@bash-app/bash-common 30.219.0 → 30.221.0

package/src/utils/__tests__/paymentUtils.test.ts

@@ -3,6 +3,7 @@
  * Testing business logic without database dependencies
  */
 
+import { BashPassTier, MembershipTier } from "@prisma/client";
 import {
   calculateDiscountFromPromoCode,
   convertCentsToDollars,
@@ -15,6 +16,14 @@ import {
   calculateTotalBashPoints,
   calculateStripeDonationFee,
   calculateServiceFeeWithMembershipDiscount,
+  calculateBashPlatformFeeCents,
+  splitBashPlatformFeeForTicketCheckout,
+  computeTicketApplicationFeeAmountCents,
+  userHasActiveBashPass,
+  getEffectiveBashPassTier,
+  getBashPassMonthlyCapRemaining,
+  higherBashPassTier,
+  membershipGrantsBashPassTier,
 } from "../paymentUtils.js";
 
 describe("PaymentUtils - Core Functions", () => {
@@ -93,6 +102,67 @@ describe("PaymentUtils - Core Functions", () => {
     test("calculateStripeFee (dollars) aligns with calculateStripeProcessingFeeCents", () => {
       expect(calculateStripeFee(100)).toBe(3.2);
     });
+
+    test("calculateBashPlatformFeeCents floors 3% of gross", () => {
+      expect(calculateBashPlatformFeeCents(10000, 0.03)).toBe(300);
+      expect(calculateBashPlatformFeeCents(100, 0.03)).toBe(3);
+      expect(calculateBashPlatformFeeCents(0, 0.03)).toBe(0);
+    });
+
+    test("splitBashPlatformFeeForTicketCheckout respects feeHandling and BashPass", () => {
+      const base = {
+        grossCents: 10000,
+        platformFeeEnabled: true,
+        platformFeeRate: 0.03,
+      };
+      expect(splitBashPlatformFeeForTicketCheckout({ ...base, feeHandling: "HostAbsorbs", bashPassWaivesGuestFee: false })).toEqual({
+        totalPlatformCents: 300,
+        guestPlatformLineCents: 0,
+      });
+      expect(splitBashPlatformFeeForTicketCheckout({ ...base, feeHandling: "GuestPays", bashPassWaivesGuestFee: false })).toEqual({
+        totalPlatformCents: 300,
+        guestPlatformLineCents: 300,
+      });
+      expect(splitBashPlatformFeeForTicketCheckout({ ...base, feeHandling: "Split", bashPassWaivesGuestFee: false })).toEqual({
+        totalPlatformCents: 300,
+        guestPlatformLineCents: 150,
+      });
+      expect(splitBashPlatformFeeForTicketCheckout({ ...base, feeHandling: "GuestPays", bashPassWaivesGuestFee: true })).toEqual({
+        totalPlatformCents: 300,
+        guestPlatformLineCents: 0,
+      });
+    });
+
+    test("computeTicketApplicationFeeAmountCents sums Stripe + Bash platform into application fee", () => {
+      const r = computeTicketApplicationFeeAmountCents({
+        discountedSubtotalCents: 10000,
+        platformFeeEnabled: true,
+        platformFeeRate: 0.03,
+        feeHandling: "HostAbsorbs",
+        bashPassWaivesGuestFee: false,
+      });
+      expect(r.totalChargedCents).toBe(10000);
+      expect(r.bashPlatformTotalCents).toBe(300);
+      expect(r.stripeProcessingCents).toBe(calculateStripeProcessingFeeCents(10000));
+      expect(r.applicationFeeAmountCents).toBe(r.stripeProcessingCents + 300);
+    });
+
+    test("userHasActiveBashPass", () => {
+      expect(userHasActiveBashPass({ bashPassStripeSubscriptionId: null, bashPassCurrentPeriodEnd: null })).toBe(false);
+      expect(userHasActiveBashPass({ bashPassStripeSubscriptionId: "sub_1", bashPassCurrentPeriodEnd: null })).toBe(true);
+      expect(
+        userHasActiveBashPass({
+          bashPassStripeSubscriptionId: "sub_1",
+          bashPassCurrentPeriodEnd: new Date(Date.now() + 86400000),
+        })
+      ).toBe(true);
+      expect(
+        userHasActiveBashPass({
+          bashPassStripeSubscriptionId: "sub_1",
+          bashPassCurrentPeriodEnd: new Date(Date.now() - 86400000),
+        })
+      ).toBe(false);
+    });
   });
 
