@wopr-network/platform-core 0.1.0

package/src/billing/stripe/payment-methods.ts

@@ -0,0 +1,76 @@
+import type Stripe from "stripe";
+import type { ITenantCustomerRepository, TenantCustomerRepository } from "./tenant-store.js";
+
+export class PaymentMethodOwnershipError extends Error {
+  readonly code = "PAYMENT_METHOD_NOT_OWNED" as const;
+  constructor() {
+    super("Payment method does not belong to this tenant");
+    this.name = "PaymentMethodOwnershipError";
+  }
+}
+
+export interface DetachPaymentMethodOpts {
+  tenant: string;
+  paymentMethodId: string;
+}
+
+/**
+ * Detach a payment method from a Stripe customer.
+ *
+ * Validates the payment method belongs to the tenant's Stripe customer
+ * before detaching to prevent cross-tenant attacks.
+ */
+export async function detachPaymentMethod(
+  stripe: Stripe,
+  tenantRepo: TenantCustomerRepository,
+  opts: DetachPaymentMethodOpts,
+): Promise<void> {
+  const mapping = await tenantRepo.getByTenant(opts.tenant);
+  if (!mapping) {
+    throw new Error(`No Stripe customer found for tenant: ${opts.tenant}`);
+  }
+
+  // Retrieve the payment method to verify it belongs to this customer
+  const pm = await stripe.paymentMethods.retrieve(opts.paymentMethodId);
+  if (!pm.customer || pm.customer !== mapping.processor_customer_id) {
+    throw new PaymentMethodOwnershipError();
+  }
+
+  await stripe.paymentMethods.detach(opts.paymentMethodId);
+}
+
+/**
+ * Detach ALL payment methods from a tenant's Stripe customer.
+ *
+ * Used during ban cascade to prevent any future charges.
+ * Returns the number of payment methods detached.
+ * Returns 0 (does not throw) if tenant has no Stripe customer or no methods.
+ */
+export async function detachAllPaymentMethods(
+  stripe: Stripe,
+  tenantRepo: ITenantCustomerRepository,
+  tenantId: string,
+): Promise<number> {
+  const mapping = await tenantRepo.getByTenant(tenantId);
+  if (!mapping) return 0;
+
+  let detached = 0;
+  let startingAfter: string | undefined;
+
+  while (true) {
+    const methods = await stripe.customers.listPaymentMethods(mapping.processor_customer_id, {
+      limit: 100,
+      ...(startingAfter ? { starting_after: startingAfter } : {}),
+    });
+
+    for (const pm of methods.data) {
+      await stripe.paymentMethods.detach(pm.id);
+      detached++;
+    }
+
+    if (!methods.has_more) break;
+    startingAfter = methods.data[methods.data.length - 1].id;
+  }
+
+  return detached;
+}

package/src/billing/stripe/portal.test.ts

@@ -0,0 +1,63 @@
+import type Stripe from "stripe";
+import { describe, expect, it, vi } from "vitest";
+import { createPortalSession } from "./portal.js";
+import type { TenantCustomerRepository } from "./tenant-store.js";
+
+describe("createPortalSession", () => {
+  function mockStripe(portalResult: unknown = { url: "https://billing.stripe.com/session_xyz" }) {
+    return {
+      billingPortal: {
+        sessions: {
+          create: vi.fn().mockResolvedValue(portalResult),
+        },
+      },
+    } as unknown as Stripe;
+  }
+
+  function mockTenantStore(mapping: { processor_customer_id: string } | null = null) {
+    return {
+      getByTenant: vi.fn().mockReturnValue(mapping),
+    } as unknown as TenantCustomerRepository;
+  }
+
+  it("creates a portal session for an existing customer", async () => {
+    const stripe = mockStripe();
+    const store = mockTenantStore({ processor_customer_id: "cus_abc" });
+
+    const session = await createPortalSession(stripe, store, {
+      tenant: "t-1",
+      returnUrl: "https://example.com/billing",
+    });
+
+    expect(session.url).toBe("https://billing.stripe.com/session_xyz");
+    expect(stripe.billingPortal.sessions.create).toHaveBeenCalledWith({
+      customer: "cus_abc",
+      return_url: "https://example.com/billing",
+    });
+  });
+
+  it("throws when no Stripe customer mapping exists", async () => {
+    const stripe = mockStripe();
+    const store = mockTenantStore(null);
+
+    await expect(
+      createPortalSession(stripe, store, {
+        tenant: "unknown-tenant",
+        returnUrl: "https://example.com/billing",
+      }),
+    ).rejects.toThrow("No Stripe customer found for tenant: unknown-tenant");
+  });
+
+  it("propagates Stripe API errors", async () => {
+    const stripe = mockStripe();
+    (stripe.billingPortal.sessions.create as ReturnType<typeof vi.fn>).mockRejectedValue(new Error("Portal API error"));
+    const store = mockTenantStore({ processor_customer_id: "cus_abc" });
+
+    await expect(
+      createPortalSession(stripe, store, {
+        tenant: "t-1",
+        returnUrl: "https://example.com/billing",
+      }),
+    ).rejects.toThrow("Portal API error");
+  });
+});

