backend-manager 5.0.73 → 5.0.74

package/templates/backend-manager-config.json

@@ -47,4 +47,36 @@
       author: 'alex-raeburn',
     }
   ],
+  products: [
+    {
+      id: 'basic',
+      name: 'Basic',
+      type: 'free',
+      limits: {
+        requests: 100,
+      },
+    },
+    {
+      id: 'premium',
+      name: 'Premium',
+      type: 'subscription',
+      limits: {
+        requests: 1000,
+      },
+      trial: {
+        days: 14,
+      },
+      prices: {
+        monthly: {
+          stripe: 'price_xxx',
+          paypal: 'P-xxx',
+        },
+        annually: {
+          stripe: 'price_yyy',
+          paypal: 'P-yyy',
+        },
+      },
+    },
+    // Add more products/tiers here
+  ],
 }

package/templates/firestore.rules

@@ -58,7 +58,7 @@ service cloud.firestore {
       return isWritingField('auth')
         || isWritingField('roles')
         || isWritingField('flags')
-        || isWritingField('plan')
+        || isWritingField('subscription')
         || isWritingField('affiliate')
         || isWritingField('api')
         || isWritingField('usage');

package/test/_init/accounts-validation.js

@@ -48,9 +48,9 @@ module.exports = {
       assert.hasProperty(userDoc, 'activity.created.timestamp', `Account '${accountId}' should have activity.created.timestamp`);
       assert.hasProperty(userDoc, 'activity.created.timestampUNIX', `Account '${accountId}' should have activity.created.timestampUNIX`);
 
-      // Validate plan fields (merged from test account properties)
-      assert.hasProperty(userDoc, 'plan.id', `Account '${accountId}' should have plan.id`);
-      assert.hasProperty(userDoc, 'plan.status', `Account '${accountId}' should have plan.status`);
+      // Validate subscription fields (merged from test account properties)
+      assert.hasProperty(userDoc, 'subscription.product.id', `Account '${accountId}' should have subscription.product.id`);
+      assert.hasProperty(userDoc, 'subscription.status', `Account '${accountId}' should have subscription.status`);
     }
 
     return { success: true };

package/test/functions/user/delete.js

@@ -53,7 +53,7 @@ module.exports = {
       name: 'remove-subscription-from-delete-user',
       async run({ firestore, state }) {
         // Remove the subscription (set to null to overwrite)
-        await firestore.set(`users/${state.deleteUid}`, { plan: null }, { merge: true });
+        await firestore.set(`users/${state.deleteUid}`, { subscription: null }, { merge: true });
       },
     },
 

package/test/functions/user/get-subscription-info.js

@@ -1,7 +1,7 @@
 /**
  * Test: user:get-subscription-info
  * Tests the user get subscription info command
- * Returns plan details for authenticated users
+ * Returns subscription details for authenticated users
  */
 module.exports = {
   description: 'User get subscription info',
@@ -17,17 +17,17 @@ module.exports = {
         const response = await http.command('user:get-subscription-info', {});
 
         assert.isSuccess(response, 'Get subscription info should succeed for authenticated user');
-        assert.hasProperty(response, 'data.plan', 'Response should contain plan object');
-        assert.hasProperty(response, 'data.plan.id', 'Plan should have id');
-        assert.hasProperty(response, 'data.plan.expires', 'Plan should have expires');
-        assert.hasProperty(response, 'data.plan.trial', 'Plan should have trial info');
-        assert.hasProperty(response, 'data.plan.payment', 'Plan should have payment info');
+        assert.hasProperty(response, 'data.subscription', 'Response should contain subscription object');
+        assert.hasProperty(response, 'data.subscription.product.id', 'Subscription should have id');
+        assert.hasProperty(response, 'data.subscription.expires', 'Subscription should have expires');
+        assert.hasProperty(response, 'data.subscription.trial', 'Subscription should have trial info');
+        assert.hasProperty(response, 'data.subscription.payment', 'Subscription should have payment info');
       },
     },
 
-    // Test 2: Plan has correct structure
+    // Test 2: Subscription has correct structure
     {
-      name: 'plan-structure-valid',
+      name: 'subscription-structure-valid',
       auth: 'basic',
       timeout: 15000,
 
@@ -36,31 +36,26 @@ module.exports = {
 
         assert.isSuccess(response, 'Get subscription info should succeed');
 
-        const plan = response.data.plan;
+        const subscription = response.data.subscription;
 
