hecks 5.0.0 → 7.0.0

data/rust/host/src/lib.rs

@@ -1,53 +1,46 @@
 //! The host as a library: the modules the `bootstrap` binary boots, plus the harness binaries' shared code.
 //! Commerce (payments, checkout, newsletter, registrations, mail) plugs in through [`extension::HostExtension`].
 
+pub use rust_host_core::{
+    arg_limits, clock, dispatch, expr_json, field_hints, hecks_naming, host, ir, journal,
+    lambda_client, log, needs, plugins, presentation, presentation_write, query_step,
+    reference_transform, reference_validate, storage_shape, ui_schema, validation, wasm_runner,
+};
+
 pub mod api;
 pub mod auth;
+pub mod aws_lambda_invoker;
 mod b64;
 pub mod boot;
 pub mod checkout;
-mod clock;
 pub mod commerce_ir;
 mod crypto;
-pub mod dispatch;
-pub mod expr_json;
+#[cfg(test)]
+mod dispatch_tests;
 #[cfg(test)]
 #[path = "boundary_fuzz/expr_json.rs"]
 pub mod expr_json_fuzz;
 pub mod extension;
-mod http;
-// Generated: its static regexes are literals that compile, and the generator always emits
-// `r#"…"#`, so the lints below are allowed here.
-#[allow(clippy::expect_used, clippy::needless_raw_string_hashes)]
-pub mod field_hints;
 #[cfg(test)]
 pub mod fuzz_support;
-pub mod host;
-// The one `Hecks::Naming` port, compiled from `hecks-codegen`'s source: the host and the codegen
-// are independent Cargo projects, so the file is shared by path rather than by dependency.
-#[allow(dead_code)]
-#[path = "../../codegen/src/hecks_naming.rs"]
-pub mod hecks_naming;
-pub mod ir;
-pub mod journal;
-pub mod lambda_client;
-pub mod log;
-pub mod mint;
-pub mod needs;
+#[cfg(test)]
+mod hecksagon_boundary_tests;
+mod http;
+#[cfg(test)]
+#[path = "boundary_fuzz/ir.rs"]
+mod ir_fuzz;
+pub mod ledger;
 pub mod payments;
 pub mod platform_signin;
-pub mod presentation;
-pub mod presentation_write;
-pub mod query_step;
+#[cfg(test)]
+mod presentation_tests;
 pub mod rate_limit;
-pub mod reference_transform;
-pub mod reference_validate;
 pub mod resend;
 pub mod secrets;
 pub mod server;
-pub mod storage_shape;
+pub mod store;
+#[cfg(test)]
+mod store_conformance;
 #[cfg(test)]
 pub mod test_pg;
-pub mod ui_schema;
-pub mod wasm_runner;
 pub mod web;

data/rust/host/src/payments/tests.rs

@@ -1,11 +1,14 @@
+#[allow(unused_imports)]
+use crate::store::{StoreExt, StoreFixtures};
 // Route-level tests for payments.rs, run against real Postgres and the compiled
 // checkout_fixture wasm; every Stripe call goes to a local recording server, not the network.
 
 use super::keystore::MemoryStore;
 use super::*;
-use crate::dispatch::tests::{provision_lineage, scratch_db};
+use crate::dispatch_tests::tests::{provision_lineage, scratch_db};
 use crate::host::Host;
 use crate::lambda_client::NeverInvoker;
+use crate::store::Store;
 use crate::web;
 use axum::extract::State;
 use axum::http::StatusCode;
@@ -56,6 +59,10 @@ struct FakeState {
     webhooks_created: AtomicUsize,
     // Stripe cannot delete a webhook endpoint (an outage, say).
     fail_deletes: AtomicBool,
+    // How many session requests answer together: each waits until that many have arrived, so
+    // that many registrations are past their seat check at once. Zero answers each at once.
+    session_rendezvous: AtomicUsize,
+    sessions_arrived: AtomicUsize,
 }
 
