@bongos/core 1.23.22 → 1.24.2

package/tests/account_logins_db.mjs

@@ -0,0 +1,161 @@
+// tests/account_logins_db.mjs — the ways a person signs in, against real SQL
+// (task 1004992, ADR 0393). The DB-free sibling is tests/account_logins.mjs; this
+// file proves what a fake pool cannot execute: the UNIQUE constraints, the
+// sequence, the trigger, the backfill and a real race.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the INTEGRATION set
+// of scripts/bongos/run-unit-tests.js.
+//
+// Run:  DATABASE_URL=... node tests/account_logins_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const logins = require('../modules/platform-identity/account-logins.js');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`account_logins_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const GH = 90499201; // a GitHub-born account
+const GH_OLD = 90499202; // an account from before migration 034
+const SUB = (s) => `t1004992-${s}`;
+const q = (sql, params) => pool.query(sql, params);
+
+async function cleanup() {
+  await q(
+    `DELETE FROM platform_identity_accounts
+      WHERE github_id = ANY($1::bigint[])
+         OR id IN (SELECT account_id FROM platform_identity_account_logins WHERE subject LIKE 't1004992-%')`,
+    [[GH, GH_OLD]],
+  ).catch(() => {});
+}
+const loginRows = async (accountId) => (await q(
+  `SELECT provider, subject, email FROM platform_identity_account_logins WHERE account_id = $1 ORDER BY provider`,
+  [accountId],
+)).rows;
+const accountRow = async (key) => (await q(
+  `SELECT id, github_id::text AS key, github_login, handle, profile_state FROM platform_identity_accounts WHERE github_id = $1`,
+  [key],
+)).rows[0];
+const code = async (p) => { try { await p; return null; } catch (e) { return e.code; } };
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg); pass++; console.log(`  ok - ${msg}`); };
+
+try {
+  for (const f of [
+    'platform_identity_001_tables.sql', 'platform_identity_007_profile_consent.sql',
+    'platform_identity_008_handle.sql', 'platform_identity_009_profile_fields.sql',
+    'platform_identity_012_account_privacy.sql', 'platform_identity_019_terms_acceptance.sql',
+    'platform_identity_024_terms_grandfathered.sql',
+  ]) await q(migrationSql(f));
+  await cleanup();
+
+  // An account from before this change: created, then its login row removed, as
+  // if 034 had not run yet. Re-running 034 must backfill it — and re-running is safe.
+  await q(`INSERT INTO platform_identity_accounts (github_id, github_login) VALUES ($1, 'old-octo')`, [GH_OLD]).catch(() => {});
+  await q(migrationSql('platform_identity_034_account_logins.sql'));
+  const old = await accountRow(GH_OLD);
+  await q(`DELETE FROM platform_identity_account_logins WHERE account_id = $1`, [old.id]);
+  await q(migrationSql('platform_identity_034_account_logins.sql'));
+  same(await loginRows(old.id), [{ provider: 'github', subject: String(GH_OLD), email: null }],
+    'every existing account gets its GitHub way in, and the migration re-runs safely');
+
+  // 1 — a GitHub-born account gets its login row from the trigger, with no writer change.
+  await q(`INSERT INTO platform_identity_accounts (github_id, github_login) VALUES ($1, 'octo')`, [GH]);
+  const gh = await accountRow(GH);
+  same(await loginRows(gh.id), [{ provider: 'github', subject: String(GH), email: null }],
+    'an account born through GitHub has its GitHub way in, written by the trigger');
+
+  // 2 — a person arriving through Google: a minted negative key, no GitHub login.
+  const jane = await logins.createAccountForLogin(
+    { provider: 'google', subject: SUB('jane'), email: 'jane@example.com', displayName: 'Jane Doe' }, { pool });
+  ok(jane.created && logins.isMintedPersonKey(jane.personKey), `a Google arrival gets a minted negative key (${jane.personKey})`);
+  const janeRow = await accountRow(jane.personKey);
+  same([janeRow.github_login, janeRow.profile_state], [null, 'provisional'], 'no GitHub login is invented, and the account is provisional');
+  ok(/^janedoe(-\d+)?$/.test(janeRow.handle), `the handle grows from the name (${janeRow.handle})`);
+  same(await loginRows(janeRow.id), [{ provider: 'google', subject: SUB('jane'), email: 'jane@example.com' }],
+    'only the Google way in — the trigger writes no GitHub row for a minted key');
+
+  // 3 — the same Google identity again reaches the same person.
