@stardeck-customer-apps/testing 0.21.0 → 0.23.0

package/SKILL.md

@@ -218,6 +218,13 @@ const integrations = createIntegrationsClient();
 await integrations.line.push("U123", { type: "text", text: "Your order shipped" });
 expect(app.messages.channel("line").to("U123")[0].body.text).toMatch(/shipped/i);
 
+// Signed in through LINE (a shop's LINE MINI App): the session carries the
+// person's shop-provider LINE user ID. Push to the ID on the SESSION.
+app.asUser({ id: "buyer-1", lineUserId: "Ushop-provider-1" });
+// route under test: const s = await getSession(); await integrations.line.push(s.user.lineUserId, ...)
+await callRoute(POST);
+expect(app.messages.channel("line").to("Ushop-provider-1")).toHaveLength(1);
+
 // LINE Flex card — the simulator preserves the complete LINE-native container.
 const card = {
   type: "bubble" as const,
@@ -322,7 +329,18 @@ expect(app.edge.latestDisplay()?.action).toBe("show");
   or the platform's test-run deadline.
 
 - `app.asUser(partial?)` — sign in a test user; `getSession()` in app code
-  resolves to it. `app.signOut()` clears.
+  resolves to it. `app.signOut()` clears. Pass `lineUserId` to sign in as a
+  person who came through LINE sign-in inside the shop's LINE MINI App; it is
+  the same field production sets, so app code reads `session.user.lineUserId`.
+  `issueSession({ lineUserId })` carries it through cookie auth and the real
+  `/api/auth/me` route too.
+- `app.setLiffId(id | null)` / `createTestApp({ liffId })` — the LIFF ID the
+  platform forwards to the app (`null` by default = no LINE MINI App). The real
+  project-auth `/api/auth/me` returns it as `liffId` on every response, signed
+  in or not, which is what makes `useLiff()` start LIFF. `reset()` restores the
+  `createTestApp` value. The simulator does not run LIFF sign-in itself
+  (`POST /api/auth/liff` needs a real LINE ID token), so seed the signed-in
+  state with `asUser`/`issueSession` instead.
 - `app.issueSession(partial?)` — mint access/refresh tokens for cookie-based
   auth flows (`__stardeck:sess`).
 - `app.inbox` — emails sent through the email-sdk: `.latest(addr?)`,
@@ -421,6 +439,24 @@ externalId })` helper models a trusted platform/channel link, and
   `isVirtual: false`; create/list validation matches the control plane
   (expiry 90–600s, amount positive int, payment-method enum, deploymentId UUID,
   list `limit` 1–100, status filter values).
+  Beam direct charges (inline checkout): `.directCharges`, `.getDirectCharge(id)`,
+  `.completeDirectCharge(id)` and `.failDirectCharge(id, failureCode?)` settle a
+  PENDING charge and return the `charge.succeeded` / `charge.failed` payload to
+  pass to `.deliverBeamEvent`. `QR_PROMPT_PAY` returns `ENCODED_IMAGE` (expiry
+  honours `expiryDurationInSec`), wallets and mobile banking return `REDIRECT`
+  to `https://beam.stardeck.test/pay/<id>?returnUrl=…`, and the same
