@tribe-nest/forge 2.2.0 → 3.4.0

package/src/utils/_tests/ticketOrderOutcome.spec.ts

@@ -0,0 +1,126 @@
+import { describe, it, expect } from "vitest";
+import {
+  getTicketOrderOutcome,
+  isTicketOrderRefunded,
+  TICKET_ORDER_REFUNDED_COPY,
+} from "../ticketOrderOutcome";
+import { OrderStatus } from "../../types/models";
+
+/**
+ * The whole point of this module: `event_ticket_orders.status = cancelled`
+ * means two different things and the buyer must not be told the wrong one.
+ *
+ * The fixtures below mirror exactly what the backend writes:
+ *  - abandoned → the sweeper only ever touches `initiated_payment` rows, so the
+ *    refund columns are still at their defaults (0 / "none");
+ *  - refund-voided → `adjustPillarRefundTracking` runs BEFORE the void, and the
+ *    void is gated on a FULL refund, so the row is (>0 / "full") by then.
+ */
+const abandoned = {
+  status: OrderStatus.Cancelled,
+  refundedAmountCents: 0,
+  refundState: "none",
+};
+
+const refundVoided = {
+  status: OrderStatus.Cancelled,
+  // bigint over JSON — a string, which is the shape the API really sends.
+  refundedAmountCents: "2500",
+  refundState: "full",
+};
+
+describe("getTicketOrderOutcome", () => {
+  it("treats every fulfillment state of a successful order as paid", () => {
+    for (const status of [
+      OrderStatus.Paid,
+      OrderStatus.Processing,
+      OrderStatus.LabelPurchased,
+      OrderStatus.Shipped,
+      OrderStatus.Delivered,
+      OrderStatus.Processed,
+    ]) {
+      expect(getTicketOrderOutcome({ status })).toBe("paid");
+    }
+  });
+
+  it("calls a refund-voided cancelled order refunded, not not-completed", () => {
+    expect(getTicketOrderOutcome(refundVoided)).toBe("refunded");
+  });
+
+  it("still calls a swept, never-paid cancelled order not_completed", () => {
+    // Regression guard: this path is unchanged and MUST stay — the abandoned
+    // copy is correct for a buyer who never paid.
+    expect(getTicketOrderOutcome(abandoned)).toBe("not_completed");
+  });
+
+  it("treats a cancelled order with no refund fields at all as not_completed", () => {
+    // Rows written before the refund columns existed, and any caller that
+    // trims the payload: absence of evidence is not evidence of a refund.
+    expect(getTicketOrderOutcome({ status: OrderStatus.Cancelled })).toBe("not_completed");
+    expect(
+      getTicketOrderOutcome({ status: OrderStatus.Cancelled, refundedAmountCents: null, refundState: null }),
+    ).toBe("not_completed");
+  });
+
+  it("keeps a failed payment not_completed even though it is not cancelled", () => {
+    expect(getTicketOrderOutcome({ status: OrderStatus.PaymentFailed })).toBe("not_completed");
+    expect(getTicketOrderOutcome({ status: OrderStatus.InitiatedPayment })).toBe("not_completed");
+    expect(getTicketOrderOutcome({ status: OrderStatus.Failed })).toBe("not_completed");
+  });
+
+  it("leaves a PARTIALLY refunded, still-valid order as paid", () => {
+    // A partial refund voids nothing (786a20bc's rule) — the pass still admits
+    // entry, and this screen is about whether it does. Showing "refunded" here
+    // would be the mirror-image lie.
+    expect(
+      getTicketOrderOutcome({ status: OrderStatus.Paid, refundedAmountCents: "500", refundState: "partial" }),
+    ).toBe("paid");
+  });
+
+  it("tolerates a garbage refunded amount rather than inventing a refund", () => {
+    expect(
+      getTicketOrderOutcome({ status: OrderStatus.Cancelled, refundedAmountCents: "not-a-number" }),
+    ).toBe("not_completed");
+  });
+
+  it("falls back to refund_state when the amount is missing", () => {
+    // The two are written together, so this should not happen — but if it does,
+    // the state is still evidence money moved.
+    expect(getTicketOrderOutcome({ status: OrderStatus.Cancelled, refundState: "full" })).toBe("refunded");
+  });
+});
+
+describe("isTicketOrderRefunded", () => {
+  it("is false for an abandoned order and true for a refunded one", () => {
+    expect(isTicketOrderRefunded(abandoned)).toBe(false);
+    expect(isTicketOrderRefunded(refundVoided)).toBe(true);
+  });
+
+  it("does not treat a zero-cent refund row as a refund", () => {
+    expect(isTicketOrderRefunded({ status: OrderStatus.Cancelled, refundedAmountCents: "0", refundState: "none" })).toBe(
+      false,
+    );
+  });
+});
+
+describe("TICKET_ORDER_REFUNDED_COPY", () => {
+  it("never tells a refunded buyer their order was not completed", () => {
+    const all = Object.values(TICKET_ORDER_REFUNDED_COPY).join(" ").toLowerCase();
+    expect(all).not.toContain("not completed");
+    expect(all).not.toContain("contact support");
+    expect(all).not.toContain("if you were charged");
+  });
+
+  it("promises no settlement deadline we do not control", () => {
+    const body = TICKET_ORDER_REFUNDED_COPY.body.toLowerCase();
+    // No "5-10 business days" style claim: settlement is the provider's and the
+    // buyer's bank's, not ours.
+    expect(body).not.toMatch(/\d+\s*(-|–|to)?\s*\d*\s*(business\s+)?days?/);
+    expect(body).not.toContain("working days");
+    expect(body).toContain("bank or card issuer");
+  });
+
+  it("says the tickets no longer admit entry", () => {
+    expect(TICKET_ORDER_REFUNDED_COPY.body.toLowerCase()).toContain("will not admit entry");
+  });
+});