+  const again = await logins.createAccountForLogin({ provider: 'google', subject: SUB('jane') }, { pool });
+  same([again.personKey, again.created], [jane.personKey, false], 'signing up twice with one Google account is one person');
+  same(await logins.findPersonByLogin({ provider: 'google', subject: SUB('jane') }, { pool }),
+    { accountId: janeRow.id, personKey: jane.personKey }, 'the sign-in lookup finds them');
+
+  // 4 — a real race: two sign-ups for one new identity at once make one person.
+  const [r1, r2] = await Promise.all([
+    logins.createAccountForLogin({ provider: 'google', subject: SUB('race') }, { pool }),
+    logins.createAccountForLogin({ provider: 'google', subject: SUB('race') }, { pool }),
+  ]);
+  same(r1.personKey, r2.personKey, 'racing sign-ups land on one key');
+  const raced = (await q(
+    `SELECT count(*)::int AS n FROM platform_identity_account_logins WHERE provider = 'google' AND subject = $1`, [SUB('race')],
+  )).rows[0].n;
+  same(raced, 1, 'and one way in');
+  const orphans = (await q(
+    `SELECT count(*)::int AS n FROM platform_identity_accounts a
+      WHERE a.github_id < 0 AND NOT EXISTS (SELECT 1 FROM platform_identity_account_logins l WHERE l.account_id = a.id)`,
+  )).rows[0].n;
+  same(orphans, 0, 'the losing request left no account without a way in');
+
+  // 5 — the database refuses a second owner, and a second way in of one kind.
+  same(await code(q(
+    `INSERT INTO platform_identity_account_logins (account_id, provider, subject) VALUES ($1, 'google', $2)`, [gh.id, SUB('jane')],
+  )), '23505', 'a Google identity can belong to only one person');
+  await q(`INSERT INTO platform_identity_account_logins (account_id, provider, subject, email) VALUES ($1, 'google', $2, 'octo@example.com')`,
+    [gh.id, SUB('octo')]);
+  same(await code(q(
+    `INSERT INTO platform_identity_account_logins (account_id, provider, subject) VALUES ($1, 'google', $2)`, [gh.id, SUB('octo2')],
+  )), '23505', 'a person holds at most one Google way in');
+  same(await code(q(
+    `INSERT INTO platform_identity_account_logins (account_id, provider, subject) VALUES ($1, 'email', 'a@b.c')`, [gh.id],
+  )), '23514', 'an unknown provider is refused by the database');
+
+  // 6 — the own-scope read lists the person's ways in, GitHub first, and no ids.
+  const listed = await logins.listLoginsForPerson(String(GH), { pool });
+  same(listed.map((m) => [m.provider, m.email]), [['github', null], ['google', 'octo@example.com']],
+    'a person with both ways in sees both, GitHub first');
+  ok(listed.every((m) => !('subject' in m)), 'provider ids never leave the read');
+  same((await logins.listLoginsForPerson(jane.personKey, { pool })).map((m) => m.provider), ['google'],
+    'a minted key reads its own ways in');
+
+  // 7 — a minted key stays the key: the sequence never hands out a GitHub-shaped id.
+  const keys = (await q(`SELECT github_id FROM platform_identity_accounts WHERE id IN (
+    SELECT account_id FROM platform_identity_account_logins WHERE subject LIKE 't1004992-%' AND provider = 'google')
+    AND github_id < 0`)).rows;
+  ok(keys.length >= 2, 'every Google-born fixture holds a negative key');
+
+  // 8 — signing in with Google (task 1004993, ADR 0396): the same person every time,
+  // found by Google's id; and the hub's own sign-in never writes the core stand-in
+  // (or any login) onto a minted key.