 struct FakeStripe {
@@ -73,6 +80,8 @@ impl FakeStripe {
             refuse_webhooks: AtomicBool::new(false),
             webhooks_created: AtomicUsize::new(0),
             fail_deletes: AtomicBool::new(false),
+            session_rendezvous: AtomicUsize::new(0),
+            sessions_arrived: AtomicUsize::new(0),
         });
         let app = axum::Router::new()
             .fallback(answer)
@@ -118,6 +127,9 @@ async fn answer(
     let path = recorded.path.clone();
     let method = recorded.method.clone();
     state.requests.lock().unwrap().push(recorded);
+    if (method.as_str(), path.as_str()) == ("POST", "/v1/checkout/sessions") {
+        meet_the_other_sessions(&state).await;
+    }
 
     let (status, reply) = match (method.as_str(), path.as_str()) {
         // Stripe does not recognise the key: every call it authenticates is a 401.
@@ -177,8 +189,20 @@ async fn answer(
     (status, axum::Json(reply)).into_response()
 }
 
+// Holds a session request until `session_rendezvous` of them have arrived (five seconds at most).
+async fn meet_the_other_sessions(state: &FakeState) {
+    let expected = state.session_rendezvous.load(Ordering::SeqCst);
+    let arrived = state.sessions_arrived.fetch_add(1, Ordering::SeqCst) + 1;
+    for _ in 0..1000 {
+        if arrived >= expected || state.sessions_arrived.load(Ordering::SeqCst) >= expected {
+            return;
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(5)).await;
+    }
+}
+
 struct Tenant {
-    client: Mutex<Client>,
+    client: Store,
     domain_ir: Value,
     config: LineageConfig,
     wasm: std::path::PathBuf,
@@ -257,6 +281,7 @@ async fn tenant(name: &str) -> Tenant {
             domain: "CheckoutFixture".to_string(),
             era: Some(1),
             mirrored: None,
+            seal_every: None,
         },
         wasm: std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"))
             .join("../dist/checkout_fixture.wasm"),
@@ -418,8 +443,11 @@ impl Tenant {
 
     // POST /registrations for `slug`; the checkout URL and registration id on success.
     async fn register(&self, slug: &str) -> (u64, Value) {
-        let body = json!({"event_slug": slug, "name": "Ada Lovelace", "email": "ada@example.com"})
-            .to_string();
+        self.register_as(slug, "ada@example.com").await
+    }
+
+    async fn register_as(&self, slug: &str, email: &str) -> (u64, Value) {
+        let body = json!({"event_slug": slug, "name": "Ada Lovelace", "email": email}).to_string();
         let platform = self.platform_now().await;
         let response = web::registrations_route(
             &body,
@@ -464,6 +492,7 @@ impl Tenant {
         let response = web::registration_complete_route(
             reference,
             r#"{"outcome":"succeeded"}"#,
+            &self.platform_now().await,
             Host::new(&self.client, &self.wasm, &self.config, &NeverInvoker),
             &crate::commerce_ir::fixture_payments(),
         )
@@ -496,8 +525,16 @@ fn sign(secret: &str, now: i64, payload: &str) -> String {
     format!("t={now},v1={digest}")
 }
 
+// A Checkout Session that collected the fixture event's price (`schedule_event`'s 4200 cents).
 fn completed(reference: &str) -> Value {
-    json!({"type": "checkout.session.completed", "data": {"object": {"id": "cs_test_1", "metadata": {"registration_id": reference}}}})
+    session_event("checkout.session.completed", reference, "paid", 4200)
+}
+
+fn session_event(event_type: &str, reference: &str, payment_status: &str, cents: i64) -> Value {
+    json!({"type": event_type, "data": {"object": {
+        "id": "cs_test_1", "metadata": {"registration_id": reference},
+        "payment_status": payment_status, "amount_total": cents, "currency": "usd",
+    }}})
 }
 
 fn expired(reference: &str) -> Value {
@@ -694,6 +731,7 @@ async fn an_admin_granted_owner_passes_the_payments_gate_and_keeps_the_admin_gat
         domain: "Acme".to_string(),
         era: Some(1),
         mirrored: None,
+        seal_every: None,
     };
     let cookies = |email: &str| {
         HashMap::from([(
@@ -930,7 +968,7 @@ async fn disconnecting_while_payments_are_enabled_pauses_them() {
 }
 