         // Check expires structure
-        assert.hasProperty(response, 'data.plan.expires.timestamp', 'expires should have timestamp');
-        assert.hasProperty(response, 'data.plan.expires.timestampUNIX', 'expires should have timestampUNIX');
+        assert.hasProperty(response, 'data.subscription.expires.timestamp', 'expires should have timestamp');
+        assert.hasProperty(response, 'data.subscription.expires.timestampUNIX', 'expires should have timestampUNIX');
 
         // Check trial structure
         assert.ok(
-          typeof plan.trial.activated === 'boolean',
+          typeof subscription.trial.activated === 'boolean',
           'trial.activated should be boolean'
         );
-        assert.hasProperty(response, 'data.plan.trial.date', 'trial should have date');
-        assert.hasProperty(response, 'data.plan.trial.date.timestamp', 'trial.date should have timestamp');
 
         // Check payment structure
-        assert.ok(
-          typeof plan.payment.active === 'boolean',
-          'payment.active should be boolean'
-        );
+        assert.hasProperty(response, 'data.subscription.payment', 'subscription should have payment');
       },
     },
 
     // Test 3: Premium user has active subscription
     {
-      name: 'premium-user-has-active-plan',
+      name: 'premium-user-has-active-subscription',
       auth: 'premium-active',
       timeout: 15000,
 
@@ -68,9 +63,8 @@ module.exports = {
         const response = await http.command('user:get-subscription-info', {});
 
         assert.isSuccess(response, 'Get subscription info should succeed for premium user');
-        // The API returns plan.id from the user doc (test account has plan.id = 'premium')
-        assert.hasProperty(response, 'data.plan.id', 'Premium user should have plan id');
-        assert.hasProperty(response, 'data.plan.payment', 'Premium user should have payment info');
+        assert.hasProperty(response, 'data.subscription.product.id', 'Premium user should have subscription id');
+        assert.hasProperty(response, 'data.subscription.payment', 'Premium user should have payment info');
       },
     },
 
@@ -84,8 +78,8 @@ module.exports = {
         const response = await http.command('user:get-subscription-info', {});
 
         assert.isSuccess(response, 'Get subscription info should succeed for expired premium');
-        assert.hasProperty(response, 'data.plan.id', 'Should still have plan id');
-        assert.hasProperty(response, 'data.plan.expires.timestampUNIX', 'Should have expires timestamp');
+        assert.hasProperty(response, 'data.subscription.product.id', 'Should still have subscription id');
+        assert.hasProperty(response, 'data.subscription.expires.timestampUNIX', 'Should have expires timestamp');
       },
     },
 

package/test/payments/intent.js

@@ -0,0 +1,104 @@
+/**
+ * Test: POST /payments/intent
+ * Tests intent creation endpoint validation
+ *
+ * Note: These tests validate the route logic (auth, validation, subscription checks)
+ * They do NOT create real Stripe sessions since there's no Stripe key in test env
+ */
+module.exports = {
+  description: 'Payment intent creation',
+  type: 'group',
+  timeout: 30000,
+
+  tests: [
+    {
+      name: 'rejects-unauthenticated',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.as('none').post('payments/intent', {
+          processor: 'stripe',
+          productId: 'premium',
+          frequency: 'monthly',
+        });
+
+        assert.isError(response, 401, 'Should reject unauthenticated request');
+      },
+    },
+
+    {
+      name: 'rejects-missing-processor',
+      async run({ http, assert }) {
+        const response = await http.as('basic').post('payments/intent', {
+          productId: 'premium',
+          frequency: 'monthly',
+        });
+
+        assert.isError(response, 400, 'Should reject missing processor');
+      },
+    },
+
+    {
+      name: 'rejects-missing-product-id',
+      async run({ http, assert }) {
+        const response = await http.as('basic').post('payments/intent', {
+          processor: 'stripe',
+          frequency: 'monthly',
+        });
+
+        assert.isError(response, 400, 'Should reject missing productId');
+      },
+    },
+
+    {
+      name: 'rejects-missing-frequency',
+      async run({ http, assert }) {
+        const response = await http.as('basic').post('payments/intent', {
+          processor: 'stripe',
+          productId: 'premium',
+        });
+
+        assert.isError(response, 400, 'Should reject missing frequency');
+      },
+    },
+
+    {
+      name: 'rejects-active-premium-user',
+      auth: 'premium-active',
+      async run({ http, assert }) {
+        const response = await http.as('premium-active').post('payments/intent', {
+          processor: 'stripe',
+          productId: 'premium',
+          frequency: 'monthly',
+        });
+
+        assert.isError(response, 400, 'Should reject user with active subscription');
+      },
+    },
+
+    {
+      name: 'rejects-invalid-product',
+      async run({ http, assert }) {
+        const response = await http.as('basic').post('payments/intent', {
+          processor: 'stripe',
+          productId: 'nonexistent-product',
+          frequency: 'monthly',
+        });
+
+        assert.isError(response, 400, 'Should reject invalid product');
+      },
+    },
+
+    {
+      name: 'rejects-unknown-processor',
+      async run({ http, assert }) {
+        const response = await http.as('basic').post('payments/intent', {
+          processor: 'unknown-processor',
+          productId: 'premium',
+          frequency: 'monthly',
+        });
+
+        assert.isError(response, 400, 'Should reject unknown processor');
+      },
+    },
+  ],
+};

