create-ailk 0.5.0 → 0.6.1

package/templates/apps/web/lib/auth-email.ts

@@ -0,0 +1,318 @@
+/**
+ * Better Auth's outbound-mail callbacks (#5962 § D3).
+ *
+ * WHY THIS FILE EXISTS AT ALL. `architecture.yaml`'s `apps/web` node denies
+ * `packages/email` in as many words ("email send is server-side only via
+ * apps/api"), and `tools/lint-architecture.ts` evaluates deny BEFORE allow, so
+ * an added allow entry would not clear it. These callbacks therefore serialize
+ * one body, sign it, and POST it to `apps/api`'s
+ * `/v1/auth/transactional-email` through the canonical client. `apps/web`
+ * sends no mail and imports no mail package.
+ *
+ * WHY IT IS NOT INLINE IN `auth.ts`. Three callbacks doing a credential-account
+ * lookup, a one-shot serialization, an HMAC and a bounded log line turn a
+ * declarative config file into a service module, and make themselves
+ * untestable without constructing a Better Auth instance. Each factory below
+ * takes its deps, so the suite next door exercises them with an injected
+ * transport and a prisma double.
+ *
+ * ONE SERIALIZATION. `buildAuthEmailRequest` builds the body string ONCE,
+ * signs THAT string, and hands the same string to the transport — the
+ * invariant `apps/api/src/services/revalidation.ts` states for itself ("a
+ * key-order or whitespace drift between signer and sender is impossible by
+ * construction"). This is why the call cannot go through the client's
+ * `post()`, which stringifies its own payload argument.
+ *
+ * PII BOUNDARY (§ D12). Every line carries `userId`, `kind`, `reason` and — on
+ * a failure — an error KIND. Never the recipient address, never the token,
+ * never the assembled link. The link IS the credential: one log line quoting
+ * it hands anyone with log access a live reset for an arbitrary account.
+ *
+ * NOTHING HERE THROWS. A reset send that fails must not fail the endpoint that
+ * already answered 200, and a failed § D17 notice must not fail the password
+ * change it reports.
+ */
+
+import { createHmac } from "node:crypto";
+
+import { authEmail } from "@working-theory/api-client";
+
+/** The three fixed kinds the relay will send. A caller picks no copy. */
+export type AuthEmailKind =
+  | "password-reset"
+  | "email-verification"
+  | "password-changed";
+
+export interface AuthEmailPayload {
+  kind: AuthEmailKind;
+  userId: string;
+  to: string;
+  url?: string;
+  expiresInMinutes?: number;
+}
+
+export interface AuthEmailRequest {
+  rawBody: string;
+  headers: Record<string, string>;
+}
+
+/** The transport seam — `authEmail.send`'s shape, injectable for tests. */
+export type AuthEmailTransport = (
+  rawBody: string,
+  headers: Record<string, string>,
+) => Promise<unknown>;
+
+/** The log seam — the two levels § D12's table uses. */
+export interface AuthEmailLog {
+  warn: (fields: Record<string, unknown>) => void;
+  info: (fields: Record<string, unknown>) => void;
+}
+
+/**
+ * The narrow slice of the Prisma client these callbacks touch.
+ *
+ * Declared with METHOD SHORTHAND rather than arrow properties, deliberately
+ * (code review). Under `strictFunctionTypes` a property-typed
+ * `(args: unknown) => …` is checked contravariantly, so the generated
+ * `PrismaClient` — whose delegates take their own narrow arg types — is not
+ * assignable to it, and every caller needs an `as unknown as` double
+ * assertion to get past that. Method shorthand is checked bivariantly, which
+ * is the correct reading here: this interface exists to NARROW the surface
+ * these callbacks may touch, not to accept a wider argument than Prisma does.
+ * The real client now satisfies it structurally and `auth.ts` passes it with
+ * no cast at all.
+ */
+export interface AuthEmailPrisma {
+  account: {
+    findFirst(args: unknown): Promise<{ id: string } | null>;
+  };
+  verification?: {
+    deleteMany(args: unknown): Promise<unknown>;
+  };
+}
+
