@oneuptime/common 13.0.4 → 13.0.6

package/build/dist/Server/API/BillingInvoiceAPI.js

@@ -3,12 +3,59 @@ import UserMiddleware from "../Middleware/UserAuthorization";
 import BillingInvoiceService from "../Services/BillingInvoiceService";
 import BillingService from "../Services/BillingService";
 import ProjectService from "../Services/ProjectService";
+import logger from "../Utils/Logger";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Permission from "../../Types/Permission";
 import BillingInvoice, { InvoiceStatus, } from "../../Models/DatabaseModels/BillingInvoice";
+/*
+ * The only PaymentIntent states the browser can move forward: a 3-D Secure or
+ * bank authentication prompt, or a confirmation Stripe.js has to send. Handing
+ * out the client secret of a PaymentIntent in any other state only gets the
+ * customer an opaque Stripe.js error.
+ */
+const PAYMENT_INTENT_STATUSES_NEEDING_CUSTOMER = ["requires_action", "requires_confirmation"];
+/*
+ * Stripe's refusal of invoices.pay while an earlier debit has not cleared
+ * ("Invoices with pending payments waiting to clear cannot be paid, ..."). It
+ * arrives as a plain invalid_request_error with no dedicated code, so the
+ * message is the only signal.
+ */
+const PENDING_PAYMENT_REFUSAL = /pending payments? waiting to clear/i;
+const ENDS_WITH_PUNCTUATION = /[.!?]$/;
+// Stripe SDK errors carry a type such as StripeCardError.
+const isPaymentProviderError = (err) => {
+    const type = err === null || err === void 0 ? void 0 : err.type;
+    return typeof type === "string" && type.startsWith("Stripe");
+};
+const isPendingPaymentRefusal = (err) => {
+    return (isPaymentProviderError(err) &&
+        PENDING_PAYMENT_REFUSAL.test(err.message || ""));
+};
+/*
+ * A raw StripeError reaching the error handler becomes an opaque 500
+ * "Server Error", so provider errors are turned into a message the customer
+ * can act on. Anything that is not a provider error is already one of ours
+ * (no payment method, provider unreachable) and is passed through untouched.
+ */
+const toPayInvoiceError = (data) => {
+    var _a;
+    if (!isPaymentProviderError(data.paymentError)) {
+        return data.paymentError;
+    }
+    const providerMessage = (data.paymentError.message ||
+        ((_a = data.paymentIntent) === null || _a === void 0 ? void 0 : _a.lastPaymentErrorMessage) ||
+        "").trim() || "The payment provider did not accept this payment.";
+    if (!data.suggestNewPaymentMethod) {
+        return new BadDataException(providerMessage);
+    }
+    const sentence = ENDS_WITH_PUNCTUATION.test(providerMessage)
+        ? providerMessage
+        : `${providerMessage}.`;
+    return new BadDataException(`Your payment could not be completed: ${sentence} Please update your payment method in Project Settings > Billing and try again.`);
+};
 export default class UserAPI extends BaseAPI {
     constructor() {
         var _a;
@@ -90,41 +137,79 @@ export default class UserAPI extends BaseAPI {
                 if (!billingInvoice) {
                     throw new BadDataException("Invoice not found for this project");
                 }
-                let invoice = null;
+                const customerId = project.paymentProviderCustomerId;
+                const invoiceId = item.paymentProviderInvoiceId;
+                let outcome;
                 try {
-                    invoice = await BillingService.payInvoice(project.paymentProviderCustomerId, item.paymentProviderInvoiceId);
+                    /*
+                     * The cardholder is on the other end of this request, so a card
+                     * that asks for authentication is answered with the client secret
+                     * below rather than by quietly charging one of their other cards.
+                     */
+                    const invoice = await BillingService.payInvoice(customerId, invoiceId, { canSurfaceAuthenticationPrompt: true });
+                    outcome = await this.getOutcomeOfSuccessfulPayment({
+                        customerId: customerId,
+                        invoice: invoice,
+                    });
                 }
                 catch (err) {
-                    invoice = await BillingService.getInvoice(project.paymentProviderCustomerId, item.paymentProviderInvoiceId);
-                    // check if this invoice needs more authentication like 3ds secure.
-                    if (invoice.status === InvoiceStatus.Open &&
-                        invoice.paymentIntentId) {
-                        const paymentIntentId = invoice.paymentIntentId;
-                        const clientSecret = await BillingService.getPaymentIntentClientSecret(paymentIntentId);
-                        return Response.sendJsonObjectResponse(req, res, {
-                            clientSecret: clientSecret,
-                        });
-                    }
-                    // otherwise we have no idea what went wrong and throw an error.
-                    throw err;
+                    outcome = await this.getOutcomeOfFailedPayment({
+                        customerId: customerId,
+                        invoiceId: invoiceId,
+                        paymentError: err,
+                    });
+                }
+                if (outcome.kind === "processing") {
+                    /*
+                     * The bank already has a payment for this invoice. Charging again
+                     * is either refused by Stripe or takes the money twice once the
+                     * first debit clears, so the browser is only told to wait.
+                     */
+                    await this.moveAutopayToCustomerDefault({
+                        customerId: customerId,
+                        projectId: project.id,
+                    });
+                    return Response.sendJsonObjectResponse(req, res, {
+                        paymentProcessing: true,
+                    });
+                }
+                if (outcome.kind === "requiresAction") {
+                    // 3-D Secure or a bank prompt the cardholder finishes in the browser.
