@vex-chat/spire 2.4.0 → 2.6.0

package/src/__tests__/billing.spec.ts

@@ -0,0 +1,282 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { SpireOptions } from "../Spire.ts";
+import type { AddressInfo } from "node:net";
+
+import express from "express";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { Database } from "../Database.ts";
+import {
+    devBillingGrantRoutesEnabled,
+    getBillingRouter,
+} from "../server/billing.ts";
+
+const options: SpireOptions = {
+    dbType: "sqlite3mem",
+};
+
+const userID = "4e67b90f-cbf8-44bc-8ce3-d3b248f033f1";
+const servers: Array<{ close: () => void }> = [];
+const originalEnv = { ...process.env };
+
+afterEach(() => {
+    for (const server of servers.splice(0)) {
+        server.close();
+    }
+    process.env = { ...originalEnv };
+});
+
+describe("Database store subscriptions", () => {
+    it("derives store entitlements from active subscriptions", async () => {
+        expect.assertions(4);
+        await withDb(async (db) => {
+            await db.upsertStoreSubscription({
+                environment: "sandbox",
+                expiresAt: new Date(Date.now() + 86_400_000).toISOString(),
+                externalOriginalID: "orig-1",
+                externalTransactionID: "tx-1",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                rawPayload: { transactionId: "tx-1" },
+                status: "active",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+                userID,
+            });
+
+            const entitlements = await db.recalculateStoreEntitlements(userID);
+            const state = await db.retrieveBillingAccountState(userID);
+
+            expect(entitlements.tier).toBe("plus");
+            expect(entitlements.source).toBe("store");
+            expect(state.subscriptions).toHaveLength(1);
+            expect(state.subscriptions[0]).toMatchObject({
+                platform: "apple_app_store",
+                status: "active",
+                tier: "plus",
+            });
+        });
+    });
+
+    it("downgrades expired store entitlements to free", async () => {
+        expect.assertions(2);
+        await withDb(async (db) => {
+            await db.setAccountEntitlementTier(userID, "pro", {
+                expiresAt: new Date(Date.now() - 1_000).toISOString(),
+                source: "store",
+            });
+            await db.upsertStoreSubscription({
+                environment: "sandbox",
+                expiresAt: new Date(Date.now() - 1_000).toISOString(),
+                externalOriginalID: "orig-2",
+                externalTransactionID: "tx-2",
+                platform: "apple_app_store",
+                productID: "apple_pro_monthly",
+                rawPayload: { transactionId: "tx-2" },
+                status: "expired",
+                storeProductID: "chat.vex.pro.monthly",
+                tier: "pro",
+                userID,
+            });
+
+            const entitlements = await db.recalculateStoreEntitlements(userID);
+
+            expect(entitlements.tier).toBe("free");
+            expect(entitlements.source).toBe("store");
+        });
+    });
+});
+
+describe("billing route guard", () => {
+    it("requires explicit non-production grant opt-in", () => {
+        expect(devBillingGrantRoutesEnabled({})).toBe(false);
+        expect(
+            devBillingGrantRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "production",
+                VEX_ENABLE_DEV_BILLING_GRANTS: "1",
+            }),
+        ).toBe(false);
+        expect(
+            devBillingGrantRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "development",
+                VEX_ENABLE_DEV_BILLING_GRANTS: "1",
+            }),
+        ).toBe(true);
+    });
+});
+
+describe("billing routes", () => {
+    it("returns configured billing products", async () => {
+        process.env["VEX_BILLING_PRODUCTS_JSON"] = JSON.stringify([
+            {
+                environment: "sandbox",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+            },
+        ]);
+        const { baseUrl } = mountBillingRouter({} as Database);
+
+        const res = await fetch(`${baseUrl}/billing/products?format=json`);
+        const body = (await res.json()) as unknown[];
+
+        expect(res.status).toBe(200);
+        expect(body).toEqual([
+            {
+                environment: "sandbox",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+            },
+        ]);
+    });
+
+    it("verifies a local Apple transaction payload and refreshes entitlements", async () => {
+        process.env["NODE_ENV"] = "development";
