backend-manager 5.0.102 → 5.0.104

package/src/manager/routes/payments/portal/processors/test.js

@@ -0,0 +1,18 @@
+/**
+ * Test portal processor
+ * Returns a fake portal URL — no external API calls.
+ * Only available in non-production environments.
+ */
+module.exports = {
+  async createPortalSession({ uid, returnUrl, assistant }) {
+    if (assistant.isProduction()) {
+      throw new Error('Test processor is not available in production');
+    }
+
+    const url = returnUrl || 'https://example.com/account';
+
+    assistant.log(`Test portal session: uid=${uid}, url=${url}`);
+
+    return { url };
+  },
+};

package/src/manager/routes/user/delete.js

@@ -79,7 +79,8 @@ module.exports = async ({ assistant, Manager, user, settings, libraries }) => {
   assistant.log(`Account deleted: ${uid}${reason ? `, reason: ${reason}` : ''}`);
 
   // Send confirmation email (fire-and-forget)
-  if (email) {
+  const shouldSend = !assistant.isTesting() || process.env.TEST_EXTENDED_MODE;
+  if (email && shouldSend) {
     sendConfirmationEmail(assistant, email, reason);
   }
 

package/src/manager/schemas/payments/cancel/post.js

@@ -0,0 +1,18 @@
+/**
+ * Schema: POST /payments/cancel
+ * Validates subscription cancellation parameters
+ */
+module.exports = () => ({
+  reason: {
+    types: ['string'],
+    default: null,
+  },
+  feedback: {
+    types: ['string'],
+    default: null,
+  },
+  confirmed: {
+    types: ['boolean'],
+    required: true,
+  },
+});

package/src/manager/schemas/payments/portal/post.js

@@ -0,0 +1,10 @@
+/**
+ * Schema: POST /payments/portal
+ * Validates billing portal session parameters
+ */
+module.exports = () => ({
+  returnUrl: {
+    types: ['string'],
+    default: null,
+  },
+});

package/src/test/runner.js

@@ -1,5 +1,6 @@
 const os = require('os');
 const path = require('path');
+const Module = require('module');
 const jetpack = require('fs-jetpack');
 const chalk = require('chalk');
 
@@ -369,7 +370,23 @@ class TestRunner {
     let testModule;
 
     try {
-      testModule = require(testFile);
+      const searchPaths = [
+        path.join(this.options.projectDir, 'functions'),
+        path.resolve(__dirname, '../../'),
+      ];
+      const origResolve = Module._resolveFilename.bind(Module);
+      Module._resolveFilename = function (request, parent, isMain, options) {
+        if (!request.startsWith('.') && !path.isAbsolute(request)) {
+          const extra = (options && options.paths) ? options.paths : [];
+          options = { ...options, paths: [...extra, ...searchPaths] };
+        }
+        return origResolve(request, parent, isMain, options);
+      };
+      try {
+        testModule = require(testFile);
+      } finally {
+        Module._resolveFilename = origResolve;
+      }
     } catch (error) {
       console.log(chalk.red(`    ✗ ${relativePath}`));
       console.log(chalk.red(`      Failed to load: ${error.message}`));