+                    return Response.sendJsonObjectResponse(req, res, {
+                        clientSecret: outcome.clientSecret,
+                    });
                 }
                 // save updated status.
                 await this.service.updateOneBy({
                     query: {
                         projectId: project.id,
-                        paymentProviderInvoiceId: invoice.id,
+                        paymentProviderInvoiceId: invoiceId,
                     },
                     props: {
                         isRoot: true,
                         ignoreHooks: true,
                     },
                     data: {
-                        status: invoice.status,
+                        status: outcome.status,
                     },
                 });
-                await BillingInvoiceService.refreshSubscriptionStatus({
-                    projectId: project.id,
-                });
+                try {
+                    await BillingInvoiceService.refreshSubscriptionStatus({
+                        projectId: project.id,
+                    });
+                }
+                finally {
+                    /*
+                     * After the refresh: reactivating a subscription recreates it, and
+                     * the new one must not keep a stale pinned card either.
+                     */
+                    if (outcome.status === InvoiceStatus.Paid) {
+                        await this.moveAutopayToCustomerDefault({
+                            customerId: customerId,
+                            projectId: project.id,
+                        });
+                    }
+                }
                 return Response.sendEmptySuccessResponse(req, res);
             }
             catch (err) {
@@ -132,5 +217,134 @@ export default class UserAPI extends BaseAPI {
             }
         });
     }
+    /*
+     * invoices.pay resolving does not always mean the money arrived. A card
+     * debit the bank confirms later (India e-mandate cards sit in "processing"
+     * for about a day) comes back as a still-open invoice, and reporting that as
+     * paid invites the customer to pay again once the page reloads.
+     */
+    async getOutcomeOfSuccessfulPayment(data) {
+        const settledOutcome = {
+            kind: "paid",
+            status: data.invoice.status,
+        };
+        if (data.invoice.status !== InvoiceStatus.Open) {
+            return settledOutcome;
+        }
+        try {
+            // payInvoice does not return the PaymentIntent, so read the invoice again.
+            const invoice = await BillingService.getInvoice(data.customerId, data.invoice.id);
+            if (!invoice.paymentIntentId) {
+                return settledOutcome;
+            }
+            const paymentIntent = await BillingService.getPaymentIntent(invoice.paymentIntentId);
+            if (paymentIntent.status === "processing") {
+                return { kind: "processing" };
+            }
+            if (PAYMENT_INTENT_STATUSES_NEEDING_CUSTOMER.includes(paymentIntent.status) &&
+                paymentIntent.clientSecret) {
+                return {
+                    kind: "requiresAction",
+                    clientSecret: paymentIntent.clientSecret,
+                };
+            }
+        }
+        catch (err) {
+            /*
+             * Stripe accepted the payment. Failing the request because a follow-up
+             * read failed would tell the customer the payment failed when it did not.
+             */
+            logger.error(err, {
+                paymentProviderInvoiceId: data.invoice.id,
+            });
+        }
+        return settledOutcome;
+    }
+    /*
+     * A failed invoices.pay call says little on its own: the same 400 can mean
+     * "declined", "a payment is already on its way" or "this invoice cannot be
+     * paid any more". Stripe's view of the invoice and its PaymentIntent is read
+     * back before deciding what the customer sees, instead of handing the
+     * browser a client secret for whatever state the PaymentIntent is in.
+     */
+    async getOutcomeOfFailedPayment(data) {
+        let invoice;
+        try {
+            invoice = await BillingService.getInvoice(data.customerId, data.invoiceId);
+        }
+        catch (lookupError) {
+            logger.error(lookupError, {
+                paymentProviderInvoiceId: data.invoiceId,
+            });
+            // The payment error is the one the customer needs to hear about.
+            throw toPayInvoiceError({ paymentError: data.paymentError });
+        }
+        // Paid between the page loading and the click, or by the attempt itself.
+        if (invoice.status === InvoiceStatus.Paid) {
+            return { kind: "paid", status: InvoiceStatus.Paid };
+        }
+        if (invoice.status !== InvoiceStatus.Open) {
+            // void, uncollectible, draft: nothing to confirm and nothing to wait for.
+            throw toPayInvoiceError({ paymentError: data.paymentError });
+        }
+        let paymentIntent = null;
+        if (invoice.paymentIntentId) {
+            try {
+                paymentIntent = await BillingService.getPaymentIntent(invoice.paymentIntentId);
+            }
+            catch (lookupError) {
+                logger.error(lookupError, {
+                    paymentProviderInvoiceId: data.invoiceId,
+                });
+            }
+        }
+        if ((paymentIntent === null || paymentIntent === void 0 ? void 0 : paymentIntent.status) === "processing") {
+            return { kind: "processing" };
+        }
+        if (paymentIntent &&
+            PAYMENT_INTENT_STATUSES_NEEDING_CUSTOMER.includes(paymentIntent.status)) {
+            if (!paymentIntent.clientSecret) {
+                throw new BadDataException("This payment needs to be confirmed with your bank, but the payment provider did not return the details needed to do that. Please try again later.");
+            }
+            return {
+                kind: "requiresAction",
+                clientSecret: paymentIntent.clientSecret,
+            };
+        }
+        if ((paymentIntent === null || paymentIntent === void 0 ? void 0 : paymentIntent.status) === "succeeded") {
+            // The money cleared; Stripe marks the invoice paid right behind it.
+            return { kind: "paid", status: InvoiceStatus.Paid };
+        }
+        /*
+         * Stripe refused because a payment is pending, even though the invoice's
+         * PaymentIntent could not be read or is not the pending one. Stripe is
+         * authoritative about that payment, so the customer is told to wait.