 #[tokio::test]
-async fn checkout_stays_on_the_mock_until_payments_are_enabled() {
+async fn checkout_is_the_mock_only_while_no_connection_exists() {
     let t = tenant("hecks_pay_test_checkout_mock").await;
     t.schedule_event("mock-event").await;
 
@@ -945,16 +983,12 @@ async fn checkout_stays_on_the_mock_until_payments_are_enabled() {
         "{body}"
     );
 
-    // Connected but not enabled: still the mock.
+    // Connected but not enabled: registrations wait, never a free walkthrough.
     t.connect().await;
     let (status, body) = t.register("mock-event").await;
-    assert_eq!(status, 200, "{body}");
-    assert!(
-        body["checkout_url"]
-            .as_str()
-            .unwrap()
-            .starts_with("https://site.example/pay/"),
-        "{body}"
+    assert_eq!(
+        (status, body["error"].as_str()),
+        (503, Some("payments are temporarily unavailable"))
     );
     assert!(
         t.fake.requests_to("/v1/checkout/sessions").is_empty(),
@@ -966,7 +1000,7 @@ async fn checkout_stays_on_the_mock_until_payments_are_enabled() {
         .iter()
         .map(|(_, p)| p["processor"]["value"].as_str().unwrap().to_string())
         .collect();
-    assert_eq!(processors, vec!["mock_stripe", "mock_stripe"]);
+    assert_eq!(processors, vec!["mock_stripe"]);
 }
 
 #[tokio::test]
@@ -1192,6 +1226,67 @@ async fn an_unpaid_checkout_holds_the_seat_until_its_session_expires() {
     );
 }
 
+// Two guests past the seat check for the last seat at once (both waiting on Stripe): once both
+// are written, the event holds no more registrations than seats.
+#[tokio::test]
+async fn two_guests_racing_for_the_last_seat_never_oversell_it() {
+    let t = tenant("hecks_pay_test_capacity_race").await;
+    t.schedule_event_with_capacity("last-seat", 1).await;
+    t.connect().await;
+    t.enable().await;
+    t.fake.state.session_rendezvous.store(2, Ordering::SeqCst);
+
+    let (first, second) = tokio::join!(
+        t.register_as("last-seat", "ada@example.com"),
+        t.register_as("last-seat", "grace@example.com")
+    );
+
+    let read = dispatch::read(&t.client, &t.wasm).await.unwrap();
+    let taken = web::seats_taken(
+        &read,
+        "CheckoutFixture",
+        &crate::commerce_ir::fixture_payments(),
+        "last-seat",
+    );
+    assert!(taken <= 1, "{taken} seats taken of 1: {first:?} {second:?}");
+    let admitted = [first.0, second.0]
+        .iter()
+        .filter(|status| **status == 200)
+        .count();
+    assert!(
+        admitted <= 1,
+        "both guests were admitted: {first:?} {second:?}"
+    );
+    for (status, body) in [first, second].iter().filter(|(status, _)| *status != 200) {
+        assert_eq!(
+            (*status, body["error"].as_str()),
+            (409, Some("this event is full"))
+        );
+    }
+}
+
+// Opening a mock walkthrough checkout costs nothing and nothing lapses it, so it holds no seat:
+// the seat is taken when the walkthrough is paid, and refused then if the event filled up.
+#[tokio::test]
+async fn an_unpaid_mock_checkout_holds_no_seat_and_paying_takes_one() {
+    let t = tenant("hecks_pay_test_capacity_mock_hold").await;
+    t.schedule_event_with_capacity("one-seat", 1).await;
+
+    let (status, first) = t.register("one-seat").await;
+    assert_eq!(status, 200, "{first}");
+    let (status, second) = t.register("one-seat").await;
+    assert_eq!(
+        status, 200,
+        "an unpaid walkthrough must not fill the event: {second}"
+    );
+
+    let first = first["registration_id"].as_str().unwrap().to_string();
+    let second = second["registration_id"].as_str().unwrap().to_string();
+    assert_eq!(t.settle(&first).await, 200);
+    assert_eq!(t.settle(&second).await, 409, "the only seat is taken");
+    assert_eq!(t.payment_status(&second).await, "pending");
+}
+
 #[tokio::test]
 async fn a_declined_payment_frees_the_seat_and_a_paid_one_keeps_it() {
     let t = tenant("hecks_pay_test_capacity_declined").await;
@@ -1202,6 +1297,7 @@ async fn a_declined_payment_frees_the_seat_and_a_paid_one_keeps_it() {
     let response = web::registration_complete_route(
         &first,
         r#"{"outcome":"failed"}"#,
+        &t.platform_now().await,
         Host::new(&t.client, &t.wasm, &t.config, &NeverInvoker),
         &crate::commerce_ir::fixture_payments(),
     )
@@ -1465,13 +1561,20 @@ async fn an_enabled_connection_whose_secret_key_is_missing_is_paused_not_mock()
     );
 }
 