package/src/utils/safeRedirect.ts

@@ -0,0 +1,41 @@
+/**
+ * Sanitize a `?redirect=` target before navigating to it (C13).
+ *
+ * The login and signup templates assigned the raw query parameter to
+ * `window.location.href`. Two bugs in one line:
+ *
+ *   - **Reflected XSS.** A `javascript:` target executes on the artist's REAL
+ *     domain, after a genuine successful login — so it steals a live member
+ *     token from a page the visitor has every reason to trust.
+ *   - **Open redirect.** An absolute URL sends a just-authenticated fan
+ *     off-site with the artist's domain as the referrer.
+ *
+ * The rule is deliberately strict: a same-origin ROOT-RELATIVE path, nothing
+ * else. Not "block javascript:" — a scheme denylist loses to tab/newline
+ * smuggling, `data:`, `vbscript:`, and whatever the next parser quirk turns out
+ * to be. Anything that fails falls back to `fallback`, so a mangled link still
+ * lands the user somewhere sensible instead of erroring.
+ *
+ * Rejected: absolute URLs, scheme-relative (`//evil.example`), the backslash
+ * variant (`/\\evil.example`, which browsers normalize to `//`), control
+ * characters used to smuggle a scheme past a naive check, and anything not
+ * starting with `/`.
+ */
+export const safeRedirectPath = (value: unknown, fallback = "/i/account"): string => {
+  if (typeof value !== "string") return fallback;
+
+  // Strip characters browsers ignore when parsing a URL scheme: a tab or
+  // newline inside "java<TAB>script:" is dropped before the scheme is read.
+  const cleaned = value.replace(/[\u0000-\u0020]/g, "").trim();
+  if (!cleaned) return fallback;
+
+  // Must be root-relative. This single check rejects `javascript:`, `data:`,
+  // `https://evil` and a bare `evil.example` in one go.
+  if (!cleaned.startsWith("/")) return fallback;
+
+  // `//host` and `/\host` are protocol-relative — off-site despite the leading
+  // slash.
+  if (cleaned.startsWith("//") || cleaned.startsWith("/\\")) return fallback;
+
+  return cleaned;
+};