package/src/billing/stripe/portal.ts

@@ -0,0 +1,25 @@
+import type Stripe from "stripe";
+import type { TenantCustomerRepository } from "./tenant-store.js";
+import type { PortalSessionOpts } from "./types.js";
+
+/**
+ * Create a Stripe Customer Portal session so the user can manage their billing.
+ *
+ * Users can update payment methods, view invoices, cancel subscriptions, etc.
+ * All via Stripe's hosted UI -- zero billing UI code in WOPR.
+ */
+export async function createPortalSession(
+  stripe: Stripe,
+  tenantRepo: TenantCustomerRepository,
+  opts: PortalSessionOpts,
+): Promise<Stripe.BillingPortal.Session> {
+  const mapping = await tenantRepo.getByTenant(opts.tenant);
+  if (!mapping) {
+    throw new Error(`No Stripe customer found for tenant: ${opts.tenant}`);
+  }
+
+  return stripe.billingPortal.sessions.create({
+    customer: mapping.processor_customer_id,
+    return_url: opts.returnUrl,
+  });
+}

package/src/billing/stripe/setup-intent.test.ts

@@ -0,0 +1,78 @@
+import type { PGlite } from "@electric-sql/pglite";
+import type Stripe from "stripe";
+import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import type { PlatformDb } from "../../db/index.js";
+import { beginTestTransaction, createTestDb, endTestTransaction, rollbackTestTransaction } from "../../test/db.js";
+import { createSetupIntent } from "./setup-intent.js";
+import { TenantCustomerRepository } from "./tenant-store.js";
+
+function mockStripe(overrides: { setupIntentCreate?: ReturnType<typeof vi.fn> } = {}) {
+  return {
+    setupIntents: {
+      create:
+        overrides.setupIntentCreate ??
+        vi.fn().mockResolvedValue({
+          id: "seti_test_123",
+          client_secret: "seti_test_123_secret_abc",
+        }),
+    },
+  } as unknown as Stripe;
+}
+
+describe("createSetupIntent", () => {
+  let pool: PGlite;
+  let db: PlatformDb;
+  let store: TenantCustomerRepository;
+
+  beforeAll(async () => {
+    ({ db, pool } = await createTestDb());
+    await beginTestTransaction(pool);
+  });
+
+  afterAll(async () => {
+    await endTestTransaction(pool);
+    await pool.close();
+  });
+
+  beforeEach(async () => {
+    await rollbackTestTransaction(pool);
+    store = new TenantCustomerRepository(db);
+  });
+
+  it("calls stripe.setupIntents.create with correct customer ID", async () => {
+    await store.upsert({ tenant: "t-1", processorCustomerId: "cus_abc123" });
+
+    const stripe = mockStripe();
+    const result = await createSetupIntent(stripe, store, { tenant: "t-1" });
+
+    expect(result.client_secret).toBe("seti_test_123_secret_abc");
+    expect(stripe.setupIntents.create).toHaveBeenCalledWith({
+      customer: "cus_abc123",
+      metadata: { wopr_tenant: "t-1" },
+    });
+  });
+
+  it("throws when tenant has no Stripe customer mapping", async () => {
+    const stripe = mockStripe();
+
+    await expect(createSetupIntent(stripe, store, { tenant: "t-unknown" })).rejects.toThrow(
+      "No Stripe customer found for tenant: t-unknown",
+    );
+  });
+
+  it("omits payment_method_types to allow dynamic payment methods", async () => {
+    await store.upsert({ tenant: "t-2", processorCustomerId: "cus_def456" });
+
+    const setupIntentCreate = vi.fn().mockResolvedValue({
+      id: "seti_test_456",
+      client_secret: "seti_test_456_secret_xyz",
+    });
+    const stripe = mockStripe({ setupIntentCreate });
+
+    await createSetupIntent(stripe, store, { tenant: "t-2" });
+
+    const callArgs = setupIntentCreate.mock.calls[0][0];
+    expect(callArgs.payment_method_types).toBeUndefined();
+    expect(callArgs.metadata).toEqual({ wopr_tenant: "t-2" });
+  });
+});

package/src/billing/stripe/setup-intent.ts

@@ -0,0 +1,34 @@
+import type Stripe from "stripe";
+import type { TenantCustomerRepository } from "./tenant-store.js";
+
+export interface SetupIntentOpts {
+  tenant: string;
+}
+
+/**
+ * Create a Stripe SetupIntent so the user can save a payment method.
+ *
+ * Requires an existing Stripe customer (created during credit checkout).
+ * Returns the client_secret for use with Stripe Elements on the frontend.
+ *
+ * Note: payment_method_types is omitted to allow dynamic payment methods
+ * configured in the Stripe Dashboard. This enables the best payment options
+ * for each user's location and preferences.
+ */
+export async function createSetupIntent(
+  stripe: Stripe,
+  tenantRepo: TenantCustomerRepository,
+  opts: SetupIntentOpts,
+): Promise<Stripe.SetupIntent> {
+  const mapping = await tenantRepo.getByTenant(opts.tenant);
+  if (!mapping) {
+    throw new Error(`No Stripe customer found for tenant: ${opts.tenant}`);
+  }
+
+  return stripe.setupIntents.create({
+    customer: mapping.processor_customer_id,
+    metadata: {
+      wopr_tenant: opts.tenant,
+    },
+  });
+}