fix: redirect unauthenticated users from subscriptions page (#4137)

Co-authored-by: Jean du Plessis <jeandp@gmail.com>

Author: FaisalMisbah23

apps/web/src/app/(app)/subscriptions/layout.test.ts

@@ -0,0 +1,37 @@
+import type { ReactNode } from 'react';
+import type { User } from '@kilocode/db/schema';
+import { defineTestUser } from '@/tests/helpers/user.helper';
+
+const mockGetUserFromAuthOrRedirect = jest.fn<Promise<User>, []>();
+
+jest.mock('@/lib/user/server', () => ({
+  getUserFromAuthOrRedirect: () => mockGetUserFromAuthOrRedirect(),
+}));
+
+describe('SubscriptionsLayout', () => {
+  const redirectSentinel = new Error('NEXT_REDIRECT');
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('renders subscription pages when authenticated', async () => {
+    mockGetUserFromAuthOrRedirect.mockResolvedValue(defineTestUser());
+
+    const { default: SubscriptionsLayout } = await import('@/app/(app)/subscriptions/layout');
+    const children = 'subscriptions content' as ReactNode;
+
+    await expect(SubscriptionsLayout({ children })).resolves.toBe(children);
+    expect(mockGetUserFromAuthOrRedirect).toHaveBeenCalledTimes(1);
+  });
+
+  it('propagates a redirect sentinel when unauthenticated', async () => {
+    mockGetUserFromAuthOrRedirect.mockRejectedValue(redirectSentinel);
+
+    const { default: SubscriptionsLayout } = await import('@/app/(app)/subscriptions/layout');
+    const children = 'subscriptions content' as ReactNode;
+
+    await expect(SubscriptionsLayout({ children })).rejects.toBe(redirectSentinel);
+    expect(mockGetUserFromAuthOrRedirect).toHaveBeenCalledTimes(1);
+  });
+});

apps/web/src/app/(app)/subscriptions/layout.tsx

@@ -1,5 +1,7 @@
 import type { ReactNode } from 'react';
+import { getUserFromAuthOrRedirect } from '@/lib/user/server';
 
-export default function SubscriptionsLayout({ children }: { children: ReactNode }) {
+export default async function SubscriptionsLayout({ children }: { children: ReactNode }) {
+  await getUserFromAuthOrRedirect();
   return children;
 }

apps/web/src/lib/impact/kilo-pass-referrals.test.ts

@@ -661,11 +661,9 @@ describe('Kilo Pass Impact referral conversions', () => {
     expect(await db.select().from(impact_referral_rewards)).toHaveLength(0);
   });
 
-  test('renewal, prior subscription, deleted tombstone, and self-referral do not grant rewards', async () => {
-    const cases = ['renewal', 'prior_subscription', 'deleted_tombstone', 'self_referral'] as const;
-
-    for (const scenario of cases) {
-      await cleanupDbForTest();
+  test.each(['renewal', 'prior_subscription', 'deleted_tombstone', 'self_referral'] as const)(
+    '%s does not grant referral rewards',
+    async scenario => {
       const referrer = await insertTestUser({ created_at: '2025-12-01T00:00:00.000Z' });
       const referee =
         scenario === 'self_referral'
@@ -696,11 +694,11 @@ describe('Kilo Pass Impact referral conversions', () => {
 
       const disposition = await processInvoice({ refereeId: referee.id, subscriptionId });
       const rewards = await db.select().from(impact_referral_rewards);
-      expect({ scenario, rewardCount: rewards.length }).toEqual({ scenario, rewardCount: 0 });
+      expect(rewards).toHaveLength(0);
       expect(disposition.winningTouchType).toBe(ImpactReferralWinningTouchType.Referral);
       expect(disposition.disqualificationReason).toMatch(/^referral_/);
     }
-  });
+  );
 
   test('referrer cap limits only referrer reward and invoice retry is idempotent', async () => {
     const referrer = await insertTestUser({ created_at: '2025-12-01T00:00:00.000Z' });