+  `idempotencyKey` returns the same charge. Card tokens: `tokenizeBeamCard`
+  against the simulated Beam host returns `ctok_sim_<n>`; the card number picks
+  the outcome of a `CARD_TOKEN` charge — `4111111111111111` / `5372074248113841`
+  succeed (`NONE`), `4953261730509988` / `4389783280144506` need OTP
+  (`REDIRECT`), `4943129900084541` fails `CH_INSUFFICIENT_FUNDS`,
+  `4111111111000025` fails `CH_CARD_DECLINED`, `4111111111000033` fails
+  `CH_CARD_RESTRICTED`, anything else fails `CH_PROCESSING_FAILED`.
+  `.setCardTokenization(false)` models a merchant with no publishable key
+  (`getCardTokenizationConfig` throws `CARD_TOKENIZATION_NOT_CONFIGURED`).
+  Raw `CARD` / `CARD_INSTALLMENTS`, token methods without a `cardToken`, and
+  non-QR methods without a `returnUrl` are
+  refused with 400, as on the control plane.
 - `app.storage` — uploads through storage-sdk: `.uploads`, `.latest()`, `.count`, `.clear()`.
 - `app.messages` — outbound Slack/LINE/Facebook sends:
   `.all()`, `.latest()`, `.to(recipient)`, `.channel("line")`, `.count`, `.clear()`. LINE Flex
@@ -497,8 +533,8 @@ true })` remains source-compatible but the simulator (like the control plane)
 - For merge-correct reads, request aliases in batches and include every id in
   the returned canonical set. Page directory UIs through `search({ query,
 cursor, limit })`; `list()` intentionally keeps its previous array shape.
-- `PaymentsServerClient` (Stripe checkout + Beam payment links + Bolt+
-  connections/intents/charges, product list) — captured in `app.payments`;
+- `PaymentsServerClient` (Stripe checkout + Beam payment links + Beam direct
+  charges and card tokenization + Bolt+ connections/intents/charges, product list) — captured in `app.payments`;
   fulfill checkout via `markPaid` (poll) or `deliverStripeEvent` /
   `deliverBeamEvent` (webhook push). Drive a terminal without hardware via
   `approveBoltIntent` / `declineBoltIntent` / `expireBoltIntent`. Beam payment-link
@@ -512,7 +548,8 @@ cursor, limit })`; `list()` intentionally keeps its previous array shape.
   one-shot HTTP or network failures during Stripe checkout creation/status polling
   and Beam payment-link creation/status polling. The operation names are
   `stripe.createCheckout`, `stripe.getCheckoutSessionStatus`,
-  `beam.createPaymentLink`, and `beam.getPaymentLinkStatus`. HTTP failures support
+  `beam.createPaymentLink`, `beam.getPaymentLinkStatus`, `beam.createDirectCharge`,
+  and `beam.getCharge`. HTTP failures support
   statuses 400, 402, 409, 429, 500, and 503 plus optional `code`, `details`, and
   `retryAfterSeconds`; `{ kind: "network", message }` rejects fetch instead.
   `app.reset()` clears pending failures.
@@ -600,6 +637,20 @@ per-field validation (unit-test the route), login/logout (platform-provided).
   never `waitForTimeout` (web-first assertions auto-wait), every test
   independent of other tests' data and ordering.
 
