From d021452431457bf6a820ab65745dbcf23485904c Mon Sep 17 00:00:00 2001 From: Manas Srivastava Date: Wed, 10 Jun 2026 09:27:43 +0530 Subject: [PATCH] fix(funnel): magic-link/claim recovery + CLI device-flow web half + llms anon-deploy sync MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Funnel-recovery and CLI device-flow fixes for the auth/claim surfaces, plus the llms.txt anon-deploy contract sync and the prerender pipeline gap that was silently serving the un-guarded llms.txt. F4 — magic-link "we sent a link" was a silent dead-end (email delivery is 100%-failing while the Brevo sender is unvalidated). The sent state now offers a "Resend" affordance and an "or continue with GitHub" fallback to the one working auth path. (src/pages/LoginPage.tsx) F6 — the /claim dead-ends (tokenless "Missing claim link" + invalid/expired token) now surface GitHub OAuth as a primary recovery CTA. (src/pages/ClaimPage.tsx) D2 (web half) — finish the CLI device-flow. LoginPage now forwards ?cli_session= through the OAuth/magic-link return_to; LoginCallbackPage POSTs /auth/cli/{id}/complete with the session Bearer after sign-in (new completeCliSession() helper, best-effort — never blocks the browser user). Before this, App.tsx forwarded the param to /login then dropped it and the CLI polled forever. (src/api/index.ts, src/pages/LoginPage.tsx, LoginCallbackPage.tsx) llms.txt anon-deploy sync — the canonical homepage example (anonymous "no signup" flow) told the agent to POST /deploy/new, which is RequireAuth and 401s for an anonymous caller; corrected to POST /stacks/new (memory project_anonymous_deploy_via_stacks_not_deploy_new). Pinned via a fetch-content requireMarkers guard + llmsContract.test.ts row so a content-repo sync can't silently revert it. Also fixed scripts/prerender.mjs Step 5, which published dist/llms.txt straight from .content/ — bypassing the requireMarkers guard so the SERVED /llms.txt reverted to stale upstream even when public/llms.txt carried the correction. It now publishes the guarded copy. S6 — VERDICT: operator/edge, NOT fixable in-repo. The live site is GitHub Pages behind Cloudflare (verified via served headers: server:cloudflare + x-github-request-id, Fastly via:varnish, no nginx). GitHub Pages cannot emit custom response headers, so CSP/X-Frame-Options are absent on every route, not just /app/*. The repo nginx.conf is only used by the Dockerfile path (not live). X-Frame-Options is header-only (no equivalent), so a build-only fix is impossible. The live fix needs a Cloudflare Transform Rule. Documented in nginx.conf; ALSO fixed a real latent nginx add_header-inheritance bug there (location / redefined add_header, dropping all server-level security headers for HTML/app routes under the Docker path). Tests: 9 new vitest cases (LoginPage F4+D2, LoginCallbackPage D2, ClaimPage F6, completeCliSession wrapper) + 1 llmsContract row, and a new mocked Playwright spec e2e/funnel-recovery.spec.ts (10 cases). Gate green: tsc --noEmit + vite build + vitest (81 files, 1169 passed / 3 skipped). Co-Authored-By: Claude Opus 4.8 --- e2e/funnel-recovery.spec.ts | 182 +++++++++++++++++++++++++++ nginx.conf | 40 +++++- public/llms.txt | 2 +- scripts/fetch-content.mjs | 10 ++ scripts/prerender.mjs | 32 +++-- src/api/index.ts | 34 +++++ src/api/index.wrappers.test.ts | 36 ++++++ src/lib/llmsContract.test.ts | 13 ++ src/pages/ClaimPage.test.tsx | 37 ++++++ src/pages/ClaimPage.tsx | 49 +++++++- src/pages/LoginCallbackPage.test.tsx | 34 +++++ src/pages/LoginCallbackPage.tsx | 17 ++- src/pages/LoginPage.test.tsx | 93 ++++++++++++++ src/pages/LoginPage.tsx | 91 ++++++++++++-- 14 files changed, 649 insertions(+), 21 deletions(-) create mode 100644 e2e/funnel-recovery.spec.ts diff --git a/e2e/funnel-recovery.spec.ts b/e2e/funnel-recovery.spec.ts new file mode 100644 index 0000000..c673608 --- /dev/null +++ b/e2e/funnel-recovery.spec.ts @@ -0,0 +1,182 @@ +/* funnel-recovery.spec.ts — mocked-contract Playwright gate for the + * auth/claim funnel-recovery surfaces shipped 2026-06-10: + * + * F4 — the magic-link "we sent a link" state is no