package/test/payments/journey-payment-cancel.js

@@ -0,0 +1,166 @@
+/**
+ * Test: Payment Journey - Cancel
+ * Simulates: premium active → pending cancel → cancelled
+ *
+ * Step 1: Webhook with cancel_at_period_end=true → cancellation.pending=true
+ * Step 2: Webhook with status=canceled → status=cancelled, id=basic
+ */
+const powertools = require('node-powertools');
+
+module.exports = {
+  description: 'Payment journey: premium → pending cancel → cancelled',
+  type: 'suite',
+  timeout: 30000,
+
+  tests: [
+    {
+      name: 'verify-starts-as-premium',
+      async run({ accounts, firestore, assert, state }) {
+        const uid = accounts['journey-payment-cancel'].uid;
+        const userDoc = await firestore.get(`users/${uid}`);
+
+        assert.ok(userDoc, 'User doc should exist');
+        assert.equal(userDoc.subscription?.product?.id, 'premium', 'Should start as premium');
+        assert.equal(userDoc.subscription?.status, 'active', 'Should be active');
+
+        state.uid = uid;
+        state.subscriptionId = '_test-sub-journey-cancel';
+      },
+    },
+
+    {
+      name: 'write-pending-cancel-webhook',
+      async run({ firestore, state }) {
+        const now = powertools.timestamp(new Date(), { output: 'string' });
+        const nowUNIX = powertools.timestamp(now, { output: 'unix' });
+        const futureDate = new Date();
+        futureDate.setFullYear(futureDate.getFullYear() + 1);
+
+        state.eventId1 = '_test-evt-journey-cancel-pending';
+
+        await firestore.delete(`payments-webhooks/${state.eventId1}`);
+        await firestore.delete(`payments-subscriptions/${state.subscriptionId}`);
+
+        // Webhook: active subscription with cancel_at_period_end = true
+        await firestore.set(`payments-webhooks/${state.eventId1}`, {
+          id: state.eventId1,
+          processor: 'stripe',
+          status: 'pending',
+          uid: state.uid,
+          event: { type: 'customer.subscription.updated' },
+          raw: {
+            id: state.eventId1,
+            type: 'customer.subscription.updated',
+            data: {
+              object: {
+                id: state.subscriptionId,
+                object: 'subscription',
+                status: 'active',
+                metadata: { uid: state.uid },
+                cancel_at_period_end: true,
+                cancel_at: Math.floor(futureDate.getTime() / 1000),
+                canceled_at: null,
+                current_period_end: Math.floor(futureDate.getTime() / 1000),
+                current_period_start: Math.floor(Date.now() / 1000),
+                start_date: Math.floor(Date.now() / 1000) - 86400 * 30,
+                trial_start: null,
+                trial_end: null,
+                plan: { id: 'price_xxx', interval: 'month' },
+              },
+            },
+          },
+          error: null,
+          metadata: {
+            received: { timestamp: now, timestampUNIX: nowUNIX },
+            processed: { timestamp: null, timestampUNIX: null },
+          },
+        });
+      },
+    },
+
+    {
+      name: 'pending-cancel-processed',
+      async run({ firestore, assert, state, waitFor }) {