+        process.env["VEX_BILLING_ALLOW_LOCAL_STORE_PAYLOADS"] = "1";
+        process.env["VEX_BILLING_PRODUCTS_JSON"] = JSON.stringify([
+            {
+                environment: "sandbox",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+            },
+        ]);
+
+        await withDb(async (db) => {
+            const notify = vi.fn();
+            const { baseUrl } = mountBillingRouter(db, notify);
+            const res = await fetch(
+                `${baseUrl}/billing/apple/transactions?format=json`,
+                {
+                    body: JSON.stringify({
+                        environment: "sandbox",
+                        signedTransactionInfo: encodedPayload({
+                            environment: "Sandbox",
+                            expiresDate: Date.now() + 86_400_000,
+                            originalTransactionId: "orig-apple-1",
+                            productId: "chat.vex.plus.monthly",
+                            transactionId: "tx-apple-1",
+                        }),
+                    }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            const body = (await res.json()) as {
+                entitlements?: { tier?: unknown };
+                subscriptions?: unknown[];
+            };
+
+            expect(res.status).toBe(200);
+            expect(body.entitlements?.tier).toBe("plus");
+            expect(body.subscriptions).toHaveLength(1);
+            expect(notify).toHaveBeenCalledWith(
+                userID,
+                "accountEntitlementsChanged",
+                expect.any(String),
+                { tier: "plus" },
+            );
+        });
+    });
+
+    it("allows explicit dev billing grants with the dev key", async () => {
+        process.env["NODE_ENV"] = "development";
+        process.env["DEV_API_KEY"] = "local-secret";
+        process.env["VEX_ENABLE_DEV_BILLING_GRANTS"] = "1";
+        await withDb(async (db) => {
+            const notify = vi.fn();
+            const { baseUrl } = mountBillingRouter(db, notify);
+
+            const res = await fetch(
+                `${baseUrl}/__dev/billing/grants?format=json`,
+                {
+                    body: JSON.stringify({ tier: "pro", userID }),
+                    headers: {
+                        "Content-Type": "application/json",
+                        "x-dev-api-key": "local-secret",
+                    },
+                    method: "POST",
+                },
+            );
+            const body = (await res.json()) as {
+                source?: unknown;
+                tier?: unknown;
+            };
+
+            expect(res.status).toBe(200);
+            expect(body).toMatchObject({ source: "store", tier: "pro" });
+            expect(notify).toHaveBeenCalledWith(
+                userID,
+                "accountEntitlementsChanged",
+                expect.any(String),
+                { tier: "pro" },
+            );
+        });
+    });
+});
+
+function encodedPayload(payload: unknown): string {
+    return Buffer.from(JSON.stringify(payload))
+        .toString("base64")
+        .replace(/=/g, "")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_");
+}
+
+function mountBillingRouter(
+    db: Database,
+    notify = vi.fn(),
+): { baseUrl: string } {
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+        (
+            req as express.Request & {
+                user?: { lastSeen: string; userID: string; username: string };
+            }
+        ).user = {
+            lastSeen: new Date().toISOString(),
+            userID,
+            username: "alice",
+        };
+        next();
+    });
+    app.use(getBillingRouter(db, notify));
+
+    const server = app.listen(0);
+    servers.push(server);
+    const { port } = server.address() as AddressInfo;
+    return { baseUrl: `http://127.0.0.1:${String(port)}` };
+}
+
+async function withDb<T>(fn: (db: Database) => Promise<T>): Promise<T> {
+    const provider = new Database(options);
+    return new Promise<T>((resolve, reject) => {
+        provider.once("ready", () => {
+            void (async () => {
+                try {
+                    const result = await fn(provider);
+                    await provider.close();
+                    resolve(result);
+                } catch (e: unknown) {
+                    await provider.close().catch(() => {
+                        // best-effort cleanup; ignore close failures here
+                    });
+                    reject(e instanceof Error ? e : new Error(String(e)));
+                }
+            })();
+        });
+    });
+}

