@vex-chat/spire 2.5.0 → 2.6.0

package/src/__tests__/billing.spec.ts

@@ -0,0 +1,282 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { SpireOptions } from "../Spire.ts";
+import type { AddressInfo } from "node:net";
+
+import express from "express";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { Database } from "../Database.ts";
+import {
+    devBillingGrantRoutesEnabled,
+    getBillingRouter,
+} from "../server/billing.ts";
+
+const options: SpireOptions = {
+    dbType: "sqlite3mem",
+};
+
+const userID = "4e67b90f-cbf8-44bc-8ce3-d3b248f033f1";
+const servers: Array<{ close: () => void }> = [];
+const originalEnv = { ...process.env };
+
+afterEach(() => {
+    for (const server of servers.splice(0)) {
+        server.close();
+    }
+    process.env = { ...originalEnv };
+});
+
+describe("Database store subscriptions", () => {
+    it("derives store entitlements from active subscriptions", async () => {
+        expect.assertions(4);
+        await withDb(async (db) => {
+            await db.upsertStoreSubscription({
+                environment: "sandbox",
+                expiresAt: new Date(Date.now() + 86_400_000).toISOString(),
+                externalOriginalID: "orig-1",
+                externalTransactionID: "tx-1",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                rawPayload: { transactionId: "tx-1" },
+                status: "active",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+                userID,
+            });
+
+            const entitlements = await db.recalculateStoreEntitlements(userID);
+            const state = await db.retrieveBillingAccountState(userID);
+
+            expect(entitlements.tier).toBe("plus");
+            expect(entitlements.source).toBe("store");
+            expect(state.subscriptions).toHaveLength(1);
+            expect(state.subscriptions[0]).toMatchObject({
+                platform: "apple_app_store",
+                status: "active",
+                tier: "plus",
+            });
+        });
+    });
+
+    it("downgrades expired store entitlements to free", async () => {
+        expect.assertions(2);
+        await withDb(async (db) => {
+            await db.setAccountEntitlementTier(userID, "pro", {
+                expiresAt: new Date(Date.now() - 1_000).toISOString(),
+                source: "store",
+            });
+            await db.upsertStoreSubscription({
+                environment: "sandbox",
+                expiresAt: new Date(Date.now() - 1_000).toISOString(),
+                externalOriginalID: "orig-2",
+                externalTransactionID: "tx-2",
+                platform: "apple_app_store",
+                productID: "apple_pro_monthly",
+                rawPayload: { transactionId: "tx-2" },
+                status: "expired",
+                storeProductID: "chat.vex.pro.monthly",
+                tier: "pro",
+                userID,
+            });
+
+            const entitlements = await db.recalculateStoreEntitlements(userID);
+
+            expect(entitlements.tier).toBe("free");
+            expect(entitlements.source).toBe("store");
+        });
+    });
+});
+
+describe("billing route guard", () => {
+    it("requires explicit non-production grant opt-in", () => {
+        expect(devBillingGrantRoutesEnabled({})).toBe(false);
+        expect(
+            devBillingGrantRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "production",
+                VEX_ENABLE_DEV_BILLING_GRANTS: "1",
+            }),
+        ).toBe(false);
+        expect(
+            devBillingGrantRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "development",
+                VEX_ENABLE_DEV_BILLING_GRANTS: "1",
+            }),
+        ).toBe(true);
+    });
+});
+
+describe("billing routes", () => {
+    it("returns configured billing products", async () => {
+        process.env["VEX_BILLING_PRODUCTS_JSON"] = JSON.stringify([
+            {
+                environment: "sandbox",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+            },
+        ]);
+        const { baseUrl } = mountBillingRouter({} as Database);
+
+        const res = await fetch(`${baseUrl}/billing/products?format=json`);
+        const body = (await res.json()) as unknown[];
+
+        expect(res.status).toBe(200);
+        expect(body).toEqual([
+            {
+                environment: "sandbox",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+            },
+        ]);
+    });
+
+    it("verifies a local Apple transaction payload and refreshes entitlements", async () => {
+        process.env["NODE_ENV"] = "development";
+        process.env["VEX_BILLING_ALLOW_LOCAL_STORE_PAYLOADS"] = "1";
