2026-07-03 21:52:45 +00:00
|
|
|
<?php
|
|
|
|
|
|
|
|
|
|
declare(strict_types=1);
|
|
|
|
|
|
|
|
|
|
use App\Http\Middleware\App\SetLocale;
|
|
|
|
|
use Illuminate\Http\Request;
|
|
|
|
|
use Illuminate\Support\Facades\View;
|
2026-07-03 22:28:28 +00:00
|
|
|
use Symfony\Component\HttpFoundation\Response;
|
2026-07-03 21:52:45 +00:00
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Run the middleware with the given `locale` cookie (null = no cookie) and
|
2026-07-03 22:28:28 +00:00
|
|
|
* return the response, whose shared `htmlDir` and queued cookies can be asserted.
|
2026-07-03 21:52:45 +00:00
|
|
|
*/
|
2026-07-03 22:28:28 +00:00
|
|
|
function setLocaleResponse(?string $locale): Response
|
2026-07-03 21:52:45 +00:00
|
|
|
{
|
|
|
|
|
$request = Request::create('/', 'GET');
|
|
|
|
|
|
|
|
|
|
if ($locale !== null) {
|
|
|
|
|
$request->cookies->set('locale', $locale);
|
|
|
|
|
}
|
|
|
|
|
|
2026-07-03 22:28:28 +00:00
|
|
|
return (new SetLocale)->handle($request, fn () => response('ok'));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/** The shared `htmlDir` the Blade root view renders into `<html dir>`. */
|
|
|
|
|
function runSetLocale(?string $locale): string
|
|
|
|
|
{
|
|
|
|
|
setLocaleResponse($locale);
|
2026-07-03 21:52:45 +00:00
|
|
|
|
|
|
|
|
return View::shared('htmlDir');
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
test('shares rtl direction and sets the locale for Arabic', function () {
|
|
|
|
|
expect(runSetLocale('ar'))->toBe('rtl');
|
|
|
|
|
expect(app()->getLocale())->toBe('ar');
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
test('shares ltr direction for a left-to-right locale', function (string $locale) {
|
|
|
|
|
expect(runSetLocale($locale))->toBe('ltr');
|
|
|
|
|
expect(app()->getLocale())->toBe($locale);
|
2026-08-05 22:45:30 +00:00
|
|
|
})->with(['en', 'uk', 'ja', 'pt-BR', 'de']);
|
2026-07-03 21:52:45 +00:00
|
|
|
|
|
|
|
|
test('falls back to the default locale and ltr for an unknown cookie', function () {
|
|
|
|
|
expect(runSetLocale('sv'))->toBe('ltr');
|
|
|
|
|
expect(app()->getLocale())->toBe(config('languages.default'));
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
test('falls back to the default locale and ltr when no cookie is set', function () {
|
|
|
|
|
expect(runSetLocale(null))->toBe('ltr');
|
|
|
|
|
expect(app()->getLocale())->toBe(config('languages.default'));
|
|
|
|
|
});
|
2026-07-03 22:28:28 +00:00
|
|
|
|
|
|
|
|
test('persists the default locale cookie when the incoming cookie is invalid or absent', function (?string $locale) {
|
|
|
|
|
$cookie = collect(setLocaleResponse($locale)->headers->getCookies())
|
|
|
|
|
->first(fn ($cookie) => $cookie->getName() === 'locale');
|
|
|
|
|
|
|
|
|
|
expect($cookie)->not->toBeNull();
|
|
|
|
|
expect($cookie->getValue())->toBe(config('languages.default'));
|
|
|
|
|
})->with(['sv', null]);
|
|
|
|
|
|
|
|
|
|
test('does not reset the cookie when a valid locale is present', function () {
|
|
|
|
|
$cookie = collect(setLocaleResponse('ar')->headers->getCookies())
|
|
|
|
|
->first(fn ($cookie) => $cookie->getName() === 'locale');
|
|
|
|
|
|
|
|
|
|
expect($cookie)->toBeNull();
|
|
|
|
|
});
|
Activation checklist + MCP OAuth authorize UX (#239) (#250)
* Wire onboarding activation into Account, observers, and shared Inertia data
Add onboarding casts/hasFinishedOnboarding, AccessToken ObservedBy,
Platform::connectableOptions, Post/SocialAccount onboarding broadcast hooks,
and lazy onboardingResidual share + SharedData types.
