trypost/app/Actions/Onboarding/ResolveOnboardingStatus.php

463 lines
14 KiB
PHP
Raw Permalink Normal View History

Activation checklist + MCP OAuth authorize UX (#239) (#250) * Wire onboarding activation into Account, observers, and shared Inertia data Add onboarding casts/hasFinishedOnboarding, AccessToken ObservedBy, Platform::connectableOptions, Post/SocialAccount onboarding broadcast hooks, and lazy onboardingResidual share + SharedData types. * Register onboarding routes and post-checkout activation redirects. Wire billing processing and the sidebar checklist so owners land on activation after subscribe, with locale sidebar/uk onboarding strings. * Align MCP grant usability with onboarding activation checks Unbound MCP tokens fall back to the user's current workspace and require createPost so viewer/unscoped grants neither unlock the checklist nor broadcast onboarding status. * Require bound MCP workspace for onboarding activation. Drop current-workspace fallback from usable MCP grants so checklist detection and broadcasts match Passport token scoping; viewers still cannot unlock the MCP step. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden onboarding review findings and tighten locale strings. Fix Welcome/Persona/TrackPost suites broken by the activation route reuse and PostObserver analytics side effects, restore Echo poll fallbacks, reject unbound MCP grants in tests, and drop unused onboarding.mcp keys. Co-authored-by: Cursor <cursoragent@cursor.com> * Remove unused sidebar and MCP authorization locale keys. Drop dead sidebar menu/theme strings (including the overwritten workspace label and api_keys nav entry) and unused MCP authorize app_title/approving copy across all locales. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix SetLocale crashing on Passport Symfony OAuth responses. OAuth errors return a raw Symfony Response without withCookie(); attach the default locale cookie via headers so authorize no longer 500s. Co-authored-by: Cursor <cursoragent@cursor.com> * Prompt OAuth guests to log in before rejecting unknown clients. MCP Inspector often reuses a stale client_id; validateAuthorizationRequest was returning invalid_client JSON before the login redirect. Guests now hit /login first, then client validation runs after authentication. Co-authored-by: Cursor <cursoragent@cursor.com> * Render Inertia OAuth authorize errors for browser logins. After login, Inertia follows the intended authorize URL; raw invalid_client JSON broke that visit. HTML/Inertia requests now get mcp/AuthorizeError while API JSON clients still receive the OAuth error payload. Co-authored-by: Cursor <cursoragent@cursor.com> * Detect Inertia OAuth error pages via Request::inertia(). Use the framework helper so post-login authorize failures keep returning an Inertia page instead of raw OAuth JSON. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify OAuth authorize error page detection to expectsJson. Drop the X-Inertia header sniff; browser and Inertia visits already do not expectsJson, while API clients still receive the OAuth JSON payload. Co-authored-by: Cursor <cursoragent@cursor.com> * Share MCP authorize layout and drop the error close button. Keep authorize and authorize-error on the same centered card shell instead of the auth split layout. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding activation for reviewability and safety. Use an exists-based MCP check, keep GETs read-only, move sync into syncAndNotify, clear MCP skips on connect, restrict complete to owners, and share Echo/poll via one composable. Co-authored-by: Cursor <cursoragent@cursor.com> * Move MCP OAuth authorize UX out of the onboarding PR. Keep the activation checklist focused; OAuth guest/error-page work now lives on fix/mcp-oauth-authorize-ux. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix corrupted French MCP locale after OAuth key cleanup. Co-authored-by: Cursor <cursoragent@cursor.com> * Restore MCP OAuth authorize UX onto the onboarding branch. Keep authorize error page, guest login-before-client validation, and SetLocale Symfony cookie fix in #250. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix OAuth prompt=none redirects and harden onboarding tests. Keep login_required/consent_required as redirects instead of Inertia, add regression coverage for owner-only activation, require invite email confirmation, and align MCP connected apps with the sessions list UI. