@forklaunch/implementation-billing-stripe 1.2.12 → 1.3.0

package/lib/services/index.js

@@ -60,10 +60,12 @@ var StripeBillingPortalService = class {
   billingPortalSessionExpiryDurationMs = 5 * 60 * 1e3;
   mappers;
   async createBillingPortalSession(billingPortalDto, ...args) {
+    await this.mappers.CreateBillingPortalMapper.validateCreate?.(billingPortalDto);
     const session = await this.stripeClient.billingPortal.sessions.create({
       ...billingPortalDto.stripeFields,
       customer: billingPortalDto.customerId
     });
+    await this.mappers.CreateBillingPortalMapper.validateProviderCreate?.(session);
     return await this.baseBillingPortalService.createBillingPortalSession(
       {
         ...billingPortalDto,
@@ -88,10 +90,20 @@ var StripeBillingPortalService = class {
     const existingSession = await this.baseBillingPortalService.getBillingPortalSession({
       id: billingPortalDto.id
     });
+    if (!this.options?.enableDatabaseBackup && this.mappers.UpdateBillingPortalMapper.toCachedDto && billingPortalDto.customerId !== void 0 && billingPortalDto.customerId !== existingSession.customerId) {
+      throw new Error("Cached session identity cannot change");
+    }
+    if (!this.options?.enableDatabaseBackup && this.mappers.UpdateBillingPortalMapper.toCachedDto && this.mappers.UpdateBillingPortalMapper.validateCachedUpdate) {
+      await this.mappers.UpdateBillingPortalMapper.validateCachedUpdate(
+        billingPortalDto,
+        existingSession
+      );
+    }
     const session = await this.stripeClient.billingPortal.sessions.create({
       ...billingPortalDto.stripeFields,
       customer: billingPortalDto.customerId || existingSession.customerId
     });
+    await this.mappers.CreateBillingPortalMapper.validateProviderCreate?.(session);
     return await this.baseBillingPortalService.updateBillingPortalSession(
       {
         ...billingPortalDto,
@@ -138,6 +150,7 @@ var StripeCheckoutSessionService = class {
   schemaValidator;
   mappers;
   async createCheckoutSession(checkoutSessionDto, ...args) {
+    await this.mappers.CreateCheckoutSessionMapper.validateCreate?.(checkoutSessionDto);
     const session = await this.stripeClient.checkout.sessions.create({
       ...checkoutSessionDto.stripeFields,
       mode: "subscription",
@@ -146,6 +159,7 @@ var StripeCheckoutSessionService = class {
       success_url: checkoutSessionDto.successRedirectUri,
       cancel_url: checkoutSessionDto.cancelRedirectUri
     });
+    await this.mappers.CreateCheckoutSessionMapper.validateProviderCreate?.(session);
     return await this.baseCheckoutSessionService.createCheckoutSession(
       {
         ...checkoutSessionDto,
@@ -160,6 +174,17 @@ var StripeCheckoutSessionService = class {
     );
   }
   async getCheckoutSession(idDto) {
+    const readCachedDto = this.mappers.CheckoutSessionMapper.readCachedDto;
+    if (readCachedDto) {
+      const existing = await this.baseCheckoutSessionService.getCheckoutSession(idDto);
+      if (existing.id !== idDto.id) {
+        throw new Error("Cached checkout identity does not match");
+      }
+      return readCachedDto(
+        existing,
+        (providerId) => this.stripeClient.checkout.sessions.retrieve(providerId)
+      );
+    }
     const session = await this.stripeClient.checkout.sessions.retrieve(
       idDto.id
     );
@@ -167,33 +192,73 @@ var StripeCheckoutSessionService = class {
     databaseCheckoutSession.stripeFields = session;
     return databaseCheckoutSession;
   }
+  /**
+   * The Stripe id (`cs_...`) stored with a checkout session when it was
+   * created. Public ids are local; Stripe only knows its own id. The stored
+   * provider object's id wins; a record without one is still usable when its
+   * own id is a Stripe id. Anything else fails here rather than sending Stripe
+   * a local id.
