@cosmicdrift/kumiko-bundled-features 0.316.0 → 0.318.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.316.0",
+  "version": "0.318.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -55,6 +55,7 @@
     "./ledger": "./src/ledger/index.ts",
     "./ledger/web": "./src/ledger/web/index.ts",
     "./billing-foundation": "./src/billing-foundation/index.ts",
+    "./billing-foundation/web": "./src/billing-foundation/web/index.ts",
     "./subscription-stripe": "./src/subscription-stripe/index.ts",
     "./subscription-mollie": "./src/subscription-mollie/index.ts",
     "./foundation-shared": "./src/foundation-shared/index.ts",
@@ -133,12 +134,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.316.0",
-    "@cosmicdrift/kumiko-framework": "0.316.0",
-    "@cosmicdrift/kumiko-headless": "0.316.0",
-    "@cosmicdrift/kumiko-renderer": "0.316.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.316.0",
-    "@cosmicdrift/kumiko-types": "0.316.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.318.0",
+    "@cosmicdrift/kumiko-framework": "0.318.0",
+    "@cosmicdrift/kumiko-headless": "0.318.0",
+    "@cosmicdrift/kumiko-renderer": "0.318.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.318.0",
+    "@cosmicdrift/kumiko-types": "0.318.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -167,8 +168,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.316.0",
-    "@cosmicdrift/kumiko-locale-es": "0.316.0",
+    "@cosmicdrift/kumiko-locale-de": "0.318.0",
+    "@cosmicdrift/kumiko-locale-es": "0.318.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/web/__tests__/use-url-token.test.tsx

@@ -4,7 +4,7 @@ import { useUrlToken } from "../auth-form-primitives";
 
 // #774: magic-link tokens must not linger in browser history / Referer.
 // useUrlToken reads the token once, then scrubs the param via replaceState.
-// (dom.preload resets window.location to http://localhost/ after each test.)
+// (preload/dom resets window.location to http://localhost/ after each test.)
 describe("useUrlToken (magic-link history hygiene)", () => {
   test("reads ?token= and strips it from the URL, keeping other params", () => {
     window.history.replaceState(null, "", "http://localhost/reset?token=secret-abc&keep=1");

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -47,7 +47,7 @@ import {
   SubscriptionFoundationHandlers,
   SubscriptionStatuses,
 } from "../constants";
-import { billingFoundationFeature } from "../feature";
+import { createBillingFoundationFeature } from "../feature";
 import { paymentsProjectionTable, subscriptionsProjectionTable } from "../projection";
 import type { PaymentEvent, SubscriptionProviderPlugin } from "../types";
 import { createSubscriptionWebhookRoute } from "../webhook-handler";
@@ -73,6 +73,10 @@ const mockProviderFeature = defineFeature("test-mock-provider", (r) => {
   r.requires("billing-foundation");
   const plugin: SubscriptionProviderPlugin = {
     verifyAndParseWebhook: async () => null,
+    // Only the two tiers scenario 6's subscription-mode checkouts actually
+    // exercise — the hardened create-checkout-session now requires every
+    // mode:"subscription" priceId to resolve through priceToTier.
+    priceToTier: { price_pro_test: "pro", price_business_test: "business" },
     createCheckoutSession: async (_ctx, options) => {
       mockCheckoutCalls.push({
         priceId: options.priceId,
@@ -131,7 +135,7 @@ beforeAll(async () => {
       createTenantFeature(),
       createComplianceProfilesFeature(),
       createTenantLifecycleFeature(),
-      billingFoundationFeature,
+      createBillingFoundationFeature({ baseUrl: "https://example.com" }),
       mockProviderFeature,
       mockPaymentProviderFeature,
     ],
@@ -480,7 +484,10 @@ describe("scenario 5: Provider-Wechsel mid-period (Disney+-Pattern)", () => {
 describe("scenario 6: create-checkout-session — Plugin-routing", () => {
   test("happy-path: valid provider → URL durchgereicht + plugin mit korrekten args aufgerufen", async () => {
     mockCheckoutCalls.length = 0;
-    const admin = adminFor(3009);
+    // Not 3009 — scenario 5 reuses that tenant number and leaves it with a
+    // non-terminal "pro" subscription; openCheckout's new existing-
+    // subscription conflict-gate would reject this checkout for it.
+    const admin = adminFor(3016);
     const result = (await stack.http.writeOk(
       "billing-foundation:write:create-checkout-session",
       {
@@ -525,7 +532,26 @@ describe("scenario 6: create-checkout-session — Plugin-routing", () => {
 