+         */
+        if (isPendingPaymentRefusal(data.paymentError)) {
+            return { kind: "processing" };
+        }
+        throw toPayInvoiceError({
+            paymentError: data.paymentError,
+            paymentIntent: paymentIntent,
+            suggestNewPaymentMethod: true,
+        });
+    }
+    /*
+     * A subscription pinned to an old card keeps charging that card whichever
+     * card the customer pays with by hand. Existing pins are only cleaned up
+     * lazily, so whenever an invoice ends paid or processing the pin is cleared
+     * and the next autopay charges the customer's default card. It must never
+     * fail a payment that already went through, so errors are only logged.
+     */
+    async moveAutopayToCustomerDefault(data) {
+        try {
+            await BillingService.syncSubscriptionPaymentMethodsWithCustomerDefault(data.customerId);
+        }
+        catch (err) {
+            logger.error(err, {
+                projectId: data.projectId.toString(),
+            });
+        }
+    }
 }
 //# sourceMappingURL=BillingInvoiceAPI.js.map

package/build/dist/Server/API/BillingInvoiceAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"BillingInvoiceAPI.js","sourceRoot":"","sources":["../../../../Server/API/BillingInvoiceAPI.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,qBAEN,MAAM,mCAAmC,CAAC;AAC3C,OAAO,cAA2B,MAAM,4BAA4B,CAAC;AACrE,OAAO,cAAc,MAAM,4BAA4B,CAAC;AAOxD,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,SAAS,MAAM,iEAAiE,CAAC;AACxF,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,OAAO,UAA8B,MAAM,wBAAwB,CAAC;AACpE,OAAO,cAAc,EAAE,EACrB,aAAa,GACd,MAAM,4CAA4C,CAAC;AAGpD,MAAM,CAAC,OAAO,OAAO,OAAQ,SAAQ,OAGpC;IACC;;QACE,KAAK,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;QAE7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,MAAM,EAC3D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,gBAAgB,CACxB,uGAAuG,CACxG,CAAC;gBACJ,CAAC;gBAED,MAAM,eAAe,GAA0B,CAC7C,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CACxC,CAAC,MAAM,CAAC,CAAC,UAA0B,EAAE,EAAE;oBACtC,OAAO,CACL,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE;wBAC9B,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE;wBACpC,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE;4BAC9B,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE,CACrC,CAAC;gBACJ,CAAC,CAAC,CAAC;gBAEH,IACE,eAAe,CAAC,MAAM,KAAK,CAAC;oBAC5B,CAAC,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,CAAA,EAC3D,CAAC;oBACD,MAAM,IAAI,gBAAgB,CACxB,YAAY,UAAU,CAAC,YAAY,OAAO,UAAU,CAAC,YAAY,8BAA8B,CAChG,CAAC;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;oBAC/D,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAE;oBAC1B,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;wBACT,yBAAyB,EAAE,IAAI;wBAC/B,6BAA6B,EAAE,IAAI;wBACnC,oCAAoC,EAAE,IAAI;qBAC3C;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;oBACvC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;gBACpE,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC;oBAC3C,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAe,GAAG,CAAC,IAAI,CAAC;gBAElC,MAAM,IAAI,GAAmB,SAAS,CAAC,QAAQ,CAC7C,IAAI,CAAC,MAAM,CAAe,EAC1B,IAAI,CAAC,UAAU,CACE,CAAC;gBAEpB,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC;oBACnC,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;gBACrD,CAAC;gBAED;;;;;mBAKG;gBACH,IACE,IAAI,CAAC,yBAAyB;oBAC9B,IAAI,CAAC,yBAAyB,KAAK,OAAO,CAAC,yBAAyB,EACpE,CAAC;oBACD,MAAM,IAAI,gBAAgB,CACxB,6CAA6C,CAC9C,CAAC;gBACJ,CAAC;gBAED,2CAA2C;gBAC3C,MAAM,cAAc,GAClB,MAAM,qBAAqB,CAAC,SAAS,CAAC;oBACpC,KAAK,EAAE;wBACL,SAAS,EAAE,OAAO,CAAC,EAAG;wBACtB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;qBACxD;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;qBACV;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;wBACZ;;;;2BAIG;wBACH,WAAW,EAAE,IAAI;qBAClB;iBACF,CAAC,CAAC;gBAEL,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;gBACnE,CAAC;gBAED,IAAI,OAAO,GAAmB,IAAI,CAAC;gBAEnC,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CACvC,OAAO,CAAC,yBAAyB,EACjC,IAAI,CAAC,wBAAwB,CAC9B,CAAC;gBACJ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CACvC,OAAO,CAAC,yBAAyB,EACjC,IAAI,CAAC,wBAAwB,CAC9B,CAAC;oBAEF,mEAAmE;oBACnE,IACE,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI;wBACrC,OAAO,CAAC,eAAe,EACvB,CAAC;wBACD,MAAM,eAAe,GAAW,OAAO,CAAC,eAAe,CAAC;wBAExD,MAAM,YAAY,GAChB,MAAM,cAAc,CAAC,4BAA4B,CAC/C,eAAe,CAChB,CAAC;wBAEJ,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;4BAC/C,YAAY,EAAE,YAAY;yBAC3B,CAAC,CAAC;oBACL,CAAC;oBACD,gEAAgE;oBAChE,MAAM,GAAG,CAAC;gBACZ,CAAC;gBAED,uBAAuB;gBAEvB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7B,KAAK,EAAE;wBACL,SAAS,EAAE,OAAO,CAAC,EAAG;wBACtB,wBAAwB,EAAE,OAAO,CAAC,EAAG;qBACtC;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;oBACD,IAAI,EAAE;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAuB;qBACxC;iBACF,CAAC,CAAC;gBAEH,MAAM,qBAAqB,CAAC,yBAAyB,CAAC;oBACpD,SAAS,EAAE,OAAO,CAAC,EAAG;iBACvB,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"BillingInvoiceAPI.js","sourceRoot":"","sources":["../../../../Server/API/BillingInvoiceAPI.