Files
accounted/lib/branding/__tests__/resolve.test.ts
T
Mattsson 4f6ecad549 feat(white-label): invite-only signup for brand domains (#1995)
* feat(white-label): invite-only signup for brand domains

A brand domain belongs to the partner's people (founder decision
2026-08-27): only allowlisted or invited users may create an account on
an invite-only brand domain; everyone else is shown an interstitial that
sends them to the canonical Accounted signup.

- brands.signup_mode ('open' default / 'invite_only') +
  brand_signup_allowlist (lowercase emails, team-scoped RLS, owner/admin
  writes) + create_company_for_brand_signup RPC, with pg-real coverage
- server-side gate (lib/auth/brand-signup-gate.ts) enforced on every
  signup path: email signup moved to POST /api/auth/signup (the browser
  used to call GoTrue directly, so a client-side check would be
  bypassable), BankID gated in /bankid/complete, Google covered by the
  dashboard layout's brand-domain bounce
- company invites bypass the allowlist: the invite is the authorization
- register page interstitial on gated brands (no email in the outbound
  URL), sv+en strings
- dashboard layout bounces non-belonging sessions off gated brand hosts
  to the canonical domain (navigation rule like WL-01, not a security
  boundary)
- allowlisted signups' onboarding-created companies attach to the
  brand's byra team via the new RPC, so WL-01 homes them on the brand
  domain; the allowlist entry recorded by an owner/admin stands in for
  the WL-15 admin gate
- byra cockpit page /clients/access + /api/clients/signup-access to
  manage the mode and the allowlist

All existing brands default to 'open': behavior is byte-identical until
a brand is flipped to invite_only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4

* fix(white-label): rollback brand-signup company with the service client

Skeptic (correctness) found that a brand-signup company created under the
service role rolled back with the cookie-session client: `companies` has
RLS and no FOR DELETE policy, so the delete was a silent 0-row no-op,
stranding a member-less ghost company on the partner's byra team. Pass an
optional rollbackClient to createCompanyCore and hand it the service
client on that path; user_preferences.active_company_id then clears itself
via its ON DELETE SET NULL FK once the company row is actually deleted.

Also map a validateBody 400 (flat envelope, no code) on the register page
to the specific email-invalid field message instead of the generic one,
since the client already pre-gates password strength.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4

* fix(white-label): fail-safe brand lookup, pg-test seed, anonymize fixtures

Second resolve-pr cycle: skeptic + CodeRabbit findings and a green-up.

- Fail safe on a brands-table error (CodeRabbit CWE-285): the gate treated a
  failed resolveBrandByHost as an unbranded host, opening invite-only signup
  during a transient DB blip. resolveBrandResultByHost now distinguishes
  "no brand" from "lookup failed"; the gate returns lookupFailed and the
  email + BankID routes answer 503 (retry), never creating an account.
- pg-real: the RLS delete test seeded its row inside withUserContext, which
  always rolls back, so the owner DELETE saw zero rows. Seed on the superuser
  pool instead.
- Anonymize every test/fixture brand to the repo's existing synthetic
  placeholder (Siffra / app.siffra.se): no real partner names in code.
- SignupAccessManager: functional setData updates so a concurrent mode
  toggle and an add/remove do not clobber each other's snapshot (CodeRabbit).
- Route a transient-error message through i18n instead of the raw envelope
  (raw-user-error guard); new register.error_temporary sv+en.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4

* test(white-label): anonymize new signup-gate fixtures; log oracle residual

Rename the placeholder brand in the four new brand-signup test files to a
clearly-fake, partner-unrelated name (Testbrand / app.testbrand.example);
the previous placeholder echoed a real partner. Scoped to files this PR
creates; the repo-wide legacy placeholder is left for a separate cleanup.