+   */
+  async stripeCheckoutSessionId(id) {
+    const checkoutSession = await this.baseCheckoutSessionService.getCheckoutSession({ id });
+    const stored = checkoutSession?.stripeFields?.id;
+    const stripeId = stored === void 0 ? checkoutSession?.id : stored;
+    if (typeof stripeId !== "string" || !/^cs_[A-Za-z0-9_]+$/.test(stripeId)) {
+      throw new Error(
+        `Checkout session ${id} has no stored Stripe checkout session id`
+      );
+    }
+    return stripeId;
+  }
   async expireCheckoutSession({ id }) {
-    await this.stripeClient.checkout.sessions.expire(id);
+    await this.stripeClient.checkout.sessions.expire(
+      await this.stripeCheckoutSessionId(id)
+    );
     await this.baseCheckoutSessionService.expireCheckoutSession({ id });
   }
   async handleCheckoutSuccess({ id }) {
-    await this.stripeClient.checkout.sessions.update(id, {
-      metadata: {
-        status: "SUCCESS"
+    await this.stripeClient.checkout.sessions.update(
+      await this.stripeCheckoutSessionId(id),
+      {
+        metadata: {
+          status: "SUCCESS"
+        }
       }
-    });
+    );
     await this.baseCheckoutSessionService.handleCheckoutSuccess({ id });
   }
   async handleCheckoutFailure({ id }) {
-    await this.stripeClient.checkout.sessions.update(id, {
-      metadata: {
-        status: "FAILED"
+    await this.stripeClient.checkout.sessions.update(
+      await this.stripeCheckoutSessionId(id),
+      {
+        metadata: {
+          status: "FAILED"
+        }
       }
-    });
+    );
     await this.baseCheckoutSessionService.handleCheckoutFailure({ id });
   }
 };
 
 // services/paymentLink.service.ts
 var import_services3 = require("@forklaunch/implementation-billing-base/services");
+function validatePaymentLinkCreateFields(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || !Array.isArray(value.line_items) || !value.line_items.every(
+    (item) => item !== null && typeof item === "object" && !Array.isArray(item)
+  )) {
+    throw new Error(
+      "Payment link provider options require a line_items array of objects"
+    );
+  }
+}
 var StripePaymentLinkService = class {
   constructor(stripeClient, em, cache, openTelemetryCollector, schemaValidator, mappers, options) {
     this.options = options;
+    const limit = options?.maxConfiguredListRecords === void 0 ? 100 : options.maxConfiguredListRecords;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1e3) {
+      throw new Error("Invalid configured payment link list limit");
+    }
+    this.maxConfiguredListRecords = limit;
     this.stripeClient = stripeClient;
     this.em = em;
     this.cache = cache;
@@ -211,6 +276,7 @@ var StripePaymentLinkService = class {
   }
   options;
   basePaymentLinkService;
+  maxConfiguredListRecords;
   stripeClient;
   em;
   cache;
@@ -218,11 +284,16 @@ var StripePaymentLinkService = class {
   schemaValidator;
   mappers;
   async createPaymentLink(paymentLinkDto, ...args) {
+    await this.mappers.CreatePaymentLinkMapper.validateCreate?.(paymentLinkDto);
+    validatePaymentLinkCreateFields(paymentLinkDto.stripeFields);
     const session = await this.stripeClient.paymentLinks.create({
       ...paymentLinkDto.stripeFields,
       payment_method_types: paymentLinkDto.paymentMethods,
       currency: paymentLinkDto.currency
     });
+    await this.mappers.CreatePaymentLinkMapper.validateProviderCreate?.(
+      session
+    );
     const paymentLink = await this.basePaymentLinkService.createPaymentLink(
       {
         ...paymentLinkDto,
@@ -239,20 +310,55 @@ var StripePaymentLinkService = class {
     paymentLink.stripeFields = session;
     return paymentLink;
   }
+  /**
+   * The Stripe id (`plink_...`) stored with a payment link when it was created.
+   * Public ids are local; Stripe only knows its own id. The stored provider
+   * object's id wins; a record without one is still usable when its own id is a
+   * Stripe id. Anything else fails here rather than sending Stripe a local id.
