Add post-subscription onboarding activation

.claude/release-assets/render-thumbnail.mjs

@@ -16,11 +16,11 @@
 // Playwright is resolved from the repo's node_modules, so the script works
 // regardless of where it is invoked.
 
-import { createRequire } from 'module';
 import { readFileSync, writeFileSync, unlinkSync } from 'fs';
-import { fileURLToPath } from 'url';
-import { dirname, join } from 'path';
+import { createRequire } from 'module';
 import { tmpdir } from 'os';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(here, '..', '..');

.cursor/rules/tests-dusk.mdc

@@ -1,43 +1,51 @@
 ---
-description: Laravel Dusk browser tests — named routes, dusk selectors, no CSS/text-based assertions
+description: Browser tests (Pest + Playwright) — named routes, data-testid selectors, no CSS/text-based assertions
 globs: tests/Browser/**/*.php
 alwaysApply: false
 ---
 
-# Dusk Browser Tests
+# Browser Tests
 
 ## Named routes (IMPORTANT)
 
 ALWAYS use named routes via the `route()` helper. NEVER hardcode URLs like `'https://trypost.test/login'`.
 
 ```php
 // BAD
-$browser->visit('https://trypost.test/login');
+visit('https://trypost.test/login');
 
 // GOOD
-$browser->visit(route('login'));
+visit(route('login'));
 ```
 
-## Dusk selectors
+## Selectors (IMPORTANT)
 
-ALWAYS use `dusk` selectors (`@selector-name`) for interactions and assertions. NEVER use CSS classes (`.text-red-600`), tag names, or text strings.
+ALWAYS use `data-testid` attributes and target them with `@selector-name`. NEVER use CSS classes (`.text-red-600`), tag names, or text strings.
 
-Add `dusk="my-element"` attributes to Vue components and target them with `$browser->click('@my-element')`, `$browser->waitFor('@my-element')`, etc.
+The Pest browser plugin resolves `@selector` against `[data-testid]` / `[data-test]` only — `dusk="..."` attributes are NOT matched (legacy from Laravel Dusk).
+
+Add `data-testid="my-element"` attributes to Vue components and target them with `$page->click('@my-element')`, `$page->assertVisible('@my-element')`, etc.
 
 ```php
 // BAD
-$browser->waitFor('.text-red-600');
-$browser->click('button.primary');
-$browser->assertSee('Welcome');
+$page->assertVisible('.text-red-600');
+$page->click('button.primary');
 
 // GOOD
-$browser->waitFor('@input-error');
-$browser->click('@submit-button');
-$browser->assertVisible('@welcome-message');
+$page->assertVisible('@input-error');
+$page->click('@submit-button');
 ```
 
 ```vue
 <!-- Vue component -->
-<button dusk="submit-button" @click="handleSubmit">Submit</button>
-<span dusk="input-error" v-if="error">{{ error }}</span>
+<button data-testid="submit-button" @click="handleSubmit">Submit</button>
+<span data-testid="input-error" v-if="error">{{ error }}</span>
 ```
+
+## No auto-wait
+
+Browser assertions do not auto-wait. Poll browser-side (see `waitForTestId` / `waitForDusk` helpers in existing tests) before asserting on async UI.
+
+## Strict models
+
+Use `->fresh()` when acting as a factory-created user — the in-process server keeps the guard user across requests, and factory instances lack nullable columns (strict mode throws `MissingAttributeException`).

.env.example

@@ -11,6 +11,13 @@ WEBHOOK_URL=
 # Self-hosted mode (skips payment requirements)
 SELF_HOSTED=true
 
+# Passport OAuth keys (API tokens / MCP). Prefer env vars over key files so
+# every node behind a load balancer shares the same key pair. Use literal \n
+# for newlines in the PEM. When unset, Passport falls back to storage/oauth-*.key
+# (generate with: php artisan passport:keys).
+# PASSPORT_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
+# PASSPORT_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"
+
 TELESCOPE_ENABLED=false
 
 APP_LOCALE=en
@@ -191,11 +198,17 @@ STRIPE_SECRET=
 STRIPE_WEBHOOK_SECRET=
 # Set to false to allow generic signup trial without requiring a card.
 REQUIRE_CARD_FOR_TRIAL=true
-# Free trial length in days, used only for the no-card generic trial above.
+# Checkout trial length in days (card collected up front when REQUIRE_CARD_FOR_TRIAL=true).
+# - >0: Stripe Checkout trial for N days for first-time signups only (no prior
+#   real subscription). Values below 2 are clamped to 2 (Stripe's 48h min).
+# - 0: no Checkout trial; charge starts immediately.
+# - Returning / canceled accounts never get another Checkout trial.
+# - When REQUIRE_CARD_FOR_TRIAL=false, Checkout never applies a trial (generic
+#   signup trial uses this value instead; must be >= 1 in that mode).
+# Empty = default 8.
 CASHIER_TRIAL_DAYS=8
-# Stripe Coupon ID (amount_off, duration=once) so the first invoice at
-# checkout comes out to $1 instead of the full monthly price.
-STRIPE_FIRST_MONTH_COUPON_ID=
+# Show Stripe Checkout promotion-code field.
+CASHIER_ALLOW_PROMOTION_CODES=true
 