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding guards and dedupe viewed analytics. Introduce isOnboardingOpen / belongsToAccount helpers, collapse duplicated sync/dispatch paths, and capture onboarding.viewed once per account. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding event, observers, and status helpers. Tighten Account onboarding predicates, drop nullable broadcast/dispatch APIs, and collapse repeated observer/controller guards. Co-authored-by: Cursor <cursoragent@cursor.com> * Treat in-app users as always having an account. Add resolveAccount(), tighten belongsToAccount to string ids, and fold guest residual handling into ResolveOnboardingStatus. Co-authored-by: Cursor <cursoragent@cursor.com> * Rename onboarding residual share test to progress. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding status and rename residual to progress. Use accountOrFail, extract MCP onboarding scope, auto-leave the ready screen, and send non-onboarding checkout back to accounts. Co-authored-by: Cursor <cursoragent@cursor.com> * Extract HasAccount and prefer data_get in onboarding flows. Move account helpers off User, drop nullable sidebarProgress, and read OAuth/onboarding payloads with data_get. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding checks and extract HasOnboarding. Use Eloquent + policies for MCP/backfill paths, and move account onboarding helpers into a dedicated trait. Co-authored-by: Cursor <cursoragent@cursor.com> * Add trait tests and tidy onboarding imports. Cover HasAccount and HasOnboarding under Models/Traits, prefer filled() for checkout session ids, and import Throwable instead of FQCN. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify checkout session_id and OAuth error props. Read session_id via request->string(), and take OAuth error details from the League exception instead of decoding the response body. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify PostObserver onboarding notify path. Share one otherPosts check for first-create and last-delete instead of separate callbacks. Co-authored-by: Cursor <cursoragent@cursor.com> * Use post author as onboarding sync actor. Drop Auth::user() preference in PostObserver; checklist sync attributes to $post->user. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify SocialAccountObserver and OAuth authorize flow. Share create/delete onboarding notify, drop Auth actor fallback to owner, and inline Passport Inertia error handling. Co-authored-by: Cursor <cursoragent@cursor.com> * Use lazy Inertia props for onboarding partial reloads. Drop partial-header branching; wrap page props in closures and always redirect completed/dismissed accounts to the calendar. Co-authored-by: Cursor <cursoragent@cursor.com> * Defer sidebar onboarding progress and stamp completion as owner-only. Skip the MCP checklist work on full Inertia visits via deferred shared props, early-exit token scans, and keep account completion stamps owner-gated. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify deferred onboarding progress share via canShowProgress. Co-authored-by: Cursor <cursoragent@cursor.com> * Add User firstName for shared auth and simplify onboarding page. Co-authored-by: Cursor <cursoragent@cursor.com> * Move User firstName coverage into UserTest. Co-authored-by: Cursor <cursoragent@cursor.com> * Use first_name directly without empty-name fallbacks. Co-authored-by: Cursor <cursoragent@cursor.com> * Resolve onboarding sample prompt on the frontend via i18n. Co-authored-by: Cursor <cursoragent@cursor.com> * Stamp onboarding completion via the account owner after teammate unlocks. Co-authored-by: Cursor <cursoragent@cursor.com> * Count only the account owner MCP grant toward onboarding activation. Co-authored-by: Cursor <cursoragent@cursor.com> * Fix OAuth consent auth-token mismatch for mid-activation owners. Skip deferred onboardingProgress on Passport authorize so Inertia does not rotate the session authToken, cover happy and stale-token paths in tests, and polish MCP setup copy plus sidebar/onboarding layout. Co-authored-by: Cursor <cursoragent@cursor.com> * Keep users on onboarding after activation completes. Stamp completion and re-render the finished checklist instead of redirecting to the calendar so owners can review the done state. Co-authored-by: Cursor <cursoragent@cursor.com> * Clarify Passport consent-view opt-out and guard app-route deferral. Rename the authorize-only route check and assert onboardingProgress still defers on