+// The walkthrough's Pay button settles a mock payment only while checkout is the walkthrough: a
+// mock payment opened before real payments were switched on stays unpaid for good after.
 #[tokio::test]
-async fn only_a_mock_payment_can_be_settled_by_hand() {
+async fn only_a_mock_payment_is_settled_by_hand_and_only_while_checkout_is_the_mock() {
     let t = tenant("hecks_pay_test_complete").await;
     t.schedule_event("hand-event").await;
 
-    let (_, mock) = t.register("hand-event").await;
-    let mock_ref = mock["registration_id"].as_str().unwrap().to_string();
+    let (_, settled) = t.register("hand-event").await;
+    let settled_ref = settled["registration_id"].as_str().unwrap().to_string();
+    assert_eq!(t.settle(&settled_ref).await, 200);
+    assert_eq!(t.payment_status(&settled_ref).await, "succeeded");
+
+    let (_, stale) = t.register("hand-event").await;
+    let stale_ref = stale["registration_id"].as_str().unwrap().to_string();
     t.connect().await;
     t.enable().await;
     let (_, real) = t.register("hand-event").await;
@@ -1483,8 +1586,12 @@ async fn only_a_mock_payment_can_be_settled_by_hand() {
         "a real processor's payment is settled only by its webhook"
     );
     assert_eq!(t.payment_status(&real_ref).await, "pending");
-    assert_eq!(t.settle(&mock_ref).await, 200);
-    assert_eq!(t.payment_status(&mock_ref).await, "succeeded");
+    assert_eq!(
+        t.settle(&stale_ref).await,
+        403,
+        "a mock payment left over from before payments were enabled is never settled for free"
+    );
+    assert_eq!(t.payment_status(&stale_ref).await, "pending");
 }
 
 #[tokio::test]
@@ -1558,19 +1665,15 @@ fn checkout_plan_is_decided_from_the_connection_lifecycle() {
     };
     let own = |status: &str, mode: &str| with(status, "stripe", mode, SELF_ACCOUNT);
     assert!(matches!(checkout_plan(None, &platform), CheckoutPlan::Mock));
-    for status in ["connected", "disconnected"] {
+    for status in ["connected", "disconnected", "paused"] {
         assert!(
             matches!(
                 checkout_plan(Some(&own(status, "test")), &platform),
-                CheckoutPlan::Mock
+                CheckoutPlan::Paused
             ),
-            "{status}"
+            "{status}: a business that has its own account never falls back to the mock"
         );
     }
-    assert!(matches!(
-        checkout_plan(Some(&own("paused", "test")), &platform),
-        CheckoutPlan::Paused
-    ));
     assert!(matches!(
         checkout_plan(Some(&own("enabled", "test")), &platform),
         CheckoutPlan::Stripe { ref api_key, ref publishable_key } if api_key == "sk_test_own" && publishable_key == "pk_test_own"
@@ -1780,16 +1883,9 @@ async fn the_own_account_charges_with_its_own_key_and_names_no_other_account() {
     t.schedule_event("own-event").await;
     t.connect().await;
 