+   */
+  stripePaymentLinkId(paymentLink, id) {
+    const stored = paymentLink?.stripeFields?.id;
+    const stripeId = stored === void 0 ? paymentLink?.id : stored;
+    if (typeof stripeId !== "string" || !/^plink_[A-Za-z0-9_]+$/.test(stripeId)) {
+      throw new Error(
+        `Payment link ${id} has no stored Stripe payment link id`
+      );
+    }
+    return stripeId;
+  }
   async updatePaymentLink(paymentLinkDto, ...args) {
-    const session = await this.stripeClient.paymentLinks.update(
-      paymentLinkDto.id,
-      {
-        ...paymentLinkDto.stripeFields,
-        payment_method_types: paymentLinkDto.paymentMethods
-      }
-    );
+    const existing = await this.basePaymentLinkService.getPaymentLink({
+      id: paymentLinkDto.id
+    });
+    if (this.mappers.UpdatePaymentLinkMapper.validateCachedUpdate) {
+      await this.mappers.UpdatePaymentLinkMapper.validateCachedUpdate(
+        paymentLinkDto,
+        existing
+      );
+    }
+    const stripeId = this.stripePaymentLinkId(existing, paymentLinkDto.id);
+    const session = await this.stripeClient.paymentLinks.update(stripeId, {
+      ...paymentLinkDto.stripeFields,
+      payment_method_types: paymentLinkDto.paymentMethods
+    });
+    if (session.id !== stripeId) {
+      throw new Error("Invalid Stripe billing response");
+    }
+    const toLocalUpdate = this.mappers.UpdatePaymentLinkMapper.toLocalUpdate;
+    if (toLocalUpdate) {
+      const patch = await toLocalUpdate(paymentLinkDto, session);
+      return this.basePaymentLinkService.updatePaymentLink(
+        patch,
+        this.em,
+        session,
+        ...args
+      );
+    }
     const paymentLink = await this.basePaymentLinkService.updatePaymentLink(
       await this.mappers.PaymentLinkMapper.toDto(
         await this.mappers.UpdatePaymentLinkMapper.toEntity(
           {
             ...paymentLinkDto,
-            id: session.id,
             amount: session.line_items?.data.reduce(
               (total, item) => total + item.amount_total,
               0
@@ -268,13 +374,28 @@ var StripePaymentLinkService = class {
     return paymentLink;
   }
   async getPaymentLink({ id }) {
+    const readCachedDto = this.mappers.PaymentLinkMapper.readCachedDto;
+    if (readCachedDto) {
+      const existing = await this.basePaymentLinkService.getPaymentLink({ id });
+      if (existing.id !== id) {
+        throw new Error("Cached payment link identity does not match");
+      }
+      return readCachedDto(
+        existing,
+        (providerId) => this.stripeClient.paymentLinks.retrieve(providerId)
+      );
+    }
     const stripePaymentLink = await this.stripeClient.paymentLinks.retrieve(id);
     const databasePaymentLink = await this.basePaymentLinkService.getPaymentLink({ id });
     databasePaymentLink.stripeFields = stripePaymentLink;
     return databasePaymentLink;
   }
   async expirePaymentLink({ id }) {
-    await this.stripeClient.paymentLinks.update(id, {
+    const stripeId = this.stripePaymentLinkId(
+      await this.basePaymentLinkService.getPaymentLink({ id }),
+      id
+    );
+    await this.stripeClient.paymentLinks.update(stripeId, {
       metadata: {
         status: "EXPIRED"
       }
@@ -282,7 +403,11 @@ var StripePaymentLinkService = class {
     await this.basePaymentLinkService.expirePaymentLink({ id });
   }
   async handlePaymentSuccess({ id }) {
-    await this.stripeClient.paymentLinks.update(id, {
+    const stripeId = this.stripePaymentLinkId(
+      await this.basePaymentLinkService.getPaymentLink({ id }),
+      id
+    );
+    await this.stripeClient.paymentLinks.update(stripeId, {
       metadata: {
         status: "COMPLETED"
       }
@@ -290,7 +415,11 @@ var StripePaymentLinkService = class {
     await this.basePaymentLinkService.handlePaymentSuccess({ id });
   }
   async handlePaymentFailure({ id }) {
-    await this.stripeClient.paymentLinks.update(id, {
+    const stripeId = this.stripePaymentLinkId(
+      await this.basePaymentLinkService.getPaymentLink({ id }),
+      id
+    );
+    await this.stripeClient.paymentLinks.update(stripeId, {
       metadata: {
         status: "FAILED"
       }
@@ -299,6 +428,26 @@ var StripePaymentLinkService = class {
   }
   async listPaymentLinks(idsDto) {