calendar, onboarding, and MCP settings. Co-authored-by: Cursor <cursoragent@cursor.com> * Harden onboarding completion and MCP consent workspace binding. Reject OAuth approve without a workspace, retry auto-complete until stamped, send dismissed complete straight to calendar, and cover the device consent defer opt-out. Co-authored-by: Cursor <cursoragent@cursor.com> * Enable activation checklist for self-hosted installs. Remove the self-hosted onboarding redirects, keep the SaaS-only dismiss backfill, and cover subscription-less owners plus skip/complete destinations. Co-authored-by: Cursor <cursoragent@cursor.com> * Add GitHub, Hacker News, and directories referral sources. Expand the welcome referral step with open-source and directory discovery channels. Co-authored-by: Cursor <cursoragent@cursor.com> * Refine welcome referral sources and labels. Split Instagram/Threads, add Founder, and shorten Google, GitHub, AI, and blog option labels. Co-authored-by: Cursor <cursoragent@cursor.com> * Sort accounts platforms alphabetically and drop connect hover plus. Reuse connectableOptions for the accounts index and remove the unused plus badge on disconnected cards. Co-authored-by: Cursor <cursoragent@cursor.com> * Centralize PostHog once-capture so disabled installs don't burn dedupe keys. Move isEnabled + Cache::add into PostHogService::captureOnce and route onboarding viewed/step events through it. Co-authored-by: Cursor <cursoragent@cursor.com> * Simplify onboarding backfill to complete every existing open account. Drop self-hosted and subscription filters; down clears completed_at again. Co-authored-by: Cursor <cursoragent@cursor.com> * Drop PostHog captureOnce and use plain capture for onboarding. Remove cache-based event dedupe; callers rely on PostHogService::capture gating. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-07 23:34:43 +00:00
<?php
declare(strict_types=1);
namespace App\Actions\Onboarding;
use App\Enums\PostHog\OnboardingEvent;
use App\Enums\SocialAccount\Status;
use App\Events\OnboardingStatusUpdated;
use App\Models\Account;
use App\Models\User;
use App\Models\Workspace;
use App\Services\PostHogService;
use Illuminate\Database\Eloquent\Builder;
class ResolveOnboardingStatus
{
/**
* Checklist step identifiers mapped to their status keys. Steps are derived
* from real state; optional steps may additionally be skipped.
*/
public const STEPS = [
'mcp' => 'mcp_connected',
'social' => 'social_connected',
'first_post' => 'first_post_created',
];
public function __construct(
private readonly PostHogService $postHog,
) {}
public static function totalSteps(): int
{
return count(self::STEPS);
}
/**
* Pure read of activation checklist state. Safe for Inertia shared props.
*
* @return array{
* mcp_connected: bool,
* social_connected: bool,
* first_post_created: bool,
* skipped_steps: list<string>,
* all_complete: bool,
* show_progress: bool,
* completed_at: ?string,
* dismissed_at: ?string
* }
*/
public function handle(User $user): array
{
$account = $user->accountOrFail();
return $account->isOnboardingCompleted()
? $this->completedStatus($account)
: $this->activeStatus($user, $account);
}
/**
* Read checklist state, capture step analytics, and stamp completion when done.
* Call from observers / explicit mutations — not from shared Inertia props or GETs.
*
* @return array{
* mcp_connected: bool,
* social_connected: bool,
* first_post_created: bool,
* skipped_steps: list<string>,
* all_complete: bool,
* show_progress: bool,
* completed_at: ?string,
* dismissed_at: ?string
* }
*/
public function syncProgress(User $user): array
{
$account = $user->accountOrFail();
// Completed is read-only. Dismissed still runs below so a late MCP
// connect can clear a leftover mcp skip.
if ($account->isOnboardingCompleted()) {
return $this->handle($user);
}
$this->clearMcpSkipIfConnected($account);
$status = $this->handle($user);
if ($account->isOnboardingDismissed()) {
return $status;
}
$this->captureCompletedSteps($user, $account, $status);
$owner = $account->owner;
if (! data_get($status, 'all_complete') || $owner === null) {
return $status;
}
$this->markCompleted($owner);
$account->refresh();
if (! $account->isOnboardingCompleted()) {
return $status;
}
return [
...$status,
'show_progress' => false,
'completed_at' => $account->onboarding_completed_at?->toIso8601String(),
];
}
/**
* Sync checklist progress for an account actor, then broadcast progress updates.
* Used by observers after a step unlocks (post-commit).
