@taskforcehq/taskforce 0.3.304 → 0.3.305

package/dist/server/routes/billing.js

@@ -1,5 +1,5 @@
 import Stripe from 'stripe';
-import { parseJsonBody } from '../routes.js';
+import { parseJsonBody } from './primitives.js';
 import { resolveTaskforceCloudEnvironmentFromHostname } from '../../config/cloudEnvironment.js';
 import { buildMockStripeHostedCheckoutUrl, completeMockStripeCheckoutSession, createMockStripeClient, isMockStripeClient, isMockStripeEnabled, readMockStripeCheckoutSession, renderMockStripeCheckoutHtml } from '../mockStripe.js';
 const BILLING_CONFIG_KEY_PLAN = 'billing.config.v1';
@@ -795,11 +795,15 @@ function applySubscriptionSnapshot(core, input) {
         ? (currentPeriodEnd && currentPeriodEnd > nowIso ? 'active' : 'canceled')
         : null;
     const mappedCanonicalState = canceledState || mapStripeStatusToCanonicalState(stripeStatus);
+    const existingPlanVersionId = String(existingEntitlement?.plan_version_id || '').trim();
     const preserveExistingAccess = mappedCanonicalState === 'checkout_pending'
+        && Boolean(planVersionId)
+        && existingPlanVersionId === planVersionId
         && isCommercialStateAppAccessible(existingEntitlement?.entitlement_state);
     const canonicalState = preserveExistingAccess
         ? String(existingEntitlement?.entitlement_state || 'active').trim().toLowerCase()
         : mappedCanonicalState;
+    const billingConfirmedSource = source === 'stripe-webhook' || source === 'checkout-confirm';
     const effectiveUntil = stripeStatus === 'canceled'
         ? currentPeriodEnd
         : (currentPeriodEnd || null);
@@ -826,7 +830,7 @@ function applySubscriptionSnapshot(core, input) {
             });
         }
     }
-    else if (planVersionId) {
+    else if (planVersionId && billingConfirmedSource) {
         core.transitionCanonicalCommercialState({
             accountId: userId,
             planVersionId: planVersionId || existingEntitlement?.plan_version_id || core.getDefaultPlanVersionIdByMode('personal', { allowFallback: true }),
@@ -1326,18 +1330,11 @@ export function registerBillingRoutes(deps) {
             res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
             return;
         }
-        try {
-            const requestUrl = parseRequestUrl(req);
-            const interval = parseInterval(requestUrl.searchParams.get('interval'));
-            const options = await listStripePriceOptions(interval);
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ options }));
-        }
-        catch (error) {
-            const statusCode = resolveErrorStatusCode(error, 400);
-            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: String(error?.message || 'Unable to list Stripe prices'), code: error?.code }));
-        }
+        res.writeHead(410, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            error: 'Manual Stripe price selection has been removed. Refresh prices from Stripe metadata instead.',
+            code: 'BILLING_PRICE_MANUAL_MAPPING_REMOVED'
+        }));
     });
     addRoute('PUT', '/api/taskforce/admin/billing/price-mappings', async (req, res) => {
         if (!ensureCloudBilling(req, res))
@@ -1347,121 +1344,11 @@ export function registerBillingRoutes(deps) {
             res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
             return;
         }
-        const body = await parseJsonBody(req);
-        const planVersionId = String(body?.planVersionId || '').trim();
-        const interval = parseInterval(body?.interval);
-        const pricingType = parsePricingType(body?.pricingType) || 'stripe';
-        const stripePriceId = String(body?.stripePriceId || '').trim();
-        const setActive = body?.active === false ? false : true;
-        if (!planVersionId || !interval) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'planVersionId and interval are required.', code: 'BILLING_MAPPING_INPUT_REQUIRED' }));
-            return;
-        }
-        if (pricingType === 'stripe' && !stripePriceId) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'stripePriceId is required for Stripe pricing.', code: 'BILLING_MAPPING_STRIPE_PRICE_REQUIRED' }));
-            return;
-        }
-        const db = core.getDatabaseAdapter();
-        const tenantId = core.getTenantId();
-        const versionExists = db.prepare(`
-            SELECT plan_version_id
-            FROM plan_versions
-            WHERE tenant_id = ? AND plan_version_id = ?