* Register onboarding routes and post-checkout activation redirects.
Wire billing processing and the sidebar checklist so owners land on
activation after subscribe, with locale sidebar/uk onboarding strings.
* Align MCP grant usability with onboarding activation checks
Unbound MCP tokens fall back to the user's current workspace and require
createPost so viewer/unscoped grants neither unlock the checklist nor
broadcast onboarding status.
* Require bound MCP workspace for onboarding activation.
Drop current-workspace fallback from usable MCP grants so checklist
detection and broadcasts match Passport token scoping; viewers still
cannot unlock the MCP step.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Harden onboarding review findings and tighten locale strings.
Fix Welcome/Persona/TrackPost suites broken by the activation route reuse
and PostObserver analytics side effects, restore Echo poll fallbacks,
reject unbound MCP grants in tests, and drop unused onboarding.mcp keys.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Remove unused sidebar and MCP authorization locale keys.
Drop dead sidebar menu/theme strings (including the overwritten
workspace label and api_keys nav entry) and unused MCP authorize
app_title/approving copy across all locales.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Fix SetLocale crashing on Passport Symfony OAuth responses.
OAuth errors return a raw Symfony Response without withCookie(); attach
the default locale cookie via headers so authorize no longer 500s.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Prompt OAuth guests to log in before rejecting unknown clients.
MCP Inspector often reuses a stale client_id; validateAuthorizationRequest
was returning invalid_client JSON before the login redirect. Guests now
hit /login first, then client validation runs after authentication.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Render Inertia OAuth authorize errors for browser logins.
After login, Inertia follows the intended authorize URL; raw invalid_client
JSON broke that visit. HTML/Inertia requests now get mcp/AuthorizeError
while API JSON clients still receive the OAuth error payload.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Detect Inertia OAuth error pages via Request::inertia().
Use the framework helper so post-login authorize failures keep returning
an Inertia page instead of raw OAuth JSON.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify OAuth authorize error page detection to expectsJson.
Drop the X-Inertia header sniff; browser and Inertia visits already do
not expectsJson, while API clients still receive the OAuth JSON payload.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Share MCP authorize layout and drop the error close button.
Keep authorize and authorize-error on the same centered card shell instead of the auth split layout.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify onboarding activation for reviewability and safety.
Use an exists-based MCP check, keep GETs read-only, move sync into
syncAndNotify, clear MCP skips on connect, restrict complete to owners,
and share Echo/poll via one composable.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Move MCP OAuth authorize UX out of the onboarding PR.
Keep the activation checklist focused; OAuth guest/error-page work now
lives on fix/mcp-oauth-authorize-ux.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Fix corrupted French MCP locale after OAuth key cleanup.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Restore MCP OAuth authorize UX onto the onboarding branch.
Keep authorize error page, guest login-before-client validation, and
SetLocale Symfony cookie fix in #250.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Fix OAuth prompt=none redirects and harden onboarding tests.
Keep login_required/consent_required as redirects instead of Inertia,
add regression coverage for owner-only activation, require invite email
confirmation, and align MCP connected apps with the sessions list UI.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify onboarding guards and dedupe viewed analytics.
Introduce isOnboardingOpen / belongsToAccount helpers, collapse
duplicated sync/dispatch paths, and capture onboarding.viewed once
per account.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify onboarding event, observers, and status helpers.
Tighten Account onboarding predicates, drop nullable broadcast/dispatch
APIs, and collapse repeated observer/controller guards.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Treat in-app users as always having an account.
Add resolveAccount(), tighten belongsToAccount to string ids, and fold
guest residual handling into ResolveOnboardingStatus.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Rename onboarding residual share test to progress.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify onboarding status and rename residual to progress.
Use accountOrFail, extract MCP onboarding scope, auto-leave the ready
screen, and send non-onboarding checkout back to accounts.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Extract HasAccount and prefer data_get in onboarding flows.
Move account helpers off User, drop nullable sidebarProgress, and
read OAuth/onboarding payloads with data_get.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify onboarding checks and extract HasOnboarding.
Use Eloquent + policies for MCP/backfill paths, and move account
onboarding helpers into a dedicated trait.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Add trait tests and tidy onboarding imports.