package/src/__tests__/entitlements.spec.ts

@@ -0,0 +1,241 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { SpireOptions } from "../Spire.ts";
+import type { AddressInfo } from "node:net";
+
+import express from "express";
+
+import { buildAccountEntitlements } from "@vex-chat/types";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { Database } from "../Database.ts";
+import {
+    devEntitlementRoutesEnabled,
+    getEntitlementRouter,
+} from "../server/entitlements.ts";
+
+const options: SpireOptions = {
+    dbType: "sqlite3mem",
+};
+
+const userID = "4e67b90f-cbf8-44bc-8ce3-d3b248f033f1";
+const servers: Array<{ close: () => void }> = [];
+const originalEnv = { ...process.env };
+
+afterEach(() => {
+    for (const server of servers.splice(0)) {
+        server.close();
+    }
+    process.env = { ...originalEnv };
+});
+
+async function withDb<T>(fn: (db: Database) => Promise<T>): Promise<T> {
+    const provider = new Database(options);
+    return new Promise<T>((resolve, reject) => {
+        provider.once("ready", () => {
+            void (async () => {
+                try {
+                    const result = await fn(provider);
+                    await provider.close();
+                    resolve(result);
+                } catch (e: unknown) {
+                    await provider.close().catch(() => {
+                        // best-effort cleanup; ignore close failures here
+                    });
+                    reject(e instanceof Error ? e : new Error(String(e)));
+                }
+            })();
+        });
+    });
+}
+
+describe("Database account entitlements", () => {
+    it("returns a computed free snapshot when the user has no row", async () => {
+        expect.assertions(7);
+        await withDb(async (db) => {
+            const entitlements = await db.retrieveAccountEntitlements(userID);
+
+            expect(entitlements.userID).toBe(userID);
+            expect(entitlements.tier).toBe("free");
+            expect(entitlements.source).toBe("default");
+            expect(entitlements.expiresAt).toBeNull();
+            expect(
+                entitlements.capabilities["attachments.encrypted_uploads"],
+            ).toBe(true);
+            expect(entitlements.capabilities["calls.relay_priority"]).toBe(
+                false,
+            );
+            expect(entitlements.limits["devices.max_trusted_devices"]).toBe(2);
+        });
+    });
+
+    it("persists a dev override tier and derives its capabilities", async () => {
+        expect.assertions(5);
+        await withDb(async (db) => {
+            const updated = await db.setAccountEntitlementTier(userID, "pro", {
+                source: "dev_override",
+            });
+            const retrieved = await db.retrieveAccountEntitlements(userID);
+
+            expect(updated.tier).toBe("pro");
+            expect(retrieved.tier).toBe("pro");
+            expect(retrieved.source).toBe("dev_override");
+            expect(retrieved.capabilities["calls.relay_priority"]).toBe(true);
+            expect(retrieved.limits["attachments.max_encrypted_bytes"]).toBe(
+                500 * 1024 * 1024,
+            );
+        });
+    });
+});
+
+describe("dev entitlement route guard", () => {
+    it("is disabled by default and in production", () => {
+        expect(devEntitlementRoutesEnabled({})).toBe(false);
+        expect(
+            devEntitlementRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "production",
+                VEX_ENABLE_DEV_ENTITLEMENTS: "1",
+            }),
+        ).toBe(false);
+    });
+
+    it("requires an explicit flag and dev API key", () => {
+        expect(
+            devEntitlementRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "development",
+                VEX_ENABLE_DEV_ENTITLEMENTS: "1",
+            }),
+        ).toBe(true);
+        expect(
+            devEntitlementRoutesEnabled({
+                NODE_ENV: "development",
+                VEX_ENABLE_DEV_ENTITLEMENTS: "1",
+            }),
+        ).toBe(false);
+    });
+});
+
+describe("entitlement routes", () => {
