From 220f7f54c502890aa990b89b2537c9b1f535e427 Mon Sep 17 00:00:00 2001 From: axiomlogicnexus Date: Mon, 22 Jun 2026 03:10:55 +0000 Subject: [PATCH] Test website app bootstrap behavior --- ...LING_AND_DISTRIBUTION_PACKET_2026-06-22.md | 1 + .../HyperTwist/FEATURE_REGISTRY.md | 2 +- .../HyperTwist/ROADMAP.md | 2 + website/README.md | 1 + website/src/__tests__/App.bootstrap.test.tsx | 76 +++++++++++++++++++ 5 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 website/src/__tests__/App.bootstrap.test.tsx diff --git a/docs/ops/HYPERTWIST_PUBLIC_WEBSITE_AUTH_BILLING_AND_DISTRIBUTION_PACKET_2026-06-22.md b/docs/ops/HYPERTWIST_PUBLIC_WEBSITE_AUTH_BILLING_AND_DISTRIBUTION_PACKET_2026-06-22.md index 433500c..8a233ed 100644 --- a/docs/ops/HYPERTWIST_PUBLIC_WEBSITE_AUTH_BILLING_AND_DISTRIBUTION_PACKET_2026-06-22.md +++ b/docs/ops/HYPERTWIST_PUBLIC_WEBSITE_AUTH_BILLING_AND_DISTRIBUTION_PACKET_2026-06-22.md @@ -156,6 +156,7 @@ The frontend behavior coverage now also explicitly pins: - login/register page continuation behavior plus the public `/download` page rule that configured release targets still route through the protected dashboard instead of exposing raw URLs - protected app-route loading/redirect behavior plus auth-aware marketing/app shell actions - real `AppRouteTree` smoke coverage for homepage, pricing, download, login, dashboard, and dashboard-download routes through the lazy public/protected router itself +- top-level `App` bootstrap coverage for unknown-route redirect plus SuperTokens wrapper enabled-versus-fallback posture - dashboard launch-readiness visibility plus generated desktop-link verify URL behavior The first-party auth server now also supports bounded same-origin public serving diff --git a/docs/v6_5_deep_manual_pack/HyperTwist/FEATURE_REGISTRY.md b/docs/v6_5_deep_manual_pack/HyperTwist/FEATURE_REGISTRY.md index aeecad6..09ebf80 100644 --- a/docs/v6_5_deep_manual_pack/HyperTwist/FEATURE_REGISTRY.md +++ b/docs/v6_5_deep_manual_pack/HyperTwist/FEATURE_REGISTRY.md @@ -264,7 +264,7 @@ repo. | Feature | Status | Primary authority | Notes | |---|---|---|---| | Public `hypertwist.app` marketing shell | Implemented now | first-party `website/` app + feature registry/roadmap authority | HyperTwist now has a dedicated first-party public web surface for homepage, about, resources, pricing, download, support, and legal routes. This lane is separate from the embedded Unreal browser runtime under `Content/Browser/` and does not claim browser-simulator parity. The same package now also carries a first-party external runtime-readiness verifier so deploy-time env and live health posture can be checked outside the dashboard, plus separated local-versus-production env templates whose placeholder values are intentionally rejected until real launch config is in place, bootstrap CI now validates both the frontend and auth-server website commands directly, and the auth server can now auto-serve the built `website/dist` bundle with bounded SPA fallback for same-origin public deployment. Request-level server coverage now also proves that public/app shell delivery does not shadow `/api/*`, `/auth*`, `/health`, or missing asset paths. | -| Browser-based operator/account dashboard | Implemented now | first-party `website/` app + shared auth/dashboard packet | A protected browser dashboard is now live for operator access, account state, download posture, browser-access boundary explanation, notices review, and bounded billing/entitlement status. It reuses the shared SuperTokens auth posture proven in FamiliarOS and ScriptoriumAI while remaining HyperTwist-specific in product content and boundary claims, the current auth-health surface now truthfully distinguishes configured versus reachable or ready shared-core posture while exposing fallback-active reason instead of hardcoding readiness, and the same dashboard now also surfaces launch-readiness truth for download URLs, checkout links, source/notices URLs, billing-secret/map configuration, and local-versus-public runtime