   describe("Ticket total price (USD)", () => {
@@ -173,4 +243,173 @@ describe("PaymentUtils - Core Functions", () => {
       expect(typeof fee).toBe("number");
     });
   });
+
+  describe("BashPass tier and monthly cap", () => {
+    const future = new Date(Date.now() + 86400000 * 30);
+    const past = new Date(Date.now() - 86400000);
+
+    test("higherBashPassTier picks the higher rank", () => {
+      expect(higherBashPassTier(BashPassTier.LITE, BashPassTier.STANDARD)).toBe(BashPassTier.STANDARD);
+      expect(higherBashPassTier(BashPassTier.STANDARD, BashPassTier.LITE)).toBe(BashPassTier.STANDARD);
+      expect(higherBashPassTier(BashPassTier.STANDARD, BashPassTier.UNLIMITED)).toBe(BashPassTier.UNLIMITED);
+      expect(higherBashPassTier(null, BashPassTier.LITE)).toBe(BashPassTier.LITE);
+      expect(higherBashPassTier(BashPassTier.LITE, null)).toBe(BashPassTier.LITE);
+      expect(higherBashPassTier(null, null)).toBeNull();
+    });
+
+    test("membershipGrantsBashPassTier returns null for Basic or expired membership", () => {
+      expect(
+        membershipGrantsBashPassTier({
+          membershipTier: MembershipTier.Basic,
+          membershipExpiresAt: future,
+        })
+      ).toBeNull();
+      expect(
+        membershipGrantsBashPassTier({
+          membershipTier: MembershipTier.Premium,
+          membershipExpiresAt: past,
+        })
+      ).toBeNull();
+    });
+
+    test("membershipGrantsBashPassTier maps Premium/Pro/Elite/Legend", () => {
+      expect(
+        membershipGrantsBashPassTier({ membershipTier: MembershipTier.Premium, membershipExpiresAt: future })
+      ).toBe(BashPassTier.LITE);
+      expect(
+        membershipGrantsBashPassTier({ membershipTier: MembershipTier.Pro, membershipExpiresAt: future })
+      ).toBe(BashPassTier.STANDARD);
+      expect(
+        membershipGrantsBashPassTier({ membershipTier: MembershipTier.Elite, membershipExpiresAt: future })
+      ).toBe(BashPassTier.UNLIMITED);
+      expect(
+        membershipGrantsBashPassTier({ membershipTier: MembershipTier.Legend, membershipExpiresAt: future })
+      ).toBe(BashPassTier.UNLIMITED);
+    });
+
+    test("getEffectiveBashPassTier uses standalone subscription when active", () => {
+      expect(
+        getEffectiveBashPassTier({
+          bashPassTier: BashPassTier.STANDARD,
+          bashPassStripeSubscriptionId: "sub_1",
+          bashPassCurrentPeriodEnd: future,
+          membershipTier: MembershipTier.Basic,
+          membershipExpiresAt: null,
+        })
+      ).toBe(BashPassTier.STANDARD);
+    });
+
+    test("getEffectiveBashPassTier uses membership when no standalone", () => {
+      expect(
+        getEffectiveBashPassTier({
+          bashPassTier: null,
+          bashPassStripeSubscriptionId: null,
+          bashPassCurrentPeriodEnd: null,
+          membershipTier: MembershipTier.Pro,
+          membershipExpiresAt: future,
+        })
+      ).toBe(BashPassTier.STANDARD);
+    });
+
+    test("getEffectiveBashPassTier takes higher of membership and standalone", () => {
+      expect(
+        getEffectiveBashPassTier({
+          bashPassTier: BashPassTier.LITE,
+          bashPassStripeSubscriptionId: "sub_1",
+          bashPassCurrentPeriodEnd: future,
+          membershipTier: MembershipTier.Pro,
+          membershipExpiresAt: future,
+        })
+      ).toBe(BashPassTier.STANDARD);
+      expect(
+        getEffectiveBashPassTier({
+          bashPassTier: BashPassTier.UNLIMITED,
+          bashPassStripeSubscriptionId: "sub_1",
+          bashPassCurrentPeriodEnd: future,
+          membershipTier: MembershipTier.Premium,
+          membershipExpiresAt: future,
+        })
+      ).toBe(BashPassTier.UNLIMITED);
+    });
+
+    test("getEffectiveBashPassTier returns null when neither applies", () => {
+      expect(
+        getEffectiveBashPassTier({
+          bashPassTier: null,
+          bashPassStripeSubscriptionId: null,
+          bashPassCurrentPeriodEnd: null,
+          membershipTier: MembershipTier.Basic,
+          membershipExpiresAt: null,
+        })
+      ).toBeNull();
+      expect(
+        getEffectiveBashPassTier({
+          bashPassTier: BashPassTier.LITE,
+          bashPassStripeSubscriptionId: null,
+          bashPassCurrentPeriodEnd: null,
+          membershipTier: MembershipTier.Basic,
+          membershipExpiresAt: null,
+        })
+      ).toBeNull();
+    });
+
+    test("getBashPassMonthlyCapRemaining is 0 without effective tier", () => {
+      expect(
+        getBashPassMonthlyCapRemaining({
+          bashPassTier: null,
+          bashPassEventsUsedThisMonth: 0,
+          bashPassStripeSubscriptionId: null,
+          bashPassCurrentPeriodEnd: null,
+          membershipTier: MembershipTier.Basic,
+          membershipExpiresAt: null,
+        })
+      ).toBe(0);
+    });
+
+    test("getBashPassMonthlyCapRemaining is null for UNLIMITED effective tier", () => {
+      expect(
+        getBashPassMonthlyCapRemaining({
+          bashPassTier: null,
+          bashPassEventsUsedThisMonth: 100,
+          bashPassStripeSubscriptionId: null,
+          bashPassCurrentPeriodEnd: null,
+          membershipTier: MembershipTier.Elite,
+          membershipExpiresAt: future,
+        })
+      ).toBeNull();
+    });
+
+    test("getBashPassMonthlyCapRemaining subtracts usage for capped tiers", () => {
+      expect(
+        getBashPassMonthlyCapRemaining({
+          bashPassTier: BashPassTier.LITE,
+          bashPassEventsUsedThisMonth: 2,
+          bashPassStripeSubscriptionId: "sub_1",
+          bashPassCurrentPeriodEnd: future,
+          membershipTier: MembershipTier.Basic,
+          membershipExpiresAt: null,
+        })
+      ).toBe(2);
+      expect(
+        getBashPassMonthlyCapRemaining({
+          bashPassTier: BashPassTier.LITE,
+          bashPassEventsUsedThisMonth: 4,
+          bashPassStripeSubscriptionId: "sub_1",
+          bashPassCurrentPeriodEnd: future,
+          membershipTier: MembershipTier.Basic,
+          membershipExpiresAt: null,
+        })
+      ).toBe(0);
+      expect(
+        getBashPassMonthlyCapRemaining({
+          bashPassTier: BashPassTier.STANDARD,
+          bashPassEventsUsedThisMonth: 8,
+          bashPassStripeSubscriptionId: "sub_1",
+          bashPassCurrentPeriodEnd: future,
+          membershipTier: MembershipTier.Basic,
+          membershipExpiresAt: null,
+        })
+      ).toBe(0);
+    });
+  });
 });