     this.openTelemetryCollector.log("info", idsDto ?? "idsDto is undefined");
+    const { readCachedDto, validateCachedRead } = this.mappers.PaymentLinkMapper;
+    if (readCachedDto && validateCachedRead) {
+      const cached = await this.basePaymentLinkService.listPaymentLinks(
+        idsDto,
+        this.maxConfiguredListRecords
+      );
+      for (const value of cached) validateCachedRead(value);
+      const active = [];
+      for (const value of cached) {
+        const fresh = await readCachedDto(
+          value,
+          (providerId) => this.stripeClient.paymentLinks.retrieve(providerId)
+        );
+        if (typeof fresh.stripeFields.active !== "boolean") {
+          throw new Error("Invalid payment link active state");
+        }
+        if (fresh.stripeFields.active) active.push(fresh);
+      }
+      return active;
+    }
     const stripePaymentLinks = await this.stripeClient.paymentLinks.list({
       active: true
     });
@@ -342,6 +491,7 @@ var StripePlanService = class {
   schemaValidator;
   mappers;
   async createPlan(planDto, em) {
+    await this.mappers.CreatePlanMapper.validateCreate?.(planDto);
     let stripePlan = await this.stripeClient.plans.create({
       ...planDto.stripeFields,
       amount: planDto.price,
@@ -349,9 +499,12 @@ var StripePlanService = class {
       product: planDto.name,
       currency: planDto.currency
     });
-    stripePlan = await this.stripeClient.plans.retrieve(stripePlan.id, {
+    await this.mappers.CreatePlanMapper.validateProviderCreate?.(stripePlan);
+    const createdId = stripePlan.id;
+    stripePlan = await this.stripeClient.plans.retrieve(createdId, {
       expand: ["product"]
     });
+    await this.mappers.PlanMapper.validateProviderRead?.(createdId, stripePlan);
     const plan = await this.basePlanService.createPlan(
       {
         ...planDto,
@@ -371,10 +524,15 @@ var StripePlanService = class {
     const plan = await this.stripeClient.plans.retrieve(planEntity.externalId, {
       expand: ["product"]
     });
+    await this.mappers.PlanMapper.validateProviderRead?.(
+      planEntity.externalId,
+      plan
+    );
     planEntity.stripeFields = plan.product;
     return planEntity;
   }
   async updatePlan(planDto, em) {
+    await this.mappers.UpdatePlanMapper.validateUpdate?.(planDto);
     const planEntity = await this.basePlanService.getPlan(
       {
         id: planDto.id
@@ -384,6 +542,14 @@ var StripePlanService = class {
     const existingPlan = await this.stripeClient.plans.retrieve(
       planEntity.externalId
     );
+    await this.mappers.PlanMapper.validateProviderRead?.(
+      planEntity.externalId,
+      existingPlan
+    );
+    await this.mappers.UpdatePlanMapper.validateProviderUpdate?.(
+      planDto,
+      existingPlan
+    );
     const existingProduct = existingPlan.product;
     if (!existingProduct) {
       throw new Error("Plan product not found");
@@ -398,14 +564,16 @@ var StripePlanService = class {
       amount: planDto.price ?? existingPlan.amount ?? void 0,
       product: productId
     });
-    updatedPlan = await this.stripeClient.plans.retrieve(updatedPlan.id, {
+    await this.mappers.CreatePlanMapper.validateProviderCreate?.(updatedPlan);
+    const createdId = updatedPlan.id;
+    updatedPlan = await this.stripeClient.plans.retrieve(createdId, {
       expand: ["product"]
     });
+    await this.mappers.PlanMapper.validateProviderRead?.(createdId, updatedPlan);
     const updatedPlanEntity = await this.basePlanService.updatePlan(
       {
         ...planDto,
         externalId: updatedPlan.id,
-        name: planDto.name,
         billingProvider: "stripe"
       },
       em,
@@ -436,6 +604,10 @@ var StripePlanService = class {
               expand: ["product"]
             }
           );
+          await this.mappers.PlanMapper.validateProviderRead?.(
+            plan.externalId,
+            fetchedPlan
+          );
           return fetchedPlan.product;
         } catch {
           return null;
@@ -475,6 +647,7 @@ var StripeSubscriptionService = class {
   schemaValidator;
   mappers;
   async createSubscription(subscriptionDto, em) {
+    await this.mappers.CreateSubscriptionMapper.validateCreate?.(subscriptionDto);
     const subscription = await this.stripeClient.subscriptions.create({
