MattssonandClaude Fable 5
4f6ecad549
* feat(white-label): invite-only signup for brand domains
A brand domain belongs to the partner's people (founder decision
2026-08-27): only allowlisted or invited users may create an account on
an invite-only brand domain; everyone else is shown an interstitial that
sends them to the canonical Accounted signup.
- brands.signup_mode ('open' default / 'invite_only') +
brand_signup_allowlist (lowercase emails, team-scoped RLS, owner/admin
writes) + create_company_for_brand_signup RPC, with pg-real coverage
- server-side gate (lib/auth/brand-signup-gate.ts) enforced on every
signup path: email signup moved to POST /api/auth/signup (the browser
used to call GoTrue directly, so a client-side check would be
bypassable), BankID gated in /bankid/complete, Google covered by the
dashboard layout's brand-domain bounce
- company invites bypass the allowlist: the invite is the authorization
- register page interstitial on gated brands (no email in the outbound
URL), sv+en strings
- dashboard layout bounces non-belonging sessions off gated brand hosts
to the canonical domain (navigation rule like WL-01, not a security
boundary)
- allowlisted signups' onboarding-created companies attach to the
brand's byra team via the new RPC, so WL-01 homes them on the brand
domain; the allowlist entry recorded by an owner/admin stands in for
the WL-15 admin gate
- byra cockpit page /clients/access + /api/clients/signup-access to
manage the mode and the allowlist
All existing brands default to 'open': behavior is byte-identical until
a brand is flipped to invite_only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4
* fix(white-label): rollback brand-signup company with the service client
Skeptic (correctness) found that a brand-signup company created under the
service role rolled back with the cookie-session client: `companies` has
RLS and no FOR DELETE policy, so the delete was a silent 0-row no-op,
stranding a member-less ghost company on the partner's byra team. Pass an
optional rollbackClient to createCompanyCore and hand it the service
client on that path; user_preferences.active_company_id then clears itself
via its ON DELETE SET NULL FK once the company row is actually deleted.
Also map a validateBody 400 (flat envelope, no code) on the register page
to the specific email-invalid field message instead of the generic one,
since the client already pre-gates password strength.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4
* fix(white-label): fail-safe brand lookup, pg-test seed, anonymize fixtures
Second resolve-pr cycle: skeptic + CodeRabbit findings and a green-up.
- Fail safe on a brands-table error (CodeRabbit CWE-285): the gate treated a
failed resolveBrandByHost as an unbranded host, opening invite-only signup
during a transient DB blip. resolveBrandResultByHost now distinguishes
"no brand" from "lookup failed"; the gate returns lookupFailed and the
email + BankID routes answer 503 (retry), never creating an account.
- pg-real: the RLS delete test seeded its row inside withUserContext, which
always rolls back, so the owner DELETE saw zero rows. Seed on the superuser
pool instead.
- Anonymize every test/fixture brand to the repo's existing synthetic
placeholder (Siffra / app.siffra.se): no real partner names in code.
- SignupAccessManager: functional setData updates so a concurrent mode
toggle and an add/remove do not clobber each other's snapshot (CodeRabbit).
- Route a transient-error message through i18n instead of the raw envelope
(raw-user-error guard); new register.error_temporary sv+en.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4
* test(white-label): anonymize new signup-gate fixtures; log oracle residual
Rename the placeholder brand in the four new brand-signup test files to a
clearly-fake, partner-unrelated name (Testbrand / app.testbrand.example);
the previous placeholder echoed a real partner. Scoped to files this PR
creates; the repo-wide legacy placeholder is left for a separate cleanup.
