ultimate-jekyll-manager 1.3.1 → 1.3.3

package/CHANGELOG.md

@@ -14,6 +14,20 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+---
+## [1.3.3] - 2026-05-21
+
+### Changed
+
+- **Reordered account page sections** in `src/defaults/dist/_layouts/themes/classy/frontend/pages/account/index.html`. Sidebar nav and section blocks now run Profile → Security → Subscription → Billing → Referrals → Team → Notifications → API Keys, pushing the less-frequently-used Team and Notifications sections below Referrals. Section content unchanged.
+
+---
+## [1.3.2] - 2026-05-22
+
+### Fixed
+
+- **Consent guard was running before `sendUserSignupMetadata`, killing every fresh signup.** `src/assets/js/core/auth.js`: on a brand-new signup the user doc exists with `consent.legal.status: 'revoked'` (the schema default written by BEM's `on-create` event); `sendUserSignupMetadata` is what flips it to `'granted'`. Previously the guard ran first and signed the user out before the metadata POST could fire — orphaned every new account. Reordered to run `sendUserSignupMetadata` first, and the guard now skips accounts younger than `SIGNUP_MAX_AGE` (5min) so a transient network error during the POST doesn't lock a user out forever — they can retry. After the grace window, the guard fires normally.
+
 ---
 ## [1.3.1] - 2026-05-21
 

package/dist/assets/js/core/auth.js

@@ -65,15 +65,30 @@ export default function () {
       if (user) {
         // User is authenticated
 
+        // Send user signup metadata if account is new.
+        // MUST run BEFORE the consent guard — on a brand-new signup the user doc
+        // exists with consent.legal.status: 'revoked' (the schema default written
+        // by the on-create auth event). sendUserSignupMetadata is what flips it
+        // to 'granted' with the captured consent payload. If we gate first, every
+        // fresh signup would be signed out before consent ever lands.
+        await sendUserSignupMetadata(user);
+
         // Consent guard: if the user is authenticated but their account doc shows
         // no legal consent on record, they're an orphan from a reversed Google signup
         // that failed to delete cleanly. Sign them out and surface a toast so the
-        // user knows what happened (especially if they just clicked Google and saw
-        // a success message before this fired).
+        // user knows what happened.
+        //
         // Gated by ENFORCE_CONSENT_GUARD (off until the legacy-user migration runs).
+        // Also skipped for accounts younger than SIGNUP_MAX_AGE — sendUserSignupMetadata
+        // above is responsible for the consent write on that path, but if it failed
+        // (network error, server 500, etc.) the guard would otherwise lock the user
+        // out forever. The 5min grace window lets a retry / refresh recover; after
+        // that, the doc legitimately has no legal consent and the guard fires.
         if (ENFORCE_CONSENT_GUARD) {
+          const accountAge = Date.now() - new Date(user.metadata.creationTime).getTime();
+          const isFreshAccount = accountAge < SIGNUP_MAX_AGE;
           const legalStatus = state.account?.consent?.legal?.status;
-          if (legalStatus && legalStatus !== 'granted') {
+          if (!isFreshAccount && legalStatus && legalStatus !== 'granted') {
             console.warn('[Auth] Signing out user with no legal consent on record');
             await webManager.auth().signOut();
             webManager.utilities().showNotification(
@@ -84,9 +99,6 @@ export default function () {
           }
         }
 
-        // Send user signup metadata if account is new
-        await sendUserSignupMetadata(user);
-
         // Check if page requires user to be unauthenticated (e.g., signin page)
         if (policy === 'unauthenticated') {
           // Check for authReturnUrl first (takes precedence)

package/dist/defaults/dist/_layouts/themes/classy/frontend/pages/account/index.html

@@ -36,9 +36,6 @@ sections:
   - id: "profile"
     name: "Profile"
     icon: "user-circle"
-  - id: "notifications"
-    name: "Notifications"
-    icon: "bell"
   - id: "security"
     name: "Security"
     icon: "shield-halved"
@@ -48,12 +45,15 @@ sections:
   - id: "billing"
     name: "Billing"
     icon: "credit-card"
-  - id: "team"
-    name: "Team"
-    icon: "users"
   - id: "referrals"
     name: "Referrals"
     icon: "user-plus"
+  - id: "team"
+    name: "Team"
+    icon: "users"
+  - id: "notifications"
+    name: "Notifications"
+    icon: "bell"
   - id: "api-keys"
     name: "API Keys"
     icon: "key"
@@ -771,26 +771,6 @@ badges:
         </form>
       </section>
 
