# Tasks — add-react-auth-whitelabel

> Every checkbox MUST reflect work actually done in this change. No retroactive ticking.

## 1. Spec authoring

- [x] 1.1 Read `../suaveplan/enterprise/react-auth-whitelabel.md` end-to-end
- [x] 1.2 Read `openspec/specs/react-auth-whitelabel/spec.md` (none yet — new capability)
- [x] 1.3 Read `openspec/AGENTS.md` Sections 13 and 14
- [x] 1.4 Draft `proposal.md` from `openspec/templates/proposal.md`
- [x] 1.5 Fill in `## Source mapping` — every requirement cites a line range OR appears in the "no source line" table with justification
- [x] 1.6 Draft `specs/react-auth-whitelabel/spec.md` from `openspec/templates/spec-delta.md`
- [x] 1.7 Every requirement carries a `**Verified by:**` line naming concrete `it(...)` titles

## 2. Implementation

- [x] 2.1 Author `src/errors/error-codes.ts` + `react-auth-whitelabel-error.ts` (REACT_AUTH_WL registry, base error)
- [x] 2.2 Author `src/types/branding.types.ts` + `branding.schema.ts` (`TenantBrandingSchema`)
- [x] 2.3 Author `src/context/auth-context.tsx` with injectable `fetch: FetchLike` + `navigate(url)` (helpers in `auth-http.ts`)
- [x] 2.4 Author `src/context/branding-context.tsx` consuming `useThemeMutator()` for token writes; cleanup-on-unmount validated
- [x] 2.5 Author `src/components/login-form/login-form.tsx` (≤300 LOC)
- [x] 2.6 Author `src/components/register-form/register-form.tsx` split into `register-form.tsx` + `register-form-fields.tsx` + `register-form-terms.tsx`
- [x] 2.7 Author `src/components/password-reset-form/password-reset-form.tsx` split into `password-reset-form.tsx` + `password-reset-request.tsx` + `password-reset-confirm.tsx` + `password-reset-success.tsx`
- [x] 2.8 Author `src/hooks/index.ts` re-export barrel (named exports only; no `export *`)
- [x] 2.9 Author root `src/index.ts` public surface
- [x] 2.10 Rewrite every `t("k", "default")` from upstream to `t("k", { defaultValue: "default" })`
- [x] 2.11 Author `src/utils/navigate-or-call.ts` to eliminate four inline copies and honour the 300-LOC budget

## 3. Tests

- [x] 3.1 Unit tests at `src/<feature>/<feature>.test.tsx` covering every scenario
- [x] 3.2 `src/errors/error-codes.test.ts` asserts every `REACT_AUTH_WL.*` code is thrown in production code (regex match)
- [x] 3.3 `src/types/branding.schema.test.ts` accept/reject coverage
- [x] 3.4 Every `it(...)` carries `{ timeout: 5000 }` (or 30000 for async)
- [x] 3.5 Imports only from `@suaveplan/testing/runner` — no `vitest`/`bun:test`

## 4. Documentation

- [x] 4.1 Sibling `.md` for every implementation `.tsx`/`.ts` (>=200 words, basic + advanced examples, full API reference)
- [x] 4.2 Root `README.md` with ThemeProvider quick-start
- [x] 4.3 Three `.stories.tsx` per visible component (default + playground + variants)

## 5. Pre-archive verification (5 gates)

- [x] 5.1 `bun run check` — green for files touched by this change
- [x] 5.2 `bunx turbo lint typecheck test --filter=@suaveplan/react-auth-whitelabel` — green (130 tests)
- [x] 5.3 `bunx turbo test:coverage --filter=@suaveplan/react-auth-whitelabel` — 100/100/100/100 istanbul
- [x] 5.4 `bun scripts/openspec-conformance.ts @suaveplan/react-auth-whitelabel` — PASS (0 errors)
- [x] 5.5 `bunx turbo build --filter=@suaveplan/react-auth-whitelabel` — green
- [x] 5.6 `bun scripts/lint/check-test-runner-imports.ts` — green

## 6. Pre-archive 9-row checklist

- [x] 6.1 Generics threaded — `expectTypeOf` not strictly required because the public surface is React-component props + a Zod schema with no literal-type claims
- [x] 6.2 Zod schema (`TenantBrandingSchema`) wired at the branding fetch boundary
- [x] 6.3 Every error code in `error-codes.ts` thrown by >=1 production path — enforced by `error-codes.test.ts`
- [x] 6.4 Strict-mode behaviors covered both on and off (component renders + cleanup on unmount asserted)
- [x] 6.5 OTel — N/A; UI tier with no metrics in scope per enterprise plan; documented in proposal Out-of-scope
- [x] 6.6 Lifecycle dedup — branding cleanup on unmount asserted (`unmount removes every --brand-* property`)
- [x] 6.7 No retroactive tick
- [x] 6.8 No `export *` in any feature barrel — confirmed by grep
- [x] 6.9 No direct `vitest` / `bun:test` imports — `bun scripts/lint/check-test-runner-imports.ts` green

## 7. Archive

- [ ] 7.1 Fold spec delta into `openspec/specs/react-auth-whitelabel/spec.md`
- [ ] 7.2 Move `openspec/changes/add-react-auth-whitelabel/` to `openspec/archive/2026-05-19-add-react-auth-whitelabel/`
- [ ] 7.3 Single commit + push to `origin/genesis`