@bash-app/bash-common 30.262.0 → 30.265.0

package/src/__tests__/requestAuthUser.test.ts

@@ -0,0 +1,120 @@
+import { UserRole } from "@prisma/client";
+import {
+  parseRequestAuthFromJwtPayload,
+  parseUserRolesFromJwtClaim,
+  userHasSuperUserAccess,
+  userHasAdminAccess,
+} from "../requestAuthUser.js";
+
+describe("parseUserRolesFromJwtClaim", () => {
+  it("returns undefined when claim is absent", () => {
+    expect(parseUserRolesFromJwtClaim(undefined)).toBeUndefined();
+  });
+
+  it("defaults empty array to User", () => {
+    expect(parseUserRolesFromJwtClaim([])).toEqual([UserRole.User]);
+  });
+
+  it("accepts valid enum values", () => {
+    expect(parseUserRolesFromJwtClaim([UserRole.User, UserRole.SuperUser])).toEqual([
+      UserRole.User,
+      UserRole.SuperUser,
+    ]);
+  });
+
+  it("rejects non-array and unknown role strings", () => {
+    expect(parseUserRolesFromJwtClaim("User")).toBeNull();
+    expect(parseUserRolesFromJwtClaim(["NotARealRole"])).toBeNull();
+  });
+});
+
+describe("parseRequestAuthFromJwtPayload", () => {
+  it("parses session-style payload with roles", () => {
+    expect(
+      parseRequestAuthFromJwtPayload({
+        id: "u-1",
+        email: "a@test.com",
+        roles: [UserRole.SuperUser],
+        isSuperUser: false,
+        givenName: "Ada",
+      }),
+    ).toEqual({
+      id: "u-1",
+      email: "a@test.com",
+      roles: [UserRole.SuperUser],
+      isSuperUser: undefined,
+      username: undefined,
+      givenName: "Ada",
+      familyName: undefined,
+    });
+  });
+
+  it("returns null when roles claim is absent", () => {
+    expect(
+      parseRequestAuthFromJwtPayload({
+        id: "u-legacy",
+        email: "legacy@test.com",
+      }),
+    ).toBeNull();
+  });
+
+  it("returns null when identity claims are missing or roles are invalid", () => {
+    expect(parseRequestAuthFromJwtPayload(null)).toBeNull();
+    expect(parseRequestAuthFromJwtPayload({ email: "a@test.com" })).toBeNull();
+    expect(
+      parseRequestAuthFromJwtPayload({
+        id: "u-1",
+        email: "a@test.com",
+        roles: ["BadRole"],
+      }),
+    ).toBeNull();
+  });
+});
+
+describe("userHasSuperUserAccess", () => {
+  it("allows SuperUser role or isSuperUser flag", () => {
+    expect(
+      userHasSuperUserAccess({
+        roles: [UserRole.User, UserRole.SuperUser],
+      }),
+    ).toBe(true);
+    expect(
+      userHasSuperUserAccess({
+        roles: [UserRole.User],
+        isSuperUser: true,
+      }),
+    ).toBe(true);
+    expect(
+      userHasSuperUserAccess({
+        roles: [UserRole.User],
+        isSuperUser: false,
+      }),
+    ).toBe(false);
+  });
+});
+
+describe("userHasAdminAccess", () => {
+  it("allows Admin role", () => {
+    expect(
+      userHasAdminAccess({ roles: [UserRole.Admin] }),
+    ).toBe(true);
+  });
+
+  it("allows SuperUser role", () => {
+    expect(
+      userHasAdminAccess({ roles: [UserRole.SuperUser] }),
+    ).toBe(true);
+  });
+
+  it("allows isSuperUser flag regardless of role", () => {
+    expect(
+      userHasAdminAccess({ roles: [UserRole.User], isSuperUser: true }),
+    ).toBe(true);
+  });
+
+  it("rejects plain User role", () => {
+    expect(
+      userHasAdminAccess({ roles: [UserRole.User], isSuperUser: false }),
+    ).toBe(false);
+  });
+});