+        process.env["VEX_BILLING_PRODUCTS_JSON"] = JSON.stringify([
+            {
+                environment: "sandbox",
+                platform: "apple_app_store",
+                productID: "apple_plus_monthly",
+                storeProductID: "chat.vex.plus.monthly",
+                tier: "plus",
+            },
+        ]);
+
+        await withDb(async (db) => {
+            const notify = vi.fn();
+            const { baseUrl } = mountBillingRouter(db, notify);
+            const res = await fetch(
+                `${baseUrl}/billing/apple/transactions?format=json`,
+                {
+                    body: JSON.stringify({
+                        environment: "sandbox",
+                        signedTransactionInfo: encodedPayload({
+                            environment: "Sandbox",
+                            expiresDate: Date.now() + 86_400_000,
+                            originalTransactionId: "orig-apple-1",
+                            productId: "chat.vex.plus.monthly",
+                            transactionId: "tx-apple-1",
+                        }),
+                    }),
+                    headers: { "Content-Type": "application/json" },
+                    method: "POST",
+                },
+            );
+            const body = (await res.json()) as {
+                entitlements?: { tier?: unknown };
+                subscriptions?: unknown[];
+            };
+
+            expect(res.status).toBe(200);
+            expect(body.entitlements?.tier).toBe("plus");
+            expect(body.subscriptions).toHaveLength(1);
+            expect(notify).toHaveBeenCalledWith(
+                userID,
+                "accountEntitlementsChanged",
+                expect.any(String),
+                { tier: "plus" },
+            );
+        });
+    });
+
+    it("allows explicit dev billing grants with the dev key", async () => {
+        process.env["NODE_ENV"] = "development";
+        process.env["DEV_API_KEY"] = "local-secret";
+        process.env["VEX_ENABLE_DEV_BILLING_GRANTS"] = "1";
+        await withDb(async (db) => {
+            const notify = vi.fn();
+            const { baseUrl } = mountBillingRouter(db, notify);
+
+            const res = await fetch(
+                `${baseUrl}/__dev/billing/grants?format=json`,
+                {
+                    body: JSON.stringify({ tier: "pro", userID }),
+                    headers: {
+                        "Content-Type": "application/json",
+                        "x-dev-api-key": "local-secret",
+                    },
+                    method: "POST",
+                },
+            );
+            const body = (await res.json()) as {
+                source?: unknown;
+                tier?: unknown;
+            };
+
+            expect(res.status).toBe(200);
+            expect(body).toMatchObject({ source: "store", tier: "pro" });
+            expect(notify).toHaveBeenCalledWith(
+                userID,
+                "accountEntitlementsChanged",
+                expect.any(String),
+                { tier: "pro" },
+            );
+        });
+    });
+});
+
+function encodedPayload(payload: unknown): string {
+    return Buffer.from(JSON.stringify(payload))
+        .toString("base64")
+        .replace(/=/g, "")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_");
+}
+
+function mountBillingRouter(
+    db: Database,
+    notify = vi.fn(),
+): { baseUrl: string } {
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+        (
+            req as express.Request & {
+                user?: { lastSeen: string; userID: string; username: string };
+            }
+        ).user = {
+            lastSeen: new Date().toISOString(),
+            userID,
+            username: "alice",
+        };
+        next();
+    });
+    app.use(getBillingRouter(db, notify));
+
+    const server = app.listen(0);
+    servers.push(server);
+    const { port } = server.address() as AddressInfo;
+    return { baseUrl: `http://127.0.0.1:${String(port)}` };
+}
+
+async function withDb<T>(fn: (db: Database) => Promise<T>): Promise<T> {
+    const provider = new Database(options);
+    return new Promise<T>((resolve, reject) => {
+        provider.once("ready", () => {
+            void (async () => {
+                try {
+                    const result = await fn(provider);
+                    await provider.close();
+                    resolve(result);
+                } catch (e: unknown) {
+                    await provider.close().catch(() => {
+                        // best-effort cleanup; ignore close failures here
+                    });
+                    reject(e instanceof Error ? e : new Error(String(e)));