longer a silent + * dead-end: it offers a Resend affordance + a GitHub-OAuth fallback + * (email delivery is 100%-failing while the Brevo sender is + * unvalidated, so this is the only path off the screen). + * F6 — the /claim dead-ends (tokenless "Missing claim link" + invalid/ + * expired token) surface GitHub OAuth as a primary recovery CTA. + * D2 — the CLI device-flow: /login?cli_session= forwards the id + * through the OAuth/magic-link return_to so LoginCallbackPage can + * POST /auth/cli/{id}/complete after sign-in. + * + * Runs under the DEFAULT mocked config (playwright.config.ts → VITE_NO_PROXY=1, + * same-origin), so every page.route() glob below intercepts the SPA's fetch and + * no upstream api is contacted. This is the browser-rendered, real-src/api layer + * that complements the vitest component tests (which stub the api module). + */ + +import { expect, test, type Page, type Route } from '@playwright/test' + +// ─── Constants ─────────────────────────────────────────────────────────────── +const EMAIL_START_PATH = '**/auth/email/start' +const AUTH_ME_PATH = '**/auth/me' +const CLI_COMPLETE_PATH = /\/auth\/cli\/[^/]+\/complete$/ +const TEST_EMAIL = 'founder@acme.dev' +const CLI_SESSION_ID = 'cli_sess_abc123' +const SESSION_TOKEN = 'sess_jwt_callback' + +/** Mock POST /auth/email/start → 202 (the api returns 202 regardless of + * whether the email exists). Captures the request body so the test can assert + * the return_to carries the cli_session when present. */ +async function mockEmailStart(page: Page, captured: { body?: any; count: number }) { + await page.route(EMAIL_START_PATH, (route: Route) => { + if (route.request().method() !== 'POST') return route.continue() + captured.count += 1 + captured.body = JSON.parse(route.request().postData() ?? '{}') + return route.fulfill({ status: 202, contentType: 'application/json', body: '{}' }) + }) +} + +/** Mock GET /auth/me → 200 so the callback page's post-token verification + * succeeds and it proceeds to navigation. */ +async function mockAuthMe(page: Page) { + await page.route(AUTH_ME_PATH, (route: Route) => + route.fulfill({ + status: 200, + contentType: 'application/json', + body: JSON.stringify({ ok: true, user_id: 'u1', team_id: 't1', email: TEST_EMAIL, tier: 'free' }), + }), + ) +} + +// ─── F4: magic-link sent state is not a dead-end ───────────────────────────── + +test.describe('F4 — magic-link recovery affordances', () => { + async function reachSentState(page: Page) { + await page.getByTestId('email-input').fill(TEST_EMAIL) + await page.getByTestId('email-submit').click() + await expect(page.getByTestId('magic-link-sent')).toBeVisible() + } + + test('the sent state renders Resend + GitHub-fallback controls', async ({ page }) => { + const cap = { count: 0 } as { body?: any; count: number } + await mockEmailStart(page, cap) + await page.goto('/login') + await reachSentState(page) + await expect(page.getByTestId('magic-link-resend')).toBeVisible() + await expect(page.getByTestId('magic-link-github-fallback')).toBeVisible() + }) + + test('Resend re-fires POST /auth/email/start', async ({ page }) => { + const cap = { count: 0 } as { body?: any; count: number } + await mockEmailStart(page, cap) + await page.goto('/login') + await reachSentState(page) + expect(cap.count).toBe(1) + await page.getByTestId('magic-link-resend').click() + await expect.poll(() => cap.count).toBe(2) + }) + + test('the GitHub fallback navigates to the OAuth start handler', async ({ page }) => { + const cap = { count: 0 } as { body?: any; count: number } + await mockEmailStart(page, cap) + // The github/start redirect leaves the SPA — intercept it so the test + // doesn't navigate to the real api. Asserting the URL we were sent to. + await page.route('**/auth/github/start*', (route: Route) => + route.fulfill({ status: 200, contentType: 'text/html', body: 'oauth start' }), + ) + await page.goto('/login') + await reachSentState(page) + await Promise.all([ + page.waitForURL(/\/auth\/github\/start\?return_to=/), + page.getByTestId('magic-link-github-fallback').click(), + ]) + }) +}) + +// ─── F6: