Registration page: full organization application, private MA-side storage

tests/onboarding.rs

@@ -50,7 +50,7 @@ async fn signup_issues_invite_and_enroll_binds_key() {
 
     let response = http
         .post(format!("{base}/v1/signup"))
-        .json(&serde_json::json!({"label": "Alice Dev", "code": "sesame"}))
+        .json(&serde_json::json!({"label": "Alice Dev", "code": "sesame", "attestation": true, "privacy_ack": true}))
         .send()
         .await
         .unwrap();
@@ -99,6 +99,76 @@ async fn signup_issues_invite_and_enroll_binds_key() {
     assert_eq!(replayed.status(), reqwest::StatusCode::FORBIDDEN);
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn signup_stores_private_application_and_class() {
+    let root = tempfile::tempdir().unwrap();
+    let dir = setup_ma(root.path());
+    let base = spawn_registry_server(&dir, Some("sesame")).await;
+    let http = reqwest::Client::builder()
+        .timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+
+    let missing = http
+        .post(format!("{base}/v1/signup"))
+        .json(&serde_json::json!({"label": "acme", "code": "sesame"}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(missing.status(), reqwest::StatusCode::BAD_REQUEST);
+
+    let response = http
+        .post(format!("{base}/v1/signup"))
+        .json(&serde_json::json!({
+            "label": "Keswick Research",
+            "code": "sesame",
+            "org": "Keswick Research LLC",
+            "representative": "J. Keswick",
+            "email": "ops@keswick.example",
+            "address": "1 Fell Road, Keswick",
+            "domain": "keswick.example",
+            "class": "enrichment",
+            "payment": "IBAN XX00 0000",
+            "privacy_link": "https://keswick.example/privacy",
+            "attestation": true,
+            "privacy_ack": true
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert!(response.status().is_success());
+    let body: Value = response.json().await.unwrap();
+    assert_eq!(
+        body.get("id").and_then(Value::as_str),
+        Some("keswick-research.frx.invalid")
+    );
+
+    // public registry stays minimal: identifier + class only, no org data
+    let signed = registry::load_registry(&dir.join("registry.json")).unwrap();
+    let member = signed
+        .doc
+        .members
+        .iter()
+        .find(|m| m.id == "keswick-research.frx.invalid")
+        .unwrap();
+    assert_eq!(member.class, frxd::config::CLASS_ENRICHMENT);
+    let raw = std::fs::read_to_string(dir.join("registry.json")).unwrap();
+    assert!(!raw.contains("Keswick Research LLC"));
+    assert!(!raw.contains("ops@keswick.example"));
+
+    // private application record holds the contract details
+    let apps = registry::load_applications(&dir.join("applications.json")).unwrap();
+    assert_eq!(apps.len(), 1);
+    let app = &apps[0];
+    assert_eq!(app.id, "keswick-research.frx.invalid");
+    assert_eq!(app.org, "Keswick Research LLC");
+    assert_eq!(app.representative, "J. Keswick");
+    assert_eq!(app.email, "ops@keswick.example");
+    assert_eq!(app.payment, "IBAN XX00 0000");
+    assert_eq!(app.privacy_link, "https://keswick.example/privacy");
+    assert_eq!(app.class, "enrichment");
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn wizard_enrolls_and_writes_config() {
     let root = tempfile::tempdir().unwrap();
@@ -107,7 +177,7 @@ async fn wizard_enrolls_and_writes_config() {
     let http = reqwest::Client::new();
     let body: Value = http
         .post(format!("{base}/v1/signup"))
-        .json(&serde_json::json!({"label": "Wizard Test", "code": "sesame"}))
+        .json(&serde_json::json!({"label": "Wizard Test", "code": "sesame", "attestation": true, "privacy_ack": true}))
         .send()
         .await
         .unwrap()