@12-apps/payments-frontend 1.4.0 → 1.4.2

package/src/__tests__/verification-slot.test.tsx

@@ -1,125 +0,0 @@
-// @vitest-environment jsdom
-import { cleanup, render, screen, waitFor } from '@testing-library/react';
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-import type { MerchantSettingsView } from '@12-apps/payments-backend';
-
-import type { PaymentsSettingsClient } from '../client';
-import { PaymentProviderSettings } from '../components/PaymentProviderSettings';
-
-/**
- * The activation step's slot.
- *
- * "Connected" and "can charge" are different facts, and only the HOST can prove
- * the second — it owns the endpoint that puts a real cent through the store's
- * account. This package's job is narrower and worth pinning: place that step
- * where an owner will actually find it, and tell the host which provider is
- * open and whether it is already live.
- */
-
-const PROVIDERS = [
-  { name: 'pagbank', displayName: 'PagBank', authMode: 'oauth', credentialSchema: [] },
-];
-
-function viewWith(config: Record<string, unknown> | null): MerchantSettingsView {
-  return {
-    providers: PROVIDERS,
-    configs: config ? [config] : [],
-    activeProvider: null,
-  } as unknown as MerchantSettingsView;
-}
-
-function fakeClient(view: MerchantSettingsView): PaymentsSettingsClient {
-  return {
-    getSettings: vi.fn().mockResolvedValue(view),
-    getSetupGuide: vi.fn().mockResolvedValue(null),
-    setEnabled: vi.fn(),
-    saveCredentials: vi.fn(),
-  } as unknown as PaymentsSettingsClient;
-}
-
-afterEach(cleanup);
-
-describe('PaymentProviderSettings — the verification slot', () => {
-  it('is not rendered while the owner is still on the provider list', async () => {
-    const renderVerification = vi.fn(() => <div data-testid="slot" />);
-    render(
-      <PaymentProviderSettings
-        client={fakeClient(viewWith(null))}
-        renderVerification={renderVerification}
-      />,
-    );
-
-    await screen.findByTestId('payments-provider-picker');
-    expect(renderVerification).not.toHaveBeenCalled();
-  });
-
-  it('hands the host the open provider and its connection state', async () => {
-    const renderVerification = vi.fn(() => <div data-testid="slot" />);
-    render(
-      <PaymentProviderSettings
-        client={fakeClient(
-          viewWith({ provider: 'pagbank', status: 'VERIFIED', enabled: true, environments: {} }),
-        )}
-        initialProvider="pagbank"
-        renderVerification={renderVerification}
-      />,
-    );
-
-    await screen.findByTestId('slot');
-    expect(renderVerification).toHaveBeenCalledWith(
-      expect.objectContaining({ provider: 'pagbank', connected: true }),
-    );
-    /**
-     * `enabled` is deliberately withheld. The step used it to render a
-     * standing "Provedor ativo" banner, which went on reassuring a store whose
-     * every charge was refused — the banner and the refusal were on screen
-     * together. The step reports what it observes, nothing else.
-     */
-    expect(renderVerification).not.toHaveBeenCalledWith(
-      expect.objectContaining({ enabled: expect.anything() }),
-    );
-  });
-
-  /**
-   * A provider with no stored row yet still renders the slot — the host decides
-   * to show nothing. Reporting `connected: false` is what lets it.
-   */
-  it('reports a provider with no stored connection as not connected', async () => {
-    const renderVerification = vi.fn(() => <div data-testid="slot" />);
-    render(
-      <PaymentProviderSettings
-        client={fakeClient(viewWith(null))}
-        initialProvider="pagbank"
-        renderVerification={renderVerification}
-      />,
-    );
-
-    await screen.findByTestId('slot');
-    expect(renderVerification).toHaveBeenCalledWith(
-      expect.objectContaining({ connected: false }),
-    );
-  });
-
-  /**
-   * Placement, not just presence: the step must sit OUTSIDE the manual
-   * credentials disclosure. An owner who connected by OAuth is told no key
-   * needs copying, so they have no reason to open it — and the step that
-   * actually turns the store on would be hidden in there.