+  const pi = require('../modules/platform-identity/platform-identity.js');
+  const first = await logins.signInWithLogin({ provider: 'google', subject: SUB('signin'), email: 'one@example.com', displayName: 'Sign In' }, { pool });
+  ok(first.created && /^-\d+$/.test(first.personKey), 'a first Google sign-in creates a person with a minted key');
+  const second = await logins.signInWithLogin({ provider: 'google', subject: SUB('signin'), email: 'two@example.com' }, { pool });
+  same([second.personKey, second.created], [first.personKey, false], 'signing in again reaches the same person');
+  same((await logins.listLoginsForPerson(first.personKey, { pool }))[0].email, 'two@example.com', 'the shown email follows the latest sign-in');
+  await pi.upsertAccount({ githubId: first.personKey, githubLogin: '~signin', displayName: 'Sign In', activate: true }, { pool });
+  const after = await accountRow(first.personKey);
+  same([after.github_login, after.profile_state], [null, 'active'], 'the hub sign-in activates the person and writes no login');
+
+  console.log(`\naccount_logins_db.mjs: ${pass} passed`);
+} finally {
+  await cleanup();
+  await pool.end();
+}

package/tests/ai_studio_billing.mjs

@@ -0,0 +1,253 @@
+// tests/ai_studio_billing.mjs — what an AI generation costs, and the order
+// money moves in (task 1004920, goal 1000136, ADR 0392):
+//   - price = provider cost x 1.08, in integer micro-dollars, never shaved;
+//   - a top-up adds the processor's fee so the asked-for amount arrives whole;
+//   - the full price is HELD before the call, a short balance refuses and the
+//     call never runs, the real price is captured after, and a provider failure
+//     releases the whole hold;
+//   - the default backend refuses money entirely, and the ledger is append-only.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const P = require('../modules/ai-studio/pricing.js');
+const payments = require('../modules/ai-studio/payments.js');
+const { runPaid, BillingRefusal } = require('../modules/ai-studio/billing.js');
+const S = require('../modules/ai-studio/studio.js');
+
+const USD = P.MICRO_PER_USD;
+
+// ---- pricing arithmetic ----------------------------------------------------
+
+test('the multiplier is the owner\'s 1.08, and nothing else in the module spells it', () => {
+  assert.equal(P.AI_PRICE_MULTIPLIER, 1.08);
+  for (const f of ['billing.js', 'payments.js', 'keys.js', 'db.js', 'routes/ai-studio.js', 'generate.js', 'studio.js', 'openrouter.js', 'context.js', 'gemini.js']) {
+    const src = fs.readFileSync(new URL(`../modules/ai-studio/${f}`, import.meta.url), 'utf8');
+    assert.doesNotMatch(src, /1\.08|\b108\b/, `${f} re-spells the multiplier`);
+  }
+});
+
+test('price = cost x 1.08: provider cost and markup apart, rounded up, never down', () => {
+  assert.deepEqual(P.priceFor(1 * USD), { provider_cost_micro: 1000000, markup_micro: 80000, price_micro: 1080000 });
+  assert.deepEqual(P.priceFor(0), { provider_cost_micro: 0, markup_micro: 0, price_micro: 0 });
+  // A sub-cent call: 0.0437 cents -> 437 micro x 1.08 = 471.96 -> 472 (up).
+  assert.deepEqual(P.priceFor(437), { provider_cost_micro: 437, markup_micro: 35, price_micro: 472 });
+  for (const c of [1, 7, 99, 12345, 987654321]) {
+    const p = P.priceFor(c);
+    assert.ok(p.price_micro >= c * 1.08, `price for ${c} fell below cost x 1.08`);
+    assert.ok(p.price_micro - c * 1.08 < 1, `price for ${c} rounded up by more than one micro-dollar`);
+    assert.equal(p.provider_cost_micro + p.markup_micro, p.price_micro);
+  }
+  assert.throws(() => P.priceFor(-1), TypeError);
+  assert.throws(() => P.priceFor(1.5), TypeError);
+});
+
+test('a top-up charges enough that, after the processor\'s fee, the full amount arrives', () => {
+  const q = P.topUpCharge(10 * USD);
+  // $10 net: (10 + 0.30) / 0.971 = 10.6076... -> $10.61; fee = round(10.61 x 2.9%) + 0.30 = 0.61.