package/src/__tests__/serviceCheckoutPaymentMethods.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, it } from "@jest/globals";
+
+import {
+  resolveServiceCheckoutPaymentMethodTypes,
+  serviceCheckoutOffersAchDebit,
+  serviceCheckoutOffersBankTransfer,
+} from "../ticketBnplPaymentMethods.js";
+
+describe("resolveServiceCheckoutPaymentMethodTypes", () => {
+  it("includes customer_balance when bank transfer enabled", () => {
+    expect(
+      resolveServiceCheckoutPaymentMethodTypes({
+        bankTransferEnabled: true,
+        totalChargedCents: 250_000,
+        currency: "usd",
+      })
+    ).toContain("customer_balance");
+  });
+
+  it("includes us_bank_account when ACH enabled", () => {
+    expect(
+      resolveServiceCheckoutPaymentMethodTypes({
+        achDebitEnabled: true,
+        totalChargedCents: 250_000,
+        currency: "usd",
+      })
+    ).toContain("us_bank_account");
+  });
+
+  it("excludes async methods when globally disabled", () => {
+    expect(
+      resolveServiceCheckoutPaymentMethodTypes({
+        bankTransferEnabled: true,
+        achDebitEnabled: true,
+        totalChargedCents: 250_000,
+        currency: "usd",
+        bankTransferGloballyEnabled: false,
+        achDebitGloballyEnabled: false,
+      })
+    ).toEqual(["card", "link"]);
+  });
+
+  it("serviceCheckoutOffers* reflects resolver", () => {
+    expect(
+      serviceCheckoutOffersBankTransfer({
+        bankTransferEnabled: true,
+        totalChargedCents: 10_000,
+        currency: "usd",
+      })
+    ).toBe(true);
+    expect(
+      serviceCheckoutOffersAchDebit({
+        achDebitEnabled: true,
+        totalChargedCents: 10_000,
+        currency: "usd",
+      })
+    ).toBe(true);
+  });
+});

package/src/__tests__/ticketBnplPaymentMethods.bankTransfer.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from "@jest/globals";
+
+import {
+  resolveTicketCheckoutPaymentMethodTypes,
+  ticketCheckoutOffersBankTransfer,
+} from "../ticketBnplPaymentMethods.js";
+
+describe("resolveTicketCheckoutPaymentMethodTypes bank transfer", () => {
+  it("includes customer_balance when host toggle and USD order", () => {
+    expect(
+      resolveTicketCheckoutPaymentMethodTypes({
+        installmentsEnabled: false,
+        bankTransferEnabled: true,
+        totalChargedCents: 50_000,
+        currency: "usd",
+      })
+    ).toContain("customer_balance");
+  });
+
+  it("excludes customer_balance when globally disabled", () => {
+    expect(
+      resolveTicketCheckoutPaymentMethodTypes({
+        installmentsEnabled: false,
+        bankTransferEnabled: true,
+        totalChargedCents: 50_000,
+        currency: "usd",
+        bankTransferGloballyEnabled: false,
+      })
+    ).not.toContain("customer_balance");
+  });
+
+  it("ticketCheckoutOffersBankTransfer reflects resolver", () => {
+    expect(
+      ticketCheckoutOffersBankTransfer({
+        installmentsEnabled: false,
+        bankTransferEnabled: true,
+        totalChargedCents: 10_000,
+        currency: "usd",
+      })
+    ).toBe(true);
+  });
+});

package/src/definitions.ts

@@ -473,6 +473,8 @@ export const HTTP_CODE_FORBIDDEN = 403 as const;
 export const HTTP_CODE_NOT_FOUND = 404 as const;
 export const ERR_UNAUTHORIZED_REQUEST =
   "Unauthorized to perform requested action. Have you logged in?" as const;
+export const ERR_SESSION_EXPIRED =
+  "Your session has expired — please refresh or log in again." as const;
 
 export const DEFAULT_PRISMA_TTL_SECONDS = 60 as const;
 export const PRISMA_MEDIA_TTL_SECONDS = 60 * 5; // 5 hours
@@ -1022,6 +1024,7 @@ export type StripeLinkingStatus = {
   cardPaymentsActive?: boolean;
   klarnaPaymentsActive?: boolean;
   cashappPaymentsActive?: boolean;
+  usBankTransferPaymentsActive?: boolean;
 };
 
 export type StripeBusinessDataPublic = {

package/src/extendedSchemas.ts

@@ -1217,6 +1217,9 @@ export interface InvitationExtraData extends Invitation {
   organizerTitle?: string;
   isOwnershipTransfer?: boolean;
   includeQRCode?: boolean; // Controls whether QR code should be included in the invitation email
+  sendEmail?: boolean; // When false, skip email notification (default true)
+  existingTicketId?: string; // Link invitation to an existing ticket instead of creating a new one
+  revoke?: boolean; // Host action: set revokedDate
 }
 
 export interface AssociatedBashExt extends AssociatedBash {

package/src/index.ts

@@ -1,4 +1,5 @@
 export * from "./definitions.js";
+export * from "./requestAuthUser.js";
 export * from "./sms/smsTemplates.js";
 export * from "./legalTemplates.js";
 export * from "./utmAttribution.js";