-    // Connected but not enabled: still the mock, no Stripe call.
+    // Connected but not enabled: registrations wait, no Stripe call.
     let (status, body) = t.register("own-event").await;
-    assert_eq!(status, 200, "{body}");
-    assert!(
-        body["checkout_url"]
-            .as_str()
-            .unwrap()
-            .starts_with("https://site.example/pay/"),
-        "{body}"
-    );
+    assert_eq!(status, 503, "{body}");
     assert!(t.fake.requests_to("/v1/checkout/sessions").is_empty());
 
     t.enable().await;
@@ -1984,8 +2080,10 @@ async fn saving_keys_checks_them_creates_the_webhook_and_keeps_every_secret_out_
         "url=https%3A%2F%2Fwebhooks.example.test%2Fwebhooks%2Fstripe",
         "description=Checkout+Fixture+website",
         "enabled_events%5B0%5D=checkout.session.completed",
-        "enabled_events%5B1%5D=checkout.session.expired",
-        "enabled_events%5B2%5D=charge.refunded",
+        "enabled_events%5B1%5D=checkout.session.async_payment_succeeded",
+        "enabled_events%5B2%5D=checkout.session.async_payment_failed",
+        "enabled_events%5B3%5D=checkout.session.expired",
+        "enabled_events%5B4%5D=charge.refunded",
     ] {
         assert!(
             created[0].body.contains(expected),

data/rust/host/src/payments.rs

@@ -5,14 +5,13 @@ use crate::auth;
 use crate::checkout::STRIPE_API_VERSION;
 use crate::dispatch;
 use crate::host::Host;
-use crate::journal::LineageConfig;
+use crate::store::journal_sql::LineageConfig;
+use crate::store::Store;
 use crate::web::{instances_for, json_error, last_refusal, respond, site_url};
 use serde_json::{json, Value};
 use std::collections::HashMap;
 use std::path::Path;
 use std::sync::Arc;
-use tokio::sync::Mutex;
-use tokio_postgres::Client;
 
 mod keystore;
 /// Which member roles may manage payments (`HECKS_PAYMENTS_MANAGER_ROLES`).
@@ -264,7 +263,7 @@ pub fn connection(read: &Value, domain: &str) -> Option<Connection> {
 
 /// What checkout does for one request.
 pub enum CheckoutPlan {
-    /// No connection, or one that is not enabled: the mock walkthrough.
+    /// No connection at all: the mock walkthrough.
     Mock,
     /// Payments are enabled: charged on the business's own account with its own
     /// key; the guest pays in a form embedded in the site via the publishable key.
@@ -272,8 +271,8 @@ pub enum CheckoutPlan {
         api_key: String,
         publishable_key: String,
     },
-    /// Payments were enabled and cannot be taken now. Registrations answer
-    /// 503; never a fallback to the mock.
+    /// A connection exists but payments cannot be taken now (paused, not yet
+    /// enabled, or disconnected). Registrations answer 503; never a fallback to the mock.
     Paused,
 }
 
@@ -302,8 +301,9 @@ pub fn checkout_plan(connection: Option<&Connection>, platform: &PlatformConfig)
                 }
             }
         }
-        "paused" => CheckoutPlan::Paused,
-        _ => CheckoutPlan::Mock,
+        // Paused, not yet enabled, or disconnected: a business that has, or had, its own
+        // account, where the walkthrough would let anyone register without paying.
+        _ => CheckoutPlan::Paused,
     }
 }
 
