@stardeck-customer-apps/testing 0.26.0 → 0.27.0

package/dist/setup.js

@@ -84,6 +84,11 @@ var state = globalSingleton("state", () => ({
   cardTokens: /* @__PURE__ */ new Map(),
   cardTokenCounter: 0,
   cardTokenizationEnabled: true,
+  stripePaymentIntents: /* @__PURE__ */ new Map(),
+  stripePaymentIntentCounter: 0,
+  stripeIdempotentIntents: /* @__PURE__ */ new Map(),
+  stripeAllowedMethods: ["card", "promptpay"],
+  stripeChargesEnabled: true,
   uploads: [],
   uploadCounter: 0,
   storageFiles: /* @__PURE__ */ new Map(),
@@ -570,8 +575,8 @@ async function handleNeonSql(db, request) {
       rowAsArray: arrayMode
     });
   } catch (error) {
-    const err = error;
-    return json({ message: err.message, code: err.code }, 400);
+    const err2 = error;
+    return json({ message: err2.message, code: err2.code }, 400);
   }
 }
 
@@ -1536,6 +1541,281 @@ var requestScopeStorage = globalSingleton(
   () => new import_node_async_hooks.AsyncLocalStorage()
 );
 
+// src/simulator/stripe-payment-intents.ts
+var SIM_STRIPE_PUBLISHABLE_KEY = "pk_test_sim_stripe";
+var SIM_STRIPE_DEFAULT_ACCOUNT = "acct_sim_default";
+var METHODS = ["card", "promptpay"];
+var RESERVED_METADATA_KEYS = ["projectId", "stardeckReferenceId", "stardeckStagingDeploymentId"];
+var PROMPTPAY_QR_TTL_SECONDS = 15 * 60;
+var PATH_RE = /^\/api\/store\/(?!beam\/)([^/]+)\/(payment-intents(?:\/([^/]+)(?:\/(cancel))?)?|elements-config|readiness)$/;
+function err(error, status, code) {
+  return json({ error, code }, status);
+}
+function decode(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
+function isPlayground(account) {
+  return account === "playground";
+}
+function resolveAccount(account) {
+  if (isPlayground(account)) return null;
+  if (account === "default") {
+    return process.env.STRIPE_CONNECT_ACCOUNT_ID || SIM_STRIPE_DEFAULT_ACCOUNT;
+  }
+  return account;
+}
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var APP_METADATA_MAX_KEYS = 50 - RESERVED_METADATA_KEYS.length;
+function isStringRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((v) => typeof v === "string");
+}
+function isValidMetadata(value) {
+  if (!isStringRecord(value)) return false;
+  const entries = Object.entries(value);
+  return entries.length <= APP_METADATA_MAX_KEYS && entries.every(([k, v]) => k.length >= 1 && k.length <= 40 && v.length <= 500);
+}
+function isOptional(value, test) {
+  return value === void 0 || test(value);
+}
+var isEmail = (v) => typeof v === "string" && EMAIL_RE.test(v);
+function validateCreate(body) {
+  const { amount, currency, method, referenceId, idempotencyKey } = body;
+  const checks = [
+    [
+      typeof amount === "number" && Number.isInteger(amount) && amount > 0,
+      "amount must be a positive integer in minor units"
+    ],
+    [typeof currency === "string" && currency.length === 3, "currency must be a 3-letter ISO code"],
+    [
+      typeof method === "string" && METHODS.includes(method),
+      `method must be one of: ${METHODS.join(", ")}`
+    ],
+    [
+      typeof referenceId === "string" && referenceId.length >= 1 && referenceId.length <= 200,
+      "referenceId must be 1 to 200 characters"
+    ],
+    [
+      typeof idempotencyKey === "string" && idempotencyKey.length >= 1 && idempotencyKey.length <= 200,
+      "idempotencyKey is required (1 to 200 characters)"
+    ],
+    [
+      isOptional(body.description, (v) => typeof v === "string" && v.length <= 1e3),
+      "description must be at most 1000 characters"
+    ],
+    [isOptional(body.receiptEmail, isEmail), "receiptEmail must be an email address"],
+    [isOptional(body.billingEmail, isEmail), "billingEmail must be an email address"],
+    [