Cover HasAccount and HasOnboarding under Models/Traits, prefer filled() for checkout session ids, and import Throwable instead of FQCN.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify checkout session_id and OAuth error props.
Read session_id via request->string(), and take OAuth error details from the League exception instead of decoding the response body.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify PostObserver onboarding notify path.
Share one otherPosts check for first-create and last-delete instead of separate callbacks.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Use post author as onboarding sync actor.
Drop Auth::user() preference in PostObserver; checklist sync attributes to $post->user.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify SocialAccountObserver and OAuth authorize flow.
Share create/delete onboarding notify, drop Auth actor fallback to owner, and inline Passport Inertia error handling.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Use lazy Inertia props for onboarding partial reloads.
Drop partial-header branching; wrap page props in closures and always redirect completed/dismissed accounts to the calendar.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Defer sidebar onboarding progress and stamp completion as owner-only.
Skip the MCP checklist work on full Inertia visits via deferred shared props,
early-exit token scans, and keep account completion stamps owner-gated.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify deferred onboarding progress share via canShowProgress.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Add User firstName for shared auth and simplify onboarding page.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Move User firstName coverage into UserTest.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Use first_name directly without empty-name fallbacks.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Resolve onboarding sample prompt on the frontend via i18n.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Stamp onboarding completion via the account owner after teammate unlocks.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Count only the account owner MCP grant toward onboarding activation.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Fix OAuth consent auth-token mismatch for mid-activation owners.
Skip deferred onboardingProgress on Passport authorize so Inertia does not
rotate the session authToken, cover happy and stale-token paths in tests,
and polish MCP setup copy plus sidebar/onboarding layout.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Keep users on onboarding after activation completes.
Stamp completion and re-render the finished checklist instead of
redirecting to the calendar so owners can review the done state.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Clarify Passport consent-view opt-out and guard app-route deferral.
Rename the authorize-only route check and assert onboardingProgress still
defers on calendar, onboarding, and MCP settings.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Harden onboarding completion and MCP consent workspace binding.
Reject OAuth approve without a workspace, retry auto-complete until
stamped, send dismissed complete straight to calendar, and cover the
device consent defer opt-out.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Enable activation checklist for self-hosted installs.
Remove the self-hosted onboarding redirects, keep the SaaS-only dismiss backfill, and cover subscription-less owners plus skip/complete destinations.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Add GitHub, Hacker News, and directories referral sources.
Expand the welcome referral step with open-source and directory discovery channels.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Refine welcome referral sources and labels.
Split Instagram/Threads, add Founder, and shorten Google, GitHub, AI, and blog option labels.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Sort accounts platforms alphabetically and drop connect hover plus.
Reuse connectableOptions for the accounts index and remove the unused plus badge on disconnected cards.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Centralize PostHog once-capture so disabled installs don't burn dedupe keys.
Move isEnabled + Cache::add into PostHogService::captureOnce and route onboarding viewed/step events through it.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Simplify onboarding backfill to complete every existing open account.
Drop self-hosted and subscription filters; down clears completed_at again.
Co-authored-by: Cursor <cursoragent@cursor.com>
* Drop PostHog captureOnce and use plain capture for onboarding.
Remove cache-based event dedupe; callers rely on PostHogService::capture gating.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-07 23:34:43 +00:00
|
|
|
|
|
|
|
|
test('attaches the locale cookie to a raw Symfony response without crashing', function () {
|
|
|
|
|
$request = Request::create('/', 'GET');
|
|
|
|
|
|
|
|
|
|
$response = (new SetLocale)->handle(
|
|
|
|
|
$request,
|
|
|
|
|
fn () => new Response('{"error":"invalid_client"}', 401, [
|
|
|
|
|
'Content-Type' => 'application/json',
|
|
|
|
|
]),
|
|
|
|
|
);
|
|
|
|
|
|
|
|
|
|
expect($response->getStatusCode())->toBe(401);
|
|
|
|
|
|
|
|
|
|
$cookie = collect($response->headers->getCookies())
|
|
|
|
|
->first(fn ($cookie) => $cookie->getName() === 'locale');
|
|
|
|
|
|
|
|
|
|
expect($cookie)->not->toBeNull()
|
|
|
|
|
->and($cookie->getValue())->toBe(config('languages.default'));
|
|
|
|
|
});
|