+const defaultLog: AuthEmailLog = {
+  warn: (fields) => console.warn(`[auth-email] ${JSON.stringify(fields)}`),
+  info: (fields) => console.info(`[auth-email] ${JSON.stringify(fields)}`),
+};
+
+/**
+ * Builds the signed request for one message. The timestamp is inside the
+ * signed material, so it cannot be swapped independently of the body it
+ * authenticates — the replay window #5851's revalidate pair deliberately does
+ * without, closed here because a replayed EMAIL is not a no-op.
+ */
+export function buildAuthEmailRequest(
+  payload: AuthEmailPayload,
+  secret: string,
+): AuthEmailRequest {
+  // ONE serialization. This exact string is both signed and sent.
+  const rawBody = JSON.stringify({
+    kind: payload.kind,
+    userId: payload.userId,
+    to: payload.to,
+    ...(payload.url !== undefined ? { url: payload.url } : {}),
+    ...(payload.expiresInMinutes !== undefined
+      ? { expiresInMinutes: payload.expiresInMinutes }
+      : {}),
+  });
+  const timestamp = String(Math.floor(Date.now() / 1000));
+  const signature = `sha256=${createHmac("sha256", secret)
+    .update(`${timestamp}.${rawBody}`, "utf8")
+    .digest("hex")}`;
+
+  return {
+    rawBody,
+    headers: {
+      "x-ailk-auth-email-signature": signature,
+      "x-ailk-auth-email-timestamp": timestamp,
+    },
+  };
+}
+
+interface DispatchDeps {
+  send: AuthEmailTransport;
+  /** Defaults to a console logger bound to the § D12 field set. */
+  log?: AuthEmailLog;
+}
+
+/**
+ * Signs and posts one message, and swallows every failure into one log line.
+ * The relay answers 202 for an accepted send AND for one its per-recipient
+ * budget suppressed, so a caller here cannot tell the two apart — which is the
+ * point: an observable suppression is an account-enumeration oracle.
+ */
+async function dispatch(
+  payload: AuthEmailPayload,
+  { send, log }: { send: AuthEmailTransport; log: AuthEmailLog },
+): Promise<void> {
+  const secret = process.env.AUTH_EMAIL_WEBHOOK_SECRET;
+  const base = { userId: payload.userId, kind: payload.kind };
+
+  if (!secret) {
+    // Never sign with an empty key: the relay would reject every delivery and
+    // the deployment would have no local signal at all.
+    log.warn({ ...base, reason: "not_configured" });
+    return;
+  }
+
+  /**
+   * SIGNING IS GUARDED TOO (#6068). This file's header promises "NOTHING HERE
+   * THROWS", and `auth.ts`'s `onPasswordReset` relies on that promise in as
+   * many words — but the build-and-sign step used to sit OUTSIDE the try
+   * below, so anything `buildAuthEmailRequest` threw propagated straight out
+   * of a callback that runs AFTER the password has already changed and the
+   * presented token has already been consumed. #6061 made that callback
+   * unconditional, so it now runs in degraded configurations, which is exactly
+   * where a signer is least likely to be healthy.
+   *
+   * Its own `try` rather than a widened one, so the log line still names the
+   * STAGE that failed: a signer that cannot run is an operator's problem with
+   * this deployment, not the relay's, and `transport_error` would send whoever
+   * reads the line looking in the wrong place.
+   */
+  let request: AuthEmailRequest;
+  try {
+    request = buildAuthEmailRequest(payload, secret);
+  } catch {
+    // The KIND only — see this file's PII boundary note.
+    log.warn({ ...base, reason: "send_failed", errorKind: "signing_failed" });
+    return;
+  }
+
+  try {
+    const result = (await send(request.rawBody, request.headers)) as
+      | { ok: boolean; status?: number }
+      | undefined;
+    if (result && result.ok === false) {
+      // The STATUS, never the response body — the relay's own error text is
+      // not guaranteed free of the address it was given.
+      log.warn({ ...base, reason: "send_failed", errorKind: "relay_rejected" });
+      return;
+    }
+    log.info({ ...base, reason: "sent" });