claim dead-ends surface GitHub OAuth ──────────────────────────────── + +test.describe('F6 — claim funnel recovery via GitHub OAuth', () => { + test('the tokenless "Missing claim link" state surfaces a GitHub CTA', async ({ page }) => { + await page.goto('/claim') + await expect(page.getByText(/missing claim link/i)).toBeVisible() + await expect(page.getByTestId('claim-github-oauth')).toBeVisible() + }) + + test('the invalid/expired-link state surfaces a GitHub CTA', async ({ page }) => { + await page.goto('/claim?t=not-a-valid-jwt-blob') + await expect(page.getByTestId('claim-invalid')).toBeVisible() + await expect(page.getByTestId('claim-github-oauth')).toBeVisible() + }) + + test('the GitHub CTA navigates to the OAuth start handler', async ({ page }) => { + await page.route('**/auth/github/start*', (route: Route) => + route.fulfill({ status: 200, contentType: 'text/html', body: 'oauth start' }), + ) + await page.goto('/claim') + await Promise.all([ + page.waitForURL(/\/auth\/github\/start\?return_to=/), + page.getByTestId('claim-github-oauth').click(), + ]) + }) +}) + +// ─── D2: CLI device-flow — cli_session preserved + completed ───────────────── + +test.describe('D2 — CLI device-flow completion', () => { + test('LoginPage forwards cli_session into the magic-link return_to', async ({ page }) => { + const cap = { count: 0 } as { body?: any; count: number } + await mockEmailStart(page, cap) + await page.goto(`/login?cli_session=${CLI_SESSION_ID}`) + await page.getByTestId('email-input').fill(TEST_EMAIL) + await page.getByTestId('email-submit').click() + await expect(page.getByTestId('magic-link-sent')).toBeVisible() + // The return_to the SPA sent the api must carry the cli_session so the + // post-auth callback can complete the device flow. + expect(cap.body?.return_to).toContain(`/login/callback?cli_session=${CLI_SESSION_ID}`) + }) + + test('the callback POSTs /auth/cli/{id}/complete then lands the user on /app', async ({ page }) => { + await mockAuthMe(page) + const completeCap = { id: '', count: 0 } + await page.route(CLI_COMPLETE_PATH, (route: Route) => { + completeCap.count += 1 + // Pull the session id out of the path: /auth/cli//complete + const m = new URL(route.request().url()).pathname.match(/\/auth\/cli\/([^/]+)\/complete$/) + completeCap.id = m ? decodeURIComponent(m[1]) : '' + return route.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify({ ok: true }) }) + }) + + // The callback uses the legacy ?session_token path (no cookie exchange + // needed for the mock) + ?cli_session to trigger completion. + await page.goto(`/login/callback?session_token=${SESSION_TOKEN}&cli_session=${CLI_SESSION_ID}`) + await expect(page).toHaveURL(/\/app\/?$/) + expect(completeCap.count).toBe(1) + expect(completeCap.id).toBe(CLI_SESSION_ID) + }) + + test('a cli-completion failure does NOT block the user sign-in (still lands on /app)', async ({ page }) => { + await mockAuthMe(page) + await page.route(CLI_COMPLETE_PATH, (route: Route) => + route.fulfill({ status: 404, contentType: 'application/json', body: JSON.stringify({ error: 'session_not_found' }) }), + ) + await page.goto(`/login/callback?session_token=${SESSION_TOKEN}&cli_session=${CLI_SESSION_ID}`) + // completeCliSession swallows the error; the browser user must still + // reach the app. + await expect(page).toHaveURL(/\/app\/?$/) + }) + + test('no cli_session → the callback never calls /auth/cli/.../complete', async ({ page }) => { + await mockAuthMe(page) + let completeCalled = false + await page.route(CLI_COMPLETE_PATH, (route: Route) => { + completeCalled = true + return route.fulfill({ status: 200, contentType: 'application/json', body: JSON.stringify({ ok: true }) }) + }) + await page.goto(`/login/callback?session_token=${SESSION_TOKEN}`) + await expect(page).toHaveURL(/\/app\/?$/) + expect(completeCalled).toBe(false) + }) +}) diff --git a/nginx.conf b/nginx.conf index 802b2b5..e77358f 100644 --- a/nginx.conf +++ b/nginx.conf @@ -25,9 +25,29 @@ server { # - the New Relic browser agent boots inline at the top of # - JSON-LD blog metadata is inline