@@ -353,7 +353,7 @@ async fn caller(
     domain_ir: &Value,
     cookies: &HashMap<String, String>,
     secret: &str,
-    client: &Mutex<Client>,
+    domain_store: &Store,
     platform: &PlatformConfig,
 ) -> Result<Caller, Value> {
     let not_logged_in = || json_error(401, "not logged in");
@@ -363,7 +363,7 @@ async fn caller(
     else {
         return Err(not_logged_in());
     };
-    match auth::active_role(client, domain_ir, &email).await {
+    match auth::active_role(domain_store, domain_ir, &email).await {
         Ok(Some(role)) => Ok(Caller {
             manager: roles::manages(&platform.manager_roles, &role),
             operator: platform.is_operator(&email),
@@ -428,11 +428,11 @@ fn connection_json(
 }
 
 async fn current_connection(
-    client: &Mutex<Client>,
+    domain_store: &Store,
     wasm_path: &Path,
     config: &LineageConfig,
 ) -> Result<Option<Connection>, Value> {
-    match dispatch::read(client, wasm_path).await {
+    match dispatch::read(domain_store, wasm_path).await {
         Ok(read) => Ok(connection(&read, &config.domain)),
         Err(e) => Err(json_error(
             500,
@@ -444,11 +444,11 @@ async fn current_connection(
 async fn connection_response(
     caller: &Caller,
     platform: &PlatformConfig,
-    client: &Mutex<Client>,
+    domain_store: &Store,
     wasm_path: &Path,
     config: &LineageConfig,
 ) -> Value {
-    match current_connection(client, wasm_path, config).await {
+    match current_connection(domain_store, wasm_path, config).await {
         Ok(connection) => respond(
             200,
             "application/json",
@@ -473,7 +473,7 @@ pub async fn route(
     host: Host<'_>,
 ) -> Option<Value> {
     let Host {
-        client,
+        store: domain_store,
         wasm_path,
         config,
         ..
@@ -481,12 +481,12 @@ pub async fn route(
     if !owns(method, path) {
         return None;
     }
-    let caller = match caller(domain_ir, cookies, secret, client, platform).await {
+    let caller = match caller(domain_ir, cookies, secret, domain_store, platform).await {
         Ok(caller) => caller,
         Err(response) => return Some(response),
     };
     Some(match path {
-        "/payments/connection" => show(&caller, platform, client, wasm_path, config).await,
+        "/payments/connection" => show(&caller, platform, domain_store, wasm_path, config).await,
         "/payments/connection/direct" => direct_route(&caller, raw_body, platform, host).await,
         "/payments/connection/disconnect" => disconnect_route(&caller, platform, host).await,
         "/payments/connection/enable" => {
@@ -514,14 +514,14 @@ pub async fn route(
 async fn show(
     caller: &Caller,
     platform: &PlatformConfig,
-    client: &Mutex<Client>,
+    domain_store: &Store,
     wasm_path: &Path,
     config: &LineageConfig,
 ) -> Value {
     if !caller.manager && !caller.operator {
         return json_error(403, "not permitted");
     }
-    connection_response(caller, platform, client, wasm_path, config).await
+    connection_response(caller, platform, domain_store, wasm_path, config).await
 }
 