package/src/utils/__tests__/urlUtils.externalLink.test.ts

@@ -0,0 +1,36 @@
+import { toExternalLinkHref } from "../urlUtils.js";
+
+describe("toExternalLinkHref", () => {
+  it("returns # for empty or null", () => {
+    expect(toExternalLinkHref(null)).toBe("#");
+    expect(toExternalLinkHref(undefined)).toBe("#");
+    expect(toExternalLinkHref("")).toBe("#");
+    expect(toExternalLinkHref("   ")).toBe("#");
+  });
+
+  it("leaves http(s) URLs unchanged", () => {
+    expect(toExternalLinkHref("https://example.com")).toBe("https://example.com");
+    expect(toExternalLinkHref("http://example.com/path")).toBe("http://example.com/path");
+  });
+
+  it("prepends https to bare hostnames so browsers do not treat them as relative paths", () => {
+    expect(toExternalLinkHref("aavprod.com")).toBe("https://aavprod.com");
+    expect(toExternalLinkHref("www.foo.com/bar")).toBe("https://www.foo.com/bar");
+  });
+
+  it("preserves mailto and tel", () => {
+    expect(toExternalLinkHref("mailto:a@b.com")).toBe("mailto:a@b.com");
+    expect(toExternalLinkHref("tel:+15555551212")).toBe("tel:+15555551212");
+  });
+
+  it("maps Instagram @handle to instagram.com URL", () => {
+    expect(toExternalLinkHref("@a_prod_av")).toBe(
+      "https://www.instagram.com/a_prod_av/"
+    );
+  });
+
+  it("blocks obvious unsafe schemes", () => {
+    expect(toExternalLinkHref("javascript:alert(1)")).toBe("#");
+    expect(toExternalLinkHref("data:text/html,hi")).toBe("#");
+  });
+});