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,qBAEN,MAAM,mCAAmC,CAAC;AAC3C,OAAO,cAGN,MAAM,4BAA4B,CAAC;AACpC,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,MAAyB,MAAM,iBAAiB,CAAC;AAOxD,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,SAAS,MAAM,iEAAiE,CAAC;AACxF,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAGtE,OAAO,UAA8B,MAAM,wBAAwB,CAAC;AACpE,OAAO,cAAc,EAAE,EACrB,aAAa,GACd,MAAM,4CAA4C,CAAC;AAYpD;;;;;GAKG;AACH,MAAM,wCAAwC,GAE1C,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,uBAAuB,GAAW,qCAAqC,CAAC;AAE9E,MAAM,qBAAqB,GAAW,QAAQ,CAAC;AAY/C,0DAA0D;AAC1D,MAAM,sBAAsB,GAAmC,CAC7D,GAAY,EACiB,EAAE;IAC/B,MAAM,IAAI,GAAa,GAAiC,aAAjC,GAAG,uBAAH,GAAG,CAAgC,IAAI,CAAC;IAE/D,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC/D,CAAC,CAAC;AAIF,MAAM,uBAAuB,GAAoC,CAC/D,GAAY,EACH,EAAE;IACX,OAAO,CACL,sBAAsB,CAAC,GAAG,CAAC;QAC3B,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAChD,CAAC;AACJ,CAAC,CAAC;AAUF;;;;;GAKG;AACH,MAAM,iBAAiB,GAA8B,CACnD,IAA2B,EAClB,EAAE;;IACX,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,MAAM,eAAe,GACnB,CACE,IAAI,CAAC,YAAY,CAAC,OAAO;SACzB,MAAA,IAAI,CAAC,aAAa,0CAAE,uBAAuB,CAAA;QAC3C,EAAE,CACH,CAAC,IAAI,EAAE,IAAI,mDAAmD,CAAC;IAElE,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAClC,OAAO,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAW,qBAAqB,CAAC,IAAI,CAAC,eAAe,CAAC;QAClE,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,GAAG,eAAe,GAAG,CAAC;IAE1B,OAAO,IAAI,gBAAgB,CACzB,wCAAwC,QAAQ,iFAAiF,CAClI,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,OAAQ,SAAQ,OAGpC;IACC;;QACE,KAAK,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;QAE7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,MAAM,EAC3D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,gBAAgB,CACxB,uGAAuG,CACxG,CAAC;gBACJ,CAAC;gBAED,MAAM,eAAe,GAA0B,CAC7C,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CACxC,CAAC,MAAM,CAAC,CAAC,UAA0B,EAAE,EAAE;oBACtC,OAAO,CACL,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE;wBAC9B,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE;wBACpC,UAAU,CAAC,UAAU,CAAC,QAAQ,EAAE;4BAC9B,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE,CACrC,CAAC;gBACJ,CAAC,CAAC,CAAC;gBAEH,IACE,eAAe,CAAC,MAAM,KAAK,CAAC;oBAC5B,CAAC,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,CAAA,EAC3D,CAAC;oBACD,MAAM,IAAI,gBAAgB,CACxB,YAAY,UAAU,CAAC,YAAY,OAAO,UAAU,CAAC,YAAY,8BAA8B,CAChG,CAAC;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;oBAC/D,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAE;oBAC1B,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;wBACT,yBAAyB,EAAE,IAAI;wBAC/B,6BAA6B,EAAE,IAAI;wBACnC,oCAAoC,EAAE,IAAI;qBAC3C;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;oBACvC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;gBACpE,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC;oBAC3C,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAED,MAAM,IAAI,GAAe,GAAG,CAAC,IAAI,CAAC;gBAElC,MAAM,IAAI,GAAmB,SAAS,CAAC,QAAQ,CAC7C,IAAI,CAAC,MAAM,CAAe,EAC1B,IAAI,CAAC,UAAU,CACE,CAAC;gBAEpB,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC;oBACnC,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;gBACrD,CAAC;gBAED;;;;;mBAKG;gBACH,IACE,IAAI,CAAC,yBAAyB;oBAC9B,IAAI,CAAC,yBAAyB,KAAK,OAAO,CAAC,yBAAyB,EACpE,CAAC;oBACD,MAAM,IAAI,gBAAgB,CACxB,6CAA6C,CAC9C,CAAC;gBACJ,CAAC;gBAED,2CAA2C;gBAC3C,MAAM,cAAc,GAClB,MAAM,qBAAqB,CAAC,SAAS,CAAC;oBACpC,KAAK,EAAE;wBACL,SAAS,EAAE,OAAO,CAAC,EAAG;wBACtB,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;qBACxD;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;qBACV;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;wBACZ;;;;2BAIG;wBACH,WAAW,EAAE,IAAI;qBAClB;iBACF,CAAC,CAAC;gBAEL,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;gBACnE,CAAC;gBAED,MAAM,UAAU,GAAW,OAAO,CAAC,yBAAyB,CAAC;gBAC7D,MAAM,SAAS,GAAW,IAAI,CAAC,wBAAwB,CAAC;gBAExD,IAAI,OAA0B,CAAC;gBAE/B,IAAI,CAAC;oBACH;;;;uBAIG;oBACH,MAAM,OAAO,GAAY,MAAM,cAAc,CAAC,UAAU,CACtD,UAAU,EACV,SAAS,EACT,EAAE,8BAA8B,EAAE,IAAI,EAAE,CACzC,CAAC;oBAEF,OAAO,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC;wBACjD,UAAU,EAAE,UAAU;wBACtB,OAAO,EAAE,OAAO;qBACjB,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC;wBAC7C,UAAU,EAAE,UAAU;wBACtB,SAAS,EAAE,SAAS;wBACpB,YAAY,EAAE,GAAG;qBAClB,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAClC;;;;uBAIG;oBACH,MAAM,IAAI,CAAC,4BAA4B,CAAC;wBACtC,UAAU,EAAE,UAAU;wBACtB,SAAS,EAAE,OAAO,CAAC,EAAG;qBACvB,CAAC,CAAC;oBAEH,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;wBAC/C,iBAAiB,EAAE,IAAI;qBACxB,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACtC,sEAAsE;oBACtE,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