-   */
-  it('places the step outside the manual-credentials disclosure', async () => {
-    render(
-      <PaymentProviderSettings
-        client={fakeClient(
-          viewWith({ provider: 'pagbank', status: 'VERIFIED', enabled: false, environments: {} }),
-        )}
-        initialProvider="pagbank"
-        renderVerification={() => <div data-testid="slot" />}
-      />,
-    );
-
-    const slot = await screen.findByTestId('slot');
-    await waitFor(() => expect(screen.queryByTestId('payments-manual-fallback')).toBeNull());
-    expect(slot.closest('[data-testid="payments-manual-fallback"]')).toBeNull();
-  });
-});

package/src/card/tokenize.test.ts

@@ -1,194 +0,0 @@
-// @vitest-environment jsdom
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-import { tokenizeForCheckout, tokenizerFor } from "./tokenize";
-import type { CardDetails } from "./types";
-
-/** A Luhn-valid Visa test PAN (the mock path validates before minting). */
-const VALID_CARD: CardDetails = {
-  number: "4111 1111 1111 1111",
-  holder: "Ana Compradora",
-  expiry: "12/39",
-  cvv: "123",
-};
-
-/** The always-declines test PAN the mock encodes as `tok_declined…`. */
-const DECLINE_CARD: CardDetails = { ...VALID_CARD, number: "4000 0000 0000 0002" };
-
-describe("tokenizeForCheckout — the mock gate (FUT-697)", () => {
-  it("NEVER mints a mock token without server-granted stub permission", async () => {
-    // The exact production shape of the bug: a Stone/Stripe store resolved to
-    // a null PagBank key, and the old fallback minted a fake `tok_…` that
-    // entered a real charge. With no `mockTokenization` grant, the answer is
-    // a clear bail BEFORE any money moves.
-    const result = await tokenizeForCheckout(VALID_CARD, {
-      provider: "stripe",
-      publicKey: null,
-      mockTokenization: false,
-    });
-    expect(result.ok).toBe(false);
-    if (!result.ok) expect(result.error).toContain("indisponível");
-  });
-
-  it("bails clearly for a provider with no browser scheme, even WITH a key", async () => {
-    const result = await tokenizeForCheckout(VALID_CARD, {
-      provider: "infinitepay",
-      publicKey: "pk_live_123",
-      mockTokenization: false,
-    });
-    expect(result.ok).toBe(false);
-    if (!result.ok) expect(result.error).toContain("indisponível");
-  });
-
-  it("bails clearly when the store has no provider at all", async () => {
-    const result = await tokenizeForCheckout(VALID_CARD, {
-      provider: null,
-      publicKey: null,
-      mockTokenization: false,
-    });
-    expect(result.ok).toBe(false);
-    if (!result.ok) expect(result.error).toContain("indisponível");
-  });
-
-  it("mints the mock token under stub permission (dev / e2e path)", async () => {
-    const result = await tokenizeForCheckout(VALID_CARD, {
-      provider: "pagbank",
-      publicKey: null,
-      mockTokenization: true,
-    });
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.data.token).toMatch(/^tok/);
-      expect(result.data.token).not.toMatch(/^tok_declined/);
-      expect(result.data.last4).toBe("1111");
-    }
-  });
-
-  it("encodes the decline scenario in the mock token", async () => {
-    const result = await tokenizeForCheckout(DECLINE_CARD, {
-      provider: "pagbank",
-      publicKey: null,
-      mockTokenization: true,
-    });
-    expect(result.ok).toBe(true);
-    if (result.ok) expect(result.data.token).toMatch(/^tok_declined/);
-  });
-
-  it("still validates the card before minting a mock", async () => {
-    const result = await tokenizeForCheckout(
-      { ...VALID_CARD, number: "1234" },
-      { provider: "pagbank", publicKey: null, mockTokenization: true },
-    );
-    expect(result.ok).toBe(false);
-  });
-
-  it("routes a keyed PagBank store to the REAL tokenizer — a key beats stub permission", async () => {
-    // Stub the SDK so `ensurePagBankSdk` short-circuits (no script injection in
-    // the test env). The encrypted blob coming back — never a `tok_…` mock —
-    // is the proof that a present key routes to REAL tokenization even when
-    // stub permission was granted.
