backend-manager 5.2.5 → 5.2.6

package/src/manager/routes/general/email/post.js

@@ -22,10 +22,12 @@ module.exports = async ({ assistant, Manager, settings }) => {
     payload: {},
   };
 
-  // Load email template
+  // Load email template — colons in id are converted to nested folders
+  // (e.g. "general:download-app-link" → templates/general/download-app-link.js)
+  const templatePath = settings.id.split(':').join('/');
   let emailPayload;
   try {
-    const script = require(path.join(__dirname, 'templates', `${settings.id}.js`));
+    const script = require(path.join(__dirname, 'templates', `${templatePath}.js`));
     emailPayload = merge(
       {},
       DEFAULT,

package/src/manager/routes/marketing/email-preferences/post.js

@@ -166,7 +166,7 @@ async function handleAnonymous({ assistant, Manager, settings, analytics }) {
         method: 'POST',
         response: 'json',
         headers: { 'Authorization': `Bearer ${process.env.SENDGRID_API_KEY}` },
-        timeout: 10000,
+        timeout: 60000,
         body: { recipient_emails: [email] },
       });
     } else {
@@ -176,7 +176,7 @@ async function handleAnonymous({ assistant, Manager, settings, analytics }) {
         method: 'DELETE',
         response: 'text',
         headers: { 'Authorization': `Bearer ${process.env.SENDGRID_API_KEY}` },
-        timeout: 10000,
+        timeout: 60000,
       });
     }
   } catch (e) {

package/src/manager/routes/payments/dispute-alert/post.js

@@ -8,16 +8,16 @@ const powertools = require('node-powertools');
  *
  * Query params:
  *   - provider: alert provider name (default: 'chargeblast')
- *   - key: must match BACKEND_MANAGER_KEY
+ *   - key: must match BACKEND_MANAGER_WEBHOOK_KEY (BACKEND_MANAGER_KEY accepted as legacy fallback)
  */
 module.exports = async ({ assistant, Manager, libraries }) => {
   const { admin } = libraries;
   const body = assistant.request.body;
   const query = assistant.request.query;
 
-  // Validate key against BACKEND_MANAGER_KEY
+  // Validate key — accept either BACKEND_MANAGER_WEBHOOK_KEY (preferred) or BACKEND_MANAGER_KEY (legacy)
   const key = query.key;
-  if (!key || key !== process.env.BACKEND_MANAGER_KEY) {
+  if (!key || (key !== process.env.BACKEND_MANAGER_WEBHOOK_KEY && key !== process.env.BACKEND_MANAGER_KEY)) {
     return assistant.respond('Invalid key', { code: 401 });
   }
 

package/src/manager/routes/payments/intent/processors/test.js

@@ -155,12 +155,12 @@ async function createOneTimeIntent({ uid, orderId, product, productId, confirmat
  * Fire-and-forget webhook to trigger the full pipeline
  */
 function fireWebhook({ event, assistant }) {
-  const webhookUrl = `${assistant.Manager.project.apiUrl}/backend-manager/payments/webhook?processor=test&key=${process.env.BACKEND_MANAGER_KEY}`;
+  const webhookUrl = `${assistant.Manager.project.apiUrl}/backend-manager/payments/webhook?processor=test&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`;
   fetch(webhookUrl, {
     method: 'POST',
     response: 'json',
     body: event,
-    timeout: 15000,
+    timeout: 60000,
   }).catch((e) => {
     assistant.log(`Test processor auto-webhook failed: ${e.message}`);
   });

package/src/manager/routes/payments/webhook/post.js

@@ -24,8 +24,8 @@ module.exports = async ({ assistant, Manager, libraries }) => {
     return assistant.respond('Missing processor parameter', { code: 400 });
   }
 
-  // Validate key against BACKEND_MANAGER_KEY
-  if (!key || key !== process.env.BACKEND_MANAGER_KEY) {
+  // Validate key — accept either BACKEND_MANAGER_WEBHOOK_KEY (preferred) or BACKEND_MANAGER_KEY (legacy)
+  if (!key || (key !== process.env.BACKEND_MANAGER_WEBHOOK_KEY && key !== process.env.BACKEND_MANAGER_KEY)) {
     return assistant.respond('Invalid key', { code: 401 });
   }
 

package/src/manager/routes/user/delete.js

@@ -48,7 +48,7 @@ module.exports = async ({ assistant, Manager, user, settings, libraries }) => {
 
   await fetch(`${Manager.project.apiUrl}/backend-manager/user/sessions`, {
     method: 'delete',
-    timeout: 30000,
+    timeout: 60000,
     response: 'json',
     tries: 2,
     log: true,