+## Testing LINE flows
+
+- Sign in as a LINE person with `app.asUser({ lineUserId: "U..." })` and call
+  the route with `callRoute`; assert the push with
+  `app.messages.channel("line").to("U...")`. Cover the person with no LINE
+  identity too (`asUser()` without `lineUserId`): the route must send nothing.
+- The recipient of a LINE push comes from `session.user.lineUserId` on the
+  server, never from a request body, query string or client-side value. A
+  `lineUserId` a browser sends can be forged to message any friend of the shop's
+  LINE Official Account. Do not write a route that takes one, and do not write a
+  test that posts one to make a push happen; sign in with `lineUserId` instead.
+- Whether the person is a friend of the shop's OA is a client concern
+  (`useLiff().isFriend`); a server route checks only that `lineUserId` exists.
+
 ## Rules
 
 - Test **business logic and route handlers**, not framework plumbing. Focus on

package/dist/index.d.mts

@@ -38,6 +38,12 @@ interface TestUser {
     projectId?: string | null;
     /** Cross-app customer ownership key returned by the platform identity resolver. */
     identityId?: string | null;
+    /**
+     * The person's LINE user ID under the shop's own LINE provider. Set it to sign in
+     * as someone who came through LINE sign-in inside the shop's LINE MINI App; app
+     * code reads it from `session.user.lineUserId` and pushes to it.
+     */
+    lineUserId?: string | null;
 }
 interface CapturedEmail {
     resendId: string;
@@ -210,7 +216,7 @@ interface CapturedCheckout {
     metadata?: Record<string, string>;
     createdAt: Date;
 }
-type PaymentSimulatorOperation = "stripe.createCheckout" | "stripe.getCheckoutSessionStatus" | "beam.createPaymentLink" | "beam.getPaymentLinkStatus";
+type PaymentSimulatorOperation = "stripe.createCheckout" | "stripe.getCheckoutSessionStatus" | "beam.createPaymentLink" | "beam.getPaymentLinkStatus" | "beam.createDirectCharge" | "beam.getCharge";
 type PaymentSimulatorFailure = {
     kind?: "http";
     status: 400 | 402 | 409 | 429 | 500 | 503;
@@ -269,6 +275,26 @@ interface SimBoltCharge {
     sourceId?: string;
     createdAt?: string;
 }
+/** A direct charge (`createDirectCharge`) as the simulator holds it. */
+interface SimDirectCharge {
+    id: string;
+    status: "SUCCEEDED" | "FAILED" | "PENDING";
+    amount: number;
+    currency: string;
+    paymentMethodType: string;
+    referenceId: string | null;
+    deviceType: string | null;
+    returnUrl: string | null;
+    actionRequired: "NONE" | "REDIRECT" | "ENCODED_IMAGE";
+    redirectUrl: string | null;
+    /** When the QR (or the charge) stops being payable. */
+    expiresAt: string;
+    failureCode: string | null;
+    /** Last four digits of a CARD_TOKEN charge's card. */
+    cardLast4: string | null;
+    idempotencyKey: string | null;
+    createdAt: string;
+}
 interface TestPayments {
     get checkouts(): CapturedCheckout[];
     latest(): CapturedCheckout | undefined;
@@ -317,6 +343,19 @@ interface TestPayments {
     expireBoltIntent(intentId: string): void;
     listBoltIntents(): SimBoltIntentRecord[];
     getBoltIntent(intentId: string): SimBoltIntentRecord | undefined;
+    /** Every direct charge created so far, oldest first. */
+    get directCharges(): SimDirectCharge[];
+    getDirectCharge(chargeId: string): SimDirectCharge | undefined;
+    /**
+     * The shopper paid: mark a PENDING direct charge SUCCEEDED and return the
+     * `charge.succeeded` payload. Delivers no webhook; pass the payload to
+     * `deliverBeamEvent` the way Beam would.
+     */
+    completeDirectCharge(chargeId: string): Record<string, unknown>;
+    /** Mark a PENDING direct charge FAILED; returns the `charge.failed` payload. */
+    failDirectCharge(chargeId: string, failureCode?: string): Record<string, unknown>;
+    /** Turn card tokenization off, as for a merchant with no publishable key. On by default. */
+    setCardTokenization(enabled: boolean): void;
     clear(): void;
     get count(): number;
 }
@@ -582,6 +621,12 @@ interface TestStarlens {
     get count(): number;
 }
 interface TestAppOptions {
+    /**
+     * The LIFF ID the platform forwards to the app for a LINE MINI App shop. It is
+     * what `GET /api/auth/me` returns as `liffId` and what makes `useLiff()` start
+     * LIFF. Defaults to `null` (the app has no LINE MINI App). Restored by `reset()`.
+     */
+    liffId?: string | null;
     /** Data stores exposed through the production-shaped STARDECK_DATA_STORES manifest. */
     dataStores?: TestDataStoreInput[];
     /**
@@ -636,6 +681,11 @@ interface TestApp {
     asUser(user?: Partial<TestUser>): TestUser;
     /** Clear the active test user. */
     signOut(): void;
+    /**
+     * Set (or clear with `null`) the LIFF ID the platform forwards to the app, for
+     * the rest of the test. The real project-auth `me` route returns it as `liffId`.
+     */
+    setLiffId(liffId: string | null): void;
     /**
      * Mint access/refresh tokens for cookie-based auth flows. The simulated
      * control-plane verify endpoint resolves these tokens back to the user.

