@aglyn/plugins-commerce 1.0.0-beta.200 → 1.0.0-beta.201

package/src/lib/server/billing-webhook.js

@@ -25,6 +25,8 @@ import { recordContactRefund } from "./contact-refund.js";
 // specs in this library mock `@aglyn/tenant-data-admin` wholesale, and a
 // permissive stub would turn a reversal that never happened green.
 import { reverseEmailAttributedRevenue } from "@aglyn/tenant-data-admin/server/email-revenue-attribution";
+import { paymentRiskEventFrom } from "@aglyn/aglyn/app-utils/payment-risk";
+import { recordPaymentRiskOnRecord } from "@aglyn/tenant-data-admin/server/payment-risk-record";
 import { mintDownloadToken, tokenSigningSecret } from "./download.js";
 import { alertLowStockCrossing } from "./low-stock.js";
 import { decrementVariantStock } from "./reserve-stock.js";
@@ -2591,7 +2593,10 @@ async function findOrderForDispute(paymentIntentId) {
                         fromName: (await brandFor(hostId)).fromName,
                         sendingIdentity: await hostSendingIdentity(String(hostId)),
                         audience: 'tenant',
-                        context: 'reservation confirmation'
+                        context: 'reservation confirmation',
+                        // Owed to the recipient by their own booking: the phishing
+                        // screen's soft rules never hold it (AGL-3356).
+                        owedFor: 'booking'
                     }));
                     // Cost meter (AGL-1438). Transactional: the guest has paid, and a
                     // confirmation a quota refused reads as a failed reservation.
@@ -2868,7 +2873,10 @@ async function findOrderForDispute(paymentIntentId) {
                     fromName: (await brandFor(hostId)).fromName,
                     sendingIdentity: await hostSendingIdentity(String(hostId)),
                     audience: 'tenant',
-                    context: 'cart receipt'
+                    context: 'cart receipt',
+                    // Owed to the recipient by their own order: the phishing
+                    // screen's soft rules never hold it (AGL-3356).
+                    owedFor: 'order'
                 }));
                 // Cost meter (AGL-1438). Transactional: a dropped receipt looks to
                 // the buyer like an order that did not go through.
@@ -3123,7 +3131,10 @@ async function findOrderForDispute(paymentIntentId) {
                             fromName: (await brandFor(hostId)).fromName,
                             sendingIdentity: await hostSendingIdentity(String(hostId)),
                             audience: 'tenant',
-                            context: 'gift card'
+                            context: 'gift card',
+                            // Owed to the recipient by their own order: the phishing
+                            // screen's soft rules never hold it (AGL-3356).
+                            owedFor: 'order'
                         }));
                         // Cost meter (AGL-1438). Transactional: this email IS the
                         // purchased goods.
@@ -3698,7 +3709,10 @@ async function findOrderForDispute(paymentIntentId) {
                             fromName: (await brandFor(hostId)).fromName,
                             sendingIdentity: await hostSendingIdentity(String(hostId)),
                             audience: 'tenant',
-                            context: 'dropship supplier notice'
+                            context: 'dropship supplier notice',
+                            // Owed to the recipient by their own order: the phishing
+                            // screen's soft rules never hold it (AGL-3356).
+                            owedFor: 'order'
                         });
                         // Cost meter (AGL-1438). Transactional: without it the order is
                         // never fulfilled.
@@ -3813,7 +3827,10 @@ async function findOrderForDispute(paymentIntentId) {
                         fromName: (await brandFor(hostId)).fromName,
                         sendingIdentity: await hostSendingIdentity(String(hostId)),
                         audience: 'tenant',
-                        context: 'receipt'
+                        context: 'receipt',
+                        // Owed to the recipient by their own order: the phishing
+                        // screen's soft rules never hold it (AGL-3356).
+                        owedFor: 'order'
                     }));
                     // Cost meter (AGL-1438). Transactional, as the cart receipt above.
                     await meterHostEmail(String(hostId));
@@ -3857,7 +3874,10 @@ async function findOrderForDispute(paymentIntentId) {
                             fromName: (await brandFor(hostId)).fromName,
                             sendingIdentity: await hostSendingIdentity(String(hostId)),
                             audience: 'tenant',
-                            context: 'seller order notice'
+                            context: 'seller order notice',
+                            // Owed to the recipient by their own order: the phishing
+                            // screen's soft rules never hold it (AGL-3356).
+                            owedFor: 'order'
                         }));
                         // Cost meter (AGL-1438). Transactional: the seller learns about
                         // the order here.
@@ -3867,6 +3887,45 @@ async function findOrderForDispute(paymentIntentId) {
             }
         }
     }
+    // Fraud signals on a store's sale (AGL-3360): an issuer's early fraud
+    // warning and a Radar review. The merchant decides what to do for their
+    // own customer, so the signal lands on the ORDER — a timeline line and the
+    // shared `paymentRisk` chip — and the site's managers are told once.
+    // Nothing is refunded or canceled. Found by the same payment-intent join a
+    // dispute uses; a signal on anything else is not commerce's and stays
+    // silent here (the platform route and the other plugins answer it).