deployment posture. Focused frontend coverage now also protects deep-link login redirect preservation, safe `next`-path normalization across auth entry points, fallback/email auth-bootstrap normalization, login/register continuation behavior, public download-gating behavior, protected-route/shell behavior, real lazy-route tree behavior for key public and protected paths, and desktop-link verify-url/dashboard readiness behavior. | +| Browser-based operator/account dashboard | Implemented now | first-party `website/` app + shared auth/dashboard packet | A protected browser dashboard is now live for operator access, account state, download posture, browser-access boundary explanation, notices review, and bounded billing/entitlement status. It reuses the shared SuperTokens auth posture proven in FamiliarOS and ScriptoriumAI while remaining HyperTwist-specific in product content and boundary claims, the current auth-health surface now truthfully distinguishes configured versus reachable or ready shared-core posture while exposing fallback-active reason instead of hardcoding readiness, and the same dashboard now also surfaces launch-readiness truth for download URLs, checkout links, source/notices URLs, billing-secret/map configuration, and local-versus-public runtime deployment posture. Focused frontend coverage now also protects deep-link login redirect preservation, safe `next`-path normalization across auth entry points, fallback/email auth-bootstrap normalization, login/register continuation behavior, public download-gating behavior, protected-route/shell behavior, real lazy-route tree behavior for key public and protected paths, top-level app-bootstrap and SuperTokens-wrapper posture, and desktop-link verify-url/dashboard readiness behavior. | | Desktop download posture and browser-to-desktop pairing | Implemented now | first-party `website/` app + `website/server` desktop-link endpoints | Public download targets, dashboard-side release posture, and short-lived desktop-link token generation/verification are now first-party owned. The current server posture now enforces exact website-origin matching, bounded per-user issuance, one-time token consumption, and billing-backed plan/download entitlement resolution with focused `website/server` tests green on `2026-06-22`, and the verify handshake now returns the same resolved download-entitlement posture the dashboard sees instead of only identity plus plan/role. The public `/download` page now keeps raw download URLs behind the protected dashboard instead of exposing them directly. Actual release URLs remain deployment configuration rather than hardcoded product truth. | | Paddle-ready pricing and billing webhook seam | Implemented now | first-party `website/` app + `website/server` billing endpoint | The public pricing surface now exists with plan structure, checkout-link configuration seams, and the same `/api/billing/paddle/webhook` endpoint family used by the broader product website lane. The current server now verifies `Paddle-Signature` against `PADDLE_WEBHOOK_SECRET` using the documented raw-body HMAC flow, persists a bounded first-party billing state file, and applies verified Paddle events into account/download entitlement state that the browser dashboard consumes, with focused `website/server` tests green on `2026-06-22`. Production checkout URLs, secret management, and broader operator/admin billing workflows remain deployment/application tasks, not shipped-code omissions. | | Public open-source notices and corresponding-source surface | Implemented now | first-party `website/` app + `HYPERTWIST_MPL_DISTRIBUTION_PLACEMENT_CHECKLIST_2026-05-25.md` | HyperTwist now has a stable public `Open Source Notices` route linked from pricing, download, and footer surfaces, satisfying the requirement that public distribution surfaces expose notice and corresponding-source guidance when shipped builds contain `MPL`-covered material. The exact public corresponding-source URL still must be configured before external