+                }
+            })();
+        });
+    });
+}

package/src/__tests__/entitlements.spec.ts

@@ -0,0 +1,241 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+
+import type { SpireOptions } from "../Spire.ts";
+import type { AddressInfo } from "node:net";
+
+import express from "express";
+
+import { buildAccountEntitlements } from "@vex-chat/types";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { Database } from "../Database.ts";
+import {
+    devEntitlementRoutesEnabled,
+    getEntitlementRouter,
+} from "../server/entitlements.ts";
+
+const options: SpireOptions = {
+    dbType: "sqlite3mem",
+};
+
+const userID = "4e67b90f-cbf8-44bc-8ce3-d3b248f033f1";
+const servers: Array<{ close: () => void }> = [];
+const originalEnv = { ...process.env };
+
+afterEach(() => {
+    for (const server of servers.splice(0)) {
+        server.close();
+    }
+    process.env = { ...originalEnv };
+});
+
+async function withDb<T>(fn: (db: Database) => Promise<T>): Promise<T> {
+    const provider = new Database(options);
+    return new Promise<T>((resolve, reject) => {
+        provider.once("ready", () => {
+            void (async () => {
+                try {
+                    const result = await fn(provider);
+                    await provider.close();
+                    resolve(result);
+                } catch (e: unknown) {
+                    await provider.close().catch(() => {
+                        // best-effort cleanup; ignore close failures here
+                    });
+                    reject(e instanceof Error ? e : new Error(String(e)));
+                }
+            })();
+        });
+    });
+}
+
+describe("Database account entitlements", () => {
+    it("returns a computed free snapshot when the user has no row", async () => {
+        expect.assertions(7);
+        await withDb(async (db) => {
+            const entitlements = await db.retrieveAccountEntitlements(userID);
+
+            expect(entitlements.userID).toBe(userID);
+            expect(entitlements.tier).toBe("free");
+            expect(entitlements.source).toBe("default");
+            expect(entitlements.expiresAt).toBeNull();
+            expect(
+                entitlements.capabilities["attachments.encrypted_uploads"],
+            ).toBe(true);
+            expect(entitlements.capabilities["calls.relay_priority"]).toBe(
+                false,
+            );
+            expect(entitlements.limits["devices.max_trusted_devices"]).toBe(2);
+        });
+    });
+
+    it("persists a dev override tier and derives its capabilities", async () => {
+        expect.assertions(5);
+        await withDb(async (db) => {
+            const updated = await db.setAccountEntitlementTier(userID, "pro", {
+                source: "dev_override",
+            });
+            const retrieved = await db.retrieveAccountEntitlements(userID);
+
+            expect(updated.tier).toBe("pro");
+            expect(retrieved.tier).toBe("pro");
+            expect(retrieved.source).toBe("dev_override");
+            expect(retrieved.capabilities["calls.relay_priority"]).toBe(true);
+            expect(retrieved.limits["attachments.max_encrypted_bytes"]).toBe(
+                500 * 1024 * 1024,
+            );
+        });
+    });
+});
+
+describe("dev entitlement route guard", () => {
+    it("is disabled by default and in production", () => {
+        expect(devEntitlementRoutesEnabled({})).toBe(false);
+        expect(
+            devEntitlementRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "production",
+                VEX_ENABLE_DEV_ENTITLEMENTS: "1",
+            }),
+        ).toBe(false);
+    });
+
+    it("requires an explicit flag and dev API key", () => {
+        expect(
+            devEntitlementRoutesEnabled({
+                DEV_API_KEY: "local",
+                NODE_ENV: "development",
+                VEX_ENABLE_DEV_ENTITLEMENTS: "1",
+            }),
+        ).toBe(true);
+        expect(
+            devEntitlementRoutesEnabled({
+                NODE_ENV: "development",
+                VEX_ENABLE_DEV_ENTITLEMENTS: "1",
+            }),
+        ).toBe(false);
+    });
+});
+
+describe("entitlement routes", () => {
+    it("returns the authenticated user's entitlement snapshot", async () => {
+        const retrieveAccountEntitlements = vi.fn((id: string) =>
+            Promise.resolve(
+                buildAccountEntitlements({ tier: "plus", userID: id }),
+            ),
+        );
+        const db = {
+            retrieveAccountEntitlements,
+        } as unknown as Database;
+        const { baseUrl } = mountEntitlementRouter(db);
+
+        const res = await fetch(