package/src/test/test-accounts.js

@@ -193,6 +193,98 @@ const JOURNEY_ACCOUNTS = {
       subscription: { product: { id: 'basic' }, status: 'active' },
     },
   },
+  'journey-payments-intent': {
+    id: 'journey-payments-intent',
+    uid: '_test-journey-payments-intent',
+    email: '_test.journey-payments-intent@{domain}',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'basic' }, status: 'active' },
+    },
+  },
+  'journey-payments-cancel-route': {
+    id: 'journey-payments-cancel-route',
+    uid: '_test-journey-payments-cancel-route',
+    email: '_test.journey-payments-cancel-route@{domain}',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'basic' }, status: 'active' },
+    },
+  },
+  'route-cancel-success': {
+    id: 'route-cancel-success',
+    uid: '_test-route-cancel-success',
+    email: '_test.route-cancel-success@{domain}',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'basic' }, status: 'active' },
+    },
+  },
+  'journey-payments-portal-route': {
+    id: 'journey-payments-portal-route',
+    uid: '_test-journey-payments-portal-route',
+    email: '_test.journey-payments-portal-route@{domain}',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'basic' }, status: 'active' },
+    },
+  },
+  'journey-payments-intent-trial': {
+    id: 'journey-payments-intent-trial',
+    uid: '_test-journey-payments-intent-trial',
+    email: '_test.journey-payments-intent-trial@{domain}',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'basic' }, status: 'active' },
+    },
+  },
+  // Dedicated accounts for cancel validation tests — each needs a distinct, non-conflicting subscription state
+  'cancel-no-processor': {
+    id: 'cancel-no-processor',
+    uid: '_test-cancel-no-processor',
+    email: '_test.cancel-no-processor@{domain}',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'premium', name: 'Premium' }, status: 'active', expires: getFutureExpires(), cancellation: { pending: false }, payment: { processor: null, resourceId: null } },
+    },
+  },
+  'cancel-already-pending': {
+    id: 'cancel-already-pending',
+    uid: '_test-cancel-already-pending',
+    email: '_test.cancel-already-pending@{domain}',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'premium', name: 'Premium' }, status: 'active', expires: getFutureExpires(), cancellation: { pending: true }, payment: { processor: 'stripe', resourceId: 'sub_test_fake' } },
+    },
+  },
+  'cancel-unknown-processor': {
+    id: 'cancel-unknown-processor',
+    uid: '_test-cancel-unknown-processor',
+    email: '_test.cancel-unknown-processor@{domain}',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'premium', name: 'Premium' }, status: 'active', expires: getFutureExpires(), cancellation: { pending: false }, payment: { processor: 'unknown-processor', resourceId: 'sub_test_fake' } },
+    },
+  },
+  // Dedicated accounts for portal validation tests
+  'portal-no-processor': {
+    id: 'portal-no-processor',
+    uid: '_test-portal-no-processor',
+    email: '_test.portal-no-processor@{domain}',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'premium', name: 'Premium' }, status: 'active', expires: getFutureExpires(), payment: { processor: null, resourceId: null } },
+    },
+  },
+  'portal-unknown-processor': {
+    id: 'portal-unknown-processor',
+    uid: '_test-portal-unknown-processor',
+    email: '_test.portal-unknown-processor@{domain}',
+    properties: {
+      roles: {},
+      subscription: { product: { id: 'premium', name: 'Premium' }, status: 'active', expires: getFutureExpires(), payment: { processor: 'unknown-processor', resourceId: 'sub_test_fake' } },
+    },
+  },
 };
 
 /**

package/templates/firestore.rules

@@ -58,6 +58,7 @@ service cloud.firestore {
       return isWritingField('auth')
         || isWritingField('roles')
         || isWritingField('flags')
+        || isWritingField('plan') // REMOVE THIS WHEN ALL PROJECTS UPDATED
         || isWritingField('subscription')
         || isWritingField('affiliate')
         || isWritingField('api')