+      isOptional(body.returnUrl, (v) => typeof v === "string" && URL.canParse(v)),
+      "returnUrl must be an absolute URL"
+    ],
+    [
+      isOptional(body.metadata, isValidMetadata),
+      `metadata must map keys (1-40 chars) to strings (max 500), at most ${APP_METADATA_MAX_KEYS} keys`
+    ],
+    [
+      typeof body.deploymentId === "string" && UUID_RE2.test(body.deploymentId),
+      "Invalid deployment ID"
+    ]
+  ];
+  const failed = checks.find(([ok]) => !ok);
+  return failed ? failed[1] : null;
+}
+function appMetadata(raw) {
+  if (!isStringRecord(raw)) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (!RESERVED_METADATA_KEYS.includes(key)) out[key] = value;
+  }
+  return out;
+}
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function toStripePaymentIntentSummary(intent) {
+  const open = intent.status !== "succeeded" && intent.status !== "canceled";
+  let actionRequired = "NONE";
+  if (open && intent.method === "card") actionRequired = "CLIENT_CONFIRM";
+  if (open && intent.method === "promptpay" && intent.status === "requires_action") {
+    actionRequired = "ENCODED_IMAGE";
+  }
+  return {
+    id: intent.id,
+    status: intent.status,
+    amount: intent.amount,
+    currency: intent.currency,
+    method: intent.method,
+    referenceId: intent.referenceId,
+    metadata: { ...intent.appMetadata },
+    actionRequired,
+    clientSecret: intent.method === "card" ? intent.clientSecret : null,
+    qr: actionRequired === "ENCODED_IMAGE" ? { ...intent.qr } : null,
+    latestChargeId: intent.latestChargeId,
+    amountRefunded: intent.amountRefunded,
+    lastPaymentError: intent.lastPaymentError ? { ...intent.lastPaymentError } : null,
+    created: intent.created,
+    livemode: false,
+    playground: intent.playground
+  };
+}
+function promptPayQr(id, created) {
+  return {
+    imageUrlPng: `https://qr.stripe.test/${id}.png`,
+    imageUrlSvg: `https://qr.stripe.test/${id}.svg`,
+    data: `00020101021230SIM${id}`,
+    hostedInstructionsUrl: `https://payments.stripe.test/promptpay/${id}`,
+    expiresAt: created + PROMPTPAY_QR_TTL_SECONDS
+  };
+}
+function createIntent(body, account, projectId) {
+  const problem = validateCreate(body);
+  if (problem) return err(problem, 400, "invalid_request");
+  const method = body.method;
+  const currency = body.currency.toLowerCase();
+  if (!state.stripeAllowedMethods.includes(method)) {
+    return err(
+      `The ${method} payment method is turned off for this account`,
+      422,
+      "method_not_allowed"
+    );
+  }
+  if (method === "promptpay" && currency !== "thb") {
+    return err("PromptPay only takes THB", 422, "currency_not_supported");
+  }
+  if (!state.stripeChargesEnabled) {
+    return err("This Stripe account can't take payments yet", 503, "account_not_ready");
+  }
+  const scopedKey = JSON.stringify(["pi", projectId, account, body.idempotencyKey]);
+  const comparable = { ...body };
+  delete comparable.deploymentId;
+  delete comparable.idempotencyKey;
+  const fingerprint = stableStringify(comparable);
+  const saved = state.stripeIdempotentIntents.get(scopedKey);
+  if (saved) {
+    if (saved.fingerprint !== fingerprint) {
+      return err(
+        "This idempotency key was already used with different parameters. Use a new key for a different payment.",
+        409,
+        "idempotency_conflict"
+      );
+    }
+    const existing = state.stripePaymentIntents.get(saved.id);
+    return json({ paymentIntent: toStripePaymentIntentSummary(existing) }, 201);
+  }
+  state.stripePaymentIntentCounter += 1;
+  const id = `pi_sim_${state.stripePaymentIntentCounter}`;
+  const created = Math.floor(Date.now() / 1e3);