 # Stripe Plan Price IDs (one per plan × interval). Used by PlanSeeder.
 STRIPE_WORKSPACE_MONTHLY=

.github/workflows/lint.yml

@@ -1,4 +1,4 @@
-name: linter
+name: lints
 
 on:
   push:
@@ -10,14 +10,11 @@ on:
       - develop
       - main
 
-permissions:
-  contents: write
-
 jobs:
   quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
@@ -29,17 +26,11 @@ jobs:
           composer install -q --no-ansi --no-interaction --no-scripts --no-progress --prefer-dist
           npm install
 
-      - name: Run Pint
-        run: composer lint
+      - name: Check PHP Formatting
+        run: composer test:lint
 
-      - name: Format Frontend
-        run: npm run format
+      - name: Check Frontend Formatting
+        run: npm run format:check
 
       - name: Lint Frontend
-        run: npm run lint
-
-      # - name: Commit Changes
-      #   uses: stefanzweifel/git-auto-commit-action@v5
-      #   with:
-      #     commit_message: fix code style
-      #     commit_options: '--no-verify'
+        run: npm run lint:check

.github/workflows/tests.yml

@@ -108,6 +108,9 @@ jobs:
       - name: Build assets
         run: npm run build
 
+      - name: Type-check frontend
+        run: npm run types
+
       - name: Install Playwright browsers
         run: npx playwright install --with-deps chromium
 

.gitignore

@@ -7,6 +7,7 @@
 /public/hot
 /public/storage
 /storage/*.key
+/storage/passport
 /storage/pail
 /resources/js/actions
 /resources/js/routes

CLAUDE.md

@@ -306,13 +306,16 @@ Vue components must have a single root element.
     - Example: `$this->postJson(route('app.posts.store'))` instead of `$this->postJson('/posts')`.
     - With params: `route('app.posts.ai.create.finalize', $creationId)`.
 
-## Dusk (Browser Tests)
-
-- In Dusk tests, ALWAYS use named routes via `route()` helper. NEVER hardcode URLs like `'https://trypost.test/login'`.
-    - Example: `$browser->visit(route('login'))` instead of `$browser->visit('https://trypost.test/login')`.
-- ALWAYS use `dusk` selectors (`@selector-name`) for interacting with and asserting elements. NEVER use CSS classes (`.text-red-600`), tag names, or text strings.
-    - Add `dusk="my-element"` attributes to Vue components and use `$browser->click('@my-element')`, `$browser->waitFor('@my-element')`, etc.
-    - Example: `$browser->waitFor('@input-error')` instead of `$browser->waitFor('.text-red-600')`.
+## Browser Tests
+
+- In browser tests, ALWAYS use named routes via `route()` helper. NEVER hardcode URLs like `'https://trypost.test/login'`.
+    - Example: `visit(route('login'))` instead of `visit('https://trypost.test/login')`.
+- ALWAYS use `data-testid` selectors (`@selector-name`) for interacting with and asserting elements. NEVER use CSS classes (`.text-red-600`), tag names, or text strings.
+    - The Pest browser plugin resolves `@selector` against `[data-testid]` / `[data-test]` only — `dusk="..."` attributes are NOT matched.
+    - Add `data-testid="my-element"` attributes to Vue components and use `$page->click('@my-element')`, `$page->assertVisible('@my-element')`, etc.
+    - Example: `$page->assertVisible('@input-error')` instead of `$page->assertVisible('.text-red-600')`.
+- Assertions do not auto-wait — poll browser-side (see `waitForTestId`/`waitForDusk` helpers in `tests/Browser`) before asserting on async UI.
+- Use `->fresh()` when acting as a factory-created user: the in-process server keeps the guard user across requests, and factory instances lack nullable columns (strict mode throws `MissingAttributeException`).
 