package/test/events/payments/journey-payments-cancel-endpoint.js

@@ -0,0 +1,79 @@
+/**
+ * Test: Payment Journey - Cancel via endpoint
+ * Simulates: paid active → POST /payments/cancel → cancellation pending
+ *
+ * The test processor's cancelAtPeriodEnd writes a Stripe-shaped webhook doc directly
+ * to payments-webhooks/{eventId}, triggering the full on-write pipeline automatically.
+ * Product-agnostic: resolves the first paid product from config.payment.products
+ */
+module.exports = {
+  description: 'Payment journey: cancel endpoint → cancellation pending',
+  type: 'suite',
+  timeout: 30000,
+
+  tests: [
+    {
+      name: 'setup-paid-subscription',
+      async run({ accounts, firestore, assert, state, config, http, waitFor }) {
+        const uid = accounts['journey-payments-cancel-route'].uid;
+        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
+        assert.ok(paidProduct, 'Config should have at least one paid product');
+
+        state.uid = uid;
+        state.paidProductId = paidProduct.id;
+
+        // Create subscription via test intent — auto-fires webhook pipeline
+        const response = await http.as('journey-payments-cancel-route').post('payments/intent', {
+          processor: 'test',
+          productId: paidProduct.id,
+          frequency: 'monthly',
+        });
+        assert.isSuccess(response, 'Intent should succeed');
+        state.orderId = response.data.orderId;
+
+        // Wait for subscription to activate
+        await waitFor(async () => {
+          const userDoc = await firestore.get(`users/${uid}`);
+          return userDoc?.subscription?.product?.id === paidProduct.id;
+        }, 15000, 500);
+
+        const userDoc = await firestore.get(`users/${uid}`);
+        assert.equal(userDoc.subscription?.product?.id, paidProduct.id, `Should be ${paidProduct.id}`);
+        assert.equal(userDoc.subscription?.status, 'active', 'Should be active');
+        assert.equal(userDoc.subscription?.cancellation?.pending, false, 'Should not be pending cancellation');
+      },
+    },
+
+    {
+      name: 'call-cancel-endpoint',
+      async run({ http, assert }) {
+        // Test processor writes a payments-webhooks doc directly,
+        // triggering the on-write pipeline automatically — no manual webhook needed
+        const response = await http.as('journey-payments-cancel-route').post('payments/cancel', {
+          confirmed: true,
+          reason: 'Too expensive',
+          feedback: 'Would return at a lower price',
+        });
+
+        assert.isSuccess(response, 'Cancel endpoint should succeed');
+        assert.equal(response.data.success, true, 'Should return { success: true }');
+      },
+    },
+
+    {
+      name: 'verify-cancellation-pending',
+      async run({ firestore, assert, state, waitFor }) {
+        // Poll user doc until the on-write pipeline updates subscription state
+        await waitFor(async () => {
+          const userDoc = await firestore.get(`users/${state.uid}`);
+          return userDoc?.subscription?.cancellation?.pending === true;
+        }, 15000, 500);
+
+        const userDoc = await firestore.get(`users/${state.uid}`);
+        assert.equal(userDoc.subscription.status, 'active', 'Status should still be active');
+        assert.equal(userDoc.subscription.cancellation.pending, true, 'Cancellation should be pending');
+        assert.ok(userDoc.subscription.cancellation.date.timestampUNIX > 0, 'Cancellation date should be set');
+      },
+    },
+  ],
+};

