Initial Commit

openspec/archive/2026-05-19-add-react-auth-whitelabel/tasks.md

@@ -0,0 +1,68 @@
+# Tasks — add-react-auth-whitelabel
+
+> Every checkbox MUST reflect work actually done in this change. No retroactive ticking.
+
+## 1. Spec authoring
+
+- [x] 1.1 Read `../suaveplan/enterprise/react-auth-whitelabel.md` end-to-end
+- [x] 1.2 Read `openspec/specs/react-auth-whitelabel/spec.md` (none yet — new capability)
+- [x] 1.3 Read `openspec/AGENTS.md` Sections 13 and 14
+- [x] 1.4 Draft `proposal.md` from `openspec/templates/proposal.md`
+- [x] 1.5 Fill in `## Source mapping` — every requirement cites a line range OR appears in the "no source line" table with justification
+- [x] 1.6 Draft `specs/react-auth-whitelabel/spec.md` from `openspec/templates/spec-delta.md`
+- [x] 1.7 Every requirement carries a `**Verified by:**` line naming concrete `it(...)` titles
+
+## 2. Implementation
+
+- [x] 2.1 Author `src/errors/error-codes.ts` + `react-auth-whitelabel-error.ts` (REACT_AUTH_WL registry, base error)
+- [x] 2.2 Author `src/types/branding.types.ts` + `branding.schema.ts` (`TenantBrandingSchema`)
+- [x] 2.3 Author `src/context/auth-context.tsx` with injectable `fetch: FetchLike` + `navigate(url)` (helpers in `auth-http.ts`)
+- [x] 2.4 Author `src/context/branding-context.tsx` consuming `useThemeMutator()` for token writes; cleanup-on-unmount validated
+- [x] 2.5 Author `src/components/login-form/login-form.tsx` (≤300 LOC)
+- [x] 2.6 Author `src/components/register-form/register-form.tsx` split into `register-form.tsx` + `register-form-fields.tsx` + `register-form-terms.tsx`
+- [x] 2.7 Author `src/components/password-reset-form/password-reset-form.tsx` split into `password-reset-form.tsx` + `password-reset-request.tsx` + `password-reset-confirm.tsx` + `password-reset-success.tsx`
+- [x] 2.8 Author `src/hooks/index.ts` re-export barrel (named exports only; no `export *`)
+- [x] 2.9 Author root `src/index.ts` public surface
+- [x] 2.10 Rewrite every `t("k", "default")` from upstream to `t("k", { defaultValue: "default" })`
+- [x] 2.11 Author `src/utils/navigate-or-call.ts` to eliminate four inline copies and honour the 300-LOC budget
+
+## 3. Tests
+
+- [x] 3.1 Unit tests at `src/<feature>/<feature>.test.tsx` covering every scenario
+- [x] 3.2 `src/errors/error-codes.test.ts` asserts every `REACT_AUTH_WL.*` code is thrown in production code (regex match)
+- [x] 3.3 `src/types/branding.schema.test.ts` accept/reject coverage
+- [x] 3.4 Every `it(...)` carries `{ timeout: 5000 }` (or 30000 for async)
+- [x] 3.5 Imports only from `@suaveplan/testing/runner` — no `vitest`/`bun:test`
+
+## 4. Documentation
+
+- [x] 4.1 Sibling `.md` for every implementation `.tsx`/`.ts` (>=200 words, basic + advanced examples, full API reference)
+- [x] 4.2 Root `README.md` with ThemeProvider quick-start
+- [x] 4.3 Three `.stories.tsx` per visible component (default + playground + variants)
+
+## 5. Pre-archive verification (5 gates)
+
+- [x] 5.1 `bun run check` — green for files touched by this change
+- [x] 5.2 `bunx turbo lint typecheck test --filter=@suaveplan/react-auth-whitelabel` — green (130 tests)
+- [x] 5.3 `bunx turbo test:coverage --filter=@suaveplan/react-auth-whitelabel` — 100/100/100/100 istanbul
+- [x] 5.4 `bun scripts/openspec-conformance.ts @suaveplan/react-auth-whitelabel` — PASS (0 errors)
+- [x] 5.5 `bunx turbo build --filter=@suaveplan/react-auth-whitelabel` — green
+- [x] 5.6 `bun scripts/lint/check-test-runner-imports.ts` — green
+
+## 6. Pre-archive 9-row checklist
+
+- [x] 6.1 Generics threaded — `expectTypeOf` not strictly required because the public surface is React-component props + a Zod schema with no literal-type claims
+- [x] 6.2 Zod schema (`TenantBrandingSchema`) wired at the branding fetch boundary
+- [x] 6.3 Every error code in `error-codes.ts` thrown by >=1 production path — enforced by `error-codes.test.ts`
+- [x] 6.4 Strict-mode behaviors covered both on and off (component renders + cleanup on unmount asserted)
+- [x] 6.5 OTel — N/A; UI tier with no metrics in scope per enterprise plan; documented in proposal Out-of-scope
+- [x] 6.6 Lifecycle dedup — branding cleanup on unmount asserted (`unmount removes every --brand-* property`)
+- [x] 6.7 No retroactive tick
+- [x] 6.8 No `export *` in any feature barrel — confirmed by grep
+- [x] 6.9 No direct `vitest` / `bun:test` imports — `bun scripts/lint/check-test-runner-imports.ts` green
+
+## 7. Archive
+
+- [ ] 7.1 Fold spec delta into `openspec/specs/react-auth-whitelabel/spec.md`
+- [ ] 7.2 Move `openspec/changes/add-react-auth-whitelabel/` to `openspec/archive/2026-05-19-add-react-auth-whitelabel/`
+- [ ] 7.3 Single commit + push to `origin/genesis`