   test("optional providerCustomerId wird durchgereicht (Plan-Wechsel-Flow)", async () => {
     mockCheckoutCalls.length = 0;
-    const admin = adminFor(3012);
+    // Not 3012 — that tenant already gets its own subscription in the
+    // crypto-shredding test further down and would collide.
+    const admin = adminFor(3018);
+
+    // The provider customer-id must belong to the caller's own subscription
+    // (even if canceled) — otherwise the foreign_provider_customer guard fires.
+    await stack.http.writeOk(
+      SubscriptionFoundationHandlers.processEvent,
+      {
+        ...buildEvent({
+          providerEventId: "evt_3018_create",
+          providerCustomerId: "cus_existing_xyz",
+          providerSubscriptionId: "sub_3018",
+          status: SubscriptionStatuses.canceled,
+        }),
+        providerName: "mock",
+      },
+      admin,
+    );
+
     await stack.http.writeOk(
       "billing-foundation:write:create-checkout-session",
       {
@@ -540,6 +566,59 @@ describe("scenario 6: create-checkout-session — Plugin-routing", () => {
     expect(mockCheckoutCalls[0]?.providerCustomerId).toBe("cus_existing_xyz");
   });
 
+  test("fremde providerCustomerId wird abgelehnt (foreign_provider_customer)", async () => {
+    mockCheckoutCalls.length = 0;
+    const other = adminFor(3019);
+    await stack.http.writeOk(
+      SubscriptionFoundationHandlers.processEvent,
+      {
+        ...buildEvent({
+          providerEventId: "evt_3019_create",
+          providerCustomerId: "cus_belongs_to_tenant_3019",
+          providerSubscriptionId: "sub_3019",
+        }),
+        providerName: "mock",
+      },
+      other,
+    );
+
+    const admin = adminFor(3017);
+    const error = await stack.http.writeErr(
+      "billing-foundation:write:create-checkout-session",
+      {
+        providerName: "mock",
+        priceId: "price_pro_test",
+        successUrl: "https://example.com/s",
+        cancelUrl: "https://example.com/c",
+        providerCustomerId: "cus_belongs_to_tenant_3019",
+      },
+      admin,
+    );
+    expect(error.httpStatus).toBe(422);
+    expect(error.i18nKey).toBe("billing-foundation.errors.foreignProviderCustomer");
+    expect(mockCheckoutCalls).toHaveLength(0);
+  });
+
+  test("fremde providerCustomerId wird auch im mode:payment abgelehnt", async () => {
+    mockCheckoutCalls.length = 0;
+    const admin = adminFor(3020);
+    const error = await stack.http.writeErr(
+      "billing-foundation:write:create-checkout-session",
+      {
+        providerName: "mock",
+        priceId: "price_topup_test",
+        successUrl: "https://example.com/s",
+        cancelUrl: "https://example.com/c",
+        providerCustomerId: "cus_belongs_to_tenant_3019",
+        mode: "payment",
+      },
+      admin,
+    );
+    expect(error.httpStatus).toBe(422);
+    expect(error.i18nKey).toBe("billing-foundation.errors.foreignProviderCustomer");
+    expect(mockCheckoutCalls).toHaveLength(0);
+  });
+
   test("optional mode wird durchgereicht (One-off-Payment-Flow, fw#2755)", async () => {
     mockCheckoutCalls.length = 0;
     const admin = adminFor(3014);

package/src/billing-foundation/__tests__/billing-plans-admin-only.integration.test.ts

