release: promote develop to main (router security, coverage)

apps/mobile/src/screens/ProfileScreen.tsx

@@ -24,7 +24,6 @@ import { ProfileStats } from '@beakerstack/shared/components/profile/ProfileStat
 // @ts-ignore - Dynamic imports are supported by Metro, TypeScript error is a false positive
 import type { ProfileEditorProps } from '@beakerstack/shared/components/profile/ProfileEditor.native';
 import { loadProfileEditorModule } from './profileEditorLoader';
-let ProfileEditor: React.ComponentType<ProfileEditorProps> | null = null;
 
 type RootStackParamList = {
   Home: undefined;
@@ -78,28 +77,28 @@ export default function ProfileScreen({ navigation }: Props) {
   }
 
   // Render protected content if authenticated
-  return <ProfileScreenContent navigation={navigation} />;
+  return <ProfileScreenContent />;
 }
 
-function ProfileScreenContent({ navigation: _navigation }: Props) {
+function ProfileScreenContent() {
   const [isEditing, setIsEditing] = useState(false);
-  const [componentsLoaded, setComponentsLoaded] = useState(false);
+  const [ProfileEditor, setProfileEditor] =
+    useState<React.ComponentType<ProfileEditorProps> | null>(null);
   const auth = useAuthContext();
   const profile = useProfileContext();
 
   // Lazy load ProfileEditor only when editing
   useEffect(() => {
-    if (isEditing && !componentsLoaded) {
+    if (isEditing && !ProfileEditor) {
       loadProfileEditorModule()
         .then(module => {
-          ProfileEditor = module.ProfileEditor;
-          setComponentsLoaded(true);
+          setProfileEditor(() => module.ProfileEditor);
         })
         .catch(err => {
           Logger.error('[ProfileScreen] Failed to load ProfileEditor:', err);
         });
     }
-  }, [isEditing, componentsLoaded]);
+  }, [isEditing, ProfileEditor]);
 
   return (
     <SafeAreaView style={styles.container}>
@@ -158,7 +157,7 @@ function ProfileScreenContent({ navigation: _navigation }: Props) {
 
             {isEditing && (
               <View style={styles.card}>
-                {componentsLoaded && ProfileEditor ? (
+                {ProfileEditor ? (
                   <ProfileEditor
                     onSuccess={() => {
                       // Refresh profile data after successful update

apps/web/package.json

@@ -31,7 +31,7 @@
     "lucide-react": "^0.460.0",
     "react": "18.2.0",
     "react-dom": "18.2.0",
-    "react-router-dom": "^6.30.3",
+    "react-router-dom": "^6.30.4",
     "zod": "^3.22.0"
   },
   "devDependencies": {

packages/admin/package.json

@@ -37,7 +37,7 @@
     "jsdom": "^26.1.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
-    "react-router-dom": "^6.30.3",
+    "react-router-dom": "^6.30.4",
     "typescript": "^5.3.0",
     "@vitest/coverage-v8": "^4.1.8",
     "vitest": "^4.1.8"

packages/admin/src/components/AdminDetailDrawer.web.test.tsx

@@ -307,4 +307,20 @@ describe('AdminDetailDrawer', () => {
     await user.click(screen.getByLabelText('Close'));
     expect(onClose).toHaveBeenCalledTimes(1);
   });
+
+  it('does not trap Tab when focus is not on the last element', async () => {
+    const user = userEvent.setup();
+    render(
+      <AdminDetailDrawer open title='User' onClose={vi.fn()}>
+        <input aria-label='Notes' />
+        <button type='button'>Save</button>
+      </AdminDetailDrawer>
+    );
+    const notes = screen.getByLabelText('Notes');
+    const save = screen.getByRole('button', { name: 'Save' });
+    await user.click(notes);
+    expect(document.activeElement).toBe(notes);
+    await user.tab();
+    expect(document.activeElement).toBe(save);
+  });
 });

packages/admin/src/components/AdminTable.web.test.tsx

@@ -123,4 +123,21 @@ describe('AdminTable', () => {
     await user.click(screen.getByText('Ada'));
     expect(onRowClick).toHaveBeenCalledWith({ id: '1', name: 'Ada' });
   });
+
+  it('ignores non-activation keys on clickable rows', async () => {
+    const onRowClick = vi.fn();
+    const user = userEvent.setup();
+    render(
+      <AdminTable
+        columns={columns}
+        rows={[{ id: '1', name: 'Ada' }]}
+        getRowKey={r => r.id}
+        onRowClick={onRowClick}
+      />
+    );
+    const row = screen.getByRole('button', { name: 'View details for 1' });
+    row.focus();
+    await user.keyboard('{ArrowDown}');
+    expect(onRowClick).not.toHaveBeenCalled();
+  });
 });

packages/articles/package.json

@@ -27,7 +27,7 @@
   "peerDependencies": {
     "react": "18.2.0",
     "react-dom": "18.2.0",
-    "react-router-dom": "^6.30.3"
+    "react-router-dom": "^6.30.4"
   },
   "peerDependenciesMeta": {
     "react-dom": {
@@ -50,7 +50,7 @@
     "prettier": "^3.1.0",
     "react": "18.2.0",
     "react-dom": "18.2.0",
-    "react-router-dom": "^6.30.3",
+    "react-router-dom": "^6.30.4",
     "tsx": "^4.19.0",
     "typescript": "^5.3.0",
     "vitest": "^4.1.8",

packages/billing/src/BillingProvider.test.tsx

@@ -11,6 +11,15 @@ import {
   testSubscription,
 } from './test/billingFixtures.js';
 