*/
public function syncAndNotify(Account $account, ?string $actorId = null): void
{
$actor = $actorId !== null
? User::query()->with('account')->find($actorId)
: null;
$syncTarget = $actor?->belongsToAccount($account->id)
? $actor
: $account->owner;
if ($syncTarget !== null) {
$this->syncProgress($syncTarget);
$account->refresh();
}
if ($account->isOnboardingOpen()) {
OnboardingStatusUpdated::broadcastForAccount($account);
}
}
/**
* Stamp account onboarding completion once and capture the funnel event.
* Owner-only — teammates unlock steps but cannot finish the account funnel.
*/
public function markCompleted(User $user): bool
{
if (! $user->isAccountOwner()) {
return false;
}
$account = $user->accountOrFail();
if (! $account->isOnboardingOpen()) {
return false;
}
$completedAt = now();
$updated = Account::query()
->whereKey($account->id)
->onboardingOpen()
->update([
'onboarding_completed_at' => $completedAt,
'updated_at' => $completedAt,
]);
if ($updated === 0) {
return false;
}
$account->refresh();
$this->postHog->capture($user->id, OnboardingEvent::Completed->value, account: $account);
// Every stamp path must clear progress banners account-wide.
OnboardingStatusUpdated::broadcastForAccount($account);
return true;
}
/**
* Skip the optional MCP step, then stamp completion when it was the last open step.
*/
public function skipMcp(User $user): bool
{
$account = $user->accountOrFail();
if (! $account->isOnboardingOpen()) {
return false;
}
$status = $this->handle($user);
if ($this->stepIsSettled($status, 'mcp')) {
return false;
}
$skippedSteps = [...data_get($status, 'skipped_steps', []), 'mcp'];
$updated = Account::query()
->whereKey($account->id)
->onboardingOpen()
->where(function (Builder $query): void {
$query->whereNull('onboarding_skipped_steps')
->orWhereJsonDoesntContain('onboarding_skipped_steps', 'mcp');
})
->update([
'onboarding_skipped_steps' => $skippedSteps,
'updated_at' => now(),
]);
if ($updated === 0) {
return false;
}
$account->refresh();
$this->postHog->capture(
$user->id,
OnboardingEvent::StepSkipped->value,
['step' => 'mcp'],
$account,
);
$this->completeChecklistOrBroadcast($user, $account);
return true;
}
/**
* Sidebar checklist progress, or false when the banner should not show.
*
* Pure read — safe for Inertia shared props and prefetch. Cross-workspace
* completion is stamped by syncProgress / observers, not here.
*
* @return array{completed: int, total: int}|false
*/
public function sidebarProgress(User $user): array|false
{
if (! $this->canShowProgress($user)) {
return false;
}
$status = $this->handle($user);
return data_get($status, 'show_progress')
? [
'completed' => $this->completedStepCount($status),
'total' => self::totalSteps(),
]
: false;
}
/**
* Cheap gates before handle()'s step queries.
* Non-owners never reach step state.
*/
public function canShowProgress(User $user, ?Account $account = null): bool
{
if (! $user->isAccountOwner()) {
return false;
}
$account ??= $user->account;
return $account !== null
&& $account->isOnboardingOpen()
&& $account->hasAppAccess();
}
/**
* After skipping a step: stamp completion when the checklist is done,
* otherwise broadcast so sidebar progress refreshes.
*/
private function completeChecklistOrBroadcast(User $user, Account $account): void
{
if (data_get($this->handle($user), 'all_complete') && $this->markCompleted($user)) {
return;
}
OnboardingStatusUpdated::broadcastForAccount($account);
}
/**
* @return array{
* mcp_connected: bool,
* social_connected: bool,
* first_post_created: bool,
* skipped_steps: list<string>,
* all_complete: bool,
* show_progress: bool,
* completed_at: string,
* dismissed_at: ?string
* }
*/
private function completedStatus(Account $account): array
{
$skippedSteps = $account->skippedOnboardingSteps();
// Preserve skip vs real MCP completion for the ready UI badge.