package/src/requestAuthUser.ts

@@ -0,0 +1,105 @@
+import { UserRole } from "@prisma/client";
+
+/**
+ * Claims available on `req.auth` after JWT verification.
+ *
+ * This is intentionally smaller than Prisma `User`: route handlers should load
+ * full profile data from the DB when they need more than identity + authorization.
+ */
+export type RequestAuthUser = {
+  id: string;
+  email: string;
+  roles: UserRole[];
+  isSuperUser?: boolean;
+  username?: string;
+  givenName?: string;
+  familyName?: string;
+};
+
+const USER_ROLE_VALUES = new Set<string>(Object.values(UserRole));
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function optionalString(value: unknown): string | undefined {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
+/**
+ * Parse and validate a `roles` JWT claim.
+ *
+ * - `undefined` → claim absent (invalid for newly issued tokens)
+ * - `null` → present but malformed
+ */
+export function parseUserRolesFromJwtClaim(value: unknown): UserRole[] | null | undefined {
+  if (value === undefined) {
+    return undefined;
+  }
+  if (!Array.isArray(value)) {
+    return null;
+  }
+  if (value.length === 0) {
+    return [UserRole.User];
+  }
+  const roles: UserRole[] = [];
+  for (const item of value) {
+    if (typeof item !== "string" || !USER_ROLE_VALUES.has(item)) {
+      return null;
+    }
+    roles.push(item as UserRole);
+  }
+  return roles;
+}
+
+/**
+ * Normalize a verified JWT payload into {@link RequestAuthUser}.
+ *
+ * Returns `null` when required identity claims are missing, when `roles` is
+ * absent, or when `roles` is present but invalid. All newly issued session and
+ * minimal JWTs must include a `roles` array (see signMinimalJwt / login flows).
+ */
+export function parseRequestAuthFromJwtPayload(decoded: unknown): RequestAuthUser | null {
+  if (!isRecord(decoded)) {
+    return null;
+  }
+
+  const id = optionalString(decoded.id);
+  const email = optionalString(decoded.email);
+  if (!id || !email) {
+    return null;
+  }
+
+  const parsedRoles = parseUserRolesFromJwtClaim(decoded.roles);
+  if (parsedRoles === null || parsedRoles === undefined) {
+    return null;
+  }
+
+  return {
+    id,
+    email,
+    roles: parsedRoles,
+    isSuperUser: decoded.isSuperUser === true ? true : undefined,
+    username: optionalString(decoded.username),
+    givenName: optionalString(decoded.givenName),
+    familyName: optionalString(decoded.familyName),
+  };
+}
+
+/** SuperUser role or legacy `isSuperUser` flag on the session JWT. */
+export function userHasSuperUserAccess(
+  auth: Pick<RequestAuthUser, "roles" | "isSuperUser">,
+): boolean {
+  return auth.isSuperUser === true || auth.roles.includes(UserRole.SuperUser);
+}
+
+/** Admin or SuperUser role, or legacy `isSuperUser` flag. */
+export function userHasAdminAccess(
+  auth: Pick<RequestAuthUser, "roles" | "isSuperUser">,
+): boolean {
+  return (
+    auth.isSuperUser === true ||
+    auth.roles.includes(UserRole.SuperUser) ||
+    auth.roles.includes(UserRole.Admin)
+  );
+}

package/src/ticketBnplPaymentMethods.ts

@@ -10,7 +10,16 @@ export type TicketCheckoutPaymentMethodType =
   | "link"
   | "klarna"
   | "afterpay_clearpay"
-  | "cashapp";
+  | "cashapp"
+  | "customer_balance"
+  | "us_bank_account";
+
+/** Service booking Checkout — card, link, and optional async bank methods. */
+export type ServiceCheckoutPaymentMethodType =
+  | "card"
+  | "link"
+  | "customer_balance"
+  | "us_bank_account";
 
 /** USD floors/ceilings aligned with typical Stripe BNPL eligibility (conservative). */
 export const TICKET_BNPL_MIN_CENTS_USD = 3_500; // $35
@@ -21,6 +30,8 @@ export interface TicketBnplPaymentMethodInput {
   installmentsEnabled: boolean;
   /** Per-event host toggle (`BashEvent.cashAppEnabled`). */
   cashAppEnabled?: boolean;
+  /** Per-event host toggle (`BashEvent.bankTransferEnabled`). */
+  bankTransferEnabled?: boolean;
   /** Buyer total charged at checkout (tickets + guest-visible fees), in cents. */
   totalChargedCents: number;
   /** ISO currency lowercase, e.g. "usd". */
@@ -29,6 +40,8 @@ export interface TicketBnplPaymentMethodInput {
   bnplGloballyEnabled?: boolean;
   /** Platform kill switch (API env `TICKET_CASHAPP_ENABLED`). Default true in tests. */
   cashAppGloballyEnabled?: boolean;
+  /** Platform kill switch (API env `TICKET_BANK_TRANSFER_ENABLED`). Default true in tests. */
+  bankTransferGloballyEnabled?: boolean;
 }
 
