@aglyn/plugins-commerce 1.0.0-beta.200 → 1.0.0-beta.202

package/src/lib/server/billing-webhook.js

@@ -25,6 +25,9 @@ import { recordContactRefund } from "./contact-refund.js";
 // specs in this library mock `@aglyn/tenant-data-admin` wholesale, and a
 // permissive stub would turn a reversal that never happened green.
 import { reverseEmailAttributedRevenue } from "@aglyn/tenant-data-admin/server/email-revenue-attribution";
+import { paymentRiskEventFrom } from "@aglyn/aglyn/app-utils/payment-risk";
+import { recordPaymentRiskOnRecord } from "@aglyn/tenant-data-admin/server/payment-risk-record";
+import { applyGiftCardRiskToOrder, notifyGiftCardHold } from "./gift-card-risk.js";
 import { mintDownloadToken, tokenSigningSecret } from "./download.js";
 import { alertLowStockCrossing } from "./low-stock.js";
 import { decrementVariantStock } from "./reserve-stock.js";
@@ -303,6 +306,26 @@ async function findOrderForDispute(paymentIntentId) {
         evidenceDueByMs: dueBy * 1000
     } : {});
 }
+/**
+ * Apply a gift-card risk action to the cards an order issued (AGL-3363). The
+ * order doc id is the Checkout Session id every issued card carries as its
+ * `orderId`. Never throws.
+ */ async function applyOrderGiftCardRisk(snapshot, action) {
+    try {
+        var _snapshot_ref_parent, _snapshot_ref;
+        const hostRef = (_snapshot_ref = snapshot.ref) == null ? void 0 : (_snapshot_ref_parent = _snapshot_ref.parent) == null ? void 0 : _snapshot_ref_parent.parent;
+        if (!hostRef) return 0;
+        return await applyGiftCardRiskToOrder({
+            firestore: firebaseAdmin.app().firestore(),
+            hostRef,
+            orderId: snapshot.id,
+            action
+        });
+    } catch (error) {
+        console.error('[gift-card-risk] skipped', snapshot.id, error);
+        return 0;
+    }
+}
 /**
  * `charge.dispute.created`: FLAG the order, reverse nothing (AGL-1787).
  *
@@ -2591,7 +2614,10 @@ async function findOrderForDispute(paymentIntentId) {
                         fromName: (await brandFor(hostId)).fromName,
                         sendingIdentity: await hostSendingIdentity(String(hostId)),
                         audience: 'tenant',
-                        context: 'reservation confirmation'
+                        context: 'reservation confirmation',
+                        // Owed to the recipient by their own booking: the phishing
+                        // screen's soft rules never hold it (AGL-3356).
+                        owedFor: 'booking'
                     }));
                     // Cost meter (AGL-1438). Transactional: the guest has paid, and a
                     // confirmation a quota refused reads as a failed reservation.
@@ -2868,7 +2894,10 @@ async function findOrderForDispute(paymentIntentId) {
                     fromName: (await brandFor(hostId)).fromName,
                     sendingIdentity: await hostSendingIdentity(String(hostId)),
                     audience: 'tenant',
-                    context: 'cart receipt'
+                    context: 'cart receipt',
+                    // Owed to the recipient by their own order: the phishing
+                    // screen's soft rules never hold it (AGL-3356).
+                    owedFor: 'order'
                 }));
                 // Cost meter (AGL-1438). Transactional: a dropped receipt looks to
                 // the buyer like an order that did not go through.
@@ -3076,6 +3105,9 @@ async function findOrderForDispute(paymentIntentId) {
                         balanceCents: line.unitAmountCents,
                         recipientEmail: (_ref53 = object == null ? void 0 : (_object_customer_details12 = object.customer_details) == null ? void 0 : _object_customer_details12.email) != null ? _ref53 : null,
                         orderId: String(object.id),
+                        // Which line bought it, so a refund that withdraws that line
+                        // voids this card and no other (AGL-3363).
+                        productId: line.productId,
                         // What the console's Gift cards search asks (AGL-3321).
                         searchTokens: giftCardSearchTokens(code, (_ref54 = object == null ? void 0 : (_object_customer_details13 = object.customer_details) == null ? void 0 : _object_customer_details13.email) != null ? _ref54 : null),
                         createdAtMs: Date.now()
@@ -3123,7 +3155,10 @@ async function findOrderForDispute(paymentIntentId) {
                             fromName: (await brandFor(hostId)).fromName,
                             sendingIdentity: await hostSendingIdentity(String(hostId)),
                             audience: 'tenant',
-                            context: 'gift card'
+                            context: 'gift card',
+                            // Owed to the recipient by their own order: the phishing
+                            // screen's soft rules never hold it (AGL-3356).