+  } catch {
+    // The error's NAME would be safe; its message is not guaranteed to be.
+    log.warn({ ...base, reason: "send_failed", errorKind: "transport_error" });
+  }
+}
+
+export interface ResetPasswordDeps extends DispatchDeps {
+  prisma: AuthEmailPrisma;
+}
+
+/**
+ * Better Auth's `sendResetPassword` (§ D14).
+ *
+ * The credential-account check is the load-bearing part. `password.mjs`
+ * CREATES a `credential` account on reset if the user has none — so combined
+ * with § D2, which enables the password method on `AUTH_EMAIL_SERVER` +
+ * `AUTH_EMAIL_FROM`, an existing Google-or-GitHub-only user who completed a
+ * reset would silently gain a password path around their identity provider
+ * and whatever MFA it enforces. No credential account means no mail.
+ *
+ * The skip is SILENT — same 200, same body, log only. The visitor-facing
+ * answer must not distinguish "this address has no password" from "this
+ * address does not exist": the second is the enumeration AC-1 forbids and the
+ * first is nearly as useful to an attacker, since it maps a site's users to
+ * their identity provider.
+ */
+export function makeSendResetPassword(deps: ResetPasswordDeps) {
+  const { prisma, send } = deps;
+  const log = deps.log ?? defaultLog;
+  return async function sendResetPassword({
+    user,
+    url,
+  }: {
+    user: { id: string; email: string };
+    url: string;
+  }): Promise<void> {
+    let hasPassword: { id: string } | null;
+    try {
+      hasPassword = await prisma.account.findFirst({
+        where: { userId: user.id, providerId: "credential" },
+        select: { id: true },
+      });
+    } catch {
+      log.warn({
+        userId: user.id,
+        kind: "password-reset",
+        reason: "send_failed",
+        errorKind: "lookup_failed",
+      });
+      return;
+    }
+
+    if (!hasPassword) {
+      log.warn({
+        userId: user.id,
+        kind: "password-reset",
+        reason: "no_credential_account",
+      });
+      return; // no send; the endpoint's 200 body is unchanged
+    }
+
+    await dispatch(
+      {
+        kind: "password-reset",
+        userId: user.id,
+        to: user.email,
+        url,
+        expiresInMinutes: 60,
+      },
+      { send, log },
+    );
+  };
+}
+
+/** Better Auth's `sendVerificationEmail` (§ D9). */
+export function makeSendVerificationEmail(deps: DispatchDeps) {
+  const { send } = deps;
+  const log = deps.log ?? defaultLog;
+  return async function sendVerificationEmail({
+    user,
+    url,
+  }: {
+    user: { id: string; email: string };
+    url: string;
+  }): Promise<void> {
+    await dispatch(
+      {
+        kind: "email-verification",
+        userId: user.id,
+        to: user.email,
+        url,
+        expiresInMinutes: 24 * 60,
+      },
+      { send, log },
+    );
+  };
+}
+
+/**
+ * The completed-reset notice (§ D17).
+ *
+ * § D2 leaves `requireEmailVerification: false` and § D7 revokes every session
+ * on reset, so a takeover through a compromised mailbox is otherwise silent
+ * and total: the owner's sessions vanish and no message ever reaches them.
+ * This notice is the only signal the owner gets. It carries no link and no
+ * token — the payload has no `url` — so the message reporting a takeover
+ * cannot hand the attacker a second credential.
+ */
+export function makeSendPasswordChangedNotice(deps: DispatchDeps) {
+  const { send } = deps;
+  const log = deps.log ?? defaultLog;
+  return async function sendPasswordChangedNotice(user: {
+    id: string;
+    email: string;
+  }): Promise<void> {
+    await dispatch(
+      { kind: "password-changed", userId: user.id, to: user.email },
+      { send, log },
+    );
+  };
+}
+
+/** The production transport — the canonical client, never a bare fetch. */
+export const authEmailTransport: AuthEmailTransport = (rawBody, headers) =>
+  authEmail.send(rawBody, headers);