package/src/manager/routes/user/oauth2/providers/discord.js

@@ -22,7 +22,7 @@ module.exports = {
 
     const response = await fetch(this.urls.revoke, {
       method: 'POST',
-      timeout: 30000,
+      timeout: 60000,
       body: new URLSearchParams({
         token,
         client_id: clientId,

package/src/manager/routes/user/oauth2/providers/google.js

@@ -27,7 +27,7 @@ module.exports = {
 
     const response = await fetch(this.urls.revoke, {
       method: 'POST',
-      timeout: 30000,
+      timeout: 60000,
       body: new URLSearchParams({ token }),
       headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
     }).catch(e => e);

package/src/test/runner.js

@@ -147,6 +147,12 @@ class TestRunner {
       return false;
     }
 
+    if (!this.options.backendManagerWebhookKey) {
+      console.log(chalk.red('  ✗ Missing backendManagerWebhookKey'));
+      console.log(chalk.gray('    Set BEM_BACKEND_MANAGER_WEBHOOK_KEY environment variable or pass --webhook-key flag'));
+      return false;
+    }
+
     if (!this.options.brand?.id) {
       console.log(chalk.red('  ✗ Missing brand.id'));
       console.log(chalk.gray('    Could not determine brand ID from configuration'));
@@ -661,6 +667,7 @@ class TestRunner {
       timeout: this.options.timeout,
       accounts: this.accounts,
       backendManagerKey: this.options.backendManagerKey,
+      backendManagerWebhookKey: this.options.backendManagerWebhookKey,
     });
 
     // Set default auth

package/src/test/utils/http-client.js

@@ -22,6 +22,7 @@ class HttpClient {
     // Store accounts reference for as() method
     this.accounts = options.accounts || null;
     this.backendManagerKey = options.backendManagerKey || '';
+    this.backendManagerWebhookKey = options.backendManagerWebhookKey || '';
   }
 
   /**

package/test/events/payments/journey-payments-cancel.js

@@ -56,7 +56,7 @@ module.exports = {
 
         state.eventId1 = `_test-evt-journey-cancel-pending-${Date.now()}`;
 
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.eventId1,
           type: 'customer.subscription.updated',
           data: {
@@ -64,7 +64,7 @@ module.exports = {
               id: state.subscriptionId,
               object: 'subscription',
               status: 'active',
-              metadata: { uid: state.uid },
+              metadata: { uid: state.uid, orderId: state.orderId },
               cancel_at_period_end: true,
               cancel_at: Math.floor(futureDate.getTime() / 1000),
               canceled_at: null,
@@ -105,7 +105,7 @@ module.exports = {
       async run({ http, assert, state, config, payments }) {
         state.eventId2 = `_test-evt-journey-cancel-final-${Date.now()}`;
 
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.eventId2,
           type: 'customer.subscription.deleted',
           data: {
@@ -113,7 +113,7 @@ module.exports = {
               id: state.subscriptionId,
               object: 'subscription',
               status: 'canceled',
-              metadata: { uid: state.uid },
+              metadata: { uid: state.uid, orderId: state.orderId },
               cancel_at_period_end: false,
               canceled_at: Math.floor(Date.now() / 1000),
               current_period_end: Math.floor(Date.now() / 1000),

package/test/events/payments/journey-payments-failure.js

@@ -58,7 +58,7 @@ module.exports = {
 
         // Send invoice.payment_failed with subscription billing reason
         // This tests the new parseWebhook routing: billing_reason=subscription_cycle → subscription category
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.eventId,
           type: 'invoice.payment_failed',
           data: {
@@ -72,7 +72,7 @@ module.exports = {
               parent: {
                 subscription_details: {
                   subscription: state.subscriptionId,
-                  metadata: { uid: state.uid },
+                  metadata: { uid: state.uid, orderId: state.orderId },
                 },
                 type: 'subscription_details',
               },

package/test/events/payments/journey-payments-legacy-product.js

@@ -66,7 +66,7 @@ module.exports = {
         // Send a subscription created webhook with the LEGACY product ID
         // This simulates an existing subscriber whose Stripe subscription still
         // references the old product ID from before migration
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.legacyEventId,
           type: 'customer.subscription.created',
           data: {

package/test/events/payments/journey-payments-one-time-failure.js

@@ -39,7 +39,7 @@ module.exports = {
 
         // Send invoice.payment_failed with a non-subscription billing reason
         // This routes to category: 'one-time' in the webhook parser
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.eventId,
           type: 'invoice.payment_failed',
           data: {

package/test/events/payments/journey-payments-plan-change.js

@@ -59,7 +59,7 @@ module.exports = {
         state.eventId = `_test-evt-journey-plan-change-${Date.now()}`;
 