-            LIMIT 1
-        `).get(tenantId, planVersionId);
-        if (!versionExists?.plan_version_id) {
-            res.writeHead(404, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Plan version not found.', code: 'PLAN_VERSION_NOT_FOUND' }));
-            return;
-        }
-        try {
-            const now = new Date().toISOString();
-            const targetStripePriceId = pricingType === 'free'
-                ? buildFreePricingSyntheticId(planVersionId, interval)
-                : stripePriceId;
-            let unitAmount = 0;
-            let currency = null;
-            if (pricingType === 'stripe') {
-                const stripe = getStripeClient();
-                const stripePrice = await stripe.prices.retrieve(stripePriceId);
-                const stripeInterval = parseInterval(stripePrice.recurring?.interval || '');
-                if (!stripePrice.active) {
-                    res.writeHead(422, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Stripe price is not active.', code: 'STRIPE_PRICE_INACTIVE' }));
-                    return;
-                }
-                if (!stripeInterval) {
-                    res.writeHead(422, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'Stripe price must be recurring month/year.', code: 'STRIPE_PRICE_INTERVAL_UNSUPPORTED' }));
-                    return;
-                }
-                if (stripeInterval !== interval) {
-                    res.writeHead(422, { 'Content-Type': 'application/json' });
-                    res.end(JSON.stringify({ error: `Stripe price interval (${stripeInterval}) does not match requested interval (${interval}).`, code: 'STRIPE_PRICE_INTERVAL_MISMATCH' }));
-                    return;
-                }
-                unitAmount = typeof stripePrice.unit_amount === 'number' ? stripePrice.unit_amount : null;
-                currency = stripePrice.currency || null;
-            }
-            const beforeRows = db.prepare(`
-                SELECT plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency
-                FROM billing_price_mappings
-                WHERE tenant_id = ? AND plan_version_id = ? AND billing_interval = ?
-                ORDER BY stripe_price_id ASC
-            `).all(tenantId, planVersionId, interval);
-            if (setActive) {
-                db.prepare(`
-                    UPDATE billing_price_mappings
-                    SET active = 0, updated_at = ?
-                    WHERE tenant_id = ?
-                      AND plan_version_id = ?
-                      AND billing_interval = ?
-                      AND stripe_price_id <> ?
-                      AND active = 1
-                `).run(now, tenantId, planVersionId, interval, targetStripePriceId);
-            }
-            db.prepare(`
-                INSERT INTO billing_price_mappings (
-                    tenant_id, plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
-                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-                ON CONFLICT (tenant_id, plan_version_id, billing_interval, stripe_price_id) DO UPDATE SET
-                    pricing_type = excluded.pricing_type,
-                    active = excluded.active,
-                    unit_amount = excluded.unit_amount,
-                    currency = excluded.currency,
-                    updated_at = excluded.updated_at
-            `).run(tenantId, planVersionId, interval, targetStripePriceId, pricingType, setActive ? 1 : 0, unitAmount, currency, now, now);
-            const mapping = db.prepare(`
-                SELECT plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency, created_at, updated_at
-                FROM billing_price_mappings
-                WHERE tenant_id = ? AND plan_version_id = ? AND billing_interval = ? AND stripe_price_id = ?
-                LIMIT 1
-            `).get(tenantId, planVersionId, interval, targetStripePriceId);
-            const afterRows = db.prepare(`
-                SELECT plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency
-                FROM billing_price_mappings
-                WHERE tenant_id = ? AND plan_version_id = ? AND billing_interval = ?
-                ORDER BY stripe_price_id ASC
-            `).all(tenantId, planVersionId, interval);
-            auditAdminAction(req, 'billing-price-mapping-upsert', {
-                planVersionId,
-                interval,
-                pricingType,
-                stripePriceId: pricingType === 'free' ? null : stripePriceId,
-                active: setActive,
-                before: beforeRows,
-                after: afterRows
-            });
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ mapping }));
-        }
-        catch (error) {
-            const statusCode = resolveErrorStatusCode(error, 400);
-            res.writeHead(statusCode, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: String(error?.message || 'Unable to upsert price mapping'), code: error?.code }));
-        }
+        res.writeHead(410, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            error: 'Manual billing price mappings have been removed. Import Stripe prices instead.',
+            code: 'BILLING_PRICE_MANUAL_MAPPING_REMOVED'
+        }));
     });
     addRoute('POST', '/api/taskforce/admin/billing/price-mappings/deactivate', async (req, res) => {
         if (!ensureCloudBilling(req, res))
@@ -1471,51 +1358,11 @@ export function registerBillingRoutes(deps) {
             res.end(JSON.stringify({ error: 'Forbidden: system admin role required.' }));
             return;
         }
-        const body = await parseJsonBody(req);
-        const planVersionId = String(body?.planVersionId || '').trim();
-        const interval = parseInterval(body?.interval);
-        const stripePriceId = String(body?.stripePriceId || '').trim();
-        if (!planVersionId || !interval) {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'planVersionId and interval are required.', code: 'BILLING_MAPPING_TARGET_REQUIRED' }));
-            return;
-        }
-        const db = core.getDatabaseAdapter();
-        const tenantId = core.getTenantId();
-        const now = new Date().toISOString();
-        const beforeRows = db.prepare(`
-            SELECT plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency
-            FROM billing_price_mappings
-            WHERE tenant_id = ? AND plan_version_id = ? AND billing_interval = ?