package/dist/index.d.ts

@@ -38,6 +38,12 @@ interface TestUser {
     projectId?: string | null;
     /** Cross-app customer ownership key returned by the platform identity resolver. */
     identityId?: string | null;
+    /**
+     * The person's LINE user ID under the shop's own LINE provider. Set it to sign in
+     * as someone who came through LINE sign-in inside the shop's LINE MINI App; app
+     * code reads it from `session.user.lineUserId` and pushes to it.
+     */
+    lineUserId?: string | null;
 }
 interface CapturedEmail {
     resendId: string;
@@ -210,7 +216,7 @@ interface CapturedCheckout {
     metadata?: Record<string, string>;
     createdAt: Date;
 }
-type PaymentSimulatorOperation = "stripe.createCheckout" | "stripe.getCheckoutSessionStatus" | "beam.createPaymentLink" | "beam.getPaymentLinkStatus";
+type PaymentSimulatorOperation = "stripe.createCheckout" | "stripe.getCheckoutSessionStatus" | "beam.createPaymentLink" | "beam.getPaymentLinkStatus" | "beam.createDirectCharge" | "beam.getCharge";
 type PaymentSimulatorFailure = {
     kind?: "http";
     status: 400 | 402 | 409 | 429 | 500 | 503;
@@ -269,6 +275,26 @@ interface SimBoltCharge {
     sourceId?: string;
     createdAt?: string;
 }
+/** A direct charge (`createDirectCharge`) as the simulator holds it. */
+interface SimDirectCharge {
+    id: string;
+    status: "SUCCEEDED" | "FAILED" | "PENDING";
+    amount: number;
+    currency: string;
+    paymentMethodType: string;
+    referenceId: string | null;
+    deviceType: string | null;
+    returnUrl: string | null;
+    actionRequired: "NONE" | "REDIRECT" | "ENCODED_IMAGE";
+    redirectUrl: string | null;
+    /** When the QR (or the charge) stops being payable. */
+    expiresAt: string;
+    failureCode: string | null;
+    /** Last four digits of a CARD_TOKEN charge's card. */
+    cardLast4: string | null;
+    idempotencyKey: string | null;
+    createdAt: string;
+}
 interface TestPayments {
     get checkouts(): CapturedCheckout[];
     latest(): CapturedCheckout | undefined;
@@ -317,6 +343,19 @@ interface TestPayments {
     expireBoltIntent(intentId: string): void;
     listBoltIntents(): SimBoltIntentRecord[];
     getBoltIntent(intentId: string): SimBoltIntentRecord | undefined;
+    /** Every direct charge created so far, oldest first. */
+    get directCharges(): SimDirectCharge[];
+    getDirectCharge(chargeId: string): SimDirectCharge | undefined;
+    /**
+     * The shopper paid: mark a PENDING direct charge SUCCEEDED and return the
+     * `charge.succeeded` payload. Delivers no webhook; pass the payload to
+     * `deliverBeamEvent` the way Beam would.
+     */
+    completeDirectCharge(chargeId: string): Record<string, unknown>;
+    /** Mark a PENDING direct charge FAILED; returns the `charge.failed` payload. */
+    failDirectCharge(chargeId: string, failureCode?: string): Record<string, unknown>;
+    /** Turn card tokenization off, as for a merchant with no publishable key. On by default. */
+    setCardTokenization(enabled: boolean): void;
     clear(): void;
     get count(): number;
 }
@@ -582,6 +621,12 @@ interface TestStarlens {
     get count(): number;
 }
 interface TestAppOptions {
+    /**
+     * The LIFF ID the platform forwards to the app for a LINE MINI App shop. It is
+     * what `GET /api/auth/me` returns as `liffId` and what makes `useLiff()` start
+     * LIFF. Defaults to `null` (the app has no LINE MINI App). Restored by `reset()`.
+     */
+    liffId?: string | null;
     /** Data stores exposed through the production-shaped STARDECK_DATA_STORES manifest. */
     dataStores?: TestDataStoreInput[];
     /**
@@ -636,6 +681,11 @@ interface TestApp {
     asUser(user?: Partial<TestUser>): TestUser;
     /** Clear the active test user. */
     signOut(): void;
+    /**
+     * Set (or clear with `null`) the LIFF ID the platform forwards to the app, for
+     * the rest of the test. The real project-auth `me` route returns it as `liffId`.
+     */
+    setLiffId(liffId: string | null): void;
     /**
      * Mint access/refresh tokens for cookie-based auth flows. The simulated
      * control-plane verify endpoint resolves these tokens back to the user.