+type ConsoleErrorSpy = ReturnType<typeof vi.spyOn<typeof console, 'error'>>;
+
+function expectNoUnmountedConsoleWarnings(consoleSpy: ConsoleErrorSpy) {
+  const unmountedWarnings = consoleSpy.mock.calls.filter(args =>
+    args.some(arg => String(arg).toLowerCase().includes('unmounted'))
+  );
+  expect(unmountedWarnings).toHaveLength(0);
+}
+
 function Reader() {
   const { userId, subscription } = useBillingContext();
   return (
@@ -569,7 +578,7 @@ describe('BillingProvider', () => {
     let resolveSession: (value: {
       data: { session: { user: { id: string } } | null };
     }) => void = () => {};
-    auth.getSession.mockImplementation(
+    auth.getSession.mockImplementationOnce(
       () =>
         new Promise(resolve => {
           resolveSession = resolve;
@@ -585,4 +594,144 @@ describe('BillingProvider', () => {
     await Promise.resolve();
     expect(db.maybeSingle).not.toHaveBeenCalled();
   });
+
+  it('ignores plan query result after unmount', async () => {
+    let resolvePlan: (value: {
+      data: ReturnType<typeof testPlan> | null;
+      error: null;
+    }) => void = () => {};
+    const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      auth.state.session = { user: { id: 'u-plan-unmount' } };
+      const row = {
+        ...testSubscription(),
+        user_id: 'u-plan-unmount',
+        plan_id: 'plan_free',
+      };
+      db.maybeSingle.mockResolvedValue({ data: row, error: null });
+      db.planMaybeSingle.mockImplementationOnce(
+        () =>
+          new Promise(resolve => {
+            resolvePlan = resolve;
+          })
+      );
+      const { unmount } = render(
+        <BillingProvider config={testBillingConfig} {...providerProps}>
+          <PlanReader />
+        </BillingProvider>
+      );
+      await waitFor(() => expect(db.planMaybeSingle).toHaveBeenCalled());
+      unmount();
+      resolvePlan({
+        data: testPlan({ display_name: 'Late plan' }),
+        error: null,
+      });
+      await act(async () => {
+        await Promise.resolve();
+      });
+
+      expectNoUnmountedConsoleWarnings(consoleSpy);
+    } finally {
+      consoleSpy.mockRestore();
+    }
+  });
+
+  it('ignores ensure_billing_subscription result after unmount', async () => {
+    let resolveRpc: (value: { error: null }) => void = () => {};
+    const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      auth.state.session = { user: { id: 'u-rpc-unmount' } };
+      db.rpc.mockImplementationOnce(
+        () =>
+          new Promise(resolve => {
+            resolveRpc = resolve;
+          })
+      );
+      const { unmount } = render(
+        <BillingProvider config={testBillingConfig} {...providerProps}>
+          <Reader />
+        </BillingProvider>
+      );
+      await waitFor(() =>
+        expect(screen.getByTestId('uid').textContent).toBe('u-rpc-unmount')
+      );
+      await waitFor(() => expect(db.rpc).toHaveBeenCalled());
+      unmount();
+      resolveRpc({ error: null });
+      await act(async () => {
+        await Promise.resolve();
+      });
+
+      expectNoUnmountedConsoleWarnings(consoleSpy);
+    } finally {
+      consoleSpy.mockRestore();
+    }
+  });
+
+  it('ignores plan query errors after unmount', async () => {
+    let rejectPlan: (error: Error) => void = () => {};
+    const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      auth.state.session = { user: { id: 'u-plan-err-unmount' } };
+      const row = {
+        ...testSubscription(),
+        user_id: 'u-plan-err-unmount',
+        plan_id: 'plan_free',
+      };
+      db.maybeSingle.mockResolvedValue({ data: row, error: null });
+      db.planMaybeSingle.mockImplementationOnce(
+        () =>
+          new Promise((_resolve, reject) => {
+            rejectPlan = reject;
+          })
+      );
+      const { unmount } = render(
+        <BillingProvider config={testBillingConfig} {...providerProps}>
+          <PlanReader />
+        </BillingProvider>
+      );
+      await waitFor(() => expect(db.planMaybeSingle).toHaveBeenCalled());
+      unmount();
+      rejectPlan(new Error('late plan fail'));
+      await act(async () => {
+        await Promise.resolve();
+      });
+
+      expectNoUnmountedConsoleWarnings(consoleSpy);
+    } finally {
+      consoleSpy.mockRestore();
+    }
+  });
+
+  it('ignores ensure_billing_subscription errors after unmount', async () => {
+    let rejectRpc: (error: Error) => void = () => {};
+    const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      auth.state.session = { user: { id: 'u-rpc-err-unmount' } };
+      db.rpc.mockImplementationOnce(
+        () =>
+          new Promise((_resolve, reject) => {
+            rejectRpc = reject;
+          })
+      );
+      const { unmount } = render(
+        <BillingProvider config={testBillingConfig} {...providerProps}>
+          <Reader />
+        </BillingProvider>
+      );
+      await waitFor(() =>
+        expect(screen.getByTestId('uid').textContent).toBe('u-rpc-err-unmount')
+      );
+      await waitFor(() => expect(db.rpc).toHaveBeenCalled());
+      unmount();
+      rejectRpc(new Error('late rpc fail'));
+      await act(async () => {
+        await Promise.resolve();
+      });
+
+      expectNoUnmountedConsoleWarnings(consoleSpy);
+    } finally {
+      consoleSpy.mockRestore();
+    }
+  });
 });