 fn body_field(body: &Value, key: &str) -> Result<String, Value> {
@@ -545,12 +545,12 @@ async fn record_connection(
     host: Host<'_>,
 ) -> Value {
     let Host {
-        client,
+        store: domain_store,
         wasm_path,
         config,
         ..
     } = host;
-    let existing = match current_connection(client, wasm_path, config).await {
+    let existing = match current_connection(domain_store, wasm_path, config).await {
         Ok(existing) => existing,
         Err(response) => return response,
     };
@@ -576,7 +576,7 @@ async fn record_connection(
     };
     match outcome {
         Ok(outcome) if outcome.accepted => {
-            connection_response(caller, platform, client, wasm_path, config).await
+            connection_response(caller, platform, domain_store, wasm_path, config).await
         }
         Ok(outcome) => json_error(422, &refusal_message(&last_refusal(&outcome.result))),
         Err(e) => json_error(500, &format!("{e:#}")),
@@ -629,7 +629,7 @@ async fn direct_route(
 // also removes its webhook and deletes the saved keys.
 async fn disconnect_route(caller: &Caller, platform: &PlatformConfig, host: Host<'_>) -> Value {
     let Host {
-        client,
+        store: domain_store,
         wasm_path,
         config,
         ..
@@ -637,7 +637,7 @@ async fn disconnect_route(caller: &Caller, platform: &PlatformConfig, host: Host
     if let Err(response) = require_manager(caller) {
         return response;
     }
-    let existing = match current_connection(client, wasm_path, config).await {
+    let existing = match current_connection(domain_store, wasm_path, config).await {
         Ok(existing) => existing,
         Err(response) => return response,
     };
@@ -657,7 +657,7 @@ async fn disconnect_route(caller: &Caller, platform: &PlatformConfig, host: Host
                 forget_saved_keys(platform, &existing.mode).await;
             }
             let refreshed = refreshed(platform).await;
-            connection_response(caller, &refreshed, client, wasm_path, config).await
+            connection_response(caller, &refreshed, domain_store, wasm_path, config).await
         }
         Ok(outcome) => json_error(422, &refusal_message(&last_refusal(&outcome.result))),
         Err(e) => json_error(500, &format!("{e:#}")),
@@ -672,7 +672,7 @@ async fn switch_route(
     host: Host<'_>,
 ) -> Value {
     let Host {
-        client,
+        store: domain_store,
         wasm_path,
         config,
         ..
@@ -680,14 +680,14 @@ async fn switch_route(
     if let Err(response) = require_operator(caller) {
         return response;
     }
-    match current_connection(client, wasm_path, config).await {
+    match current_connection(domain_store, wasm_path, config).await {
         Ok(Some(_)) => {}
         Ok(None) => return json_error(409, "connect an account first"),
         Err(response) => return response,
     }
     match dispatch_on_connection(which, json!({}), host).await {
         Ok(outcome) if outcome.accepted => {
-            connection_response(caller, platform, client, wasm_path, config).await
+            connection_response(caller, platform, domain_store, wasm_path, config).await
         }
         Ok(outcome) => json_error(422, &refusal_message(&last_refusal(&outcome.result))),
         Err(e) => json_error(500, &format!("{e:#}")),
@@ -743,8 +743,12 @@ const STRIPE_UNREACHABLE: &str = "Could not reach Stripe. Please try again in a
 const WEBHOOK_PERMISSION: &str = "That key can't create the webhook. In Stripe, give it Webhook Endpoints → Write as well and try again.";
 const WEBHOOK_FAILED: &str = "Stripe could not set up the payment webhook. Please try again.";
 const STORE_FAILED: &str = "The keys could not be stored, so nothing was saved. Please try again.";
-const WEBHOOK_EVENTS: [&str; 3] = [
+// A session paid by a delayed method (a bank debit) completes unpaid and settles through the two
+// `async_payment_*` events.
+const WEBHOOK_EVENTS: [&str; 5] = [
     "checkout.session.completed",
+    "checkout.session.async_payment_succeeded",
+    "checkout.session.async_payment_failed",
     "checkout.session.expired",
     "charge.refunded",
 ];
@@ -903,7 +907,7 @@ async fn save_keys_route(
     host: Host<'_>,
 ) -> Value {
     let Host {
-        client,
+        store: domain_store,
         wasm_path,
         config,
         ..
@@ -924,7 +928,7 @@ async fn save_keys_route(
         Ok(mode) => mode,
         Err(message) => return json_error(422, message),
     };
-    let existing = match current_connection(client, wasm_path, config).await {
+    let existing = match current_connection(domain_store, wasm_path, config).await {
         Ok(existing) => existing,
         Err(response) => return response,
     };
@@ -981,7 +985,7 @@ async fn save_keys_route(
 
     let fresh = refreshed(platform).await;
     if in_place {
-        return connection_response(caller, &fresh, client, wasm_path, config).await;
+        return connection_response(caller, &fresh, domain_store, wasm_path, config).await;
     }
     let facts = json!({
         "processor": {"value": PROCESSOR},

data/rust/host/src/platform_signin/extension.rs

@@ -159,7 +159,7 @@ impl PlatformSignin {
             return pages::refusal(Failure::Unavailable);
         };
         let members = HostMembers {
-            client: ctx.client,
+            store: ctx.store,
             domain_ir,
             wasm_path: ctx.wasm_path,
             config: ctx.config,