;wBAC/C,YAAY,EAAE,OAAO,CAAC,YAAY;qBACnC,CAAC,CAAC;gBACL,CAAC;gBAED,uBAAuB;gBAEvB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;oBAC7B,KAAK,EAAE;wBACL,SAAS,EAAE,OAAO,CAAC,EAAG;wBACtB,wBAAwB,EAAE,SAAS;qBACpC;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;wBACZ,WAAW,EAAE,IAAI;qBAClB;oBACD,IAAI,EAAE;wBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;qBACvB;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC;oBACH,MAAM,qBAAqB,CAAC,yBAAyB,CAAC;wBACpD,SAAS,EAAE,OAAO,CAAC,EAAG;qBACvB,CAAC,CAAC;gBACL,CAAC;wBAAS,CAAC;oBACT;;;uBAGG;oBACH,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;wBAC1C,MAAM,IAAI,CAAC,4BAA4B,CAAC;4BACtC,UAAU,EAAE,UAAU;4BACtB,SAAS,EAAE,OAAO,CAAC,EAAG;yBACvB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAED,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,6BAA6B,CAAC,IAG3C;QACC,MAAM,cAAc,GAAsB;YACxC,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAuB;SAC7C,CAAC;QAEF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;YAC/C,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,IAAI,CAAC;YACH,2EAA2E;YAC3E,MAAM,OAAO,GAAY,MAAM,cAAc,CAAC,UAAU,CACtD,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,OAAO,CAAC,EAAE,CAChB,CAAC;YAEF,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;gBAC7B,OAAO,cAAc,CAAC;YACxB,CAAC;YAED,MAAM,aAAa,GACjB,MAAM,cAAc,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAEjE,IAAI,aAAa,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YAChC,CAAC;YAED,IACE,wCAAwC,CAAC,QAAQ,CAC/C,aAAa,CAAC,MAAM,CACrB;gBACD,aAAa,CAAC,YAAY,EAC1B,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,gBAAgB;oBACtB,YAAY,EAAE,aAAa,CAAC,YAAY;iBACzC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb;;;eAGG;YACH,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,wBAAwB,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;aACzB,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,cAAc,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,yBAAyB,CAAC,IAIvC;QACC,IAAI,OAAgB,CAAC;QAErB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,CACvC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,SAAS,CACf,CAAC;QACJ,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE;gBACxB,wBAAwB,EAAE,IAAI,CAAC,SAAS;aACxB,CAAC,CAAC;YAEpB,iEAAiE;YACjE,MAAM,iBAAiB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,yEAAyE;QACzE,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC;QACtD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;YAC1C,0EAA0E;YAC1E,MAAM,iBAAiB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,aAAa,GAA8B,IAAI,CAAC;QAEpD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,cAAc,CAAC,gBAAgB,CACnD,OAAO,CAAC,eAAe,CACxB,CAAC;YACJ,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE;oBACxB,wBAAwB,EAAE,IAAI,CAAC,SAAS;iBACxB,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,IAAI,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,MAAK,YAAY,EAAE,CAAC;YAC3C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChC,CAAC;QAED,IACE,aAAa;YACb,wCAAwC,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,EACvE,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,gBAAgB,CACxB,mJAAmJ,CACpJ,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,YAAY,EAAE,aAAa,CAAC,YAAY;aACzC,CAAC;QACJ,CAAC;QAED,IAAI,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,MAAK,WAAW,EAAE,CAAC;YAC1C,oEAAoE;YACpE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC;QACtD,CAAC;QAED;;;;WAIG;QACH,IAAI,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,iBAAiB,CAAC;YACtB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,aAAa;YAC5B,uBAAuB,EAAE,IAAI;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,4BAA4B,CAAC,IAG1C;QACC,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,iDAAiD,CACpE,IAAI,CAAC,UAAU,CAChB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE;aACpB,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF"}

package/build/dist/Server/API/BillingPaymentMethodAPI.js

@@ -2,15 +2,28 @@ import { IsBillingEnabled } from "../EnvironmentConfig";
 import UserMiddleware from "../Middleware/UserAuthorization";
 import BillingPaymentMethodService from "../Services/BillingPaymentMethodService";
 import BillingService from "../Services/BillingService";
+import PayAsYouGoBillingService from "../Services/PayAsYouGoBillingService";
 import ProjectService from "../Services/ProjectService";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Permission from "../../Types/Permission";
 import BillingPaymentMethod from "../../Models/DatabaseModels/BillingPaymentMethod";
+/*
+ * Who may add a card, and so who may make one the default: the dashboard makes
+ * a newly added card the default straight after adding it, so anyone allowed
+ * to add one has to be allowed to finish that flow. Editing a payment method
+ * is what choosing the default is, so that permission is accepted too.