+        await waitFor(async () => {
+          const doc = await firestore.get(`payments-webhooks/${state.eventId1}`);
+          return doc?.status === 'completed';
+        }, 15000, 500);
+
+        const userDoc = await firestore.get(`users/${state.uid}`);
+
+        assert.equal(userDoc.subscription.status, 'active', 'Status should still be active');
+        assert.equal(userDoc.subscription.cancellation.pending, true, 'Cancellation should be pending');
+      },
+    },
+
+    {
+      name: 'write-cancelled-webhook',
+      async run({ firestore, state }) {
+        const now = powertools.timestamp(new Date(), { output: 'string' });
+        const nowUNIX = powertools.timestamp(now, { output: 'unix' });
+
+        state.eventId2 = '_test-evt-journey-cancel-final';
+
+        await firestore.delete(`payments-webhooks/${state.eventId2}`);
+
+        // Webhook: subscription now cancelled
+        await firestore.set(`payments-webhooks/${state.eventId2}`, {
+          id: state.eventId2,
+          processor: 'stripe',
+          status: 'pending',
+          uid: state.uid,
+          event: { type: 'customer.subscription.deleted' },
+          raw: {
+            id: state.eventId2,
+            type: 'customer.subscription.deleted',
+            data: {
+              object: {
+                id: state.subscriptionId,
+                object: 'subscription',
+                status: 'canceled',
+                metadata: { uid: state.uid },
+                cancel_at_period_end: false,
+                canceled_at: Math.floor(Date.now() / 1000),
+                current_period_end: Math.floor(Date.now() / 1000),
+                current_period_start: Math.floor(Date.now() / 1000) - 86400 * 30,
+                start_date: Math.floor(Date.now() / 1000) - 86400 * 60,
+                trial_start: null,
+                trial_end: null,
+                plan: { id: 'price_xxx', interval: 'month' },
+              },
+            },
+          },
+          error: null,
+          metadata: {
+            received: { timestamp: now, timestampUNIX: nowUNIX },
+            processed: { timestamp: null, timestampUNIX: null },
+          },
+        });
+      },
+    },
+
+    {
+      name: 'subscription-cancelled',
+      async run({ firestore, assert, state, waitFor }) {
+        await waitFor(async () => {
+          const doc = await firestore.get(`payments-webhooks/${state.eventId2}`);
+          return doc?.status === 'completed';
+        }, 15000, 500);
+
+        const userDoc = await firestore.get(`users/${state.uid}`);
+
+        assert.equal(userDoc.subscription.status, 'cancelled', 'Status should be cancelled');
+        assert.equal(userDoc.subscription.cancellation.pending, false, 'Cancellation should not be pending');
+      },
+    },
+
+    {
+      name: 'cleanup',
+      async run({ firestore, state }) {
+        await firestore.delete(`payments-webhooks/${state.eventId1}`);
+        await firestore.delete(`payments-webhooks/${state.eventId2}`);
+        await firestore.delete(`payments-subscriptions/${state.subscriptionId}`);
+      },
+    },
+  ],
+};