@@ -0,0 +1,158 @@
+// Admin-only billing-plans catalog — a separate stack (own viewRoles/
+// purchaseRoles: ["Admin"]) instead of a describe-block inside
+// billing-plans.integration.test.ts, matching how show-pony pins a distinct
+// role-shape against its own setupTestStack rather than layering it onto a
+// shared one. Proves the catalog's role-gate isn't hardcoded to
+// TenantAdmin/SystemAdmin: an app that restricts billing to a custom "Admin"
+// role locks TenantAdmin out of both the query and the purchase-handlers.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity } from "../../tenant/schema/tenant";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import { subscriptionAggregateId } from "../aggregate-id";
+import { SubscriptionFoundationHandlers, SubscriptionStatuses } from "../constants";
+import { createBillingFoundationFeature } from "../feature";
+import { subscriptionsProjectionTable } from "../projection";
+import type { BillingPlanCatalog, ProviderPrice, SubscriptionProviderPlugin } from "../types";
+
+const PRICE_TO_TIER: Readonly<Record<string, string>> = { price_pro: "pro" };
+
+const PRICES: readonly ProviderPrice[] = [
+  {
+    priceId: "price_pro",
+    unitAmount: 1900,
+    currency: "usd",
+    interval: "month",
+    intervalCount: 1,
+    active: true,
+    metadata: {},
+  },
+];
+
+const checkoutCalls: Array<{ priceId: string }> = [];
+
+const adminOnlyProviderFeature = defineFeature("test-mock-admin-only-provider", (r) => {
+  r.requires("billing-foundation");
+  const plugin: SubscriptionProviderPlugin = {
+    verifyAndParseWebhook: async () => null,
+    priceToTier: PRICE_TO_TIER,
+    retrievePrices: async (_ctx, priceIds) => PRICES.filter((p) => priceIds.includes(p.priceId)),
+    createCheckoutSession: async (_ctx, options) => {
+      checkoutCalls.push({ priceId: options.priceId });
+      return { url: `https://mock.example/checkout/${options.priceId}` };
+    },
+  };
+  r.useExtension("subscriptionProvider", "mock-admin-only-provider", plugin);
+});
+
+async function resolveCurrentTier(db: TenantDb, tenantId: string): Promise<string> {
+  const rows = await db.selectMany(
+    subscriptionsProjectionTable,
+    { id: subscriptionAggregateId(tenantId) },
+    { limit: 1 },
+  );
+  const row = rows[0];
+  if (!row) return "free";
+  const status = row["status"] as string;
+  return status === SubscriptionStatuses.active || status === SubscriptionStatuses.trialing
+    ? (row["tier"] as string)
+    : "free";
+}
+
+const adminOnlyCatalog: BillingPlanCatalog<"pro"> = {
+  plans: ["pro"],
+  tierLabelKey: (tier) => `plan.${tier}.label`,
+  benefits: () => [],
+  resolveCurrentTier,
+  viewRoles: ["Admin"],
+  purchaseRoles: ["Admin"],
+  successPath: "/billing/success",
+  cancelPath: "/billing/cancel",
+  providerName: "mock-admin-only-provider",
+};
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      createBillingFoundationFeature({
+        baseUrl: "https://app.example.com",
+        catalog: adminOnlyCatalog,
+      }),
+      adminOnlyProviderFeature,
+    ],
+  });
+  await unsafeCreateEntityTable(stack.db, tenantEntity);
+  await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("billing-plans catalog with viewRoles/purchaseRoles restricted to a custom Admin role", () => {
+  test("an Admin can query the catalog and start a checkout through to the mock provider", async () => {
+    const admin = createTestUser({ id: 8001, tenantId: testTenantId(8001), roles: ["Admin"] });
+
+    const result = (await stack.http.queryOk(
+      "billing-foundation:query:billing-plans",
+      {},
+      admin,
+    )) as {
+      canPurchase: boolean;
+      plans: Array<{ tier: string; action: string }>;
+    };
+    expect(result.canPurchase).toBe(true);
+    expect(result.plans.find((p) => p.tier === "pro")?.action).toBe("checkout");
+
+    const checkout = (await stack.http.writeOk(
+      SubscriptionFoundationHandlers.startPlanCheckout,
+      { tier: "pro" },
+      admin,
+    )) as { url: string };
+    expect(checkout.url).toBe("https://mock.example/checkout/price_pro");
+    expect(checkoutCalls).toEqual([{ priceId: "price_pro" }]);
+  });
+
+  test("a TenantAdmin without the Admin role is rejected on both query and start-plan-checkout", async () => {
+    const tenantAdmin = createTestUser({
+      id: 8002,
+      tenantId: testTenantId(8002),
+      roles: ["TenantAdmin"],
+    });
+
+    const queryError = await stack.http.queryErr(
+      "billing-foundation:query:billing-plans",
+      {},
+      tenantAdmin,
+    );
+    expect(queryError.httpStatus).toBe(403);
+
+    const writeError = await stack.http.writeErr(
+      SubscriptionFoundationHandlers.startPlanCheckout,
+      { tier: "pro" },
+      tenantAdmin,
+    );
+    expect(writeError.httpStatus).toBe(403);
+  });
+});