+ */
+const MANAGE_PAYMENT_METHOD_PERMISSIONS = [
+    Permission.ProjectOwner,
+    Permission.ManageProjectBilling,
+    Permission.CreateBillingPaymentMethod,
+    Permission.EditBillingPaymentMethod,
+];
 export default class UserAPI extends BaseAPI {
     constructor() {
-        var _a;
+        var _a, _b;
         super(BillingPaymentMethod, BillingPaymentMethodService);
         this.router.post(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/setup`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
             try {
@@ -18,7 +31,7 @@ export default class UserAPI extends BaseAPI {
                     throw new BadDataException("Billing is not enabled for this server");
                 }
                 if (req.body["projectId"]) {
-                    throw new BadDataException("projectId is required in request body");
+                    throw new BadDataException("projectId should not be passed in the request body. The project is resolved from the tenantid header.");
                 }
                 const userPermissions = (await this.getPermissionsForTenant(req)).filter((permission) => {
                     return [
@@ -43,9 +56,6 @@ export default class UserAPI extends BaseAPI {
                 if (!project) {
                     throw new BadDataException("Project not found");
                 }
-                if (!project) {
-                    throw new BadDataException("Project not found");
-                }
                 if (!project.paymentProviderCustomerId) {
                     throw new BadDataException("Payment Provider customer not found");
                 }
@@ -58,6 +68,77 @@ export default class UserAPI extends BaseAPI {
                 next(err);
             }
         });
+        /*
+         * Makes one of the project's payment methods the default, and moves
+         * autopay onto it.
+         *
+         * Autopay does not follow the customer's default on its own: a
+         * subscription carrying its own default_payment_method keeps charging that
+         * card. A customer whose card started declining could add a new card and
+         * still see every renewal fail against the old one, because nothing in
+         * OneUptime ever changed which card the subscription charged.
+         * BillingService.makePaymentMethodDefault sets the default and clears
+         * those stale subscription pins together.
+         */
+        this.router.post(`${(_b = new this.entityType().getCrudApiPath()) === null || _b === void 0 ? void 0 : _b.toString()}/set-default`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            var _a, _b;
+            try {
+                if (!IsBillingEnabled) {
+                    throw new BadDataException("Billing is not enabled for this server");
+                }
+                if (req.body["projectId"]) {
+                    throw new BadDataException("projectId should not be passed in the request body. The project is resolved from the tenantid header.");
+                }
+                const userPermissions = (await this.getPermissionsForTenant(req)).filter((permission) => {
+                    return MANAGE_PAYMENT_METHOD_PERMISSIONS.includes(permission.permission);
+                });
+                if (userPermissions.length === 0 &&
+                    !((_a = req.userAuthorization) === null || _a === void 0 ? void 0 : _a.isMasterAdmin)) {
+                    throw new BadDataException("Only project owners or members with Manage Billing access can change the default payment method.");
+                }
+                const tenantId = this.getTenantId(req);
+                if (!tenantId) {
+                    throw new BadDataException("Project not found");
+                }
+                const project = await ProjectService.findOneById({
+                    id: tenantId,
+                    props: {
+                        isRoot: true,
+                    },
+                    select: {
+                        _id: true,
+                        paymentProviderCustomerId: true,
+                    },
+                });
+                if (!project || !project.id) {
+                    throw new BadDataException("Project not found");
+                }
+                if (!project.paymentProviderCustomerId) {
+                    throw new BadDataException("Payment Provider customer not found");
+                }
+                const data = (_b = req.body) === null || _b === void 0 ? void 0 : _b["data"];
+                const paymentMethodId = data === null || data === void 0 ? void 0 : data["paymentProviderPaymentMethodId"];
+                if (typeof paymentMethodId !== "string" || !paymentMethodId.trim()) {
+                    throw new BadDataException("Payment method ID not found");
+                }
+                /*
+                 * Always the project's own customer. The service refuses a payment
+                 * method that is not attached to it, so an id belonging to another
+                 * project's customer cannot be made default here.
+                 */
+                await BillingService.makePaymentMethodDefault(project.paymentProviderCustomerId, paymentMethodId.trim());
+                /*
+                 * The cached pay-as-you-go authorization is derived from the
+                 * project's payment setup, which just changed. Drop it so the next
+                 * check reads the setup fresh, as the payment method sync does.