-            ORDER BY stripe_price_id ASC
-        `).all(tenantId, planVersionId, interval);
-        const result = stripePriceId
-            ? db.prepare(`
-                UPDATE billing_price_mappings
-                SET active = 0, updated_at = ?
-                WHERE tenant_id = ? AND plan_version_id = ? AND billing_interval = ? AND stripe_price_id = ?
-            `).run(now, tenantId, planVersionId, interval, stripePriceId)
-            : db.prepare(`
-                UPDATE billing_price_mappings
-                SET active = 0, updated_at = ?
-                WHERE tenant_id = ? AND plan_version_id = ? AND billing_interval = ?
-            `).run(now, tenantId, planVersionId, interval);
-        const afterRows = db.prepare(`
-            SELECT plan_version_id, billing_interval, stripe_price_id, pricing_type, active, unit_amount, currency
-            FROM billing_price_mappings
-            WHERE tenant_id = ? AND plan_version_id = ? AND billing_interval = ?
-            ORDER BY stripe_price_id ASC
-        `).all(tenantId, planVersionId, interval);
-        auditAdminAction(req, 'billing-price-mapping-deactivate', {
-            planVersionId,
-            interval,
-            stripePriceId: stripePriceId || null,
-            changedRows: Number(result?.changes || 0),
-            before: beforeRows,
-            after: afterRows
-        });
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ success: true, changedRows: Number(result?.changes || 0) }));
+        res.writeHead(410, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            error: 'Manual billing price mappings have been removed. Refresh Stripe prices instead.',
+            code: 'BILLING_PRICE_MANUAL_MAPPING_REMOVED'
+        }));
     });
     addRoute('GET', '/api/taskforce/admin/billing/webhook-failures', async (req, res) => {
         if (!ensureCloudBilling(req, res))
@@ -1769,8 +1616,8 @@ export function registerBillingRoutes(deps) {
             const stripe = getStripeClient();
             let currentSubscriptionId = String(currentBilling?.stripe_subscription_id || '').trim();
             const currentCustomerId = String(currentBilling?.stripe_customer_id || '').trim();
-            const currentPlanVersionId = String(currentEntitlement?.plan_version_id || '').trim();
-            const currentInterval = parseInterval(String(currentBilling?.billing_interval || '').trim());
+            let currentPlanVersionId = String(currentEntitlement?.plan_version_id || '').trim();
+            let currentInterval = parseInterval(String(currentBilling?.billing_interval || '').trim());
             const stripeAccountDiscovery = await discoverStripeAccountStateForUser(core, {
                 userId,
                 normalizedEmail: normalizedUserEmail,
@@ -1786,8 +1633,13 @@ export function registerBillingRoutes(deps) {
                 return;
             }
             let resolvedCustomerId = currentCustomerId || String(stripeAccountDiscovery.preferredCustomerId || '').trim();
-            if (!currentSubscriptionId && stripeAccountDiscovery.activeSubscriptions.length === 1) {
-                const activeSubscription = stripeAccountDiscovery.activeSubscriptions[0];
+            const activeSubscription = stripeAccountDiscovery.activeSubscriptions.length === 1
+                ? stripeAccountDiscovery.activeSubscriptions[0]
+                : null;
+            let discoveredPlanVersionId = null;
+            let discoveredInterval = null;
+            let discoveredStripePriceId = null;
+            if (!currentSubscriptionId && activeSubscription) {
                 currentSubscriptionId = String(activeSubscription.subscription?.id || '').trim();
                 resolvedCustomerId = String(activeSubscription.customerId || '').trim() || resolvedCustomerId;
                 if (currentSubscriptionId || resolvedCustomerId) {
@@ -1804,7 +1656,28 @@ export function registerBillingRoutes(deps) {
                     stripeCustomerId: resolvedCustomerId
                 });
             }
-            if (currentSubscriptionId && currentPlanVersionId === planVersionId && currentInterval === interval) {
+            if (activeSubscription) {
+                const activeSubscriptionPriceId = String(activeSubscription.subscription?.items?.data?.[0]?.price?.id || '').trim();
+                discoveredStripePriceId = activeSubscriptionPriceId || null;
+                const activePlanVersionId = resolvePlanVersionIdForBillingEvent(core, [
+                    activeSubscription.subscription?.metadata?.planVersionId,
+                    activeSubscription.subscription?.metadata?.plan_version_id
+                ], activeSubscriptionPriceId).planVersionId;
+                discoveredPlanVersionId = activePlanVersionId;
+                discoveredInterval = parseInterval(activeSubscription.subscription?.items?.data?.[0]?.price?.recurring?.interval || '');
+                if (!currentPlanVersionId && activePlanVersionId) {
+                    currentPlanVersionId = activePlanVersionId;
+                }
+                if (!currentInterval) {
+                    currentInterval = discoveredInterval;
+                }
+            }
+            const isCurrentRequestedPlan = (currentPlanVersionId === planVersionId && currentInterval === interval) || (Boolean(currentSubscriptionId)
+                && discoveredPlanVersionId === planVersionId
+                && discoveredInterval === interval) || (Boolean(currentSubscriptionId)
+                && discoveredStripePriceId === priceId
+                && discoveredInterval === interval);
+            if (currentSubscriptionId && isCurrentRequestedPlan) {
                 res.writeHead(200, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({
                     checkoutState: 'already_current_plan',
@@ -1816,6 +1689,17 @@ export function registerBillingRoutes(deps) {
             if (currentSubscriptionId) {
                 const current = await stripe.subscriptions.retrieve(currentSubscriptionId);
                 const itemId = current.items.data[0]?.id;
+                const currentStripePriceId = String(current.items.data[0]?.price?.id || '').trim();
+                const currentSubscriptionInterval = parseInterval(current.items.data[0]?.price?.recurring?.interval || '');
+                if (currentStripePriceId === priceId && currentSubscriptionInterval === interval) {
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({
+                        checkoutState: 'already_current_plan',
+                        planVersionId,
+                        message: 'You are already on this plan.'
