suaveplan/openspec/archive/2026-05-19-add-react-auth-whitelabel/tasks.md

Tasks — add-react-auth-whitelabel

Every checkbox MUST reflect work actually done in this change. No retroactive ticking.

1. Spec authoring

• 1.1 Read ../suaveplan/enterprise/react-auth-whitelabel.md end-to-end
• 1.2 Read openspec/specs/react-auth-whitelabel/spec.md (none yet — new capability)
• 1.3 Read openspec/AGENTS.md Sections 13 and 14
• 1.4 Draft proposal.md from openspec/templates/proposal.md
• 1.5 Fill in ## Source mapping — every requirement cites a line range OR appears in the "no source line" table with justification
• 1.6 Draft specs/react-auth-whitelabel/spec.md from openspec/templates/spec-delta.md
• 1.7 Every requirement carries a **Verified by:** line naming concrete it(...) titles

2. Implementation

• 2.1 Author src/errors/error-codes.ts + react-auth-whitelabel-error.ts (REACT_AUTH_WL registry, base error)
• 2.2 Author src/types/branding.types.ts + branding.schema.ts (TenantBrandingSchema)
• 2.3 Author src/context/auth-context.tsx with injectable fetch: FetchLike + navigate(url) (helpers in auth-http.ts)
• 2.4 Author src/context/branding-context.tsx consuming useThemeMutator() for token writes; cleanup-on-unmount validated
• 2.5 Author src/components/login-form/login-form.tsx (≤300 LOC)
• 2.6 Author src/components/register-form/register-form.tsx split into register-form.tsx + register-form-fields.tsx + register-form-terms.tsx
• 2.7 Author src/components/password-reset-form/password-reset-form.tsx split into password-reset-form.tsx + password-reset-request.tsx + password-reset-confirm.tsx + password-reset-success.tsx
• 2.8 Author src/hooks/index.ts re-export barrel (named exports only; no export *)
• 2.9 Author root src/index.ts public surface
• 2.10 Rewrite every t("k", "default") from upstream to t("k", { defaultValue: "default" })
• 2.11 Author src/utils/navigate-or-call.ts to eliminate four inline copies and honour the 300-LOC budget

3. Tests

• 3.1 Unit tests at src/<feature>/<feature>.test.tsx covering every scenario
• 3.2 src/errors/error-codes.test.ts asserts every REACT_AUTH_WL.* code is thrown in production code (regex match)
• 3.3 src/types/branding.schema.test.ts accept/reject coverage
• 3.4 Every it(...) carries { timeout: 5000 } (or 30000 for async)
• 3.5 Imports only from @suaveplan/testing/runner — no vitest/bun:test

4. Documentation

• 4.1 Sibling .md for every implementation .tsx/.ts (>=200 words, basic + advanced examples, full API reference)
• 4.2 Root README.md with ThemeProvider quick-start
• 4.3 Three .stories.tsx per visible component (default + playground + variants)

5. Pre-archive verification (5 gates)

• 5.1 bun run check — green for files touched by this change
• 5.2 bunx turbo lint typecheck test --filter=@suaveplan/react-auth-whitelabel — green (130 tests)
• 5.3 bunx turbo test:coverage --filter=@suaveplan/react-auth-whitelabel — 100/100/100/100 istanbul
• 5.4 bun scripts/openspec-conformance.ts @suaveplan/react-auth-whitelabel — PASS (0 errors)
• 5.5 bunx turbo build --filter=@suaveplan/react-auth-whitelabel — green
• 5.6 bun scripts/lint/check-test-runner-imports.ts — green

6. Pre-archive 9-row checklist

• 6.1 Generics threaded — expectTypeOf not strictly required because the public surface is React-component props + a Zod schema with no literal-type claims
• 6.2 Zod schema (TenantBrandingSchema) wired at the branding fetch boundary
• 6.3 Every error code in error-codes.ts thrown by >=1 production path — enforced by error-codes.test.ts
• 6.4 Strict-mode behaviors covered both on and off (component renders + cleanup on unmount asserted)
• 6.5 OTel — N/A; UI tier with no metrics in scope per enterprise plan; documented in proposal Out-of-scope
• 6.6 Lifecycle dedup — branding cleanup on unmount asserted (unmount removes every --brand-* property)
• 6.7 No retroactive tick
• 6.8 No export * in any feature barrel — confirmed by grep
• 6.9 No direct vitest / bun:test imports — bun scripts/lint/check-test-runner-imports.ts green

7. Archive

• 7.1 Fold spec delta into openspec/specs/react-auth-whitelabel/spec.md
• 7.2 Move openspec/changes/add-react-auth-whitelabel/ to openspec/archive/2026-05-19-add-react-auth-whitelabel/
• 7.3 Single commit + push to origin/genesis