       ...subscriptionDto.stripeFields,
       customer: subscriptionDto.partyId,
@@ -484,6 +657,7 @@ var StripeSubscriptionService = class {
         }
       ]
     });
+    await this.mappers.CreateSubscriptionMapper.validateProviderCreate?.(subscription);
     return await this.baseSubscriptionService.createSubscription(
       {
         ...subscriptionDto,
@@ -502,6 +676,10 @@ var StripeSubscriptionService = class {
     const stripeSubscription = await this.stripeClient.subscriptions.retrieve(
       subscriptionEntity.externalId
     );
+    await this.mappers.SubscriptionMapper.validateProviderRead?.(
+      subscriptionEntity.externalId,
+      stripeSubscription
+    );
     subscriptionEntity.stripeFields = stripeSubscription;
     return subscriptionEntity;
   }
@@ -513,6 +691,10 @@ var StripeSubscriptionService = class {
     const stripeSubscription = await this.stripeClient.subscriptions.retrieve(
       subscriptionEntity.externalId
     );
+    await this.mappers.SubscriptionMapper.validateProviderRead?.(
+      subscriptionEntity.externalId,
+      stripeSubscription
+    );
     subscriptionEntity.stripeFields = stripeSubscription;
     return subscriptionEntity;
   }
@@ -524,6 +706,10 @@ var StripeSubscriptionService = class {
     const stripeSubscription = await this.stripeClient.subscriptions.retrieve(
       subscriptionEntity.externalId
     );
+    await this.mappers.SubscriptionMapper.validateProviderRead?.(
+      subscriptionEntity.externalId,
+      stripeSubscription
+    );
     subscriptionEntity.stripeFields = stripeSubscription;
     return subscriptionEntity;
   }
@@ -537,9 +723,21 @@ var StripeSubscriptionService = class {
     if (!subscriptionEntity.externalId) {
       throw new Error("Subscription not found");
     }
+    await this.mappers.UpdateSubscriptionMapper.validateUpdate?.(
+      subscriptionDto,
+      subscriptionEntity
+    );
     const existingStripeSubscription = await this.stripeClient.subscriptions.retrieve(
       subscriptionEntity.externalId
     );
+    await this.mappers.SubscriptionMapper.validateProviderRead?.(
+      subscriptionEntity.externalId,
+      existingStripeSubscription
+    );
+    await this.mappers.UpdateSubscriptionMapper.validateProviderUpdate?.(
+      subscriptionDto,
+      existingStripeSubscription
+    );
     const updatedSubscription = await this.stripeClient.subscriptions.update(
       subscriptionEntity.externalId,
       {
@@ -550,6 +748,10 @@ var StripeSubscriptionService = class {
         }))
       }
     );
+    await this.mappers.SubscriptionMapper.validateProviderRead?.(
+      subscriptionEntity.externalId,
+      updatedSubscription
+    );
     const updatedSubscriptionEntity = await this.baseSubscriptionService.updateSubscription(
       {
         ...subscriptionDto,
@@ -584,9 +786,14 @@ var StripeSubscriptionService = class {
     const stripeSubscriptions = await Promise.all(
       subscriptions.map(async (subscription) => {
         try {
-          return await this.stripeClient.subscriptions.retrieve(
+          const provider = await this.stripeClient.subscriptions.retrieve(
             subscription.externalId
           );
+          await this.mappers.SubscriptionMapper.validateProviderRead?.(
+            subscription.externalId,
+            provider
+          );
+          return provider;
         } catch {
           return null;
         }
@@ -628,6 +835,12 @@ var BillingProviderEnum = {
 
 // services/webhook.service.ts
 var isActiveStatus = (status) => status === "active" || status === "trialing";
+var portalExpiry = (created) => {
+  if (!Number.isSafeInteger(created) || created < 0 || created > 253402300499) {
+    throw new Error("Billing webhook payload is invalid");
+  }
+  return new Date((created + 300) * 1e3);
+};
 var StripeWebhookService = class {
   partyEnum;
   webhookEventEntity;
@@ -723,7 +936,7 @@ var StripeWebhookService = class {
           {
             id: event.data.object.id,
             customerId: event.data.object.customer,
-            expiresAt: new Date(event.data.object.created + 5 * 60 * 1e3),
+            expiresAt: portalExpiry(event.data.object.created),
             uri: event.data.object.url
           }
         );