package/src/utils/ticketOrderOutcome.ts

@@ -0,0 +1,125 @@
+import { OrderStatus } from "../types/models";
+
+/**
+ * What a buyer looking at their ticket confirmation should be told.
+ *
+ * ── Why this exists ──────────────────────────────────────────────────────────
+ * `event_ticket_orders.status = cancelled` means TWO different things, and the
+ * schema carries no discriminator column for them:
+ *
+ *   1. **Abandoned** — the buyer opened checkout, never paid, and
+ *      `SWEEP_ABANDONED_TICKET_ORDERS_JOB` retired the row. No money ever moved.
+ *   2. **Refund-voided** — the buyer DID pay, was refunded in full, and the
+ *      refund voided the order so the released seat cannot also scan at the
+ *      door (see `releaseInventoryForSource` / `voidTicketOrder`).
+ *
+ * Both surfaces used to render case 1's copy for both: "Order not completed —
+ * if you were charged, contact support." Told to someone who was charged and
+ * refunded, that is simply false.
+ *
+ * ── The signal, and why it is trustworthy ────────────────────────────────────
+ * `refunded_amount_cents` (> 0 once any money has gone back) and `refund_state`
+ * ("none" | "partial" | "full"). Both live on `event_ticket_orders` and both
+ * reach the buyer already: the public finalize endpoint answers with
+ * `EventTicketOrder.getOrderById`, which is `selectAll("eto")` — the whole row.
+ * No serializer change was needed to read them.
+ *
+ * They separate the two cases cleanly because of where each is written:
+ *
+ *   • The sweeper matches ONLY `status = initiated_payment` — an order that was
+ *     never paid — and touches no refund column. An abandoned order therefore
+ *     always carries `refunded_amount_cents = 0` / `refund_state = 'none'`
+ *     (the column defaults), and it is the only other writer of `cancelled` on
+ *     this table.
+ *   • Every path that voids a paid ticket order runs through the refund
+ *     service, which writes `adjustPillarRefundTracking` BEFORE it voids
+ *     (`recordRefund`: pillar sync, then `releaseInventoryForSource`). Both void
+ *     triggers — the seat release and an explicit `revokeAccess` — are gated on
+ *     `isFullyRefunded`, which requires `capturedAmountCents > 0`, so the state
+ *     written is always `"full"`, never `"partial"`.
+ *
+ * So the order of writes guarantees that a refund-voided order is never
+ * observed with zero refunded, and the sweeper guarantees an abandoned order is
+ * never observed with more than zero.
+ *
+ * `refunded_amount_cents > 0` is the primary test rather than
+ * `refund_state === "full"`: it is the value money is actually counted in, and
+ * it stays honest if a future partial-refund flow ever voids an order.
+ */
+export type TicketOrderOutcome =
+  /** Paid (or free) and still valid — the ticket admits entry. */
+  | "paid"
+  /** Was paid, money has gone back, the ticket no longer admits entry. */
+  | "refunded"
+  /** Never paid — abandoned checkout or a failed payment. */
+  | "not_completed";
+
+/** The only fields of a ticket order this decision reads. */
+export interface TicketOrderOutcomeInput {
+  status: OrderStatus | string;
+  /** Bigint column — arrives over JSON as a string. */
+  refundedAmountCents?: number | string | null;
+  refundState?: string | null;
+}
+
+/**
+ * A paid (or free) order advances through fulfillment — processing → shipped /
+ * delivered / processed. All of these mean the order succeeded, so the ticket
+ * confirmation treats them as "paid"; only failed/pending-payment states are
+ * "not completed". (A free order can be `delivered` by the time this loads.)
+ */
+const PAID_STATES = new Set<string>([
+  OrderStatus.Paid,
+  OrderStatus.Processing,
+  OrderStatus.LabelPurchased,
+  OrderStatus.Shipped,
+  OrderStatus.Delivered,
+  OrderStatus.Processed,
+]);
+
+/** Has any money gone back on this order? */
+export function isTicketOrderRefunded(order: TicketOrderOutcomeInput): boolean {
+  const cents = Number(order.refundedAmountCents ?? 0);
+  if (Number.isFinite(cents) && cents > 0) return true;
+  // Belt and braces: a `refund_state` of full/partial without a positive amount
+  // should not happen (they are written together), but if it ever does, the
+  // state is still evidence that money moved — and saying "refunded" to someone
+  // who was refunded is the failure we can afford.
+  return order.refundState === "full" || order.refundState === "partial";
+}
+
+/**
+ * Which of the three things happened to this ticket order.
+ *
+ * A still-valid order that carries a PARTIAL refund stays `"paid"` — the pass
+ * still admits entry, which is what this screen is about. Only an order that no
+ * longer admits entry AND has money back is `"refunded"`.
+ */
+export function getTicketOrderOutcome(order: TicketOrderOutcomeInput): TicketOrderOutcome {
+  if (PAID_STATES.has(order.status)) return "paid";
+  if (isTicketOrderRefunded(order)) return "refunded";
+  return "not_completed";
+}
+
+/**
+ * The refunded copy, shared verbatim by both rendering surfaces (the Forge
+ * `EventConfirmation` block and the client app's `/events/:id/finalise` page)
+ * so the two can never drift.
+ *
+ * Deliberately says nothing about how many days the money takes: settlement is
+ * the payment provider's and the buyer's bank's, not ours, and a number we
+ * cannot honour is the same kind of lie as "contact support" was.
+ *
+ * Equally deliberately does NOT invite the buyer to contact support: nothing
+ * went wrong here. The refund is the intended outcome.
+ */
+export const TICKET_ORDER_REFUNDED_COPY = {
+  /** Small uppercase label above the heading. */
+  eyebrow: "Refunded",
+  heading: "This order was refunded",
+  body:
+    "Your payment has been sent back to the original payment method — how long it takes to appear is up to your bank or card issuer. " +
+    "These tickets have been cancelled and will not admit entry.",
+  /** Replaces "Total paid" on the amount line. */
+  totalLabel: "Total refunded",
+} as const;