# Tasks — Add @suaveplan/react-auth — pages + PermissionGate (Wave 3)

> No retroactive ticks. Each box reflects work done in this change.

## 1. Spec authoring

- [ ] 1.1 Read `../suaveplan/enterprise/react-auth.md` end-to-end
- [ ] 1.2 Read `openspec/specs/react-auth/spec.md` (Wave 1 + Wave 2 canonical)
- [ ] 1.3 Read `openspec/AGENTS.md` §§ 2a, 6a, 7, 12, 13, 14
- [ ] 1.4 Draft `proposal.md` from template with `## Source mapping`
- [ ] 1.5 Draft `specs/react-auth/spec.md` delta with `## ADDED Requirements`, one per page + PermissionGate
- [ ] 1.6 Every requirement carries a `**Verified by:**` line at draft time

## 2. Implementation

- [ ] 2.1 Add 7 subpath exports to `package.json` `exports` block
- [ ] 2.2 Extend `vite.config.ts` `lib.entry` with 7 new entries
- [ ] 2.3 Ship `src/pages/login/` (page.tsx, .test.tsx, .md, .stories.tsx, index.ts)
- [ ] 2.4 Ship `src/pages/register/`
- [ ] 2.5 Ship `src/pages/forgot-password/`
- [ ] 2.6 Ship `src/pages/reset-password/`
- [ ] 2.7 Ship `src/pages/email-verification/` (also includes .types.ts)
- [ ] 2.8 Ship `src/pages/profile/` (split into `profile.tsx` + `profile-sections.tsx` to honour the 300-line cap; .types.ts; .md; .stories.tsx; index.ts; .test.tsx)
- [ ] 2.9 Ship `src/components/permission-gate/`
- [ ] 2.10 Extend `src/components/index.ts` with `PermissionGate` named re-export
- [ ] 2.11 Extend `src/index.ts` with the 7 new symbols (named re-exports only)
- [ ] 2.12 Extend `src/index.test.ts` expected-keys list with the 7 new symbols
- [ ] 2.13 Add `profilePage` group to `en-gb.ts` / `cy-gb.ts` / `zh-cn.ts` under `auth.profilePage`

## 3. Tests

- [ ] 3.1 `src/pages/login/login.test.tsx` — guard redirect, happy path, returnTo, error swallow
- [ ] 3.2 `src/pages/register/register.test.tsx` — guard redirect, strip confirmPassword, navigate, error swallow
- [ ] 3.3 `src/pages/forgot-password/forgot-password.test.tsx` — happy path, reset, error
- [ ] 3.4 `src/pages/reset-password/reset-password.test.tsx` — missing token, happy path, CTAs
- [ ] 3.5 `src/pages/email-verification/email-verification.test.tsx` — missing token, success, expired, CTAs
- [ ] 3.6 `src/pages/profile/profile.test.tsx` — guard, tab switching, profile update, password change validation, delete account
- [ ] 3.7 `src/components/permission-gate/permission-gate.test.tsx` — allow, deny, requireAll, numeric, unauthenticated
- [ ] 3.8 Every `it(...)` carries `{ timeout: 5000 }`
- [ ] 3.9 All tests import from `@suaveplan/testing/runner`

## 4. Documentation

- [ ] 4.1 Sibling `.md` for every page + PermissionGate + ProfileSections (≥200 words, Basic + Advanced examples, full API reference)
- [ ] 4.2 No README changes (Wave 1's README already lists subpaths generically)

## 5. Pre-archive 6-gate verification

- [ ] 5.1 `bun run check` — Biome clean across the monorepo
- [ ] 5.2 `bunx turbo lint typecheck test --filter=@suaveplan/react-auth --force` — green
- [ ] 5.3 `bunx turbo test:coverage --filter=@suaveplan/react-auth` — 100/100/100/100 istanbul
- [ ] 5.4 `bun scripts/openspec-conformance.ts @suaveplan/react-auth` — exit 0
- [ ] 5.5 `bunx turbo build --filter=@suaveplan/react-auth --force` — green
- [ ] 5.6 `bun scripts/lint/check-test-runner-imports.ts` — exit 0

## 6. Pre-archive 9-row checklist

- [ ] 6.1 Generics threaded — pages thread Wave 2 form prop generics; no `as any`
- [ ] 6.2 N/A — no new boundary input; pages re-use Wave 2's Zod boundaries
- [ ] 6.3 No new error codes introduced; pages swallow `useAuth()` action rejections (errors surface via the existing context `error` field)
- [ ] 6.4 N/A — no strict-mode behaviour toggle in this wave
- [ ] 6.5 N/A — no new OTel instruments in this wave (pages are routing adapters; metrics live on Wave 1 actions)
- [ ] 6.6 N/A — no lifecycle dedup claims on pages
- [ ] 6.7 No retroactive ticks
- [ ] 6.8 No `export *` in any feature-module barrel
- [ ] 6.9 No direct `vitest` / `bun:test` imports in test files

## 7. Archive

- [ ] 7.1 Fold spec delta — APPEND new requirements to `openspec/specs/react-auth/spec.md` under `## ADDED Requirements`; do NOT modify Wave 1 / Wave 2 requirements
- [ ] 7.2 Move `openspec/changes/add-react-auth-pages/` → `openspec/archive/2026-05-19-add-react-auth-pages/`
- [ ] 7.3 No MANIFEST.md / STATUS.md updates (not a new package)