@oneuptime/common 13.0.7 → 13.0.8

package/Tests/Server/API/BillingPayAsYouGoStatus.test.ts

@@ -1,5 +1,11 @@
 import BillingAPI from "../../../Server/API/BillingAPI";
-import PayAsYouGoBillingService from "../../../Server/Services/PayAsYouGoBillingService";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import PayAsYouGoBillingService, {
+  Service,
+} from "../../../Server/Services/PayAsYouGoBillingService";
+import BillingService from "../../../Server/Services/BillingService";
+import ProjectService from "../../../Server/Services/ProjectService";
+import Project from "../../../Models/DatabaseModels/Project";
 import {
   NextFunction,
   OneUptimeRequest,
@@ -8,19 +14,34 @@ import {
 import Response from "../../../Server/Utils/Response";
 import ObjectID from "../../../Types/ObjectID";
 import Permission, { UserPermission } from "../../../Types/Permission";
+import SubscriptionPlan, {
+  PlanType,
+} from "../../../Types/Billing/SubscriptionPlan";
 import { mockRouter } from "./Helpers";
 
 jest.mock("../../../Server/Services/BillingService", () => {
-  return { __esModule: true, default: {} };
+  return {
+    __esModule: true,
+    default: { isBillingEnabled: jest.fn(), hasPaymentMethods: jest.fn() },
+  };
 });
 jest.mock("../../../Server/Services/ProjectService", () => {
-  return { __esModule: true, default: {} };
+  return { __esModule: true, default: { findOneById: jest.fn() } };
+});
+jest.mock("../../../Server/Services/PromoCodeService", () => {
+  return { __esModule: true, default: { findOneBy: jest.fn() } };
 });
 jest.mock("../../../Server/API/CommonAPI", () => {
   return { __esModule: true, default: {} };
 });
 jest.mock("../../../Server/Middleware/UserAuthorization", () => {
-  return { __esModule: true, default: { getUserMiddleware: jest.fn() } };
+  return {
+    __esModule: true,
+    default: {
+      getUserMiddleware: jest.fn(),
+      requireUserAuthentication: jest.fn(),
+    },
+  };
 });
 jest.mock("../../../Server/Utils/Express", () => {
   return {
@@ -29,9 +50,6 @@ jest.mock("../../../Server/Utils/Express", () => {
     },
   };
 });
-jest.mock("../../../Server/Services/PayAsYouGoBillingService", () => {
-  return { __esModule: true, default: { canUsePayAsYouGo: jest.fn() } };
-});
 jest.mock("../../../Server/Utils/Response", () => {
   return { __esModule: true, default: { sendJsonObjectResponse: jest.fn() } };
 });
@@ -54,6 +72,9 @@ describe("GET /billing/pay-as-you-go-status", () => {
     req = { tenantId: projectId } as OneUptimeRequest;
     res = {} as OneUptimeResponse;
     next = jest.fn();
+    jest
+      .spyOn(PayAsYouGoBillingService, "canUsePayAsYouGo")
+      .mockResolvedValue(false);
     jest
       .spyOn(BillingAPI.prototype, "getPermissionsForTenant")
       .mockResolvedValue([
@@ -65,6 +86,24 @@ describe("GET /billing/pay-as-you-go-status", () => {
     jest.restoreAllMocks();
   });
 
+  /*
+   * A Dashboard tab left open past the access-token lifetime asks for these
+   * with no session at all (the cookie expires with the token), and
+   * getUserMiddleware lets that request through as Public.
+   * requireUserAuthentication is what answers it with the 401 that makes the
+   * browser client refresh the session and retry, instead of the handler's
+   * "You do not have access to this project" 400.
+   */
+  it.each(["/billing/pay-as-you-go-status", "/billing/customer-balance"])(
+    "registers %s behind the user middleware and the authentication guard",
+    (uri: string) => {
+      expect(mockRouter.match("get", uri).middlewares).toStrictEqual([
+        UserMiddleware.getUserMiddleware,
+        UserMiddleware.requireUserAuthentication,
+      ]);
+    },
+  );
+
   it.each([true, false])(
     "returns only the feature eligibility (%s) to a project member",
     async (isAllowed: boolean) => {
@@ -82,6 +121,53 @@ describe("GET /billing/pay-as-you-go-status", () => {
     },
   );
 