+                 */
+                PayAsYouGoBillingService.invalidate(project.id);
+                return Response.sendEmptySuccessResponse(req, res);
+            }
+            catch (err) {
+                next(err);
+            }
+        });
     }
 }
 //# sourceMappingURL=BillingPaymentMethodAPI.js.map

package/build/dist/Server/API/BillingPaymentMethodAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"BillingPaymentMethodAPI.js","sourceRoot":"","sources":["../../../../Server/API/BillingPaymentMethodAPI.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,2BAEN,MAAM,yCAAyC,CAAC;AACjD,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,cAAc,MAAM,4BAA4B,CAAC;AAMxD,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,UAA8B,MAAM,wBAAwB,CAAC;AACpE,OAAO,oBAAoB,MAAM,kDAAkD,CAAC;AAGpF,MAAM,CAAC,OAAO,OAAO,OAAQ,SAAQ,OAGpC;IACC;;QACE,KAAK,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,CAAC;QAEzD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,QAAQ,EAC7D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,gBAAgB,CAAC,uCAAuC,CAAC,CAAC;gBACtE,CAAC;gBAED,MAAM,eAAe,GAA0B,CAC7C,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CACxC,CAAC,MAAM,CAAC,CAAC,UAA0B,EAAE,EAAE;oBACtC,OAAO;wBACL,UAAU,CAAC,YAAY;wBACvB,UAAU,CAAC,oBAAoB;wBAC/B,UAAU,CAAC,0BAA0B;qBACtC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBACpC,CAAC,CAAC,CAAC;gBAEH,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACjC,MAAM,IAAI,gBAAgB,CACxB,oFAAoF,CACrF,CAAC;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;oBAC/D,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAE;oBAC1B,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;wBACT,yBAAyB,EAAE,IAAI;qBAChC;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;oBACvC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,WAAW,GAAW,MAAM,cAAc,CAAC,oBAAoB,CACnE,OAAO,CAAC,yBAAyB,CAClC,CAAC;gBAEF,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC/C,WAAW,EAAE,WAAW;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"BillingPaymentMethodAPI.js","sourceRoot":"","sources":["../../../../Server/API/BillingPaymentMethodAPI.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,2BAEN,MAAM,yCAAyC,CAAC;AACjD,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,wBAAwB,MAAM,sCAAsC,CAAC;AAC5E,OAAO,cAAc,MAAM,4BAA4B,CAAC;AAOxD,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAGtE,OAAO,UAA8B,MAAM,wBAAwB,CAAC;AACpE,OAAO,oBAAoB,MAAM,kDAAkD,CAAC;AAGpF;;;;;GAKG;AACH,MAAM,iCAAiC,GAAsB;IAC3D,UAAU,CAAC,YAAY;IACvB,UAAU,CAAC,oBAAoB;IAC/B,UAAU,CAAC,0BAA0B;IACrC,UAAU,CAAC,wBAAwB;CACpC,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,OAAQ,SAAQ,OAGpC;IACC;;QACE,KAAK,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,CAAC;QAEzD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,QAAQ,EAC7D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,gBAAgB,CACxB,uGAAuG,CACxG,CAAC;gBACJ,CAAC;gBAED,MAAM,eAAe,GAA0B,CAC7C,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CACxC,CAAC,MAAM,CAAC,CAAC,UAA0B,EAAE,EAAE;oBACtC,OAAO;wBACL,UAAU,CAAC,YAAY;wBACvB,UAAU,CAAC,oBAAoB;wBAC/B,UAAU,CAAC,0BAA0B;qBACtC,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBACpC,CAAC,CAAC,CAAC;gBAEH,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACjC,MAAM,IAAI,gBAAgB,CACxB,oFAAoF,CACrF,CAAC;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;oBAC/D,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAE;oBAC1B,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;wBACT,yBAAyB,EAAE,IAAI;qBAChC;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;oBACvC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,WAAW,GAAW,MAAM,cAAc,CAAC,oBAAoB,CACnE,OAAO,CAAC,yBAAyB,CAClC,CAAC;gBAEF,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;oBAC/C,WAAW,EAAE,WAAW;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;QAEF;;;;;;;;;;;WAWG;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,cAAc,EACnE,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;;YACtE,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtB,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,CACzC,CAAC;gBACJ,CAAC;gBAED,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,gBAAgB,CACxB,uGAAuG,CACxG,CAAC;gBACJ,CAAC;gBAED,MAAM,eAAe,GAA0B,CAC7C,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,CACxC,CAAC,MAAM,CAAC,CAAC,UAA0B,EAAE,EAAE;oBACtC,OAAO,iCAAiC,CAAC,QAAQ,CAC/C,UAAU,CAAC,UAAU,CACtB,CAAC;gBACJ,CAAC,CAAC,CAAC;gBAEH,IACE,eAAe,CAAC,MAAM,KAAK,CAAC;oBAC5B,CAAC,CAAA,MAAC,GAAwB,CAAC,iBAAiB,0CAAE,aAAa,CAAA,EAC3D,CAAC;oBACD,MAAM,IAAI,gBAAgB,CACxB,kGAAkG,CACnG,CAAC;gBACJ,CAAC;gBAED,MAAM,QAAQ,GAAoB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAExD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBAClD,CAAC;gBAED,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;oBAC/D,EAAE,EAAE,QAAQ;oBACZ,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,MAAM,EAAE;wBACN,GAAG,EAAE,IAAI;wBACT,yBAAyB,EAAE,IAAI;qBAChC;iBACF,CAAC,CAAC;gBAEH,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAC5B,MAAM,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;gBAClD,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC;oBACvC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,CAAC,CAAC;gBACpE,CAAC;gBAED,MAAM,IAAI,GAA2B,MAAA,GAAG,CAAC,IAAI,0CAAG,MAAM,CAEzC,CAAC;gBAEd,MAAM,eAAe,GACnB,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAG,gCAAgC,CAAC,CAAC;gBAE3C,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;oBACnE,MAAM,IAAI,gBAAgB,CAAC,6BAA6B,CAAC,CAAC;gBAC5D,CAAC;gBAED;;;;mBAIG;gBACH,MAAM,cAAc,CAAC,wBAAwB,CAC3C,OAAO,CAAC,yBAAyB,EACjC,eAAe,CAAC,IAAI,EAAE,CACvB,CAAC;gBAEF;;;;mBAIG;gBACH,wBAAwB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBAEhD,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/API/DashboardAPI.js