-    const pagSeguro = {
-      encryptCard: () => ({ hasErrors: false, encryptedCard: "enc-blob-123" }),
-    };
-    (window as typeof window & { PagSeguro?: typeof pagSeguro }).PagSeguro = pagSeguro;
-    try {
-      const result = await tokenizeForCheckout(VALID_CARD, {
-        provider: "pagbank",
-        publicKey: "PUB-KEY",
-        mockTokenization: true, // even with stub permission, a key means REAL tokenization
-      });
-      expect(result.ok).toBe(true);
-      if (result.ok) {
-        expect(result.data.token).toBe("enc-blob-123");
-        expect(result.data.token).not.toMatch(/^tok/);
-      }
-    } finally {
-      delete (window as typeof window & { PagSeguro?: typeof pagSeguro }).PagSeguro;
-    }
-  });
-});
-
-describe("tokenizerFor — scheme is chosen by provider, never by capability", () => {
-  it("names each implemented provider's own scheme", () => {
-    expect(tokenizerFor("pagbank")).toBe("pagbank-sdk");
-    expect(tokenizerFor("stone")).toBe("pagarme-token");
-    expect(tokenizerFor("stripe")).toBe("stripe-pm");
-  });
-
-  it("answers null for providers with no browser card path", () => {
-    expect(tokenizerFor("infinitepay")).toBeNull();
-    expect(tokenizerFor("unknown-vendor")).toBeNull();
-  });
-});
-
-describe("tokenizeForCheckout — the stripe-pm scheme (FUT-698)", () => {
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
-  /** Stub fetch once and capture the single call the tokenizer makes. */
-  function stubStripe(status: number, body: unknown): { url?: string; init?: RequestInit }[] {
-    const calls: { url?: string; init?: RequestInit }[] = [];
-    vi.stubGlobal(
-      "fetch",
-      vi.fn(async (url: RequestInfo | URL, init?: RequestInit) => {
-        calls.push({ url: String(url), init });
-        return new Response(JSON.stringify(body), { status });
-      }),
-    );
-    return calls;
-  }
-
-  it("mints a PaymentMethod at Stripe with the publishable key — the PAN never reaches us", async () => {
-    const calls = stubStripe(200, { id: "pm_123", card: { brand: "visa", last4: "1111" } });
-
-    const result = await tokenizeForCheckout(VALID_CARD, {
-      provider: "stripe",
-      publicKey: "pk_test_1",
-      mockTokenization: false,
-    });
-
-    expect(result.ok).toBe(true);
-    if (result.ok) {
-      expect(result.data.token).toBe("pm_123");
-      expect(result.data.last4).toBe("1111");
-    }
-    expect(calls[0]?.url).toBe("https://api.stripe.com/v1/payment_methods");
-    const headers = calls[0]?.init?.headers as Record<string, string>;
-    expect(headers["Authorization"]).toBe("Bearer pk_test_1");
-    const form = new URLSearchParams(String(calls[0]?.init?.body));
-    expect(form.get("type")).toBe("card");
-    expect(form.get("card[number]")).toBe("4111111111111111");
-    expect(form.get("card[exp_month]")).toBe("12");
-    expect(form.get("card[exp_year]")).toBe("2039");
-  });
-
-  it("carries Stripe's refusal verbatim — the provider's answer must reach a human", async () => {
-    stubStripe(402, { error: { message: "Your card number is incorrect." } });
-
-    const result = await tokenizeForCheckout(VALID_CARD, {
-      provider: "stripe",
-      publicKey: "pk_test_1",
-      mockTokenization: false,
-    });
-
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.error).toContain("HTTP 402");
-      expect(result.error).toContain("Your card number is incorrect.");
-    }
-  });
-
-  it("a keyed Stripe store routes to the REAL tokenizer — a key beats stub permission", async () => {
-    stubStripe(200, { id: "pm_real" });
-
-    const result = await tokenizeForCheckout(VALID_CARD, {
-      provider: "stripe",
-      publicKey: "pk_test_1",
-      mockTokenization: true, // even with stub permission, a key means REAL tokenization
-    });
-
-    expect(result.ok).toBe(true);
-    if (result.ok) expect(result.data.token).toBe("pm_real");
-  });
-});

package/src/components/checkout/__tests__/card-3ds-handover.test.tsx

@@ -1,147 +0,0 @@
-// @vitest-environment jsdom
-/**
- * FUT-698 — "Dado uma loja Stripe, quando o comprador paga com um cartão que
- * exige 3DS, então ele é levado ao desafio" — the browser-unreachable half of
- * that scenario (the stub adapter settles cards inline, so no e2e journey can
- * produce a real challenge). The return half — "e volta com o pedido pago
- * exatamente uma vez" — is the hosted-return machinery, pinned in
- * hosted-return.test.ts and settled server-side by the idempotent webhook path.
- *
- * The charge answers `hostedCheckoutUrl` and the card hook must hand the buyer
- * over exactly as a redirect provider's link does (FUT-556): park the order,
- * navigate, and start NO poll in a tab that is being torn down.