+                            owedFor: 'order'
                         }));
                         // Cost meter (AGL-1438). Transactional: this email IS the
                         // purchased goods.
@@ -3698,7 +3733,10 @@ async function findOrderForDispute(paymentIntentId) {
                             fromName: (await brandFor(hostId)).fromName,
                             sendingIdentity: await hostSendingIdentity(String(hostId)),
                             audience: 'tenant',
-                            context: 'dropship supplier notice'
+                            context: 'dropship supplier notice',
+                            // Owed to the recipient by their own order: the phishing
+                            // screen's soft rules never hold it (AGL-3356).
+                            owedFor: 'order'
                         });
                         // Cost meter (AGL-1438). Transactional: without it the order is
                         // never fulfilled.
@@ -3813,7 +3851,10 @@ async function findOrderForDispute(paymentIntentId) {
                         fromName: (await brandFor(hostId)).fromName,
                         sendingIdentity: await hostSendingIdentity(String(hostId)),
                         audience: 'tenant',
-                        context: 'receipt'
+                        context: 'receipt',
+                        // Owed to the recipient by their own order: the phishing
+                        // screen's soft rules never hold it (AGL-3356).
+                        owedFor: 'order'
                     }));
                     // Cost meter (AGL-1438). Transactional, as the cart receipt above.
                     await meterHostEmail(String(hostId));
@@ -3857,7 +3898,10 @@ async function findOrderForDispute(paymentIntentId) {
                             fromName: (await brandFor(hostId)).fromName,
                             sendingIdentity: await hostSendingIdentity(String(hostId)),
                             audience: 'tenant',
-                            context: 'seller order notice'
+                            context: 'seller order notice',
+                            // Owed to the recipient by their own order: the phishing
+                            // screen's soft rules never hold it (AGL-3356).
+                            owedFor: 'order'
                         }));
                         // Cost meter (AGL-1438). Transactional: the seller learns about
                         // the order here.
@@ -3867,6 +3911,57 @@ async function findOrderForDispute(paymentIntentId) {
             }
         }
     }
+    // Fraud signals on a store's sale (AGL-3360): an issuer's early fraud
+    // warning and a Radar review. The merchant decides what to do for their
+    // own customer, so the signal lands on the ORDER — a timeline line and the
+    // shared `paymentRisk` chip — and the site's managers are told once.
+    // Nothing is refunded or canceled. Found by the same payment-intent join a
+    // dispute uses; a signal on anything else is not commerce's and stays
+    // silent here (the platform route and the other plugins answer it).
+    // Disputes keep their own branch below, which has always told the
+    // merchant; both report the site so the seller's fraud ledger can name it.
+    const risk = paymentRiskEventFrom(type, object);
+    if (risk && risk.signal.kind !== 'dispute') {
+        var _ref83, _snapshot_data;
+        var _snapshot_ref_parent_parent;
+        const lookup = risk.paymentIntentId ? await findOrderForDispute(risk.paymentIntentId) : {
+            kind: 'not-ours'
+        };
+        if (lookup.kind !== 'order') return;
+        const snapshot = lookup.snapshot;
+        const hostId = String((_ref83 = (_snapshot_ref_parent_parent = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent.id) != null ? _ref83 : '');
+        const order = CommerceModel.liftLegacyOrder((_snapshot_data = snapshot.data()) != null ? _snapshot_data : {});
+        await recordPaymentRiskOnRecord({
+            ref: snapshot.ref,
+            signal: risk.signal,
+            hostId,
+            subjectLabel: `Order ${CommerceModel.formatOrderNumber(order, snapshot.id)}`,
+            link: `/${hostId}/orders`,
+            notificationType: 'content.order',
+            extraUpdate: (data)=>({
+                    timeline: CommerceModel.appendOrderEvent(CommerceModel.liftLegacyOrder(data), risk.signal.kind === 'early-fraud-warning' ? 'fraud-warning' : 'payment-review', risk.signal.kind === 'early-fraud-warning' ? 'The card issuer reported this payment as possibly fraudulent' + (risk.signal.detail ? ` (${risk.signal.detail.replace(/_/g, ' ')})` : '') : 'Stripe Radar is holding this payment for review', risk.signal.atMs)
+                })
+        }, {
+            firestore: firebaseAdmin.app().firestore(),
+            notify: notifyHostManagers
+        });
+        // The cards this order bought are frozen until the merchant releases them
+        // (AGL-3363): a warning or review is the moment a stolen-card gift card
+        // is still unspent.
