Files
accounted/lib/email/__tests__/brand-sender.test.ts
T
MattssonandClaude Fable 5 4f6ecad549 feat(white-label): invite-only signup for brand domains (#1995)
* feat(white-label): invite-only signup for brand domains

A brand domain belongs to the partner's people (founder decision
2026-08-27): only allowlisted or invited users may create an account on
an invite-only brand domain; everyone else is shown an interstitial that
sends them to the canonical Accounted signup.

- brands.signup_mode ('open' default / 'invite_only') +
  brand_signup_allowlist (lowercase emails, team-scoped RLS, owner/admin
  writes) + create_company_for_brand_signup RPC, with pg-real coverage
- server-side gate (lib/auth/brand-signup-gate.ts) enforced on every
  signup path: email signup moved to POST /api/auth/signup (the browser
  used to call GoTrue directly, so a client-side check would be
  bypassable), BankID gated in /bankid/complete, Google covered by the
  dashboard layout's brand-domain bounce
- company invites bypass the allowlist: the invite is the authorization
- register page interstitial on gated brands (no email in the outbound
  URL), sv+en strings
- dashboard layout bounces non-belonging sessions off gated brand hosts
  to the canonical domain (navigation rule like WL-01, not a security
  boundary)
- allowlisted signups' onboarding-created companies attach to the
  brand's byra team via the new RPC, so WL-01 homes them on the brand
  domain; the allowlist entry recorded by an owner/admin stands in for
  the WL-15 admin gate
- byra cockpit page /clients/access + /api/clients/signup-access to
  manage the mode and the allowlist

All existing brands default to 'open': behavior is byte-identical until
a brand is flipped to invite_only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4

* fix(white-label): rollback brand-signup company with the service client

Skeptic (correctness) found that a brand-signup company created under the
service role rolled back with the cookie-session client: `companies` has
RLS and no FOR DELETE policy, so the delete was a silent 0-row no-op,
stranding a member-less ghost company on the partner's byra team. Pass an
optional rollbackClient to createCompanyCore and hand it the service
client on that path; user_preferences.active_company_id then clears itself
via its ON DELETE SET NULL FK once the company row is actually deleted.

Also map a validateBody 400 (flat envelope, no code) on the register page
to the specific email-invalid field message instead of the generic one,
since the client already pre-gates password strength.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4

* fix(white-label): fail-safe brand lookup, pg-test seed, anonymize fixtures

Second resolve-pr cycle: skeptic + CodeRabbit findings and a green-up.

- Fail safe on a brands-table error (CodeRabbit CWE-285): the gate treated a
  failed resolveBrandByHost as an unbranded host, opening invite-only signup
  during a transient DB blip. resolveBrandResultByHost now distinguishes
  "no brand" from "lookup failed"; the gate returns lookupFailed and the
  email + BankID routes answer 503 (retry), never creating an account.
- pg-real: the RLS delete test seeded its row inside withUserContext, which
  always rolls back, so the owner DELETE saw zero rows. Seed on the superuser
  pool instead.
- Anonymize every test/fixture brand to the repo's existing synthetic
  placeholder (Siffra / app.siffra.se): no real partner names in code.
- SignupAccessManager: functional setData updates so a concurrent mode
  toggle and an add/remove do not clobber each other's snapshot (CodeRabbit).
- Route a transient-error message through i18n instead of the raw envelope
  (raw-user-error guard); new register.error_temporary sv+en.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4

* test(white-label): anonymize new signup-gate fixtures; log oracle residual

Rename the placeholder brand in the four new brand-signup test files to a
clearly-fake, partner-unrelated name (Testbrand / app.testbrand.example);
the previous placeholder echoed a real partner. Scoped to files this PR
creates; the repo-wide legacy placeholder is left for a separate cleanup.