package/src/utils/paymentUtils.ts

@@ -1,11 +1,20 @@
-import { BashEventPromoCode, MembershipTier, TicketTier, VenuePricingPlan as VenuePricingPlanOption } from "@prisma/client";
+import {
+  BashEventPromoCode,
+  BashPassTier,
+  MembershipTier,
+  TicketTier,
+  VenuePricingPlan as VenuePricingPlanOption,
+} from "@prisma/client";
 import {
   BASH_EVENT_FEES,
+  MEMBERSHIP_BASH_PASS_TIER,
   PARTNER_PAYMENT_FEES,
   SERVICE_BOOKING_FEES,
   STRIPE_PROCESSING_FEE,
 } from "../membershipDefinitions.js";
 import {
+  BASH_PASS_EVENT_CAPS,
+  BASH_PASS_TIER_RANK,
   NumberOfTicketsForDate,
   PRICE_DOLLARS_AND_CENTS_RATIO,
 } from "../definitions.js";
@@ -221,6 +230,152 @@ export function calculatePartnerFeeWithMembershipDiscount(
   return parseFloat(calculatedFee.toFixed(2));
 }
 
+/**
+ * Bash **platform** take rate on ticket gross (e.g. 3%). Separate from Stripe card processing pass-through.
+ */
+export function calculateBashPlatformFeeCents(grossCents: number, rate: number): number {
+  if (grossCents <= 0 || rate <= 0) return 0;
+  return Math.floor(grossCents * rate);
+}
+
+export type BashPlatformTicketFeeSplit = {
+  totalPlatformCents: number;
+  /** Shown as a separate checkout line when greater than 0 */
+  guestPlatformLineCents: number;
+};
+
+/**
+ * Split the Bash platform fee between guest line items vs host absorption using `feeHandling`.
+ * BashPass waives the **guest-visible** portion only; the host still funds the full platform fee when the guest pays nothing extra.
+ */
+export function splitBashPlatformFeeForTicketCheckout(args: {
+  grossCents: number;
+  platformFeeEnabled: boolean;
+  platformFeeRate: number;
+  feeHandling: string | null | undefined;
+  bashPassWaivesGuestFee: boolean;
+}): BashPlatformTicketFeeSplit {
+  const { grossCents, platformFeeEnabled, platformFeeRate, feeHandling, bashPassWaivesGuestFee } = args;
+  const total = platformFeeEnabled
+    ? calculateBashPlatformFeeCents(grossCents, platformFeeRate)
+    : 0;
+  if (total <= 0) {
+    return { totalPlatformCents: 0, guestPlatformLineCents: 0 };
+  }
+  const mode = feeHandling ?? "HostAbsorbs";
+  let guestLine = 0;
+  if (mode === "GuestPays") {
+    guestLine = total;
+  } else if (mode === "Split") {
+    guestLine = Math.floor(total / 2);
+  }
+  if (bashPassWaivesGuestFee && guestLine > 0) {
+    guestLine = 0;
+  }
+  return { totalPlatformCents: total, guestPlatformLineCents: guestLine };
+}
+
+export function computeTicketApplicationFeeAmountCents(args: {
+  discountedSubtotalCents: number;
+  platformFeeEnabled: boolean;
+  platformFeeRate: number;
+  feeHandling: string | null | undefined;
+  bashPassWaivesGuestFee: boolean;
+}): {
+  totalChargedCents: number;
+  stripeProcessingCents: number;
+  bashPlatformTotalCents: number;
+  applicationFeeAmountCents: number;
+  guestPlatformLineCents: number;
+} {
+  const split = splitBashPlatformFeeForTicketCheckout({
+    grossCents: args.discountedSubtotalCents,
+    platformFeeEnabled: args.platformFeeEnabled,
+    platformFeeRate: args.platformFeeRate,
+    feeHandling: args.feeHandling,
+    bashPassWaivesGuestFee: args.bashPassWaivesGuestFee,
+  });
+  const guestPlatformLineCents = split.guestPlatformLineCents;
+  const bashPlatformTotalCents = split.totalPlatformCents;
+  const totalChargedCents = args.discountedSubtotalCents + guestPlatformLineCents;
+  const stripeProcessingCents = calculateStripeProcessingFeeCents(totalChargedCents);
+  const applicationFeeAmountCents = stripeProcessingCents + bashPlatformTotalCents;
+  return {
+    totalChargedCents,
+    stripeProcessingCents,
+    bashPlatformTotalCents,
+    applicationFeeAmountCents,
+    guestPlatformLineCents,
+  };
+}
+
+export function userHasActiveBashPass(user: {
+  bashPassStripeSubscriptionId: string | null | undefined;
+  bashPassCurrentPeriodEnd: Date | null | undefined;
+}): boolean {
+  if (!user.bashPassStripeSubscriptionId) return false;
+  if (!user.bashPassCurrentPeriodEnd) return true;
+  return user.bashPassCurrentPeriodEnd > new Date();
+}
+
+/** When a user has both membership-included BashPass and a standalone subscription, keep the higher tier. */
+export function higherBashPassTier(
+  a: BashPassTier | null,
+  b: BashPassTier | null
+): BashPassTier | null {
+  if (!a && !b) return null;
+  if (!a) return b;
+  if (!b) return a;
+  return BASH_PASS_TIER_RANK[a] >= BASH_PASS_TIER_RANK[b] ? a : b;
+}
+
+export function membershipGrantsBashPassTier(user: {
+  membershipTier: MembershipTier;
+  membershipExpiresAt: Date | null | undefined;
+}): BashPassTier | null {
+  if (user.membershipTier === MembershipTier.Basic) return null;
+  if (user.membershipExpiresAt && user.membershipExpiresAt <= new Date()) {
+    return null;
+  }
+  return MEMBERSHIP_BASH_PASS_TIER[user.membershipTier] ?? null;
+}
+
+/** Effective BashPass tier from paid membership bundle and/or active standalone BashPass subscription. */
+export function getEffectiveBashPassTier(user: {
+  bashPassTier: BashPassTier | null | undefined;
+  bashPassStripeSubscriptionId: string | null | undefined;
+  bashPassCurrentPeriodEnd: Date | null | undefined;
+  membershipTier: MembershipTier;
+  membershipExpiresAt: Date | null | undefined;
+}): BashPassTier | null {
+  const fromMembership = membershipGrantsBashPassTier(user);
+  const fromStandalone =
+    userHasActiveBashPass(user) && user.bashPassTier ? user.bashPassTier : null;
+  return higherBashPassTier(fromMembership, fromStandalone);
+}
+
+/**
+ * Remaining BashPass redemptions this billing month.
+ * - `0` — no BashPass or cap exhausted
+ * - positive integer — spots left
+ * - `null` — unlimited tier (no monthly cap)
+ */
+export function getBashPassMonthlyCapRemaining(user: {
+  bashPassTier: BashPassTier | null | undefined;
+  bashPassEventsUsedThisMonth: number;
+  bashPassStripeSubscriptionId: string | null | undefined;
+  bashPassCurrentPeriodEnd: Date | null | undefined;
+  membershipTier: MembershipTier;
+  membershipExpiresAt: Date | null | undefined;
+}): number | null {
+  const effective = getEffectiveBashPassTier(user);
+  if (!effective) return 0;
+  const cap = BASH_PASS_EVENT_CAPS[effective];
+  if (cap === null) return null;
+  const used = user.bashPassEventsUsedThisMonth ?? 0;
+  return Math.max(0, cap - used);
+}
+
 // ============================================
 // VENUE PRICING PLANS
 // ============================================

