Lucas RayanandClaude Opus 5
132cecd41c
Three separate gaps, all of which made the F4 interface non-functional or unprotected: The admin console rendered for anyone. There was no middleware and no guard in the layout, so /admin/dashboard returned 200 unauthenticated - only its data calls failed. middleware.ts now redirects both surfaces to their login when the session cookie is missing, expired, carries the wrong audience, or is a pre-MFA challenge token. It reads the claims without verifying the signature on purpose: the signing key belongs to the auth service and must not reach the browser bundle. That is sound because this is not the boundary - every /api/v1 request is verified for real upstream. Nothing served /api/v1/*. next.config.ts had no rewrites and there were no route handlers, so every call the pages made 404'd against the Next server, while AUTH_SERVICE_URL sat unused. A catch-all route now proxies to the auth service, forwarding the client address and preserving multiple Set-Cookie headers, which logout needs to clear both surfaces. Session cookies also move to Path=/, since a cookie pinned to /user or /admin was never sent with the /api/v1 requests that needed it. i18n existed only as files. The three bundles had perfect key parity and real translations, but no library, no imports and no switcher: the UI was hardcoded English and i18n.test.ts compared keys while the feature was absent. There is now a provider, a hook, a language switcher, and server-side Accept-Language negotiation that honours q-values and matches a bare "pt" to pt-BR. Logins, both layouts and the settings screen consume it; the admin pages still have English titles. The settings screen invented app passwords in the browser with Math.random and never stored them. It now calls the API, which returns the password once and keeps only its hash. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
81 lines
3.0 KiB
TypeScript
81 lines
3.0 KiB
TypeScript
import { describe, it, expect } from "vitest";
|
|
import { readFileSync } from "node:fs";
|
|
import { resolve } from "node:path";
|
|
|
|
function loadJson(filename: string): Record<string, unknown> {
|
|
const path = resolve(process.cwd(), "messages", filename);
|
|
return JSON.parse(readFileSync(path, "utf8"));
|
|
}
|
|
|
|
function getLeafKeys(obj: Record<string, unknown>, prefix = ""): string[] {
|
|
let keys: string[] = [];
|
|
for (const key of Object.keys(obj)) {
|
|
const val = obj[key];
|
|
const fullKey = prefix ? `${prefix}.${key}` : key;
|
|
if (typeof val === "object" && val !== null && !Array.isArray(val)) {
|
|
keys = keys.concat(getLeafKeys(val as Record<string, unknown>, fullKey));
|
|
} else {
|
|
keys.push(fullKey);
|
|
}
|
|
}
|
|
return keys.sort();
|
|
}
|
|
|
|
describe("i18n message bundles", () => {
|
|
const en = loadJson("en.json");
|
|
const ptBR = loadJson("pt-BR.json");
|
|
const es = loadJson("es.json");
|
|
|
|
const enKeys = getLeafKeys(en);
|
|
const ptKeys = getLeafKeys(ptBR);
|
|
const esKeys = getLeafKeys(es);
|
|
|
|
it("has exact key parity between en.json (source of truth) and pt-BR.json", () => {
|
|
expect(ptKeys).toEqual(enKeys);
|
|
});
|
|
|
|
it("has exact key parity between en.json (source of truth) and es.json", () => {
|
|
expect(esKeys).toEqual(enKeys);
|
|
});
|
|
});
|
|
|
|
// Key parity alone passed while the interface was hardcoded English and the
|
|
// bundles were never imported. These tests check the wiring instead.
|
|
describe("i18n is actually wired into the app", () => {
|
|
it("resolves a key through the same helper the components use", async () => {
|
|
const { MESSAGES, translate } = await import("./i18n/config.js");
|
|
expect(translate(MESSAGES["pt-BR"], "auth.signInButton")).not.toBe("auth.signInButton");
|
|
expect(translate(MESSAGES["pt-BR"], "auth.signInButton")).not.toBe(
|
|
translate(MESSAGES.en, "auth.signInButton"),
|
|
);
|
|
});
|
|
|
|
it("falls back to the key rather than throwing on an unknown lookup", async () => {
|
|
const { MESSAGES, translate } = await import("./i18n/config.js");
|
|
expect(translate(MESSAGES.en, "nope.missing")).toBe("nope.missing");
|
|
});
|
|
|
|
it("negotiates a locale from Accept-Language, honouring q-values and bare tags", async () => {
|
|
const { negotiateLocale } = await import("./i18n/config.js");
|
|
expect(negotiateLocale("pt-BR,pt;q=0.9,en;q=0.8")).toBe("pt-BR");
|
|
expect(negotiateLocale("pt")).toBe("pt-BR");
|
|
expect(negotiateLocale("es-AR,es;q=0.9")).toBe("es");
|
|
expect(negotiateLocale("en-US")).toBe("en");
|
|
expect(negotiateLocale("de-DE")).toBe("en");
|
|
expect(negotiateLocale(null)).toBe("en");
|
|
// A low-quality preferred tag must not beat a higher-quality supported one.
|
|
expect(negotiateLocale("de;q=1.0,es;q=0.9")).toBe("es");
|
|
});
|
|
|
|
it("keeps every UI string reachable: the layouts import the provider", async () => {
|
|
const { readFileSync } = await import("node:fs");
|
|
for (const file of [
|
|
"src/app/layout.tsx",
|
|
"src/app/(user)/user/layout.tsx",
|
|
"src/app/(admin)/admin/layout.tsx",
|
|
]) {
|
|
expect(readFileSync(file, "utf8")).toMatch(/i18n\/(provider|config)/);
|
|
}
|
|
});
|
|
});
|