Also record in DECISIONS.md that the feature ships accepting the
low-severity allowlist-enumeration residual (captcha-free 403 vs 200 on
the signup endpoint), with rate-limiting as the follow-up option.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
87 lines
3.0 KiB
TypeScript
87 lines
3.0 KiB
TypeScript
import { describe, it, expect } from 'vitest'
|
|
import { getBranding } from '@/lib/branding/service'
|
|
import {
|
|
toPublicBrand,
|
|
mergeClientBranding,
|
|
type PublicBrand,
|
|
} from '@/lib/branding/public-brand'
|
|
import type { Brand } from '@/lib/branding/resolve'
|
|
|
|
const fullBrand: Brand = {
|
|
id: 'brand-1',
|
|
teamId: 'team-1',
|
|
domain: 'app.siffra.se',
|
|
appName: 'Siffra',
|
|
logoUrl: 'https://cdn.example.com/storage/v1/object/public/brand-logos/siffra.png',
|
|
brandColor: '#2563eb',
|
|
chromeColor: null,
|
|
fontKey: 'default',
|
|
supportEmail: 'support@siffra.se',
|
|
authEmailFrom: null,
|
|
senderDomain: 'mail.siffra.se',
|
|
senderDomainStatus: 'verified',
|
|
resendDomainId: 'rd_123',
|
|
signupMode: 'open',
|
|
}
|
|
|
|
describe('toPublicBrand', () => {
|
|
it('keeps only the client-safe fields', () => {
|
|
const pub = toPublicBrand(fullBrand)
|
|
expect(pub).toEqual({
|
|
appName: 'Siffra',
|
|
logoUrl: fullBrand.logoUrl,
|
|
supportEmail: 'support@siffra.se',
|
|
authEmailFrom: null,
|
|
brandColor: '#2563eb',
|
|
fontKey: 'default',
|
|
domain: 'app.siffra.se',
|
|
})
|
|
// Ops-internal email plumbing must never cross to the client bundle.
|
|
expect(pub).not.toHaveProperty('senderDomain')
|
|
expect(pub).not.toHaveProperty('senderDomainStatus')
|
|
expect(pub).not.toHaveProperty('resendDomainId')
|
|
expect(pub).not.toHaveProperty('teamId')
|
|
})
|
|
})
|
|
|
|
describe('mergeClientBranding', () => {
|
|
const base = getBranding()
|
|
|
|
it('returns plain getBranding() values when there is no brand (the additive guarantee)', () => {
|
|
const merged = mergeClientBranding(base, null)
|
|
expect(merged.brand).toBeNull()
|
|
expect(merged.logoUrl).toBeNull()
|
|
// Every base field passes through untouched.
|
|
expect(merged).toMatchObject(base)
|
|
expect(merged.appName).toBe(base.appName)
|
|
expect(merged.supportEmail).toBe(base.supportEmail)
|
|
expect(merged.authEmailFrom).toBe(base.authEmailFrom)
|
|
expect(merged.themeColor).toBe(base.themeColor)
|
|
expect(merged.logoPath).toBe(base.logoPath)
|
|
})
|
|
|
|
it('layers brand values over the defaults when a brand is active', () => {
|
|
const pub = toPublicBrand(fullBrand)
|
|
const merged = mergeClientBranding(base, pub)
|
|
expect(merged.appName).toBe('Siffra')
|
|
expect(merged.supportEmail).toBe('support@siffra.se')
|
|
expect(merged.themeColor).toBe('#2563eb')
|
|
expect(merged.logoUrl).toBe(fullBrand.logoUrl)
|
|
expect(merged.brand).toEqual(pub)
|
|
// Untouched defaults survive the merge.
|
|
expect(merged.logoPath).toBe(base.logoPath)
|
|
expect(merged.appDescription).toBe(base.appDescription)
|
|
})
|
|
|
|
it('falls back to the default authEmailFrom when the brand has none', () => {
|
|
const withoutAuthFrom: PublicBrand = { ...toPublicBrand(fullBrand), authEmailFrom: null }
|
|
expect(mergeClientBranding(base, withoutAuthFrom).authEmailFrom).toBe(base.authEmailFrom)
|
|
|
|
const withAuthFrom: PublicBrand = {
|
|
...toPublicBrand(fullBrand),
|
|
authEmailFrom: 'noreply@siffra.se',
|
|
}
|
|
expect(mergeClientBranding(base, withAuthFrom).authEmailFrom).toBe('noreply@siffra.se')
|
|
})
|
|
})
|