package/src/utils/urlUtils.ts

@@ -206,3 +206,48 @@ export function redirectToStripeWithTimeout(
     }
   }
 }
+
+/**
+ * Builds a safe absolute URL for `<a href>` from user-edited service/profile links.
+ *
+ * Browsers resolve `href="example.com"` as a **relative** URL (under the current path),
+ * not `https://example.com`, so bare domains must be prefixed with `https://`.
+ * Stores sometimes save Instagram as `@handle` instead of a full URL — those are mapped
+ * to `https://www.instagram.com/{handle}/`.
+ *
+ * @returns `"#"` when the value is empty or unsafe (`javascript:`, `data:`).
+ */
+export function toExternalLinkHref(raw: string | undefined | null): string {
+  if (raw == null) {
+    return "#";
+  }
+  const trimmed = raw.trim();
+  if (trimmed === "") {
+    return "#";
+  }
+
+  const lower = trimmed.toLowerCase();
+  if (lower.startsWith("javascript:") || lower.startsWith("data:")) {
+    return "#";
+  }
+
+  if (/^https?:\/\//i.test(trimmed)) {
+    return trimmed;
+  }
+  if (/^mailto:/i.test(trimmed) || /^tel:/i.test(trimmed)) {
+    return trimmed;
+  }
+
+  // Instagram @handle (often stored as a handle instead of a URL)
+  if (trimmed.startsWith("@")) {
+    const handle = trimmed
+      .slice(1)
+      .trim()
+      .replace(/^@+/, "");
+    if (/^[a-zA-Z0-9._]{1,30}$/.test(handle)) {
+      return `https://www.instagram.com/${handle}/`;
+    }
+  }
+
+  return `https://${trimmed}`;
+}