+  const referenceId = body.referenceId;
+  const metadata = appMetadata(body.metadata);
+  const intent = {
+    id,
+    projectId,
+    account,
+    connectedAccountId: resolveAccount(account),
+    playground: isPlayground(account),
+    status: method === "card" ? "requires_payment_method" : "requires_action",
+    amount: body.amount,
+    currency,
+    method,
+    referenceId,
+    appMetadata: metadata,
+    metadata: { ...metadata, projectId, stardeckReferenceId: referenceId },
+    description: typeof body.description === "string" ? body.description : null,
+    receiptEmail: typeof body.receiptEmail === "string" ? body.receiptEmail : null,
+    returnUrl: typeof body.returnUrl === "string" ? body.returnUrl : null,
+    clientSecret: `${id}_secret_sim`,
+    qr: method === "promptpay" ? promptPayQr(id, created) : null,
+    latestChargeId: null,
+    amountRefunded: 0,
+    lastPaymentError: null,
+    created
+  };
+  state.stripePaymentIntents.set(id, intent);
+  state.stripeIdempotentIntents.set(scopedKey, { fingerprint, id });
+  console.log(
+    `[stardeck-testing] stripe payment intent ${id} created method=${method} amount=${intent.amount} ${currency}`
+  );
+  return json({ paymentIntent: toStripePaymentIntentSummary(intent) }, 201);
+}
+function ownedIntent(id, projectId) {
+  const intent = state.stripePaymentIntents.get(id);
+  return intent && intent.projectId === projectId ? intent : void 0;
+}
+function cancelIntent(intent) {
+  if (intent.status === "succeeded") {
+    return err("This payment already succeeded and can't be canceled", 409, "already_succeeded");
+  }
+  intent.status = "canceled";
+  return json({ paymentIntent: toStripePaymentIntentSummary(intent) });
+}
+function handleIntents(request, url, account, intentId, action, projectId) {
+  if (!intentId && request.method === "POST") {
+    return readJsonBody(request).then((body) => createIntent(body, account, projectId));
+  }
+  if (!intentId && request.method === "GET") {
+    const referenceId = url.searchParams.get("referenceId");
+    if (!referenceId) return err("referenceId is required", 400, "invalid_request");
+    const paymentIntents = [...state.stripePaymentIntents.values()].filter((i) => i.projectId === projectId && i.referenceId === referenceId).map(toStripePaymentIntentSummary);
+    return json({ paymentIntents });
+  }
+  if (!intentId) return null;
+  const intent = ownedIntent(decode(intentId), projectId);
+  if (!action && request.method === "GET") {
+    if (!intent) return err("Payment intent not found", 404, "not_found");
+    return json({ paymentIntent: toStripePaymentIntentSummary(intent) });
+  }
+  if (action === "cancel" && request.method === "POST") {
+    return readJsonBody(request).then((body) => {
+      if (typeof body.deploymentId !== "string" || !UUID_RE2.test(body.deploymentId)) {
+        return err("deploymentId is required", 400, "invalid_request");
+      }
+      if (!intent) return err("Payment intent not found", 404, "not_found");
+      return cancelIntent(intent);
+    });
+  }
+  return null;
+}
+async function handleStripePaymentIntentRequest(request, url, projectId) {
+  const match = url.pathname.match(PATH_RE);
+  if (!match) return null;
+  if (!projectId) return err("Missing authentication", 401, "unauthorized");
+  const account = decode(match[1]);
+  const resource = match[2];
+  if (request.method === "GET" && !url.searchParams.get("deploymentId")) {
+    return err("deploymentId is required", 400, "invalid_request");
+  }
+  if (resource === "elements-config" && request.method === "GET") {
+    return json({
+      publishableKey: SIM_STRIPE_PUBLISHABLE_KEY,
+      stripeAccount: resolveAccount(account),