+    // Disputes keep their own branch below, which has always told the
+    // merchant; both report the site so the seller's fraud ledger can name it.
+    const risk = paymentRiskEventFrom(type, object);
+    if (risk && risk.signal.kind !== 'dispute') {
+        var _ref83, _snapshot_data;
+        var _snapshot_ref_parent_parent;
+        const lookup = risk.paymentIntentId ? await findOrderForDispute(risk.paymentIntentId) : {
+            kind: 'not-ours'
+        };
+        if (lookup.kind !== 'order') return;
+        const snapshot = lookup.snapshot;
+        const hostId = String((_ref83 = (_snapshot_ref_parent_parent = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent.id) != null ? _ref83 : '');
+        const order = CommerceModel.liftLegacyOrder((_snapshot_data = snapshot.data()) != null ? _snapshot_data : {});
+        await recordPaymentRiskOnRecord({
+            ref: snapshot.ref,
+            signal: risk.signal,
+            hostId,
+            subjectLabel: `Order ${CommerceModel.formatOrderNumber(order, snapshot.id)}`,
+            link: `/${hostId}/orders`,
+            notificationType: 'content.order',
+            extraUpdate: (data)=>({
+                    timeline: CommerceModel.appendOrderEvent(CommerceModel.liftLegacyOrder(data), risk.signal.kind === 'early-fraud-warning' ? 'fraud-warning' : 'payment-review', risk.signal.kind === 'early-fraud-warning' ? 'The card issuer reported this payment as possibly fraudulent' + (risk.signal.detail ? ` (${risk.signal.detail.replace(/_/g, ' ')})` : '') : 'Stripe Radar is holding this payment for review', risk.signal.atMs)
+                })
+        }, {
+            firestore: firebaseAdmin.app().firestore(),
+            notify: notifyHostManagers
+        });
+        return {
+            claimed: true,
+            hostId
+        };
+    }
     // Card disputes against a merchant's store (AGL-1787).
     //
     // Commerce subscribed no `charge.dispute.*` event at all, so a shopper
@@ -3892,7 +3951,8 @@ async function findOrderForDispute(paymentIntentId) {
     // finds). AGL-1554 will add its own `closed` branch for the marketplace
     // side; the two coexist because each self-selects by finding its own record.
     if (type === 'charge.dispute.created' || type === 'charge.dispute.closed') {
-        var _dispute_payment_intent;
+        var _dispute_payment_intent, _ref84;
+        var _snapshot_ref_parent_parent1;
         const dispute = object != null ? object : {};
         const paymentIntentId = String((_dispute_payment_intent = dispute.payment_intent) != null ? _dispute_payment_intent : '');
         const lookup = paymentIntentId ? await findOrderForDispute(paymentIntentId) : {
@@ -3917,9 +3977,9 @@ async function findOrderForDispute(paymentIntentId) {
         const claimed = lookup.kind === 'order' || lookup.kind === 'unresolved';
         const snapshot = lookup.kind === 'order' ? lookup.snapshot : null;
         if (snapshot) {
-            var _ref83;
-            var _snapshot_ref_parent_parent;
-            const hostId = String((_ref83 = (_snapshot_ref_parent_parent = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent.id) != null ? _ref83 : '');
+            var _ref85;
+            var _snapshot_ref_parent_parent2;
+            const hostId = String((_ref85 = (_snapshot_ref_parent_parent2 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent2.id) != null ? _ref85 : '');
             if (type === 'charge.dispute.created') {
                 const { opened, record } = await recordDisputeOpened(snapshot, dispute);
                 if (opened && hostId) {
@@ -3936,7 +3996,7 @@ async function findOrderForDispute(paymentIntentId) {
                     });
                 }
             } else {
-                var _ref84;
+                var _ref86;
                 const settled = await recordDisputeClosed(snapshot, dispute);
                 if (settled.recorded && hostId) {
                     await notifyHostManagers(hostId, {
@@ -3994,7 +4054,7 @@ async function findOrderForDispute(paymentIntentId) {
                 // transiently-failed reversal gets its retry — and gated inside on
                 // the order's own `reversedTransferCents` marker, so it runs at most
                 // once per dispute however many times Stripe delivers.
-                if (String((_ref84 = dispute == null ? void 0 : dispute.status) != null ? _ref84 : '') === 'lost') {
+                if (String((_ref86 = dispute == null ? void 0 : dispute.status) != null ? _ref86 : '') === 'lost') {
                     const pulledBackCents = await reverseSellerShare(snapshot.ref, dispute);
                     // The merchant-experience half of the AGL-1794 decision, and not an
                     // optional extra: the reversal takes money out of the connected
@@ -4021,9 +4081,11 @@ async function findOrderForDispute(paymentIntentId) {
                 }
             }
         }
-        return {
+        return _extends({
             claimed
-        };
+        }, snapshot ? {
+            hostId: String((_ref84 = (_snapshot_ref_parent_parent1 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent1.id) != null ? _ref84 : '')
+        } : {});
     }
 };