON.parse(rawBody);
+    expect(parsed.kind).toBe("password-changed");
+    expect(parsed).not.toHaveProperty("url");
+  });
+
+  it("never throws — a failed notice must not fail the password change", async () => {
+    const send = jest.fn().mockRejectedValue(new Error("down"));
+    const { log } = makeLog();
+    const notice = makeSendPasswordChangedNotice({ send, log });
+    await expect(
+      notice({ id: "user_1", email: "person@example.com" }),
+    ).resolves.toBeUndefined();
+  });
+});

package/templates/apps/web/lib/__tests__/auth-routes.test.ts

@@ -0,0 +1,74 @@
+/**
+ * Tests for the auth-route predicate (#5963).
+ *
+ * `isAuthPath()` is the ONE list the locale layout branches on and the five
+ * `(auth)` page segments are named from, so the layout and the routes cannot
+ * drift. Covers bare paths, locale-prefixed paths, near misses, nested paths,
+ * and the absent-header fail-safe.
+ */
+
+import { AUTH_SEGMENTS, isAuthPath } from "../auth-routes";
+
+const LOCALES = ["en", "fr", "de"];
+
+describe("AUTH_SEGMENTS", () => {
+  it("names exactly the five auth routes", () => {
+    expect([...AUTH_SEGMENTS]).toEqual([
+      "sign-in",
+      "sign-up",
+      "forgot-password",
+      "reset-password",
+      "verify-email",
+    ]);
+  });
+});
+
+describe("isAuthPath", () => {
+  it.each(AUTH_SEGMENTS)("matches the bare /%s path", (segment) => {
+    expect(isAuthPath(`/${segment}`, LOCALES)).toBe(true);
+  });
+
+  it.each(AUTH_SEGMENTS)("matches the locale-prefixed /fr/%s path", (segment) => {
+    expect(isAuthPath(`/fr/${segment}`, LOCALES)).toBe(true);
+  });
+
+  it("matches a trailing-slash auth path", () => {
+    expect(isAuthPath("/sign-in/", LOCALES)).toBe(true);
+  });
+
+  it("matches an auth path carrying a query string", () => {
+    expect(isAuthPath("/sign-in?next=/account", LOCALES)).toBe(true);
+  });
+
+  it("matches a nested path under an auth segment", () => {
+    expect(isAuthPath("/reset-password/confirm", LOCALES)).toBe(true);
+  });
+
+  it("does not match a near miss", () => {
+    expect(isAuthPath("/sign-in-x", LOCALES)).toBe(false);
+    expect(isAuthPath("/sign", LOCALES)).toBe(false);
+  });
+
+  it("does not match a marketing path", () => {
+    expect(isAuthPath("/pricing", LOCALES)).toBe(false);
+    expect(isAuthPath("/fr/pricing", LOCALES)).toBe(false);
+  });
+
+  it("does not match the locale root or the site root", () => {
+    expect(isAuthPath("/", LOCALES)).toBe(false);
+    expect(isAuthPath("/fr", LOCALES)).toBe(false);
+  });
+
+  it("does not strip a prefix that is not an enabled locale", () => {
+    // `/es` is not enabled here, so `es` is the first segment, not a prefix.
+    expect(isAuthPath("/es/sign-in", LOCALES)).toBe(false);
+  });
+
+  it("fails to NOT-an-auth-path for an empty or absent pathname", () => {
+    // The fail-safe direction (§ D1): an absent `x-pathname` must never strip
+    // a marketing page's chrome. The worst case is an auth page WITH chrome,
+    // which the (auth) group's own tests catch.
+    expect(isAuthPath("", LOCALES)).toBe(false);
+    expect(isAuthPath(undefined, LOCALES)).toBe(false);
+  });
+});

package/templates/apps/web/lib/__tests__/meeting-slugs.test.ts

@@ -0,0 +1,72 @@
+// oss: false
+/**
+ * Tests for enabledMeetingSlugs (#6183 S9b D5) — the D4-resolving read both
+ * /meet pages share.
+ */
+const mockMeetingTypes = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  schedule: { meetingTypes: (...args: unknown[]) => mockMeetingTypes(...args) },
+}));
+
+import { enabledMeetingSlugs } from "../meeting-slugs";
+
+describe("enabledMeetingSlugs", () => {
+  const originalEnv = process.env["SCHEDULING_CAL_LINK"];
+
+  beforeEach(() => {
+    mockMeetingTypes.mockReset();
+  });
+
+  afterEach(() => {
+    if (originalEnv === undefined) delete process.env["SCHEDULING_CAL_LINK"];
+    else process.env["SCHEDULING_CAL_LINK"] = originalEnv;
+  });
+
+  it("passes a real, populated array through unchanged", async () => {
+    mockMeetingTypes.mockResolvedValue({
+      ok: true,
+      body: { slugs: ["intro", "demo"] },
+    });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual(["intro", "demo"]);
+  });
+
+  it("passes a real, intentionally empty array through unchanged (D4 row 2 — never the fallback)", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: [] } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+
+  it("null + SCHEDULING_CAL_LINK set → the derived singleton (D4 row 1)", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual(["intro-call"]);
+  });
+
+  it("null + SCHEDULING_CAL_LINK unset → [] (no shipped page to protect)", async () => {
+    delete process.env["SCHEDULING_CAL_LINK"];
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+
+  it("a non-ok API result → [], fail closed — an outage must not open the gate", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: false, status: 500, body: null });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+
+  it("null + a MALFORMED SCHEDULING_CAL_LINK slug → [], never a corrupt fallback (D14 parity, security review 2026-09-19)", async () => {
+    // A comma in the derived slug would corrupt the batched event-meta
+    // `calLinks` join downstream (it splits on comma), misattributing the
+    // rest of the list to a foreign owner — MeetingSlugSchema rejects it.
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro,evil";
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+});

package/templates/apps/web/lib/__tests__/structured-data.test.tsx

@@ -311,7 +311,24 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
     subtree: true,
   },
   { route: "meet", reason: "booking surface, API-backed", subtree: true },
-  { route: "sign-in", reason: "auth surface, not a content page" },
+  // #6084 — both purchase return pages read a Checkout Session (or read
+  // nothing, for cancel) and render via SectionRenderer directly; neither
+  // is a content-adapter page, and the paid render's own schema.org node
+  // (`PaymentComplete`, D6) is asserted directly, not through this walk.
+  {
+    route: "purchase",
+    reason: "checkout return pages, API-backed / read-nothing",
+    subtree: true,
+  },
+  // The whole (auth) route group (#5963). The walk keys on the DIRECTORY
+  // path, and a route group's parens are part of it, so this one subtree
+  // entry covers all five auth pages — including /sign-in, whose own entry it
+  // replaces now that the page sits inside the group.
+  {
+    route: "(auth)",
+    reason: "auth surfaces, not content pages",
+    subtree: true,
+  },
 ];
 
 interface RouteEntry {