+  assert.deepEqual(q, { charge_micro: 10610000, processor_fee_micro: 610000, credited_micro: 10000000 });
+  for (const usd of [5, 7.33, 20, 99.99, 500]) {
+    const want = Math.round(usd * USD);
+    const r = P.topUpCharge(want);
+    const chargeCents = r.charge_micro / 10000;
+    assert.ok(r.charge_micro - P.processorFeeCents(chargeCents) * 10000 >= r.credited_micro, `$${usd}: the fee ate into the balance`);
+    assert.ok(r.credited_micro >= want, `$${usd}: credited less than asked`);
+    // And it is the SMALLEST such charge: one cent less would not cover it.
+    assert.ok((chargeCents - 1) - P.processorFeeCents(chargeCents - 1) < r.credited_micro / 10000, `$${usd}: overcharged`);
+  }
+  assert.throws(() => P.topUpCharge(1 * USD), RangeError);
+  assert.throws(() => P.topUpCharge(501 * USD), RangeError);
+});
+
+test('formatUsd shows a sub-cent cost instead of a rounded zero', () => {
+  assert.equal(P.formatUsd(472), '$0.0005');
+  assert.equal(P.formatUsd(10610000), '$10.61');
+  assert.equal(P.formatUsd(0), '$0.00');
+});
+
+// ---- hold, run, capture / release -----------------------------------------
+
+function harness(startUsd) {
+  const b = payments.createFakeBackend();
+  const rows = [];
+  const ledger = async (row) => { rows.push(row); };
+  return { b, rows, ledger, fund: () => b.topUp(1, { chargeMicro: startUsd * USD + 1, creditedMicro: startUsd * USD }) };
+}
+
+test('THE PAID PATH: hold the most it can cost, run, capture the real price, return the rest', async () => {
+  const h = harness(10); await h.fund();
+  let sawHeld = null;
+  const out = await runPaid({
+    builderId: 1, requestId: 'r1', maxCostMicro: 2 * USD, payments: h.b, ledger: h.ledger,
+    run: async () => { sawHeld = await h.b.balance(1); return { costMicro: 500000, result: 'pictures' }; },
+  });
+  // While the call ran, the whole ceiling (2 x 1.08) was already held.
+  assert.deepEqual(sawHeld, { available_micro: 10 * USD - 2160000, held_micro: 2160000 });
+  assert.equal(out.result, 'pictures');
+  assert.equal(out.charge.price_micro, 540000);
+  assert.deepEqual(await h.b.balance(1), { available_micro: 10 * USD - 540000, held_micro: 0 });
+  assert.deepEqual(h.rows.map((r) => [r.kind, r.amountMicro]), [['hold', 2160000], ['capture', 540000]]);
+  const cap = h.rows[1];
+  assert.equal(cap.providerCostMicro, 500000);
+  assert.equal(cap.markupMicro, 40000);
+});
+
+test('a short balance refuses BEFORE the provider is called', async () => {
+  const h = harness(5); await h.fund();
+  let ran = false;
+  await assert.rejects(
+    runPaid({ builderId: 1, requestId: 'r2', maxCostMicro: 6 * USD, payments: h.b, ledger: h.ledger, run: async () => { ran = true; return { costMicro: 1 }; } }),
+    (err) => err instanceof BillingRefusal && err.code === 'insufficient_funds' && err.needed_micro === 6480000);
+  assert.equal(ran, false, 'the generation ran without its funds secured');
+  assert.deepEqual(await h.b.balance(1), { available_micro: 5 * USD, held_micro: 0 });
+  assert.equal(h.rows.length, 0);
+});
+
+test('a provider failure releases the WHOLE hold and records it', async () => {
+  const h = harness(10); await h.fund();
+  await assert.rejects(
+    runPaid({ builderId: 1, requestId: 'r3', maxCostMicro: 3 * USD, payments: h.b, ledger: h.ledger, run: async () => { throw new Error('provider 500'); } }),
+    /provider 500/);
+  assert.deepEqual(await h.b.balance(1), { available_micro: 10 * USD, held_micro: 0 }, 'money was kept after a failed call');