package/test/helpers/stripe-to-unified-one-time.js

@@ -0,0 +1,304 @@
+/**
+ * Test: Stripe toUnifiedOneTime()
+ * Unit tests for the Stripe library's raw resource → unified one-time payment transformation
+ *
+ * Tests the pure function directly — no emulator, no Firestore, no HTTP
+ */
+const Stripe = require('../../src/manager/libraries/payment-processors/stripe.js');
+
+// Real Stripe CLI fixtures (generated via `stripe trigger`)
+const FIXTURE_SESSION = require('../fixtures/stripe/checkout-session-completed.json');
+const FIXTURE_INVOICE_FAILED = require('../fixtures/stripe/invoice-payment-failed.json');
+
+// Mock config matching the BEM template
+const MOCK_CONFIG = {
+  payment: {
+    products: [
+      { id: 'basic', name: 'Basic', type: 'subscription', limits: { requests: 100 } },
+      {
+        id: 'credits-100', name: '100 Credits', type: 'one-time',
+        prices: { once: { amount: 9.99, stripe: 'price_credits_100' } },
+      },
+      {
+        id: 'credits-500', name: '500 Credits', type: 'one-time',
+        prices: { once: { amount: 39.99, stripe: 'price_credits_500' } },
+      },
+    ],
+  },
+};
+
+function toUnifiedOneTime(rawResource, options) {
+  return Stripe.toUnifiedOneTime(rawResource, { config: MOCK_CONFIG, ...options });
+}
+
+module.exports = {
+  description: 'Stripe toUnifiedOneTime() transformation',
+  type: 'group',
+
+  tests: [
+    // ─── Status passthrough ───
+
+    {
+      name: 'status-complete',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({ status: 'complete' });
+        assert.equal(result.status, 'complete', 'Status passes through as-is');
+      },
+    },
+
+    {
+      name: 'status-open',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({ status: 'open' });
+        assert.equal(result.status, 'open', 'Status passes through as-is');
+      },
+    },
+
+    {
+      name: 'status-unknown-when-missing',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({});
+        assert.equal(result.status, 'unknown', 'Missing status → unknown');
+      },
+    },
+
+    // ─── Product resolution ───
+
+    {
+      name: 'product-resolves-from-metadata-product-id',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({ metadata: { productId: 'credits-100' } });
+        assert.equal(result.product.id, 'credits-100', 'Should resolve from metadata.productId');
+        assert.equal(result.product.name, '100 Credits', 'Should have correct name');
+      },
+    },
+
+    {
+      name: 'product-resolves-second-product',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({ metadata: { productId: 'credits-500' } });
+        assert.equal(result.product.id, 'credits-500', 'Should resolve credits-500');
+        assert.equal(result.product.name, '500 Credits', 'Should have correct name');
+      },
+    },
+
+    {
+      name: 'product-falls-back-to-unknown-on-missing-metadata',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({});
+        assert.equal(result.product.id, 'unknown', 'No metadata → unknown');
+        assert.equal(result.product.name, 'Unknown', 'No metadata → Unknown name');
+      },
+    },
+
+    {
+      name: 'product-falls-back-to-product-id-on-unknown-product',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({ metadata: { productId: 'nonexistent-product' } });
+        assert.equal(result.product.id, 'nonexistent-product', 'Unknown product → uses ID as-is');
+      },
+    },
+
+    {
+      name: 'product-without-config',
+      async run({ assert }) {
+        const result = Stripe.toUnifiedOneTime({ metadata: { productId: 'credits-100' } }, {});
+        assert.equal(result.product.id, 'credits-100', 'Without config → uses metadata ID');
+        // resolveProductOneTime returns { name: 'Unknown' } when config has no products array
+        assert.equal(result.product.name, 'Unknown', 'Without config → Unknown name');
+      },
+    },
+
+    // ─── Payment metadata ───
+
+    {
+      name: 'payment-processor-always-stripe',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({});
+        assert.equal(result.payment.processor, 'stripe', 'Processor should always be stripe');
+      },
+    },
+
+    {
+      name: 'payment-resource-id-from-session-id',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({ id: 'cs_test_abc123' });
+        assert.equal(result.payment.resourceId, 'cs_test_abc123', 'resourceId should be session/invoice ID');
+      },
+    },
+
+    {
+      name: 'payment-resource-id-null-when-missing',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({});
+        assert.equal(result.payment.resourceId, null, 'Missing ID → null resourceId');
+      },
+    },
+
+    {
+      name: 'payment-order-id-from-metadata',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({ metadata: { orderId: '1234-5678-9012' } });
+        assert.equal(result.payment.orderId, '1234-5678-9012', 'orderId should come from metadata');
+      },
+    },
+
+    {
+      name: 'payment-order-id-null-when-missing',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({});
+        assert.equal(result.payment.orderId, null, 'Missing metadata → null orderId');
+      },
+    },
+
+    {
+      name: 'payment-price-resolves-from-config',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({ metadata: { productId: 'credits-100' } });
+        assert.equal(result.payment.price, 9.99, 'Should resolve price from config');
+      },
+    },
+
+    {
+      name: 'payment-price-zero-on-unknown-product',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({ metadata: { productId: 'nonexistent' } });
+        assert.equal(result.payment.price, 0, 'Unknown product → price 0');
+      },
+    },
+
+    {