+            `${baseUrl}/user/${userID}/entitlements?format=json`,
+        );
+        const body = (await res.json()) as { tier?: unknown; userID?: unknown };
+
+        expect(res.status).toBe(200);
+        expect(body).toMatchObject({ tier: "plus", userID });
+        expect(retrieveAccountEntitlements).toHaveBeenCalledWith(userID);
+    });
+
+    it("does not mount the dev override route unless explicitly enabled", async () => {
+        const setAccountEntitlementTier = vi.fn();
+        const db = {
+            retrieveAccountEntitlements: vi.fn(),
+            setAccountEntitlementTier,
+        } as unknown as Database;
+        const { baseUrl } = mountEntitlementRouter(db);
+
+        const res = await fetch(
+            `${baseUrl}/__dev/user/${userID}/entitlements?format=json`,
+            {
+                body: JSON.stringify({ tier: "pro" }),
+                headers: { "Content-Type": "application/json" },
+                method: "PATCH",
+            },
+        );
+
+        expect(res.status).toBe(404);
+        expect(setAccountEntitlementTier).not.toHaveBeenCalled();
+    });
+
+    it("allows dev overrides only with the explicit flag and dev API key", async () => {
+        process.env["NODE_ENV"] = "development";
+        process.env["VEX_ENABLE_DEV_ENTITLEMENTS"] = "1";
+        process.env["DEV_API_KEY"] = "local-secret";
+
+        const setAccountEntitlementTier = vi.fn((id: string) =>
+            Promise.resolve(
+                buildAccountEntitlements({
+                    source: "dev_override",
+                    tier: "pro",
+                    userID: id,
+                }),
+            ),
+        );
+        const db = {
+            retrieveAccountEntitlements: vi.fn(),
+            setAccountEntitlementTier,
+        } as unknown as Database;
+        const notify = vi.fn();
+        const { baseUrl } = mountEntitlementRouter(db, notify);
+
+        const res = await fetch(
+            `${baseUrl}/__dev/user/${userID}/entitlements?format=json`,
+            {
+                body: JSON.stringify({ tier: "pro" }),
+                headers: {
+                    "Content-Type": "application/json",
+                    "x-dev-api-key": "local-secret",
+                },
+                method: "PATCH",
+            },
+        );
+        const body = (await res.json()) as { source?: unknown; tier?: unknown };
+
+        expect(res.status).toBe(200);
+        expect(body).toMatchObject({ source: "dev_override", tier: "pro" });
+        expect(setAccountEntitlementTier).toHaveBeenCalledWith(userID, "pro", {
+            expiresAt: null,
+            source: "dev_override",
+        });
+        expect(notify).toHaveBeenCalledWith(
+            userID,
+            "accountEntitlementsChanged",
+            expect.any(String),
+            { tier: "pro" },
+        );
+    });
+});
+
+function mountEntitlementRouter(
+    db: Database,
+    notify = vi.fn(),
+): { baseUrl: string } {
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+        (
+            req as express.Request & {
+                user?: { lastSeen: string; userID: string; username: string };
+            }
+        ).user = {
+            lastSeen: new Date().toISOString(),
+            userID,
+            username: "alice",
+        };
+        next();
+    });
+    app.use(getEntitlementRouter(db, notify));
+
+    const server = app.listen(0);
+    servers.push(server);
+    const { port } = server.address() as AddressInfo;
+    return { baseUrl: `http://127.0.0.1:${String(port)}` };
+}

package/src/__tests__/notifyFanout.spec.ts

@@ -8,8 +8,6 @@ import type { ClientManager } from "../ClientManager.ts";
 import type { Database, NotificationSubscription } from "../Database.ts";
 import type { BaseMsg } from "@vex-chat/types";
 
-import { generateKeyPairSync } from "node:crypto";
-
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { NotificationService } from "../NotificationService.ts";
@@ -537,140 +535,6 @@ describe("Spire notify fanout", () => {
         });
     });
 
-    it("sends Expo callWake pushes with opaque call data", async () => {
-        const callSubscription: NotificationSubscription = {
-            ...subscription,
-            events: ["callWake"],
-            subscriptionID: "sub-call",
-        };
-        const fetchMock = vi.fn().mockResolvedValueOnce({
-            json: () =>
-                Promise.resolve({
-                    data: [{ id: "receipt-a", status: "ok" }],
-                }),
-            ok: true,
-        });
-        vi.stubGlobal("fetch", fetchMock);
-
-        const { db } = createSpireHarness([], [callSubscription]);