Also record in DECISIONS.md that the feature ships accepting the
low-severity allowlist-enumeration residual (captcha-free 403 vs 200 on
the signup endpoint), with rate-limiting as the follow-up option.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-27 18:32:52 +02:00

238 lines
7.8 KiB
TypeScript

import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
import { createQueuedMockSupabase } from '@/tests/helpers'
// Holder assigned in beforeEach; the mock factory closes over it so each test
// gets a fresh queued client without re-mocking the module.
const serviceClient = vi.hoisted(() => ({ current: null as unknown }))
vi.mock('@/lib/auth/api-keys', () => ({
createServiceClientNoCookies: vi.fn(() => serviceClient.current),
}))
import {
resolveBrandByHost,
resolveBrandForCompany,
deriveChromeColor,
getEffectiveChrome,
isBrandColorAccessible,
normalizeHost,
clearBrandCache,
} from '@/lib/branding/resolve'
const brandRow = {
id: 'brand-1',
team_id: 'team-1',
domain: 'app.siffra.se',
app_name: 'Siffra',
logo_url: null,
favicon_url: null,
brand_color: '#2563eb',
chrome_color: null,
font_key: 'default',
support_email: 'support@siffra.se',
auth_email_from: null,
sender_domain: null,
sender_domain_status: 'unverified',
resend_domain_id: null,
signup_mode: 'open',
}
let mock: ReturnType<typeof createQueuedMockSupabase>
beforeEach(() => {
vi.clearAllMocks()
clearBrandCache()
mock = createQueuedMockSupabase()
serviceClient.current = mock.supabase
})
afterEach(() => {
vi.useRealTimers()
})
describe('normalizeHost', () => {
it('lowercases and strips port and trailing dot', () => {
expect(normalizeHost('APP.SIFFRA.SE:3000')).toBe('app.siffra.se')
expect(normalizeHost(' app.siffra.se. ')).toBe('app.siffra.se')
expect(normalizeHost('app.siffra.se')).toBe('app.siffra.se')
})
})
describe('resolveBrandByHost', () => {
it('resolves a brand row and maps it to the camelCase Brand shape', async () => {
mock.enqueue({ data: brandRow })
const brand = await resolveBrandByHost('app.siffra.se')
expect(brand).toEqual({
id: 'brand-1',
teamId: 'team-1',
domain: 'app.siffra.se',
appName: 'Siffra',
logoUrl: null,
faviconUrl: null,
brandColor: '#2563eb',
chromeColor: null,
fontKey: 'default',
supportEmail: 'support@siffra.se',
authEmailFrom: null,
senderDomain: null,
senderDomainStatus: 'unverified',
resendDomainId: null,
signupMode: 'open',
})
expect(mock.findCall('brands', 'eq')).toEqual(['domain', 'app.siffra.se'])
})
it('normalizes the host before lookup and shares the cache entry across variants', async () => {
mock.enqueue({ data: brandRow })
const first = await resolveBrandByHost('APP.SIFFRA.SE:3000')
expect(first?.domain).toBe('app.siffra.se')
expect(mock.findCall('brands', 'eq')).toEqual(['domain', 'app.siffra.se'])
const second = await resolveBrandByHost('app.siffra.se')
expect(second?.id).toBe('brand-1')
// Cache hit: only the first call reached the database.
expect(mock.supabase.from).toHaveBeenCalledTimes(1)
})
it('returns null for unknown hosts and caches the miss', async () => {
mock.enqueue({ data: null })
expect(await resolveBrandByHost('app.gnubok.se')).toBeNull()
expect(await resolveBrandByHost('app.gnubok.se')).toBeNull()
expect(mock.supabase.from).toHaveBeenCalledTimes(1)
})
it('returns null without touching the database for an empty host', async () => {
expect(await resolveBrandByHost('')).toBeNull()
expect(mock.supabase.from).not.toHaveBeenCalled()
})
it('expires cache entries after the TTL', async () => {
vi.useFakeTimers()
mock.enqueueMany([{ data: brandRow }, { data: brandRow }])
await resolveBrandByHost('app.siffra.se')
vi.advanceTimersByTime(59_000)
await resolveBrandByHost('app.siffra.se')
expect(mock.supabase.from).toHaveBeenCalledTimes(1)
vi.advanceTimersByTime(2_000)
await resolveBrandByHost('app.siffra.se')
expect(mock.supabase.from).toHaveBeenCalledTimes(2)
})