+  assert.deepEqual(h.rows.map((r) => [r.kind, r.amountMicro]), [['hold', 3240000], ['release', 3240000]]);
+});
+
+test('a provider reporting more than its ceiling is charged at most the ceiling', async () => {
+  const h = harness(10); await h.fund();
+  const out = await runPaid({ builderId: 1, requestId: 'r4', maxCostMicro: 1 * USD, payments: h.b, ledger: h.ledger, run: async () => ({ costMicro: 9 * USD }) });
+  assert.equal(out.charge.price_micro, 1080000);
+  assert.deepEqual(await h.b.balance(1), { available_micro: 10 * USD - 1080000, held_micro: 0 });
+});
+
+test('a ledger write failing after money moved does not charge twice or throw', async () => {
+  const h = harness(10); await h.fund();
+  const errors = [];
+  const out = await runPaid({
+    builderId: 1, requestId: 'r5', maxCostMicro: 1 * USD, payments: h.b,
+    ledger: async () => { throw new Error('db down'); }, log: { error: (o) => errors.push(o) },
+    run: async () => ({ costMicro: 100000 }),
+  });
+  assert.equal(out.charge.price_micro, 108000);
+  assert.equal(errors.length, 2);
+  assert.deepEqual(await h.b.balance(1), { available_micro: 10 * USD - 108000, held_micro: 0 });
+});
+
+test('with payments not set up (the default), nothing can be held or topped up', async () => {
+  const saved = process.env.AI_STUDIO_PAYMENTS;
+  for (const v of [undefined, '', 'stripe-typo', 'FAKEISH']) {
+    if (v === undefined) delete process.env.AI_STUDIO_PAYMENTS; else process.env.AI_STUDIO_PAYMENTS = v;
+    payments._setBackend(null);
+    assert.equal(payments.backend().name, 'none', `"${v}" opened a backend`);
+  }
+  if (saved === undefined) delete process.env.AI_STUDIO_PAYMENTS; else process.env.AI_STUDIO_PAYMENTS = saved;
+  let ran = false;
+  await assert.rejects(
+    runPaid({ builderId: 1, requestId: 'r6', maxCostMicro: 1, payments: payments.NONE, ledger: async () => {}, run: async () => { ran = true; } }),
+    (err) => err.code === 'payments_not_configured');
+  assert.equal(ran, false);
+});
+
+test('the ledger table is append-only and has no balance column', () => {
+  const sql = fs.readFileSync(new URL('../modules/ai-studio/migrations/ai_studio_002_ledger.sql', import.meta.url), 'utf8');
+  assert.match(sql, /BEFORE UPDATE OR DELETE ON ai_studio_ledger/);
+  assert.match(sql, /RAISE EXCEPTION 'ai_studio_ledger is append-only'/);
+  assert.match(sql, /provider_cost_micro\s+BIGINT/);
+  assert.match(sql, /markup_micro\s+BIGINT/);
+  assert.match(sql, /processor_fee_micro\s+BIGINT/);
+  assert.doesNotMatch(sql.replace(/--.*$/gm, ''), /\bbalance\b/i, 'a balance column would be Bongos holding user money (ADR 0385)');
+  const db = fs.readFileSync(new URL('../modules/ai-studio/db.js', import.meta.url), 'utf8');
+  assert.doesNotMatch(db, /UPDATE ai_studio_ledger|DELETE FROM ai_studio_ledger/);
+});
+
+// ---- the routes ------------------------------------------------------------
+
+const db = require('../modules/ai-studio/db.js');
+const api = require('../src/module-api.js');
+const ledgerRows = [];
+db.appendLedger = async (row) => { ledgerRows.push({ ...row, id: ledgerRows.length + 1, created_at: 'now' }); return {}; };
+db.recentLedger = async (builderId) => ledgerRows.filter((r) => r.builderId === builderId).map((r) => ({
+  id: r.id, kind: r.kind, request_id: r.requestId || null, amount_micro: r.amountMicro || 0, provider_cost_micro: r.providerCostMicro || 0,
+  markup_micro: r.markupMicro || 0, processor_fee_micro: r.processorFeeMicro || 0, backend: r.backend, note: r.note || '', created_at: r.created_at, ref: r.ref,
+})).reverse();