launch. | diff --git a/docs/v6_5_deep_manual_pack/HyperTwist/ROADMAP.md b/docs/v6_5_deep_manual_pack/HyperTwist/ROADMAP.md index fafd3b8..9c7530d 100644 --- a/docs/v6_5_deep_manual_pack/HyperTwist/ROADMAP.md +++ b/docs/v6_5_deep_manual_pack/HyperTwist/ROADMAP.md @@ -225,6 +225,8 @@ Current consolidated milestone snapshot: protected-route plus shell-action behavior, and dashboard launch-readiness plus desktop-link verify-url behavior, with real lazy-route smoke coverage now pinned for `/`, `/pricing`, `/download`, `/login`, `/app`, and `/app/downloads`, + plus top-level `App` bootstrap proof for unknown-route redirect and + SuperTokens-wrapper posture, and the auth server can now auto-serve the built `website/dist` bundle with bounded SPA fallback for same-origin `hypertwist.app` deployment when that build output is present, while the env templates and diff --git a/website/README.md b/website/README.md index de04820..4778c1e 100644 --- a/website/README.md +++ b/website/README.md @@ -98,4 +98,5 @@ The focused frontend test coverage now also pins: - login/register page continuation behavior and protected-dashboard download gating on the public download page - protected-route loading/redirect behavior plus auth-aware marketing/app shell actions - real `AppRouteTree` smoke coverage for `/`, `/pricing`, `/download`, `/login`, `/app`, and `/app/downloads` +- top-level `App` bootstrap coverage for unknown-route redirect and SuperTokens wrapper on/off posture - dashboard launch-readiness plus desktop-link verify-url behavior diff --git a/website/src/__tests__/App.bootstrap.test.tsx b/website/src/__tests__/App.bootstrap.test.tsx new file mode 100644 index 0000000..59b5c7a --- /dev/null +++ b/website/src/__tests__/App.bootstrap.test.tsx @@ -0,0 +1,76 @@ +import { cleanup, render, screen, waitFor } from '@testing-library/react' +import { beforeEach, describe, expect, it, vi } from 'vitest' + +const mockUsePlatformAuth = vi.fn() +const mockIsSuperTokensConfigured = vi.fn(() => false) + +vi.mock('../auth/platform-auth', () => ({ + PlatformAuthProvider: ({ children }: { children: React.ReactNode }) => <>{children}, + usePlatformAuth: () => mockUsePlatformAuth(), +})) + +vi.mock('../auth/supertokens-client', () => ({ + isSuperTokensConfigured: () => mockIsSuperTokensConfigured(), +})) + +vi.mock('supertokens-auth-react', () => ({ + SuperTokensWrapper: ({ children }: { children: React.ReactNode }) => ( +
{children}
+ ), +})) + +import App from '../App' + +describe('App bootstrap', () => { + beforeEach(() => { + cleanup() + mockUsePlatformAuth.mockReset() + mockIsSuperTokensConfigured.mockReset() + mockIsSuperTokensConfigured.mockReturnValue(false) + mockUsePlatformAuth.mockReturnValue({ + isAuthenticated: false, + isLoading: false, + login: vi.fn(), + register: vi.fn(), + logout: vi.fn(), + toggleColorMode: vi.fn(), + colorMode: 'dark', + superTokensConfigured: false, + user: null, + }) + window.history.replaceState({}, '', '/') + }) + + it('redirects unknown routes to the homepage through the real app root', async () => { + window.history.replaceState({}, '', '/totally-unknown') + + render() + + expect(await screen.findByText('HyperTwist turns cube practice into a real operator-grade training stack.')).toBeTruthy() + await waitFor(() => { + expect(window.location.pathname).toBe('/') + }) + expect(screen.queryByTestId('supertokens-wrapper')).toBeNull() + }) + + it('wraps the app in SuperTokens when configured and still renders the real public route', async () => { + mockIsSuperTokensConfigured.mockReturnValue(true) + mockUsePlatformAuth.mockReturnValue({ + isAuthenticated: false, + isLoading: false, + login: vi.fn(), + register: vi.fn(), + logout: vi.fn(), + toggleColorMode: vi.fn(), + colorMode: 'dark', + superTokensConfigured: true, + user: null, + }) + window.history.replaceState({}, '', '/pricing') + + render() + + expect(await screen.findByText('Pricing that matches the actual delivery model.')).toBeTruthy() + expect(screen.getByTestId('supertokens-wrapper')).toBeTruthy() + }) +})