 /**
@@ -43,6 +56,7 @@ export function resolveTicketCheckoutPaymentMethodTypes(
 
   const globallyBnplOn = input.bnplGloballyEnabled !== false;
   const globallyCashAppOn = input.cashAppGloballyEnabled !== false;
+  const globallyBankTransferOn = input.bankTransferGloballyEnabled !== false;
   const isUsd = input.currency.toLowerCase() === "usd";
   const cents = input.totalChargedCents;
 
@@ -61,6 +75,15 @@ export function resolveTicketCheckoutPaymentMethodTypes(
     methods.add("cashapp");
   }
 
+  if (
+    globallyBankTransferOn &&
+    input.bankTransferEnabled &&
+    isUsd &&
+    cents > 0
+  ) {
+    methods.add("customer_balance");
+  }
+
   return [...methods];
 }
 
@@ -77,3 +100,78 @@ export function ticketCheckoutOffersCashApp(
   const methods = resolveTicketCheckoutPaymentMethodTypes(input);
   return methods.includes("cashapp");
 }
+
+export function ticketCheckoutOffersBankTransfer(
+  input: TicketBnplPaymentMethodInput
+): boolean {
+  const methods = resolveTicketCheckoutPaymentMethodTypes(input);
+  return methods.includes("customer_balance");
+}
+
+export interface ServiceCheckoutPaymentMethodInput {
+  /** Per-service host toggle (`Service.bankTransferEnabled`). */
+  bankTransferEnabled?: boolean;
+  /** Per-service host toggle (`Service.achDebitEnabled`). */
+  achDebitEnabled?: boolean;
+  /** Buyer total charged at checkout, in cents. */
+  totalChargedCents: number;
+  /** ISO currency lowercase, e.g. "usd". */
+  currency: string;
+  /** Platform kill switch (API env `SERVICE_BANK_TRANSFER_ENABLED`). Default true in tests. */
+  bankTransferGloballyEnabled?: boolean;
+  /** Platform kill switch (API env `SERVICE_ACH_DEBIT_ENABLED`). Default true in tests. */
+  achDebitGloballyEnabled?: boolean;
+}
+
+/**
+ * Resolve `payment_method_types` for Stripe Checkout service booking sessions.
+ * Bank transfer and ACH are async — fulfillment waits for `checkout.session.async_payment_succeeded`.
+ */
+export function resolveServiceCheckoutPaymentMethodTypes(
+  input: ServiceCheckoutPaymentMethodInput
+): ServiceCheckoutPaymentMethodType[] {
+  const methods = new Set<ServiceCheckoutPaymentMethodType>(["card", "link"]);
+  const globallyBankTransferOn = input.bankTransferGloballyEnabled !== false;
+  const globallyAchOn = input.achDebitGloballyEnabled !== false;
+  const isUsd = input.currency.toLowerCase() === "usd";
+  const cents = input.totalChargedCents;
+
+  if (
+    globallyBankTransferOn &&
+    input.bankTransferEnabled &&
+    isUsd &&
+    cents > 0
+  ) {
+    methods.add("customer_balance");
+  }
+
+  if (globallyAchOn && input.achDebitEnabled && isUsd && cents > 0) {
+    methods.add("us_bank_account");
+  }
+
+  return [...methods];
+}
+
+export function serviceCheckoutOffersBankTransfer(
+  input: ServiceCheckoutPaymentMethodInput
+): boolean {
+  return resolveServiceCheckoutPaymentMethodTypes(input).includes(
+    "customer_balance"
+  );
+}
+
+export function serviceCheckoutOffersAchDebit(
+  input: ServiceCheckoutPaymentMethodInput
+): boolean {
+  return resolveServiceCheckoutPaymentMethodTypes(input).includes(
+    "us_bank_account"
+  );
+}
+
+export function checkoutUsesAsyncBankPayment(
+  methods: ReadonlyArray<
+    TicketCheckoutPaymentMethodType | ServiceCheckoutPaymentMethodType
+  >
+): boolean {
+  return methods.includes("customer_balance") || methods.includes("us_bank_account");
+}