package/templates/apps/web/lib/auth-env.ts

@@ -3,6 +3,8 @@
  *
  * Single source of truth for:
  * - AILK_AUTH_REQUIRED flag (whether protected routes redirect unauthenticated users)
+ * - AILK_AUTH_SIGNUP_OPEN / AILK_AUTH_PASSWORD_RESET flags (#5963) — whether
+ *   the /sign-up and /forgot-password|/reset-password surfaces offer a flow
  * - Active provider list (which Better Auth providers are activated by env vars)
  *
  * No better-auth import — this module is safe to require in tests without the
@@ -24,6 +26,32 @@ export function isAuthRequired(): boolean {
   return val === "1" || val === "true";
 }
 
+/**
+ * Returns true when AILK_AUTH_SIGNUP_OPEN is set to "1" or "true" (#5963).
+ * Default (unset or "0"/"false") = sign-up is CLOSED, which is what a
+ * scaffold actually is: `apps/web/auth.ts` does not enable
+ * `emailAndPassword`, so there is no public sign-up flow to open. The
+ * `/sign-up` page renders the `invitation` intent while this is false.
+ *
+ * This is the seam #5962 flips once the server-side flow is real.
+ */
+export function isSignUpOpen(): boolean {
+  const val = process.env.AILK_AUTH_SIGNUP_OPEN;
+  return val === "1" || val === "true";
+}
+
+/**
+ * Returns true when AILK_AUTH_PASSWORD_RESET is set to "1" or "true" (#5963).
+ * Default (unset or "0"/"false") = password reset is NOT available — again
+ * the honest reading of a scaffold, where `emailAndPassword` is unconfigured.
+ * `/forgot-password` and `/reset-password` render their not-available state
+ * while this is false; #5962 lands the flow behind it.
+ */
+export function isResetAvailable(): boolean {
+  const val = process.env.AILK_AUTH_PASSWORD_RESET;
+  return val === "1" || val === "true";
+}
+
 /**
  * Returns the list of provider IDs whose required env vars are all present.
  * A provider is only included when every one of its required vars is non-empty.
@@ -64,3 +92,60 @@ export function getActiveProviderIds(): string[] {
 export function hasAnyProvider(): boolean {
   return getActiveProviderIds().length > 0;
 }
+
+/**
+ * True when this deployment can actually complete a password reset end to end,
+ * SAFELY (#5962 § D10). Five conjuncts, each of which independently makes the
+ * flow impossible or unsafe:
+ *
+ *   AILK_AUTH_PASSWORD_RESET   the operator's own opt-in (#5963 D5, read here
+ *                              through isResetAvailable()). Default off.
+ *   the password METHOD        `emailAndPassword` is enabled on exactly this
+ *                              predicate (#5962 D2); with only OAuth
+ *                              configured there is no password to reset.
+ *   a send SEAM                AUTH_EMAIL_WEBHOOK_SECRET + AUTH_EMAIL_FROM —
+ *                              without the secret the apps/api relay answers
+ *                              503 and a visitor would be told "check your
+ *                              email" for mail that will never be sent.
+ *   BETTER_AUTH_URL            unset means Better Auth derives the emitted
+ *                              link's host AND the redirectTo allow-list from
+ *                              the incoming REQUEST (§ D13). A reset token
+ *                              minted under a request-derived origin is a
+ *                              token an attacker can aim at itself.
+ *   BETTER_AUTH_SECRET         unset means auth.ts's dev fallback — a string
+ *                              published in this repository — signs the
+ *                              verification JWTs and the session cookies.
+ *
+ * WHY THIS IS A SECOND NAME RATHER THAN A WIDENED `isResetAvailable()`.
+ * #5962's spec § D10 widens `isResetAvailable()` itself and makes this an
+ * alias of it. That is not takeable as written: #5963 landed
+ * `apps/web/__tests__/auth/env-helpers.test.ts`, which asserts
+ * `isResetAvailable()` is true on the flag ALONE, and #5962's AC-3 requires
+ * every existing auth test to pass UNEDITED. So the conjunction lives here,
+ * under its own name, and `isResetAvailable()` keeps the contract #5963
+ * shipped — one conjunct of this one.
+ *
+ * The consequence, stated rather than hidden: on a deployment that sets the
+ * flag but not the transport, `/forgot-password` renders the form rather than
+ * the not-available card, and a submit lands on the error state instead —
+ * because the server refuses to send. That is a degraded message, not a false
+ * promise: the card only swaps to "check your email" on a successful
+ * response, so no visitor is ever told mail is coming when none can be sent.
+ *
+ * `RESEND_API_KEY` is deliberately NOT a conjunct: it is `apps/api`'s
+ * variable, not `apps/web`'s, and `apps/web` cannot read it. The relay answers
+ * 503 when it is absent, which lands as a `send_failed` log line rather than a
+ * page state.
+ *
+ * No better-auth import: this module stays require-safe in tests, exactly as
+ * its own header promises.
+ */
+export function resetSendConfigured(): boolean {
+  if (!isResetAvailable()) return false;
+  if (!getActiveProviderIds().includes("email")) return false;
+  if (!process.env.AUTH_EMAIL_WEBHOOK_SECRET || !process.env.AUTH_EMAIL_FROM) {
+    return false;
+  }
+  if (!process.env.BETTER_AUTH_URL) return false;
+  return Boolean(process.env.BETTER_AUTH_SECRET);
+}