+    it("returns the authenticated user's entitlement snapshot", async () => {
+        const retrieveAccountEntitlements = vi.fn((id: string) =>
+            Promise.resolve(
+                buildAccountEntitlements({ tier: "plus", userID: id }),
+            ),
+        );
+        const db = {
+            retrieveAccountEntitlements,
+        } as unknown as Database;
+        const { baseUrl } = mountEntitlementRouter(db);
+
+        const res = await fetch(
+            `${baseUrl}/user/${userID}/entitlements?format=json`,
+        );
+        const body = (await res.json()) as { tier?: unknown; userID?: unknown };
+
+        expect(res.status).toBe(200);
+        expect(body).toMatchObject({ tier: "plus", userID });
+        expect(retrieveAccountEntitlements).toHaveBeenCalledWith(userID);
+    });
+
+    it("does not mount the dev override route unless explicitly enabled", async () => {
+        const setAccountEntitlementTier = vi.fn();
+        const db = {
+            retrieveAccountEntitlements: vi.fn(),
+            setAccountEntitlementTier,
+        } as unknown as Database;
+        const { baseUrl } = mountEntitlementRouter(db);
+
+        const res = await fetch(
+            `${baseUrl}/__dev/user/${userID}/entitlements?format=json`,
+            {
+                body: JSON.stringify({ tier: "pro" }),
+                headers: { "Content-Type": "application/json" },
+                method: "PATCH",
+            },
+        );
+
+        expect(res.status).toBe(404);
+        expect(setAccountEntitlementTier).not.toHaveBeenCalled();
+    });
+
+    it("allows dev overrides only with the explicit flag and dev API key", async () => {
+        process.env["NODE_ENV"] = "development";
+        process.env["VEX_ENABLE_DEV_ENTITLEMENTS"] = "1";
+        process.env["DEV_API_KEY"] = "local-secret";
+
+        const setAccountEntitlementTier = vi.fn((id: string) =>
+            Promise.resolve(
+                buildAccountEntitlements({
+                    source: "dev_override",
+                    tier: "pro",
+                    userID: id,
+                }),
+            ),
+        );
+        const db = {
+            retrieveAccountEntitlements: vi.fn(),
+            setAccountEntitlementTier,
+        } as unknown as Database;
+        const notify = vi.fn();
+        const { baseUrl } = mountEntitlementRouter(db, notify);
+
+        const res = await fetch(
+            `${baseUrl}/__dev/user/${userID}/entitlements?format=json`,
+            {
+                body: JSON.stringify({ tier: "pro" }),
+                headers: {
+                    "Content-Type": "application/json",
+                    "x-dev-api-key": "local-secret",
+                },
+                method: "PATCH",
+            },
+        );
+        const body = (await res.json()) as { source?: unknown; tier?: unknown };
+
+        expect(res.status).toBe(200);
+        expect(body).toMatchObject({ source: "dev_override", tier: "pro" });
+        expect(setAccountEntitlementTier).toHaveBeenCalledWith(userID, "pro", {
+            expiresAt: null,
+            source: "dev_override",
+        });
+        expect(notify).toHaveBeenCalledWith(
+            userID,
+            "accountEntitlementsChanged",
+            expect.any(String),
+            { tier: "pro" },
+        );
+    });
+});
+
+function mountEntitlementRouter(
+    db: Database,
+    notify = vi.fn(),
+): { baseUrl: string } {
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+        (
+            req as express.Request & {
+                user?: { lastSeen: string; userID: string; username: string };
+            }
+        ).user = {
+            lastSeen: new Date().toISOString(),
+            userID,
+            username: "alice",
+        };
+        next();
+    });
+    app.use(getEntitlementRouter(db, notify));
+
+    const server = app.listen(0);
+    servers.push(server);
+    const { port } = server.address() as AddressInfo;
+    return { baseUrl: `http://127.0.0.1:${String(port)}` };
+}

package/src/db/schema.ts

@@ -8,6 +8,63 @@ import type { Insertable, Selectable, Updateable } from "kysely";
 