 ## Array Data Access
 

app/Actions/AccessToken/ListConnectedMcpClients.php

@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Actions\AccessToken;
+
+use App\Models\AccessToken;
+use App\Models\User;
+use Illuminate\Support\Collection;
+
+class ListConnectedMcpClients
+{
+    /**
+     * Account-wide MCP OAuth connections, keyed by client + owning user.
+     *
+     * @return list<array{client_id: string, name: string, user_id: string, user_name: string, can_disconnect: bool, last_used_at: mixed}>
+     */
+    public static function forAccount(string $accountId, User $viewer): array
+    {
+        $tokens = AccessToken::query()
+            ->whereIn('user_id', User::query()->select('id')->where('account_id', $accountId))
+            ->activeMcpOAuth()
+            ->with(['client', 'user'])
+            ->get();
+
+        return $tokens
+            ->groupBy(fn (AccessToken $token): string => "{$token->client_id}:{$token->user_id}")
+            ->map(function (Collection $group) use ($viewer): array {
+                /** @var AccessToken $token */
+                $token = $group->first();
+
+                return [
+                    'client_id' => $token->client_id,
+                    'name' => $token->client->name,
+                    'user_id' => (string) $token->user_id,
+                    'user_name' => (string) ($token->user?->name ?? ''),
+                    'can_disconnect' => $token->user_id === $viewer->id,
+                    'last_used_at' => $group->max('last_used_at'),
+                ];
+            })
+            ->values()
+            ->all();
+    }
+}

app/Actions/AccessToken/RevokeMcpOAuthGrants.php

@@ -0,0 +1,99 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Actions\AccessToken;
+
+use App\Events\OnboardingStatusUpdated;
+use App\Models\AccessToken;
+use App\Models\User;
+use App\Models\Workspace;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+
+class RevokeMcpOAuthGrants
+{
+    /**
+     * Revoke MCP OAuth grants only when the user can no longer create posts in
+     * any workspace (demotion/removal that still leaves createPost elsewhere
+     * must keep the grant — MCP is account-scoped via current workspace).
+     *
+     * @return bool True when at least one grant was revoked.
+     */
+    public static function forUserIfLacksCreatePost(User $user): bool
+    {
+        if (self::canCreatePostSomewhere($user)) {
+            return false;
+        }
+
+        return self::forUser($user);
+    }
+
+    /**
+     * Revoke every active MCP OAuth access token (and its refresh tokens) for the user.
+     *
+     * @return bool True when at least one grant was revoked.
+     */
+    public static function forUser(User $user): bool
+    {
+        return self::revoke(
+            AccessToken::query()
+                ->where('user_id', $user->id)
+                ->mcpOAuth()
+                ->where('revoked', false)
+                ->get(),
+            $user,
+        );
+    }
+
+    /**
+     * Revoke active MCP OAuth grants for one OAuth client owned by the user.
+     *
+     * @return bool True when at least one grant was revoked.
+     */
+    public static function forUserClient(User $user, string $clientId): bool
+    {
+        return self::revoke(
+            AccessToken::query()
+                ->where('user_id', $user->id)
+                ->where('client_id', $clientId)
+                ->mcpOAuth()
+                ->where('revoked', false)
+                ->get(),
+            $user,
+        );
+    }
+
+    public static function canCreatePostSomewhere(User $user): bool
+    {
+        return $user->workspaces()
+            ->get()
+            ->contains(fn (Workspace $workspace): bool => $user->can('createPost', $workspace));
+    }
+
+    /**
+     * @param  Collection<int, AccessToken>  $tokens
+     */
+    private static function revoke(Collection $tokens, User $user): bool
+    {
+        if ($tokens->isEmpty()) {
+            return false;
+        }
+
+        DB::transaction(function () use ($tokens): void {
+            $tokenIds = $tokens->pluck('id');
+
+            DB::table('oauth_refresh_tokens')
+                ->whereIn('access_token_id', $tokenIds)
+                ->update(['revoked' => true]);
+
+            $tokens->each(function (AccessToken $token): void {
+                $token->forceFill(['revoked' => true])->saveQuietly();
+            });
+        });
+
+        OnboardingStatusUpdated::dispatchForAccount($user->account, $user);
+
+        return true;
+    }
+}

app/Actions/AccessToken/RevokeWorkspaceApiKeys.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Actions\AccessToken;
+
+use App\Enums\UserWorkspace\Role as WorkspaceRole;
+use App\Models\AccessToken;
+use App\Models\Workspace;
+
+class RevokeWorkspaceApiKeys
+{
+    /**
+     * Revoke personal-access API keys for a user on one workspace.
+     * Used when the member is removed or demoted below Admin (manageTeam).
+     *
+     * @return int Number of tokens revoked.
+     */
+    public static function forUserOnWorkspace(string $userId, Workspace $workspace): int
+    {
+        return AccessToken::query()
+            ->where('user_id', $userId)
+            ->where('workspace_id', $workspace->id)
+            ->where('revoked', false)
+            ->update(['revoked' => true]);
+    }
+
+    /**
+     * Admins (and account owners acting as admin) may keep workspace API keys.
+     * Any other role loses them.
+     *
+     * @return int Number of tokens revoked.
+     */
+    public static function forUserUnlessAdmin(
+        string $userId,
+        Workspace $workspace,
+        WorkspaceRole $role,
+    ): int {
+        if ($role === WorkspaceRole::Admin) {
+            return 0;
+        }
+
+        return self::forUserOnWorkspace($userId, $workspace);
+    }
+}