package/test/payments/journey-payment-suspend.js

@@ -0,0 +1,162 @@
+/**
+ * Test: Payment Journey - Suspend & Recover
+ * Simulates: premium active → payment fails → suspended → payment succeeds → active again
+ */
+const powertools = require('node-powertools');
+
+module.exports = {
+  description: 'Payment journey: premium → suspended → recovered',
+  type: 'suite',
+  timeout: 30000,
+
+  tests: [
+    {
+      name: 'verify-starts-as-premium',
+      async run({ accounts, firestore, assert, state }) {
+        const uid = accounts['journey-payment-suspend'].uid;
+        const userDoc = await firestore.get(`users/${uid}`);
+
+        assert.ok(userDoc, 'User doc should exist');
+        assert.equal(userDoc.subscription?.product?.id, 'premium', 'Should start as premium');
+        assert.equal(userDoc.subscription?.status, 'active', 'Should be active');
+
+        state.uid = uid;
+        state.subscriptionId = '_test-sub-journey-suspend';
+      },
+    },
+
+    {
+      name: 'write-past-due-webhook',
+      async run({ firestore, state }) {
+        const now = powertools.timestamp(new Date(), { output: 'string' });
+        const nowUNIX = powertools.timestamp(now, { output: 'unix' });
+
+        state.eventId1 = '_test-evt-journey-suspend-fail';
+
+        await firestore.delete(`payments-webhooks/${state.eventId1}`);
+        await firestore.delete(`payments-subscriptions/${state.subscriptionId}`);
+
+        // Webhook: subscription status changed to past_due
+        await firestore.set(`payments-webhooks/${state.eventId1}`, {
+          id: state.eventId1,
+          processor: 'stripe',
+          status: 'pending',
+          uid: state.uid,
+          event: { type: 'customer.subscription.updated' },
+          raw: {
+            id: state.eventId1,
+            type: 'customer.subscription.updated',
+            data: {
+              object: {
+                id: state.subscriptionId,
+                object: 'subscription',
+                status: 'past_due',
+                metadata: { uid: state.uid },
+                cancel_at_period_end: false,
+                canceled_at: null,
+                current_period_end: Math.floor(Date.now() / 1000) + 86400,
+                current_period_start: Math.floor(Date.now() / 1000) - 86400 * 29,
+                start_date: Math.floor(Date.now() / 1000) - 86400 * 60,
+                trial_start: null,
+                trial_end: null,
+                plan: { id: 'price_xxx', interval: 'month' },
+              },
+            },
+          },
+          error: null,
+          metadata: {
+            received: { timestamp: now, timestampUNIX: nowUNIX },
+            processed: { timestamp: null, timestampUNIX: null },
+          },
+        });
+      },
+    },
+
+    {
+      name: 'subscription-suspended',
+      async run({ firestore, assert, state, waitFor }) {
+        await waitFor(async () => {
+          const doc = await firestore.get(`payments-webhooks/${state.eventId1}`);
+          return doc?.status === 'completed';
+        }, 15000, 500);
+
+        const userDoc = await firestore.get(`users/${state.uid}`);
+
+        assert.equal(userDoc.subscription.status, 'suspended', 'Status should be suspended');
+        assert.equal(userDoc.subscription.product.id, 'premium', 'Product should still be premium');
+      },
+    },
+
+    {
+      name: 'write-recovery-webhook',
+      async run({ firestore, state }) {
+        const now = powertools.timestamp(new Date(), { output: 'string' });
+        const nowUNIX = powertools.timestamp(now, { output: 'unix' });
+        const futureDate = new Date();
+        futureDate.setMonth(futureDate.getMonth() + 1);
+
+        state.eventId2 = '_test-evt-journey-suspend-recover';
+
+        await firestore.delete(`payments-webhooks/${state.eventId2}`);
+
+        // Webhook: subscription back to active after payment succeeds
+        await firestore.set(`payments-webhooks/${state.eventId2}`, {
+          id: state.eventId2,
+          processor: 'stripe',
+          status: 'pending',
+          uid: state.uid,
+          event: { type: 'customer.subscription.updated' },
+          raw: {
+            id: state.eventId2,
+            type: 'customer.subscription.updated',
+            data: {
+              object: {
+                id: state.subscriptionId,
+                object: 'subscription',
+                status: 'active',
+                metadata: { uid: state.uid },
+                cancel_at_period_end: false,
+                canceled_at: null,
+                current_period_end: Math.floor(futureDate.getTime() / 1000),
+                current_period_start: Math.floor(Date.now() / 1000),
+                start_date: Math.floor(Date.now() / 1000) - 86400 * 60,
+                trial_start: null,
+                trial_end: null,
+                plan: { id: 'price_xxx', interval: 'month' },
+              },
+            },
+          },
+          error: null,
+          metadata: {
+            received: { timestamp: now, timestampUNIX: nowUNIX },
+            processed: { timestamp: null, timestampUNIX: null },
+          },
+        });
+      },
+    },
+
+    {
+      name: 'subscription-recovered',
+      async run({ firestore, assert, state, waitFor }) {
+        await waitFor(async () => {
+          const doc = await firestore.get(`payments-webhooks/${state.eventId2}`);
+          return doc?.status === 'completed';
+        }, 15000, 500);
+
+        const userDoc = await firestore.get(`users/${state.uid}`);
+
+        assert.equal(userDoc.subscription.status, 'active', 'Status should be active again');
+        assert.equal(userDoc.subscription.product.id, 'premium', 'Product should still be premium');
+      },
+    },
+
+    {
+      name: 'cleanup',
+      async run({ firestore, state }) {
+        await firestore.delete(`payments-webhooks/${state.eventId1}`);
+        await firestore.delete(`payments-webhooks/${state.eventId2}`);
+        await firestore.delete(`payments-subscriptions/${state.subscriptionId}`);
+      },
+    },
+  ],
+};