+      playground: isPlayground(account)
+    });
+  }
+  if (resource === "readiness" && request.method === "GET") {
+    const methods = [...state.stripeAllowedMethods];
+    return json({
+      provider: "stripe",
+      ready: state.stripeChargesEnabled && methods.length > 0,
+      chargesEnabled: state.stripeChargesEnabled,
+      methods,
+      playground: isPlayground(account)
+    });
+  }
+  if (resource.startsWith("payment-intents")) {
+    return handleIntents(request, url, account, match[3], match[4], projectId);
+  }
+  return null;
+}
+
 // src/simulator/webhook-signing.ts
 var import_node_crypto4 = __toESM(require("crypto"));
 
@@ -1555,7 +1835,7 @@ var BEAM_BOLT_PAYMENT_METHODS = [
   "SPAY_LATER"
 ];
 var BEAM_BOLT_INTENT_STATUSES = ["PENDING", "PAID", "FAILED", "CANCELED", "EXPIRED"];
-var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function payErr(error, status = 400, code, details) {
   const body = { error };
   if (code) body.code = code;
@@ -1581,7 +1861,23 @@ function paymentOperationForRequest(request, pathname) {
   if (request.method === "GET" && /^\/api\/store\/(?!beam\/)[^/]+\/checkout-sessions\/[^/]+$/.test(pathname)) {
     return "stripe.getCheckoutSessionStatus";
   }
-  return null;
+  return stripeInlineOperation(request.method, pathname);
+}
+var STRIPE_INLINE_OPERATIONS = [
+  ["POST", /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents$/, "stripe.createPaymentIntent"],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents$/, "stripe.findPaymentIntents"],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents\/[^/]+$/, "stripe.getPaymentIntent"],
+  [
+    "POST",
+    /^\/api\/store\/(?!beam\/)[^/]+\/payment-intents\/[^/]+\/cancel$/,
+    "stripe.cancelPaymentIntent"
+  ],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/elements-config$/, "stripe.getElementsConfig"],
+  ["GET", /^\/api\/store\/(?!beam\/)[^/]+\/readiness$/, "stripe.getReadiness"]
+];
+function stripeInlineOperation(method, pathname) {
+  const hit = STRIPE_INLINE_OPERATIONS.find(([m, re]) => m === method && re.test(pathname));
+  return hit ? hit[2] : null;
 }
 function consumePaymentFailure(request, pathname) {
   const operation = paymentOperationForRequest(request, pathname);
@@ -1611,11 +1907,11 @@ function isBoltPaymentMethod(value) {
 function isBoltIntentStatus(value) {
   return BEAM_BOLT_INTENT_STATUSES.includes(value);
 }
-function stableStringify(value) {
-  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+function stableStringify2(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify2).join(",")}]`;
   if (value && typeof value === "object") {
     const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify2(v)}`).join(",")}}`;
   }
   return JSON.stringify(value);
 }
@@ -1721,10 +2017,16 @@ function storedStatusesForFilter(statuses) {
   }
   return [...stored];
 }
-async function handlePaymentsRequest(request, url) {
+async function handlePaymentsRequest(request, url, signedProjectId = null) {
   const pathname = url.pathname;
   const injectedFailure = consumePaymentFailure(request, pathname);
   if (injectedFailure) return injectedFailure;
+  const inlineStripeResponse = await handleStripePaymentIntentRequest(
+    request,
+    url,
+    signedProjectId
+  );
+  if (inlineStripeResponse) return inlineStripeResponse;
   const directChargeResponse = await handleDirectChargeRequest(request, pathname);
   if (directChargeResponse) return directChargeResponse;
   if (/\/billing-portal$/.test(pathname)) {
@@ -1823,7 +2125,7 @@ async function handlePaymentsRequest(request, url) {
           code: "too_small"
         });
       }
-      if (typeof body.deploymentId !== "string" || !UUID_RE2.test(body.deploymentId)) {