+        await notifyGiftCardHold({
+            hostId,
+            orderLabel: `Order ${CommerceModel.formatOrderNumber(order, snapshot.id)}`,
+            cards: await applyOrderGiftCardRisk(snapshot, {
+                kind: 'freeze',
+                reason: risk.signal.kind
+            }),
+            reason: risk.signal.kind
+        }, notifyHostManagers);
+        return {
+            claimed: true,
+            hostId
+        };
+    }
     // Card disputes against a merchant's store (AGL-1787).
     //
     // Commerce subscribed no `charge.dispute.*` event at all, so a shopper
@@ -3892,7 +3987,8 @@ async function findOrderForDispute(paymentIntentId) {
     // finds). AGL-1554 will add its own `closed` branch for the marketplace
     // side; the two coexist because each self-selects by finding its own record.
     if (type === 'charge.dispute.created' || type === 'charge.dispute.closed') {
-        var _dispute_payment_intent;
+        var _dispute_payment_intent, _ref84;
+        var _snapshot_ref_parent_parent1;
         const dispute = object != null ? object : {};
         const paymentIntentId = String((_dispute_payment_intent = dispute.payment_intent) != null ? _dispute_payment_intent : '');
         const lookup = paymentIntentId ? await findOrderForDispute(paymentIntentId) : {
@@ -3917,10 +4013,20 @@ async function findOrderForDispute(paymentIntentId) {
         const claimed = lookup.kind === 'order' || lookup.kind === 'unresolved';
         const snapshot = lookup.kind === 'order' ? lookup.snapshot : null;
         if (snapshot) {
-            var _ref83;
-            var _snapshot_ref_parent_parent;
-            const hostId = String((_ref83 = (_snapshot_ref_parent_parent = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent.id) != null ? _ref83 : '');
+            var _ref85;
+            var _snapshot_ref_parent_parent2;
+            const hostId = String((_ref85 = (_snapshot_ref_parent_parent2 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent2.id) != null ? _ref85 : '');
             if (type === 'charge.dispute.created') {
+                // A chargeback's gift cards are frozen while it is open (AGL-3363).
+                await notifyGiftCardHold({
+                    hostId,
+                    orderLabel: `Order ${snapshot.id}`,
+                    cards: await applyOrderGiftCardRisk(snapshot, {
+                        kind: 'freeze',
+                        reason: 'dispute'
+                    }),
+                    reason: 'dispute'
+                }, notifyHostManagers);
                 const { opened, record } = await recordDisputeOpened(snapshot, dispute);
                 if (opened && hostId) {
                     // Time-critical — Stripe's evidence window is days, not weeks — so
@@ -3936,7 +4042,17 @@ async function findOrderForDispute(paymentIntentId) {
                     });
                 }
             } else {
-                var _ref84;
+                var _ref86, _ref87;
+                // Lost: the money went back, so the cards it bought are voided. Won
+                // (or closed on a warning): the dispute's freeze lifts; a freeze a
+                // fraud warning or review put on stays for the merchant (AGL-3363).
+                await applyOrderGiftCardRisk(snapshot, String((_ref86 = dispute == null ? void 0 : dispute.status) != null ? _ref86 : '') === 'lost' ? {
+                    kind: 'void',
+                    reason: 'dispute-lost'
+                } : {
+                    kind: 'release',
+                    reason: 'dispute'
+                });
                 const settled = await recordDisputeClosed(snapshot, dispute);
                 if (settled.recorded && hostId) {
                     await notifyHostManagers(hostId, {
@@ -3994,7 +4110,7 @@ async function findOrderForDispute(paymentIntentId) {
                 // transiently-failed reversal gets its retry — and gated inside on
                 // the order's own `reversedTransferCents` marker, so it runs at most
                 // once per dispute however many times Stripe delivers.
-                if (String((_ref84 = dispute == null ? void 0 : dispute.status) != null ? _ref84 : '') === 'lost') {
+                if (String((_ref87 = dispute == null ? void 0 : dispute.status) != null ? _ref87 : '') === 'lost') {
                     const pulledBackCents = await reverseSellerShare(snapshot.ref, dispute);
                     // The merchant-experience half of the AGL-1794 decision, and not an
                     // optional extra: the reversal takes money out of the connected
@@ -4021,9 +4137,11 @@ async function findOrderForDispute(paymentIntentId) {
                 }
             }
         }
-        return {
+        return _extends({
             claimed
-        };
+        }, snapshot ? {
+            hostId: String((_ref84 = (_snapshot_ref_parent_parent1 = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent1.id) != null ? _ref84 : '')
+        } : {});
     }
 };