package/templates/apps/web/lib/auth-routes.ts

@@ -0,0 +1,55 @@
+/**
+ * The auth route group's segment list and its path predicate (#5963).
+ *
+ * ONE module, so the list `app/[locale]/layout.tsx` branches on to drop the
+ * marketing chrome and the list the `(auth)` group's page segments exist at
+ * cannot drift. A route group contributes no URL segment, so these are the
+ * real paths: `/sign-in`, `/sign-up`, `/forgot-password`, `/reset-password`
+ * and `/verify-email`, each under next-intl's `as-needed` prefixing (bare for
+ * the default locale, `/<locale>/…` otherwise).
+ *
+ * No Next.js import — a pure function, asserted directly by its own suite.
+ */
+
+/** The five segments the `(auth)` route group serves. */
+export const AUTH_SEGMENTS = [
+  "sign-in",
+  "sign-up",
+  "forgot-password",
+  "reset-password",
+  "verify-email",
+] as const;
+
+export type AuthSegment = (typeof AUTH_SEGMENTS)[number];
+
+/**
+ * Whether `pathname` addresses one of the five auth routes.
+ *
+ * Locale-prefix-aware the same way `resolveLocalePath()` is: strip a leading
+ * `/<locale>` when it matches an ENABLED locale, then compare the first
+ * remaining segment against the list. A prefix that is not an enabled locale
+ * is a first segment, not a prefix.
+ *
+ * Fail-safe direction: an absent or empty pathname answers `false`. The
+ * layout's branch reads a header that can legitimately be missing (a direct
+ * render in a unit test, a path the middleware matcher excludes), and a
+ * missing header must never strip a marketing page's chrome. The worst case
+ * is an auth page that renders WITH chrome, which the group's own tests catch.
+ */
+export function isAuthPath(
+  pathname: string | undefined | null,
+  locales: readonly string[],
+): boolean {
+  if (!pathname) return false;
+
+  // Drop a query string / fragment — `x-pathname` carries the path, but a
+  // caller passing a full request path should get the same verdict.
+  const path = pathname.split(/[?#]/)[0] ?? "";
+  const bare =
+    locales.length > 0
+      ? path.replace(new RegExp(`^/(${locales.join("|")})(?=/|$)`), "")
+      : path;
+
+  const first = bare.split("/")[1];
+  return AUTH_SEGMENTS.some((segment) => segment === first);
+}