+      if (typeof body.deploymentId !== "string" || !UUID_RE3.test(body.deploymentId)) {
         issues.push({
           path: ["deploymentId"],
           message: "Invalid uuid",
@@ -2007,7 +2309,7 @@ async function handlePaymentsRequest(request, url) {
       const comparable = { ...body };
       delete comparable.deploymentId;
       delete comparable.idempotencyKey;
-      const fingerprint = stableStringify(comparable);
+      const fingerprint = stableStringify2(comparable);
       if (scopedKey) {
         const saved = state.idempotentCheckouts.get(scopedKey);
         if (saved) {
@@ -2847,7 +3149,7 @@ function requiresDeploymentHmac(request, url) {
     return !isPresignedPut;
   }
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
-  const isEmail = url.pathname === "/api/email/send";
+  const isEmail2 = url.pathname === "/api/email/send";
   const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
   const storeMatch = url.pathname.match(/^\/api\/store\//);
   const messagingMatch = url.pathname.match(
@@ -2856,7 +3158,7 @@ function requiresDeploymentHmac(request, url) {
   const edgeMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/edge(\/.*)?$/);
   const isStarlens = url.pathname === "/api/starlens/extract";
   const scheduleWakeMatch = url.pathname.match(SCHEDULE_WAKE_PATH);
-  return !!(isStarlens || scheduleWakeMatch || dataStoreMatch || isEmail || identitiesMatch || storeMatch || messagingMatch || edgeMatch);
+  return !!(isStarlens || scheduleWakeMatch || dataStoreMatch || isEmail2 || identitiesMatch || storeMatch || messagingMatch || edgeMatch);
 }
 var SCHEDULE_WAKE_PATH = /^\/api\/deployments\/[^/]+\/schedules\/([^/]+)\/wake$/;
 function deploymentIdFromPath(url) {
@@ -2879,7 +3181,7 @@ async function handleSimulatedRequest(request, url) {
     return authMatch[1].endsWith("verify") ? handleAuthVerify(request) : handleAuthRefresh(request);
   }
   const dataStoreMatch = url.pathname.match(/^\/api\/data-stores\/[^/]+(\/.*)?$/);
-  const isEmail = url.pathname === "/api/email/send";
+  const isEmail2 = url.pathname === "/api/email/send";
   const identitiesMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/identities(\/.*)?$/);
   const storeMatch = url.pathname.match(/^\/api\/store\//);
   const messagingMatch = url.pathname.match(
@@ -2888,6 +3190,7 @@ async function handleSimulatedRequest(request, url) {
   const edgeMatch = url.pathname.match(/^\/api\/deployments\/[^/]+\/edge(\/.*)?$/);
   const isStorageHost = url.hostname === STORAGE_TEST_HOST;
   let signedDeploymentId = null;
+  let signedProjectId = null;
   if (requiresDeploymentHmac(request, url)) {
     const authHeader = request.headers.get("X-Stardeck-Auth");
     if (!authHeader) {
@@ -2900,6 +3203,7 @@ async function handleSimulatedRequest(request, url) {
       return failure("Invalid authentication", 401);
     }
     signedDeploymentId = authPayload.deploymentId;
+    signedProjectId = authPayload.projectId;
   }
   if (isStorageHost) {
     return handleStorageRequest(request, url);
@@ -2907,14 +3211,14 @@ async function handleSimulatedRequest(request, url) {
   if (url.hostname === SIM_BEAM_HOST) {
     return handleCardTokenRequest(request, url);
   }
-  if (isEmail && request.method === "POST") {
+  if (isEmail2 && request.method === "POST") {
     return handleEmailSend(request);
   }
   if (identitiesMatch) {
     return handleIdentitiesRequest(request, identitiesMatch[1] ?? "");
   }
   if (storeMatch) {
-    return handlePaymentsRequest(request, url);
+    return handlePaymentsRequest(request, url, signedProjectId);
   }
   if (messagingMatch) {
     const channel = messagingMatch[1];