-      <!-- Notifications Section -->
-      <section id="notifications-section" class="account-section d-none">
-        <h2 class="h3 mb-4" >Notifications</h2>
-
-        <div class="card">
-          <div class="card-body">
-            <h5 class="card-title">Email preferences</h5>
-
-            <div class="form-check form-switch">
-              <input class="form-check-input" type="checkbox" id="marketing-emails">
-              <label class="form-check-label" for="marketing-emails">
-                Product updates, newsletters, and marketing communications
-                <small class="d-block text-muted">You can withdraw consent at any time.</small>
-                <small id="marketing-emails-grant-date" class="d-block text-muted d-none"></small>
-              </label>
-            </div>
-          </div>
-        </div>
-      </section>
-
       <!-- Security Section -->
       <section id="security-section" class="account-section d-none">
         <h2 class="h3 mb-4" >Security and data</h2>
@@ -1110,37 +1090,6 @@ badges:
         </div>
       </section>
 
-      <!-- Team Section -->
-      <section id="team-section" class="account-section d-none">
-        <h2 class="h3 mb-4" >Team</h2>
-
-        <div class="card">
-          <div class="card-body">
-            <div class="d-flex justify-content-between align-items-center mb-3">
-              <h5 class="card-title mb-0">Team members</h5>
-              <button class="btn btn-primary btn-sm" id="invite-team-member-btn">
-                {% uj_icon "user-plus", "me-2" %}
-                <span class="button-text">
-                  Invite<span class="d-none d-md-inline"> Team Member</span>
-                </span>
-              </button>
-            </div>
-
-            <div class="list-group" id="team-list">
-              <div class="list-group-item">
-                <div class="d-flex justify-content-between align-items-center">
-                  <div>
-                    <strong>You</strong>
-                    <small class="text-muted d-block">Owner</small>
-                  </div>
-                  <span class="badge bg-primary">Owner</span>
-                </div>
-              </div>
-            </div>
-          </div>
-        </div>
-      </section>
-
       <!-- Referrals Section -->
       <section id="referrals-section" class="account-section d-none">
         <h2 class="h3 mb-4" >Referrals</h2>
@@ -1207,6 +1156,57 @@ badges:
         </div>
       </section>
 
+      <!-- Team Section -->
+      <section id="team-section" class="account-section d-none">
+        <h2 class="h3 mb-4" >Team</h2>
+
+        <div class="card">
+          <div class="card-body">
+            <div class="d-flex justify-content-between align-items-center mb-3">
+              <h5 class="card-title mb-0">Team members</h5>
+              <button class="btn btn-primary btn-sm" id="invite-team-member-btn">
+                {% uj_icon "user-plus", "me-2" %}
+                <span class="button-text">
+                  Invite<span class="d-none d-md-inline"> Team Member</span>
+                </span>
+              </button>
+            </div>
+
+            <div class="list-group" id="team-list">
+              <div class="list-group-item">
+                <div class="d-flex justify-content-between align-items-center">
+                  <div>
+                    <strong>You</strong>
+                    <small class="text-muted d-block">Owner</small>
+                  </div>
+                  <span class="badge bg-primary">Owner</span>
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+      </section>
+
+      <!-- Notifications Section -->
+      <section id="notifications-section" class="account-section d-none">
+        <h2 class="h3 mb-4" >Notifications</h2>
+
+        <div class="card">
+          <div class="card-body">
+            <h5 class="card-title">Email preferences</h5>
+
+            <div class="form-check form-switch">
+              <input class="form-check-input" type="checkbox" id="marketing-emails">
+              <label class="form-check-label" for="marketing-emails">
+                Product updates, newsletters, and marketing communications
+                <small class="d-block text-muted">You can withdraw consent at any time.</small>
+                <small id="marketing-emails-grant-date" class="d-block text-muted d-none"></small>
+              </label>
+            </div>
+          </div>
+        </div>
+      </section>
+
       <!-- API Keys Section -->
       <section id="api-keys-section" class="account-section d-none">
         <h2 class="h3 mb-4" >API keys</h2>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultimate-jekyll-manager",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "Ultimate Jekyll dependency manager",
   "main": "dist/index.js",
   "exports": {