package/templates/apps/web/lib/meeting-slugs.ts

@@ -0,0 +1,53 @@
+// oss: false
+/**
+ * enabledMeetingSlugs — the enabled-meeting-slugs read both `/meet` pages
+ * share (#6183 S9b D5).
+ *
+ * Resolves `GET /v1/schedule/meeting-types`'s three D4 outcomes into ONE
+ * array both pages consume identically:
+ *
+ *   - an array is returned as-is (a real, operator-written enabled list —
+ *     D4 rows 2 and 3, INCLUDING an intentionally empty `[]`);
+ *   - `null` becomes the D4 row-1 singleton derived from
+ *     `SCHEDULING_CAL_LINK` — the ONE slug an unconfigured deployment has
+ *     ever advertised — or `[]` when that env var is unset;
+ *   - any non-`ok` API result becomes `[]`, fail closed: an API outage
+ *     must not open the gate.
+ *
+ * A duplicated inline call in both pages is how the two would drift, and
+ * it is also how one of them would forget the fail-closed arm — this is
+ * the ONE place that reasoning lives (D5).
+ */
+import { schedule } from "@working-theory/api-client";
+import { MeetingSlugSchema } from "@working-theory/site-config/schema";
+
+/**
+ * The D4 row-1 fallback: the slug half of the env-configured booker's own
+ * calLink (`"<owner>/<slug>"`), or `[]` when the env var is unset. This is
+ * deliberately the ONLY reader of `SCHEDULING_CAL_LINK`'s SECOND segment —
+ * `meet/[slug]/page.tsx`'s own `composedCalLink` reads the FIRST segment
+ * (the owner) for an unrelated purpose and is not touched by this file.
+ *
+ * Re-validated against `MeetingSlugSchema` (D14 parity with the operator-
+ * written path — `meeting-types.ts`'s own per-entry `safeParse` filter):
+ * `SCHEDULING_CAL_LINK` is operator-set env config, not a schema-validated
+ * write, so a malformed value (a stray comma, an empty second segment) could
+ * otherwise yield a slug that corrupts the batched `event-meta` `calLinks`
+ * join downstream — which splits on comma and would misattribute the rest
+ * of the list to a foreign owner (security review, 2026-09-19).
+ */
+function derivedFallbackSlugs(): string[] {
+  const configured = process.env["SCHEDULING_CAL_LINK"];
+  if (!configured) return [];
+  const slug = configured.split("/")[1];
+  if (!slug) return [];
+  const parsed = MeetingSlugSchema.safeParse(slug);
+  return parsed.success ? [parsed.data] : [];
+}
+
+/** The enabled meeting-type slug set for this deployment, D4-resolved. */
+export async function enabledMeetingSlugs(): Promise<string[]> {
+  const res = await schedule.meetingTypes();
+  if (!res.ok) return [];
+  return res.body.slugs ?? derivedFallbackSlugs();
+}

package/templates/apps/web/lib/site-brand.tsx

@@ -108,14 +108,10 @@ export const SITE_BASE_URL =
   process.env.NEXT_PUBLIC_BASE_URL ?? siteFrontmatter?.baseUrl ?? FALLBACK_BASE_URL;
 
 /**
- * Shared brand mark — the light/dark logo pair, mode-switched via the theme
- * `dark:` utility. RSC-safe (no hooks, no client state).
+ * Shared brand mark — the square logomark (the central brand library's
+ * `logomark/loop/icon.svg`). The Nav pairs it with `/wordmark.svg`.
+ * RSC-safe (no hooks, no client state).
  */
 export function siteLogo(): ReactElement {
-  return (
-    <>
-      <img src="/logo-light.svg" alt={SITE_NAME} height={28} className="block dark:hidden" />
-      <img src="/logo-dark.svg" alt={SITE_NAME} height={28} className="hidden dark:block" />
-    </>
-  );
+  return <img src="/logomark.svg" alt={SITE_NAME} width={28} height={28} className="block" />;
 }

package/templates/apps/web/lib/telemetry-scrub.ts

@@ -5,10 +5,14 @@
 // `page_location` default and into Sentry events, transactions, and session
 // replays. This is the single source of the stripped-parameter list.
 //
+// `session_id` joined by #6084 (D15): the Checkout Session id riding
+// `/purchase/success?session_id=cs_…` is the SAME class of bearer capability
+// — the exact defect #5562 fixed for `?g=`, recurring on a second surface.
+//
 // Mirrored (duplicated, not shared) in packages/analytics/src/scrub.ts,
 // since apps/* must not import @working-theory/* packages — keep both lists
 // in sync (#5613).
-export const TOKEN_QUERY_PARAMS = ["g"];
+export const TOKEN_QUERY_PARAMS = ["g", "session_id"];
 
 // Sentry navigation breadcrumbs (`data.to`/`data.from`) are relative
 // (`path?search`, no origin) rather than the absolute URLs GA and