+  it.each([
+    PlanType.Free,
+    PlanType.Growth,
+    PlanType.Scale,
+    PlanType.Enterprise,
+  ])(
+    "returns the real %s plan eligibility without a payment method",
+    async (plan: PlanType) => {
+      const service: Service = new Service();
+      jest.mocked(BillingService.isBillingEnabled).mockReturnValue(true);
+      jest.mocked(BillingService.hasPaymentMethods).mockResolvedValue(false);
+      jest.mocked(ProjectService.findOneById).mockResolvedValue(
+        Object.assign(new Project(), {
+          paymentProviderPlanId: plan,
+          paymentProviderCustomerId: "cus_status_project",
+        }),
+      );
+      jest
+        .spyOn(SubscriptionPlan, "getSubscriptionPlanById")
+        .mockReturnValue(
+          new SubscriptionPlan(plan, `${plan}_yearly`, plan, 0, 0, 0, 0),
+        );
+      jest
+        .mocked(PayAsYouGoBillingService.canUsePayAsYouGo)
+        .mockImplementation((id: ObjectID): Promise<boolean> => {
+          return service.canUsePayAsYouGo(id);
+        });
+
+      await requestStatus();
+
+      expect(Response.sendJsonObjectResponse).toHaveBeenCalledWith(req, res, {
+        isAllowed: plan !== PlanType.Free,
+      });
+      expect(ProjectService.findOneById).toHaveBeenCalledWith(
+        expect.objectContaining({ id: projectId }),
+      );
+      expect(next).not.toHaveBeenCalled();
+      if (plan === PlanType.Free) {
+        expect(BillingService.hasPaymentMethods).toHaveBeenCalledWith(
+          "cus_status_project",
+        );
+      } else {
+        expect(BillingService.hasPaymentMethods).not.toHaveBeenCalled();
+      }
+    },
+  );
+
   it("requires a selected project", async () => {
     req = {} as OneUptimeRequest;
     await requestStatus();

package/Tests/Server/API/BillingPaymentMethodAPI.test.ts

@@ -68,8 +68,19 @@ jest.mock("../../../Server/Utils/Response", () => {
     },
   };
 });
+/*
+ * Both middlewares are distinct mocks so the route registration can be
+ * asserted by identity. Leaving requireUserAuthentication out would register
+ * `undefined` in its place, and toEqual reads a trailing undefined as absent.
+ */
 jest.mock("../../../Server/Middleware/UserAuthorization", () => {
-  return { __esModule: true, default: { getUserMiddleware: jest.fn() } };
+  return {
+    __esModule: true,
+    default: {
+      getUserMiddleware: jest.fn(),
+      requireUserAuthentication: jest.fn(),
+    },
+  };
 });
 jest.mock("../../../Server/API/CommonAPI", () => {
   return { __esModule: true, default: {} };
@@ -190,13 +201,23 @@ describe("BillingPaymentMethodAPI", () => {
   });
 
   describe(`POST ${SET_DEFAULT_ROUTE}`, () => {
-    it("is registered behind the user middleware", () => {
+    /*
+     * getUserMiddleware lets a request with no session through as Public;
+     * requireUserAuthentication then answers it with a 401. The billing page
+     * left open past the access-token lifetime sends exactly that request,
+     * and the 401 is what makes the browser client refresh the session and
+     * replay it instead of showing a permission error.
+     */
+    it("is registered behind the user middleware and the authentication guard", () => {
       const route: ReturnType<typeof mockRouter.match> = mockRouter.match(
         "post",
         SET_DEFAULT_ROUTE,
       );
 
-      expect(route.middlewares).toEqual([UserMiddleware.getUserMiddleware]);
+      expect(route.middlewares).toStrictEqual([
+        UserMiddleware.getUserMiddleware,
+        UserMiddleware.requireUserAuthentication,
+      ]);
     });
 
     it("makes the card the default on the project's own customer, invalidates the pay-as-you-go cache and answers with an empty success", async () => {
@@ -458,6 +479,18 @@ describe("BillingPaymentMethodAPI", () => {
   });
 
   describe(`POST ${SETUP_ROUTE}`, () => {
+    it("is registered behind the user middleware and the authentication guard", () => {
+      const route: ReturnType<typeof mockRouter.match> = mockRouter.match(
+        "post",
+        SETUP_ROUTE,
+      );
+
+      expect(route.middlewares).toStrictEqual([
+        UserMiddleware.getUserMiddleware,
+        UserMiddleware.requireUserAuthentication,
+      ]);
+    });
+
     it("rejects a projectId in the body with a message that says so", async () => {
       /*
        * The check always rejected a body projectId, but told the caller that