Also record in DECISIONS.md that the feature ships accepting the
low-severity allowlist-enumeration residual (captcha-free 403 vs 200 on
the signup endpoint), with rate-limiting as the follow-up option.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-27 18:32:52 +02:00

114 lines
3.5 KiB
TypeScript

import { describe, it, expect, vi, beforeEach } from 'vitest'
import type { Brand } from '@/lib/branding/resolve'
const resolveBrandForCompanyMock = vi.hoisted(() => vi.fn())
vi.mock('@/lib/branding/resolve', () => ({
resolveBrandForCompany: resolveBrandForCompanyMock,
}))
vi.mock('@/lib/branding/service', () => ({
getBranding: () => ({ appName: 'Accounted', appUrl: 'https://app.gnubok.se' }),
}))
import {
getSenderForBrand,
getSenderForCompany,
getBaseUrlForBrand,
getBaseUrlForCompany,
} from '../brand-sender'
function makeBrand(overrides: Partial<Brand> = {}): Brand {
return {
id: 'brand-1',
teamId: 'team-1',
domain: 'app.siffra.se',
appName: 'Siffra',
logoUrl: null,
brandColor: '#123456',
chromeColor: null,
fontKey: 'default',
supportEmail: 'support@siffra.se',
authEmailFrom: 'noreply@post.siffra.se',
senderDomain: 'post.siffra.se',
senderDomainStatus: 'verified',
resendDomainId: 'rd-1',
signupMode: 'open',
...overrides,
}
}
beforeEach(() => {
vi.clearAllMocks()
})
describe('getSenderForBrand', () => {
it('returns platform defaults (all null) for no brand', () => {
expect(getSenderForBrand(null)).toEqual({
fromName: null,
fromAddress: null,
replyTo: null,
brand: null,
})
})
it('sends from the brand address when the sender domain is verified', () => {
const brand = makeBrand()
expect(getSenderForBrand(brand)).toEqual({
fromName: 'Siffra',
fromAddress: 'noreply@post.siffra.se',
replyTo: 'support@siffra.se',
brand,
})
})
it('falls back to the via-platform pattern when the domain is unverified', () => {
const brand = makeBrand({ senderDomainStatus: 'pending' })
expect(getSenderForBrand(brand)).toEqual({
fromName: 'Siffra',
fromAddress: null,
replyTo: 'support@siffra.se',
brand,
})
})
it('falls back when the domain is verified but authEmailFrom is missing', () => {
const brand = makeBrand({ authEmailFrom: null })
const sender = getSenderForBrand(brand)
expect(sender.fromAddress).toBeNull()
expect(sender.fromName).toBe('Siffra')
})
})
describe('getSenderForCompany', () => {
it('resolves through resolveBrandForCompany', async () => {
const brand = makeBrand()
resolveBrandForCompanyMock.mockResolvedValue(brand)
const sender = await getSenderForCompany('company-1')
expect(resolveBrandForCompanyMock).toHaveBeenCalledWith('company-1')
expect(sender.fromAddress).toBe('noreply@post.siffra.se')
})
it('returns platform defaults for a brandless company', async () => {
resolveBrandForCompanyMock.mockResolvedValue(null)
const sender = await getSenderForCompany('company-1')
expect(sender).toEqual({ fromName: null, fromAddress: null, replyTo: null, brand: null })
})
})
describe('base URLs', () => {
it('uses the brand home domain when a brand exists', () => {
expect(getBaseUrlForBrand(makeBrand())).toBe('https://app.siffra.se')
})
it('uses the canonical app URL without a brand', () => {
expect(getBaseUrlForBrand(null)).toBe('https://app.gnubok.se')
})
it('getBaseUrlForCompany resolves the brand by company', async () => {
resolveBrandForCompanyMock.mockResolvedValue(makeBrand())
await expect(getBaseUrlForCompany('company-1')).resolves.toBe('https://app.siffra.se')
resolveBrandForCompanyMock.mockResolvedValue(null)
await expect(getBaseUrlForCompany('company-2')).resolves.toBe('https://app.gnubok.se')
})
})