+let viewer = { id: 7, rank: 'xenos' };
+for (const [name, value] of Object.entries({
+  requireBuilder: (req, res, next) => { req.builder = viewer; next(); },
+  requireRank: () => (req, res, next) => next(),
+})) Object.defineProperty(api, name, { value, configurable: true, writable: true });
+
+const express = require('express');
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, opts) => res.status(typeof opts === 'number' ? opts : (opts && opts.status) || 400).json({ error: { code, message: opts && opts.message } });
+  next();
+});
+app.use(express.json());
+app.use('/api/bongos', require('../modules/ai-studio/routes/ai-studio.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method, headers: data ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(Buffer.concat(chunks).toString()) }));
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+test('routes: top up on the test backend, then read the balance and a ledger with every amount apart', async () => {
+  payments._setBackend(payments.createFakeBackend());
+  const up = await call('POST', '/ai-studio/topup', { amount_usd: 10 });
+  assert.equal(up.status, 201);
+  assert.deepEqual(up.body.topup, { charge_micro: 10610000, processor_fee_micro: 610000, credited_micro: 10000000 });
+  const bal = await call('GET', '/ai-studio/balance');
+  assert.equal(bal.body.payments, 'fake');
+  assert.equal(bal.body.test_mode, true);
+  assert.equal(bal.body.price_multiplier, 1.08);
+  assert.deepEqual(bal.body.balance, { available_micro: 10000000, held_micro: 0 });
+  assert.equal(bal.body.ledger[0].kind, 'topup');
+  assert.equal(bal.body.ledger[0].processor_fee_micro, 610000);
+  assert.ok(!('ref' in bal.body.ledger[0]), 'the processor reference is internal');
+  assert.equal((await call('POST', '/ai-studio/topup', { amount_usd: 1 })).status, 400);
+});
+
+// Task 1004921: the Studio says "your card is charged $20.91" BEFORE anything is
+// paid, and how much a run sets aside, from these two reads, so neither the fee
+// nor the ceiling is spelled in the browser.
+test('routes: a top-up quote charges what the top-up itself would, and writes nothing', async () => {
+  payments._setBackend(payments.createFakeBackend());
+  const before = ledgerRows.length;
+  const q = await call('GET', '/ai-studio/topup/quote?amount_usd=10');
+  assert.equal(q.status, 200);
+  assert.deepEqual(q.body.quote, P.topUpCharge(10 * USD));
+  assert.equal(q.body.quote.charge_micro, 10610000);
+  assert.equal(q.body.min_micro, P.MIN_TOPUP_MICRO);
+  assert.equal(q.body.max_micro, P.MAX_TOPUP_MICRO);
+  assert.equal((await call('GET', '/ai-studio/topup/quote?amount_usd=20')).body.quote.charge_micro, 20910000);
+  assert.equal((await call('GET', '/ai-studio/topup/quote?amount_usd=2')).status, 400);
+  assert.equal((await call('GET', '/ai-studio/topup/quote?amount_usd=abc')).status, 400);
+  assert.equal(ledgerRows.length, before, 'a quote must not move money or write the ledger');
+  const bal = await call('GET', '/ai-studio/balance');
+  assert.equal(bal.body.max_cost_micro, S.MAX_COST_MICRO);
+});
+
+test('routes: with payments not set up, a top-up is refused and no row is written', async () => {
+  payments._setBackend(payments.NONE);
+  const before = ledgerRows.length;
+  const r = await call('POST', '/ai-studio/topup', { amount_usd: 10 });
+  assert.equal(r.status, 409);
+  assert.equal(r.body.error.code, 'payments_not_configured');
+  assert.equal(ledgerRows.length, before);
+  assert.equal((await call('GET', '/ai-studio/balance')).body.balance, null);
+});