@@ -56,9 +56,11 @@ import SpanService from "../Services/SpanService";
 import LogService from "../Services/LogService";
 import SloHistoryService from "../Services/SloHistoryService";
 import DashboardComponentType from "../../Types/Dashboard/DashboardComponentType";
-import { DashboardVariableType } from "../../Types/Dashboard/DashboardVariable";
+import { DashboardVariableType, } from "../../Types/Dashboard/DashboardVariable";
 import PublicDashboardResourceListPolicy from "../Utils/Dashboard/PublicDashboardResourceListPolicy";
 import PublicDashboardSloHistoryPolicy from "../Utils/Dashboard/PublicDashboardSloHistoryPolicy";
+import { PublicDashboardSloWidgetTargetKind, } from "../Utils/Dashboard/PublicDashboardSloWidget";
+import { SLO_WIDGET_NAME_MATCH_LIMIT } from "../../Utils/Dashboard/SloWidgetSource";
 import AggregationType from "../../Types/BaseDatabase/AggregationType";
 import InBetween from "../../Types/BaseDatabase/InBetween";
 import { applyIncidentSelfPrivacyFilter } from "../Utils/Incident/IncidentPrivacyFilter";
@@ -242,6 +244,20 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         },
     },
     slo: PUBLIC_DASHBOARD_SLO_RESOURCE,
+    /*
+     * The SLO List widget reads the same model but is its own resource type,
+     * deliberately NOT a widget of PUBLIC_DASHBOARD_SLO_RESOURCE: the SLO
+     * history route selects its widget through that entry, and a list widget
+     * there would make "the only SLO widget on this dashboard" ambiguous for a
+     * route that can never serve a list.
+     */
+    "slo-list": {
+        modelType: ServiceLevelObjective,
+        service: ServiceLevelObjectiveService,
+        widgets: {
+            [DashboardComponentType.SloList]: null,
+        },
+    },
 };
 /*
  * Resolve the :dashboardIdOrDomain route param to a dashboard ID. Accepts
@@ -1002,9 +1018,24 @@ export default class DashboardAPI extends BaseAPI {
                     config: PUBLIC_DASHBOARD_SLO_RESOURCE,
                     requestedComponentId: req.body["componentId"],
                 });
+                /*
+                 * The viewer's toolbar selections, validated against the
+                 * dashboard's STORED variables exactly as the resource-list route
+                 * validates them. A pinned SLO chart never reads them; a chart that
+                 * follows an SLO variable reads only the variable it is bound to.
+                 */
+                const variables = PublicDashboardResourceListPolicy.resolveDashboardVariableSelections({
+                    dashboardViewConfig: dashboard.dashboardViewConfig,
+                    requestedVariables: req.body["variables"],
+                });
                 const policy = PublicDashboardSloHistoryPolicy.build({
                     widget,
                     requestedAggregateBy: JSONFunctions.deserialize(req.body["aggregateBy"]),
+                    variables,
+                });
+                const serviceLevelObjectiveId = await DashboardAPI.resolvePublicSloWidgetTarget({
+                    projectId: dashboard.projectId,
+                    target: policy.target,
                 });
                 const aggregateResult = await SloHistoryService.aggregateBy({
                     /*
@@ -1016,7 +1047,7 @@ export default class DashboardAPI extends BaseAPI {
                      */
                     query: {
                         projectId: dashboard.projectId,
-                        sloId: policy.serviceLevelObjectiveId,
+                        sloId: serviceLevelObjectiveId,
                         metricName: policy.metricName,
                         bucketStart: new InBetween(policy.startDate, policy.endDate),
                     },
@@ -1432,6 +1463,45 @@ export default class DashboardAPI extends BaseAPI {
         }
         return selectedWidget;
     }
+    /*
+     * The one SLO id a public SLO chart may aggregate.
+     *
+     * A pinned widget already names it. A widget that follows an SLO variable
+     * names an SLO by NAME, so the name is resolved to an id here — inside the
+     * dashboard's own project, among ACTIVE objectives only, by exact match —
+     * with the same two-row read the resource-list route uses: no match and a
+     * shared name both refuse, rather than aggregating some other objective's
+     * history under the one the viewer picked.
+     */
+    static async resolvePublicSloWidgetTarget(data) {
+        var _a;
+        if (data.target.kind === PublicDashboardSloWidgetTargetKind.Pinned) {
+            return data.target.serviceLevelObjectiveId;
+        }
+        const matches = await ServiceLevelObjectiveService.findBy({
+            query: {
+                projectId: data.projectId,
+                name: data.target.serviceLevelObjectiveName,
+                isArchived: false,
+            },
+            select: {
+                _id: true,
+            },
+            limit: SLO_WIDGET_NAME_MATCH_LIMIT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        if (matches.length > 1) {
+            throw new BadDataException("More than one Service Level Objective has this name.");
+        }
+        const matchedId = ((_a = matches[0]) === null || _a === void 0 ? void 0 : _a.id) || null;
+        if (!matchedId) {
+            throw new NotFoundException("No active Service Level Objective has this name.");
+        }
+        return matchedId;
+    }
     /*
      * Shared handler for the public resource-list endpoint. Loads the
      * dashboard, enforces read access, checks the resource is one this