+                    }));
+                    return;
+                }
                 if (!itemId) {
                     res.writeHead(400, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({ error: 'Subscription has no updatable line item.' }));
@@ -1840,7 +1724,7 @@ export function registerBillingRoutes(deps) {
                 res.end(JSON.stringify({
                     checkoutState: 'updated',
                     planVersionId,
-                    message: 'Your subscription was updated successfully.'
+                    message: 'Your subscription update was submitted. Changes will appear after Stripe confirms the update.'
                 }));
                 return;
             }
@@ -2010,20 +1894,52 @@ export function registerBillingRoutes(deps) {
                     return;
                 }
             }
+            if (!subscriptionId || !subscription) {
+                res.writeHead(409, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: 'Checkout session is still finalizing your subscription.',
+                    code: 'CHECKOUT_SESSION_INCOMPLETE'
+                }));
+                return;
+            }
             core.createUserBillingRecord(resolvedUserId);
             upsertBillingMirror(core, {
                 userId: resolvedUserId,
                 stripeCustomerId: customerId || null,
                 stripeSubscriptionId: subscriptionId || null
             });
-            if (subscription) {
-                resolvedPlanVersionId = applySubscriptionSnapshot(core, {
-                    userId: resolvedUserId,
-                    subscription,
-                    source: 'checkout-confirm'
-                }).planVersionId;
-                updateCheckoutAttemptStatus(core, sessionId, 'confirmed');
+            const snapshot = applySubscriptionSnapshot(core, {
+                userId: resolvedUserId,
+                subscription,
+                source: 'checkout-confirm'
+            });
+            resolvedPlanVersionId = snapshot.planVersionId;
+            if (!resolvedPlanVersionId) {
+                res.writeHead(409, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: 'Checkout completed, but the purchased plan could not be resolved yet.',
+                    code: 'CHECKOUT_PLAN_VERSION_UNRESOLVED'
+                }));
+                return;
+            }
+            const updatedEntitlement = getEntitlementRow(core, resolvedUserId);
+            const updatedPlanVersionId = String(updatedEntitlement?.plan_version_id || '').trim();
+            const updatedState = String(updatedEntitlement?.entitlement_state || '').trim().toLowerCase();
+            const canonicalSettled = snapshot.canonicalState !== 'checkout_pending'
+                && updatedPlanVersionId === resolvedPlanVersionId
+                && updatedState === snapshot.canonicalState;
+            if (!canonicalSettled) {
+                console.warn(`[Taskforce Billing] Checkout confirmation still settling for user=${resolvedUserId} session=${sessionId} subscription=${subscriptionId || '(missing)'} `
+                    + `planVersionId=${resolvedPlanVersionId} canonicalState=${snapshot.canonicalState} persistedPlanVersionId=${updatedPlanVersionId || '(missing)'} `
+                    + `persistedState=${updatedState || '(missing)'}`);
+                res.writeHead(409, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({
+                    error: 'Checkout session is still finalizing your plan.',
+                    code: 'CHECKOUT_SESSION_INCOMPLETE'
+                }));
+                return;
             }
+            updateCheckoutAttemptStatus(core, sessionId, 'confirmed');
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({
                 success: true,
@@ -2088,7 +2004,7 @@ export function registerBillingRoutes(deps) {
             const baseUrl = resolveBaseUrl(req);
             const session = await stripe.billingPortal.sessions.create({
                 customer: customerId,
-                return_url: `${baseUrl}/settings`
+                return_url: `${baseUrl}/?screen=plans`
             });
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ url: session.url, returnBaseUrl: baseUrl }));