$mcpConnected = ! $account->hasSkippedOnboardingStep('mcp')
|| $account->hasOnboardingMcpConnection();
return [
'mcp_connected' => $mcpConnected,
'social_connected' => true,
'first_post_created' => true,
'skipped_steps' => $mcpConnected
? $this->withoutSkippedStep($skippedSteps, 'mcp')
: $skippedSteps,
'all_complete' => true,
'show_progress' => false,
'completed_at' => $account->onboarding_completed_at->toIso8601String(),
'dismissed_at' => $account->onboarding_dismissed_at?->toIso8601String(),
];
}
/**
* @return array{
* mcp_connected: bool,
* social_connected: bool,
* first_post_created: bool,
* skipped_steps: list<string>,
* all_complete: bool,
* show_progress: bool,
* completed_at: null,
* dismissed_at: ?string
* }
*/
private function activeStatus(User $user, Account $account): array
{
$skippedSteps = $account->skippedOnboardingSteps();
$steps = $this->stepStates($account);
$allComplete = collect($steps)->every(
fn (bool $done, string $step): bool => $this->stepIsComplete($done, $step, $skippedSteps),
);
return [
'mcp_connected' => data_get($steps, 'mcp'),
'social_connected' => data_get($steps, 'social'),
'first_post_created' => data_get($steps, 'first_post'),
'skipped_steps' => $skippedSteps,
'all_complete' => $allComplete,
'show_progress' => $this->canShowProgress($user, $account) && ! $allComplete,
'completed_at' => null,
'dismissed_at' => $account->onboarding_dismissed_at?->toIso8601String(),
];
}
/**
* @return array{mcp: bool, social: bool, first_post: bool}
*/
private function stepStates(Account $account): array
{
return [
'mcp' => $account->hasOnboardingMcpConnection(),
'social' => $this->accountHasSocialConnection($account),
'first_post' => $this->accountHasPost($account),
];
}
/**
* Whether a checklist step is already done or skipped in a status payload.
*
* @param array{mcp_connected?: bool, social_connected?: bool, first_post_created?: bool, skipped_steps?: list<string>} $status
*/
private function stepIsSettled(array $status, string $step): bool
{
return $this->stepIsComplete(
(bool) data_get($status, data_get(self::STEPS, $step)),
$step,
data_get($status, 'skipped_steps', []),
);
}
/**
* @param list<string> $skippedSteps
*/
private function stepIsComplete(bool $done, string $step, array $skippedSteps): bool
{
return $done || in_array($step, $skippedSteps, true);
}
/**
* @param list<string> $skippedSteps
* @return list<string>
*/
private function withoutSkippedStep(array $skippedSteps, string $step): array
{
return array_values(array_diff($skippedSteps, [$step]));
}
/**
* @param array{skipped_steps: list<string>, mcp_connected: bool, social_connected: bool, first_post_created: bool} $status
*/
private function completedStepCount(array $status): int
{
return collect(self::STEPS)
->filter(fn (string $statusKey, string $step): bool => $this->stepIsComplete(
(bool) data_get($status, $statusKey),
$step,
data_get($status, 'skipped_steps', []),
))
->count();
}
/**
* @param array{mcp_connected: bool, social_connected: bool, first_post_created: bool} $status
*/
private function captureCompletedSteps(User $user, Account $account, array $status): void
{
foreach (self::STEPS as $step => $statusKey) {
if (! data_get($status, $statusKey)) {
continue;
}
$this->postHog->capture(
$user->id,
OnboardingEvent::StepCompleted->value,
['step' => $step],
$account,
);
}
}
private function accountHasSocialConnection(Account $account): bool
{
return Workspace::query()
->where('account_id', $account->id)
->whereHas(
'socialAccounts',
fn (Builder $query): Builder => $query->where('status', Status::Connected),
)
->exists();
}
private function accountHasPost(Account $account): bool
{
return Workspace::query()
->where('account_id', $account->id)
->whereHas('posts')
->exists();
}
private function clearMcpSkipIfConnected(Account $account): void
{
if (! $account->hasSkippedOnboardingStep('mcp') || ! $account->hasOnboardingMcpConnection()) {
return;
}
Account::query()
->whereKey($account->id)
->whereNull('onboarding_completed_at')
->update([
'onboarding_skipped_steps' => $this->withoutSkippedStep(
$account->skippedOnboardingSteps(),
'mcp',
) ?: null,
'updated_at' => now(),
]);
$account->refresh();
}
}