 // ── Table interfaces ────────────────────────────────────────────────────
 
+export type AccountEntitlementRow = Selectable<AccountEntitlementsTable>;
+
+export interface AccountEntitlementsTable {
+    expiresAt: null | string;
+    source: string;
+    tier: string;
+    updatedAt: string;
+    userID: string;
+}
+
+export type AccountEntitlementUpdate = Updateable<AccountEntitlementsTable>;
+
+export type BillingStoreSubscriptionRow =
+    Selectable<BillingStoreSubscriptionsTable>;
+
+export interface BillingStoreSubscriptionsTable {
+    createdAt: string;
+    environment: string;
+    expiresAt: null | string;
+    externalOriginalID: null | string;
+    externalTransactionID: null | string;
+    platform: string;
+    productID: string;
+    purchaseToken: null | string;
+    purchaseTokenHash: null | string;
+    rawPayload: string;
+    status: string;
+    storeProductID: string;
+    subscriptionID: string;
+    tier: string;
+    updatedAt: string;
+    userID: string;
+}
+
+export type BillingStoreSubscriptionUpdate =
+    Updateable<BillingStoreSubscriptionsTable>;
+
+export type BillingStoreTransactionRow =
+    Selectable<BillingStoreTransactionsTable>;
+
+export interface BillingStoreTransactionsTable {
+    environment: string;
+    eventType: string;
+    externalTransactionID: null | string;
+    platform: string;
+    processedAt: string;
+    purchaseTokenHash: null | string;
+    rawPayload: string;
+    storeProductID: string;
+    subscriptionID: string;
+    transactionID: string;
+    userID: string;
+}
+
+export type BillingStoreTransactionUpdate =
+    Updateable<BillingStoreTransactionsTable>;
+
 export type ChannelRow = Selectable<ChannelsTable>;
 
 export interface ChannelsTable {
@@ -92,8 +149,13 @@ export interface MailTable {
     time: string;
 }
 export type MailUpdate = Updateable<MailTable>;
-export type NewChannel = Insertable<ChannelsTable>;
+export type NewAccountEntitlement = Insertable<AccountEntitlementsTable>;
+export type NewBillingStoreSubscription =
+    Insertable<BillingStoreSubscriptionsTable>;
+export type NewBillingStoreTransaction =
+    Insertable<BillingStoreTransactionsTable>;
 
+export type NewChannel = Insertable<ChannelsTable>;
 export type NewDevice = Insertable<DevicesTable>;
 export type NewDevicePasskeyApproval = Insertable<DevicePasskeyApprovalsTable>;
 export type NewEmoji = Insertable<EmojisTable>;
@@ -177,6 +239,9 @@ export interface PreKeysTable {
 }
 export type PreKeyUpdate = Updateable<PreKeysTable>;
 export interface ServerDatabase {
+    account_entitlements: AccountEntitlementsTable;
+    billing_store_subscriptions: BillingStoreSubscriptionsTable;
+    billing_store_transactions: BillingStoreTransactionsTable;
     channels: ChannelsTable;
     device_passkey_approvals: DevicePasskeyApprovalsTable;
     devices: DevicesTable;

package/src/migrations/2026-06-24_account-entitlements.ts

@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { Kysely } from "kysely";
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+    await db.schema.dropTable("account_entitlements").ifExists().execute();
+}
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+        .createTable("account_entitlements")
+        .ifNotExists()
+        .addColumn("userID", "varchar(255)", (cb) => cb.primaryKey())
+        .addColumn("tier", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("source", "varchar(32)", (cb) => cb.notNull())
+        .addColumn("expiresAt", "text")
+        .addColumn("updatedAt", "text", (cb) => cb.notNull())
+        .execute();
+}