- */
-import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-import type { JSX } from "react";
-
-const client = vi.hoisted(() => ({
-  chargeCard: vi.fn(),
-  listSavedCards: vi.fn(),
-  refreshCardPublicKey: vi.fn(),
-  pollOrderStatus: vi.fn(),
-  fetchCheckoutConfig: vi.fn(),
-}));
-
-vi.mock("../client", () => client);
-
-import type { CardTokenizationConfig } from "../../../card";
-import type { CheckoutOrder, OrderStatus } from "../types";
-import { useCardCheckout } from "../use-card-checkout";
-
-const ORDER: CheckoutOrder = {
-  orderId: "o1",
-  status: "AWAITING_PAYMENT",
-  method: "CARD",
-  totalCents: 1250,
-  subtotalCents: 1250,
-  discountTotalCents: 0,
-  appliedDiscounts: [],
-  totalLabel: "R$ 12,50",
-};
-
-const STRIPE_CONFIG: CardTokenizationConfig = {
-  provider: "stripe",
-  publicKey: "pk_test_1",
-  mockTokenization: false,
-};
-
-/** A saved card, so paying skips tokenization and goes straight to the charge. */
-const SAVED_CARD = {
-  id: "card-1",
-  brand: "visa",
-  last4: "4242",
-  expMonth: 12,
-  expYear: 2033,
-  holder: "OLGA STONE",
-};
-
-function Harness({ onResolved }: { onResolved: (status: OrderStatus) => void }): JSX.Element {
-  const cc = useCardCheckout(ORDER, {}, STRIPE_CONFIG, onResolved, 10, "acme");
-  return (
-    <div>
-      <span data-testid="submitted">{String(cc.submitted)}</span>
-      <span data-testid="selection">{cc.selection}</span>
-      <button type="button" data-testid="pay" onClick={() => void cc.handlePay()}>
-        Pagar
-      </button>
-    </div>
-  );
-}
-
-/** Render, wait for the saved card to be SELECTED, and tap Pagar. */
-async function pay(onResolved = vi.fn()): Promise<void> {
-  render(<Harness onResolved={onResolved} />);
-  // Selection — not merely the fetch — is what routes handlePay past the
-  // empty new-card form; clicking earlier validates that form and stops.
-  await waitFor(() => {
-    expect(screen.getByTestId("selection").textContent).toBe("card-1");
-  });
-  fireEvent.click(screen.getByTestId("pay"));
-}
-
-const assign = vi.fn();
-
-beforeEach(() => {
-  vi.clearAllMocks();
-  window.sessionStorage.clear();
-  client.listSavedCards.mockResolvedValue([SAVED_CARD]);
-  client.pollOrderStatus.mockResolvedValue({ ok: true, data: "AWAITING_PAYMENT" });
-  vi.stubGlobal("location", { search: "", assign });
-});
-
-afterEach(() => {
-  cleanup();
-  vi.unstubAllGlobals();
-  window.sessionStorage.clear();
-});
-
-describe("card charge → 3DS handover (FUT-698)", () => {
-  it("hands the buyer to the challenge page with the order parked for the return trip", async () => {
-    client.chargeCard.mockResolvedValue({
-      ok: true,
-      data: { status: "AWAITING_PAYMENT", hostedCheckoutUrl: "https://hooks.stripe.com/3ds/x" },
-    });
-    const onResolved = vi.fn();
-
-    await pay(onResolved);
-
-    await waitFor(() => {
-      expect(assign).toHaveBeenCalledWith("https://hooks.stripe.com/3ds/x");
-    });
-    // Parked exactly as the redirect-provider handoff parks (FUT-556), so the
-    // return trip resumes THIS order's confirmation screen.
-    const parked = window.sessionStorage.getItem("futurepay.checkout.hostedOrder");
-    expect(parked).not.toBeNull();
-    expect((JSON.parse(parked as string) as { orderId: string }).orderId).toBe("o1");
-    // The tab is navigating away: nothing resolved, no poll started here.
-    expect(onResolved).not.toHaveBeenCalled();
-    expect(client.pollOrderStatus).not.toHaveBeenCalled();
-    expect(screen.getByTestId("submitted").textContent).toBe("false");
-  });
-
-  it("an accepted charge WITHOUT a challenge begins polling instead of navigating", async () => {
-    client.chargeCard.mockResolvedValue({ ok: true, data: { status: "AWAITING_PAYMENT" } });
-
-    await pay();
-
-    await waitFor(() => {
-      expect(screen.getByTestId("submitted").textContent).toBe("true");
-    });
-    expect(assign).not.toHaveBeenCalled();
-    expect(window.sessionStorage.getItem("futurepay.checkout.hostedOrder")).toBeNull();
-  });
-
-  it("a decline resolves to the status screen, never a handover", async () => {
-    client.chargeCard.mockResolvedValue({ ok: true, data: { status: "FAILED" } });
-    const onResolved = vi.fn();
-
-    await pay(onResolved);
-
-    await waitFor(() => {
-      expect(onResolved).toHaveBeenCalledWith("FAILED");
-    });
-    expect(assign).not.toHaveBeenCalled();
-  });
-});