it('does not cache a query error, so the next call retries', async () => {
mock.enqueue({ data: null, error: { message: 'boom' } })
expect(await resolveBrandByHost('app.siffra.se')).toBeNull()
mock.enqueue({ data: brandRow })
const brand = await resolveBrandByHost('app.siffra.se')
expect(brand?.id).toBe('brand-1')
expect(mock.supabase.from).toHaveBeenCalledTimes(2)
})
})
describe('resolveBrandForCompany', () => {
it('resolves companies.team_id -> brands.team_id', async () => {
mock.enqueueMany([{ data: { team_id: 'team-1' } }, { data: brandRow }])
const brand = await resolveBrandForCompany('company-1')
expect(brand?.teamId).toBe('team-1')
expect(mock.findCall('companies', 'eq')).toEqual(['id', 'company-1'])
expect(mock.findCall('brands', 'eq')).toEqual(['team_id', 'team-1'])
})
it('returns null and caches when the company has no team', async () => {
mock.enqueue({ data: { team_id: null } })
expect(await resolveBrandForCompany('company-1')).toBeNull()
expect(await resolveBrandForCompany('company-1')).toBeNull()
// One from('companies') call total; never reached brands.
expect(mock.supabase.from).toHaveBeenCalledTimes(1)
expect(mock.findCall('brands', 'eq')).toBeUndefined()
})
it('returns null when the company does not exist', async () => {
mock.enqueue({ data: null })
expect(await resolveBrandForCompany('missing')).toBeNull()
})
it('returns null when the team has no brand, and caches per company key', async () => {
mock.enqueueMany([{ data: { team_id: 'team-9' } }, { data: null }])
expect(await resolveBrandForCompany('company-9')).toBeNull()
expect(await resolveBrandForCompany('company-9')).toBeNull()
expect(mock.supabase.from).toHaveBeenCalledTimes(2)
})
})
describe('deriveChromeColor', () => {
it('derives a deterministic deep chrome tone from the brand color', () => {
expect(deriveChromeColor('#2563eb')).toBe('#1c263b')
expect(deriveChromeColor('#2563eb')).toBe('#1c263b')
expect(deriveChromeColor('#dc2626')).toBe('#3b1c1c')
expect(deriveChromeColor('#304D83')).toBe('#1c273b')
})
it('keeps near-achromatic brand colors neutral instead of tinting them red', () => {
// Pure gray input: saturating to 30% would produce a dark red (hue 0).
expect(deriveChromeColor('#1a1a1a')).toBe('#262626')
})
it('always emits a six-digit lowercase hex color', () => {
for (const input of ['#ffffff', '#000000', '#00ff00', '#ABCDEF']) {
expect(deriveChromeColor(input)).toMatch(/^#[0-9a-f]{6}$/)
}
})
it('throws on invalid input (format is CHECK-enforced upstream)', () => {
expect(() => deriveChromeColor('blue')).toThrow(/Invalid hex color/)
})
})
describe('getEffectiveChrome', () => {
it('prefers the explicit chrome_color override', () => {
expect(getEffectiveChrome({ brandColor: '#2563eb', chromeColor: '#101418' })).toBe('#101418')
})
it('derives from the brand color when no override is set', () => {
expect(getEffectiveChrome({ brandColor: '#2563eb', chromeColor: null })).toBe('#1c263b')
})
})
describe('isBrandColorAccessible', () => {
it('accepts colors where white text clears 4.5:1', () => {
expect(isBrandColorAccessible('#1a1a1a')).toBe(true)
expect(isBrandColorAccessible('#2563eb')).toBe(true)
})
it('rejects colors where white text fails 4.5:1', () => {
expect(isBrandColorAccessible('#ffff00')).toBe(false)
expect(isBrandColorAccessible('#ffffff')).toBe(false)
})
it('rejects invalid hex strings instead of throwing', () => {
expect(isBrandColorAccessible('blue')).toBe(false)
expect(isBrandColorAccessible('#12345')).toBe(false)
expect(isBrandColorAccessible('')).toBe(false)
})
})
describe('clearBrandCache', () => {
it('forces the next resolution back to the database', async () => {
mock.enqueueMany([{ data: brandRow }, { data: brandRow }])
await resolveBrandByHost('app.siffra.se')
clearBrandCache()
await resolveBrandByHost('app.siffra.se')
expect(mock.supabase.from).toHaveBeenCalledTimes(2)
})
})