+      name: 'payment-price-zero-when-no-metadata',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({});
+        assert.equal(result.payment.price, 0, 'No metadata → price 0');
+      },
+    },
+
+    {
+      name: 'payment-event-metadata-passed-through',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({}, { eventName: 'checkout.session.completed', eventId: 'evt_123' });
+        assert.equal(result.payment.updatedBy.event.name, 'checkout.session.completed', 'Event name passed through');
+        assert.equal(result.payment.updatedBy.event.id, 'evt_123', 'Event ID passed through');
+      },
+    },
+
+    {
+      name: 'payment-event-metadata-null-when-missing',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({});
+        assert.equal(result.payment.updatedBy.event.name, null, 'Missing event name → null');
+        assert.equal(result.payment.updatedBy.event.id, null, 'Missing event ID → null');
+      },
+    },
+
+    // ─── Full unified shape ───
+
+    {
+      name: 'full-session-shape',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({
+          id: 'cs_test_full',
+          status: 'complete',
+          metadata: { orderId: '1234-5678-9012', productId: 'credits-100' },
+        }, { eventName: 'checkout.session.completed', eventId: 'evt_full' });
+
+        assert.ok(result.product, 'Should have product');
+        assert.ok(result.status, 'Should have status');
+        assert.ok(result.payment, 'Should have payment');
+
+        assert.equal(result.product.id, 'credits-100', 'Product should be credits-100');
+        assert.equal(result.status, 'complete', 'Status should be complete');
+        assert.equal(result.payment.processor, 'stripe', 'Processor should be stripe');
+        assert.equal(result.payment.resourceId, 'cs_test_full', 'Resource ID should match');
+        assert.equal(result.payment.orderId, '1234-5678-9012', 'orderId should match');
+        assert.equal(result.payment.price, 9.99, 'Price should be resolved');
+        assert.equal(result.payment.updatedBy.event.name, 'checkout.session.completed', 'Event name should match');
+      },
+    },
+
+    {
+      name: 'empty-input-gets-safe-defaults',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({});
+
+        assert.equal(result.product.id, 'unknown', 'Empty → unknown product');
+        assert.equal(result.status, 'unknown', 'Empty → unknown status');
+        assert.equal(result.payment.processor, 'stripe', 'Empty → still stripe');
+        assert.equal(result.payment.orderId, null, 'Empty → null orderId');
+        assert.equal(result.payment.resourceId, null, 'Empty → null resourceId');
+        assert.equal(result.payment.price, 0, 'Empty → price 0');
+      },
+    },
+
+    {
+      name: 'no-expires-or-trial-on-one-time',
+      async run({ assert }) {
+        const result = toUnifiedOneTime({ id: 'cs_test_shape' });
+        // One-time payments do not have subscription-specific fields
+        assert.equal(result.expires, undefined, 'No expires on one-time');
+        assert.equal(result.trial, undefined, 'No trial on one-time');
+        assert.equal(result.cancellation, undefined, 'No cancellation on one-time');
+      },
+    },
+
+    // ─── Real Stripe fixtures ───
+
+    {
+      name: 'fixture-session-completed-shape',
+      async run({ assert }) {
+        const result = toUnifiedOneTime(FIXTURE_SESSION);
+
+        assert.ok(result.product, 'Should have product');
+        assert.equal(result.status, 'complete', 'Real session fixture → complete');
+        assert.equal(result.payment.processor, 'stripe', 'Processor is stripe');
+        assert.equal(result.payment.resourceId, FIXTURE_SESSION.id, 'resourceId matches fixture ID');
+      },
+    },
+
+    {
+      name: 'fixture-session-completed-no-subscription-fields',
+      async run({ assert }) {
+        const result = toUnifiedOneTime(FIXTURE_SESSION);
+        assert.equal(result.expires, undefined, 'Session fixture has no expires');
+        assert.equal(result.trial, undefined, 'Session fixture has no trial');
+        assert.equal(result.cancellation, undefined, 'Session fixture has no cancellation');
+      },
+    },
+
+    {
+      name: 'fixture-invoice-failed-shape',
+      async run({ assert }) {
+        const result = toUnifiedOneTime(FIXTURE_INVOICE_FAILED);
+
+        assert.ok(result.product, 'Should have product');
+        assert.equal(result.status, 'open', 'Failed invoice fixture → open');
+        assert.equal(result.payment.processor, 'stripe', 'Processor is stripe');
+        assert.equal(result.payment.resourceId, FIXTURE_INVOICE_FAILED.id, 'resourceId matches fixture ID');
+      },
+    },
+
+    {
+      name: 'fixture-all-have-unified-shape',
+      async run({ assert }) {
+        const fixtures = [FIXTURE_SESSION, FIXTURE_INVOICE_FAILED];
+        const names = ['session-completed', 'invoice-failed'];
+
+        for (let i = 0; i < fixtures.length; i++) {
+          const result = toUnifiedOneTime(fixtures[i]);
+          const label = names[i];
+
+          assert.ok(result.product, `${label}: should have product`);
+          assert.ok(result.product.id, `${label}: should have product.id`);
+          assert.ok(result.product.name, `${label}: should have product.name`);
+          assert.isType(result.status, 'string', `${label}: status should be string`);
+          assert.ok(result.payment, `${label}: should have payment`);
+          assert.equal(result.payment.processor, 'stripe', `${label}: processor should be stripe`);
+          assert.ok(result.payment.updatedBy, `${label}: should have updatedBy`);
+          assert.ok(result.payment.updatedBy.date, `${label}: should have updatedBy.date`);
+        }
+      },
+    },
+  ],
+};