-        const service = new NotificationService(db, [], () => {});
-
-        await service["notifyPush"]({
-            data: {
-                callID: "call-1",
-                expiresAt: "2026-06-05T12:01:00.000Z",
-                mailID: "mail-1",
-                mailNonce: "abcd",
-            },
-            deviceID: callSubscription.deviceID,
-            event: "callWake",
-            transmissionID: "00000000-0000-0000-0000-000000000017",
-            userID: callSubscription.userID,
-        });
-
-        const init = fetchMock.mock.calls[0]?.[1] as
-            | undefined
-            | { body?: unknown };
-        const messages = JSON.parse(String(init?.body)) as Array<{
-            body?: string;
-            data?: Record<string, unknown>;
-            title?: string;
-        }>;
-        expect(messages[0]?.title).toBe("Incoming Vex call");
-        expect(messages[0]?.body).toBe("Incoming voice call.");
-        expect(messages[0]?.data).toMatchObject({
-            callID: "call-1",
-            event: "callWake",
-            expiresAt: "2026-06-05T12:01:00.000Z",
-            mailID: "mail-1",
-            mailNonce: "abcd",
-            transmissionID: "00000000-0000-0000-0000-000000000017",
-        });
-        expect(messages[0]?.data).not.toHaveProperty("callerUserID");
-        expect(messages[0]?.data).not.toHaveProperty("sdp");
-    });
-
-    it("sends FCM call pushes as high-priority opaque data", async () => {
-        const { privateKey } = generateKeyPairSync("rsa", {
-            modulusLength: 2048,
-        });
-        const fcmSubscription: NotificationSubscription = {
-            ...subscription,
-            channel: "fcmCall",
-            events: ["callWake"],
-            platform: "android",
-            subscriptionID: "sub-fcm",
-            token: "fcm-token",
-        };
-        const fetchMock = vi
-            .fn()
-            .mockResolvedValueOnce({
-                json: () => Promise.resolve({ access_token: "access-token" }),
-                ok: true,
-            })
-            .mockResolvedValueOnce({
-                ok: true,
-            });
-        vi.stubGlobal("fetch", fetchMock);
-
-        process.env["SPIRE_FCM_CLIENT_EMAIL"] = "spire@example.invalid";
-        process.env["SPIRE_FCM_PRIVATE_KEY"] = privateKey.export({
-            format: "pem",
-            type: "pkcs8",
-        });
-        process.env["SPIRE_FCM_PROJECT_ID"] = "vex-test";
-        try {
-            const { db } = createSpireHarness([], [fcmSubscription]);
-            const service = new NotificationService(db, [], () => {});
-
-            await service["notifyPush"]({
-                data: {
-                    callID: "call-fcm",
-                    expiresAt: "2026-06-05T12:01:00.000Z",
-                    mailID: "mail-fcm",
-                    mailNonce: "beef",
-                },
-                deviceID: fcmSubscription.deviceID,
-                event: "callWake",
-                transmissionID: "00000000-0000-0000-0000-000000000018",
-                userID: fcmSubscription.userID,
-            });
-        } finally {
-            delete process.env["SPIRE_FCM_CLIENT_EMAIL"];
-            delete process.env["SPIRE_FCM_PRIVATE_KEY"];
-            delete process.env["SPIRE_FCM_PROJECT_ID"];
-        }
-
-        expect(fetchMock).toHaveBeenCalledTimes(2);
-        expect(fetchMock.mock.calls[0]?.[0]).toBe(
-            "https://oauth2.googleapis.com/token",
-        );
-        expect(fetchMock.mock.calls[1]?.[0]).toBe(
-            "https://fcm.googleapis.com/v1/projects/vex-test/messages:send",
-        );
-        const init = fetchMock.mock.calls[1]?.[1] as
-            | undefined
-            | { body?: unknown };
-        const body = JSON.parse(String(init?.body)) as {
-            message?: {
-                android?: { priority?: string; ttl?: string };
-                data?: Record<string, string>;
-                token?: string;
-            };
-        };
-        expect(body.message?.token).toBe("fcm-token");
-        expect(body.message?.android?.priority).toBe("HIGH");
-        expect(body.message?.data).toMatchObject({
-            callID: "call-fcm",
-            event: "callWake",
-            mailID: "mail-fcm",
-            mailNonce: "beef",
-            transmissionID: "00000000-0000-0000-0000-000000000018",
-        });
-        expect(body.message?.data).not.toHaveProperty("callerUserID");
-        expect(body.message?.data).not.toHaveProperty("sdp");
-    });
-
     it("requests the default sound for iOS visible Expo pushes only", async () => {
         const iosSubscription: NotificationSubscription = {
             ...subscription,