suaveplan/openspec/archive/2026-05-19-add-react-auth-pages/tasks.md

Tasks — Add @suaveplan/react-auth — pages + PermissionGate (Wave 3)

No retroactive ticks. Each box reflects work done in this change.

1. Spec authoring

• 1.1 Read ../suaveplan/enterprise/react-auth.md end-to-end
• 1.2 Read openspec/specs/react-auth/spec.md (Wave 1 + Wave 2 canonical)
• 1.3 Read openspec/AGENTS.md §§ 2a, 6a, 7, 12, 13, 14
• 1.4 Draft proposal.md from template with ## Source mapping
• 1.5 Draft specs/react-auth/spec.md delta with ## ADDED Requirements, one per page + PermissionGate
• 1.6 Every requirement carries a **Verified by:** line at draft time

2. Implementation

• 2.1 Add 7 subpath exports to package.json exports block
• 2.2 Extend vite.config.ts lib.entry with 7 new entries
• 2.3 Ship src/pages/login/ (page.tsx, .test.tsx, .md, .stories.tsx, index.ts)
• 2.4 Ship src/pages/register/
• 2.5 Ship src/pages/forgot-password/
• 2.6 Ship src/pages/reset-password/
• 2.7 Ship src/pages/email-verification/ (also includes .types.ts)
• 2.8 Ship src/pages/profile/ (split into profile.tsx + profile-sections.tsx to honour the 300-line cap; .types.ts; .md; .stories.tsx; index.ts; .test.tsx)
• 2.9 Ship src/components/permission-gate/
• 2.10 Extend src/components/index.ts with PermissionGate named re-export
• 2.11 Extend src/index.ts with the 7 new symbols (named re-exports only)
• 2.12 Extend src/index.test.ts expected-keys list with the 7 new symbols
• 2.13 Add profilePage group to en-gb.ts / cy-gb.ts / zh-cn.ts under auth.profilePage

3. Tests

• 3.1 src/pages/login/login.test.tsx — guard redirect, happy path, returnTo, error swallow
• 3.2 src/pages/register/register.test.tsx — guard redirect, strip confirmPassword, navigate, error swallow
• 3.3 src/pages/forgot-password/forgot-password.test.tsx — happy path, reset, error
• 3.4 src/pages/reset-password/reset-password.test.tsx — missing token, happy path, CTAs
• 3.5 src/pages/email-verification/email-verification.test.tsx — missing token, success, expired, CTAs
• 3.6 src/pages/profile/profile.test.tsx — guard, tab switching, profile update, password change validation, delete account
• 3.7 src/components/permission-gate/permission-gate.test.tsx — allow, deny, requireAll, numeric, unauthenticated
• 3.8 Every it(...) carries { timeout: 5000 }
• 3.9 All tests import from @suaveplan/testing/runner

4. Documentation

• 4.1 Sibling .md for every page + PermissionGate + ProfileSections (≥200 words, Basic + Advanced examples, full API reference)
• 4.2 No README changes (Wave 1's README already lists subpaths generically)

5. Pre-archive 6-gate verification

• 5.1 bun run check — Biome clean across the monorepo
• 5.2 bunx turbo lint typecheck test --filter=@suaveplan/react-auth --force — green
• 5.3 bunx turbo test:coverage --filter=@suaveplan/react-auth — 100/100/100/100 istanbul
• 5.4 bun scripts/openspec-conformance.ts @suaveplan/react-auth — exit 0
• 5.5 bunx turbo build --filter=@suaveplan/react-auth --force — green
• 5.6 bun scripts/lint/check-test-runner-imports.ts — exit 0

6. Pre-archive 9-row checklist

• 6.1 Generics threaded — pages thread Wave 2 form prop generics; no as any
• 6.2 N/A — no new boundary input; pages re-use Wave 2's Zod boundaries
• 6.3 No new error codes introduced; pages swallow useAuth() action rejections (errors surface via the existing context error field)
• 6.4 N/A — no strict-mode behaviour toggle in this wave
• 6.5 N/A — no new OTel instruments in this wave (pages are routing adapters; metrics live on Wave 1 actions)
• 6.6 N/A — no lifecycle dedup claims on pages
• 6.7 No retroactive ticks
• 6.8 No export * in any feature-module barrel
• 6.9 No direct vitest / bun:test imports in test files

7. Archive

• 7.1 Fold spec delta — APPEND new requirements to openspec/specs/react-auth/spec.md under ## ADDED Requirements; do NOT modify Wave 1 / Wave 2 requirements
• 7.2 Move openspec/changes/add-react-auth-pages/ → openspec/archive/2026-05-19-add-react-auth-pages/
• 7.3 No MANIFEST.md / STATUS.md updates (not a new package)