         // Send subscription.updated with product B's Stripe product ID (or test sentinel)
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.eventId,
           type: 'customer.subscription.updated',
           data: {

package/test/events/payments/journey-payments-refund-webhook.js

@@ -59,7 +59,7 @@ module.exports = {
 
         state.cancelEventId = `_test-evt-journey-refund-cancel-${Date.now()}`;
 
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.cancelEventId,
           type: 'customer.subscription.updated',
           data: {
@@ -67,7 +67,7 @@ module.exports = {
               id: state.subscriptionId,
               object: 'subscription',
               status: 'active',
-              metadata: { uid: state.uid },
+              metadata: { uid: state.uid, orderId: state.orderId },
               cancel_at_period_end: true,
               cancel_at: Math.floor(futureDate.getTime() / 1000),
               canceled_at: null,
@@ -110,7 +110,7 @@ module.exports = {
         state.refundEventId = `_test-evt-journey-refund-charge-${Date.now()}`;
         state.refundAmountCents = 2800; // $28.00
 
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.refundEventId,
           type: 'charge.refunded',
           data: {
@@ -121,7 +121,7 @@ module.exports = {
               amount_refunded: state.refundAmountCents,
               currency: 'usd',
               subscription: state.subscriptionId,
-              metadata: { uid: state.uid },
+              metadata: { uid: state.uid, orderId: state.orderId },
               refunds: {
                 data: [
                   {

package/test/events/payments/journey-payments-suspend.js

@@ -53,7 +53,7 @@ module.exports = {
       async run({ http, assert, state, config, payments }) {
         state.eventId1 = `_test-evt-journey-suspend-fail-${Date.now()}`;
 
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.eventId1,
           type: 'customer.subscription.updated',
           data: {
@@ -61,7 +61,7 @@ module.exports = {
               id: state.subscriptionId,
               object: 'subscription',
               status: 'past_due',
-              metadata: { uid: state.uid },
+              metadata: { uid: state.uid, orderId: state.orderId },
               cancel_at_period_end: false,
               canceled_at: null,
               current_period_end: Math.floor(Date.now() / 1000) + 86400,
@@ -104,7 +104,7 @@ module.exports = {
 
         state.eventId2 = `_test-evt-journey-suspend-recover-${Date.now()}`;
 
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.eventId2,
           type: 'customer.subscription.updated',
           data: {
@@ -112,7 +112,7 @@ module.exports = {
               id: state.subscriptionId,
               object: 'subscription',
               status: 'active',
-              metadata: { uid: state.uid },
+              metadata: { uid: state.uid, orderId: state.orderId },
               cancel_at_period_end: false,
               canceled_at: null,
               current_period_end: Math.floor(futureDate.getTime() / 1000),

package/test/events/payments/journey-payments-trial.js

@@ -115,7 +115,7 @@ module.exports = {
 
         state.eventId2 = `_test-evt-journey-trial-active-${Date.now()}`;
 
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.eventId2,
           type: 'customer.subscription.updated',
           data: {
@@ -123,7 +123,7 @@ module.exports = {
               id: state.subscriptionId,
               object: 'subscription',
               status: 'active',
-              metadata: { uid: state.uid },
+              metadata: { uid: state.uid, orderId: state.orderId },
               cancel_at_period_end: false,
               canceled_at: null,
               current_period_end: Math.floor(futureDate.getTime() / 1000),

package/test/events/payments/journey-payments-uid-resolution.js

@@ -65,7 +65,7 @@ module.exports = {
 
         state.noUidEventId = `_test-evt-journey-uid-resolve-${Date.now()}`;
 
-        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerKey}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=test&key=${config.backendManagerWebhookKey}`, {
           id: state.noUidEventId,
           type: 'customer.subscription.updated',
           data: {

package/test/routes/payments/dispute-alert.js

@@ -32,7 +32,7 @@ module.exports = {
       name: 'rejects-unknown-provider',
       auth: 'none',
       async run({ http, assert }) {
-        const response = await http.as('none').post(`payments/dispute-alert?provider=unknown&key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?provider=unknown&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: '_test-dispute-unknown-provider',
           card: '4242',
           amount: 9.99,
@@ -47,7 +47,7 @@ module.exports = {
       name: 'rejects-missing-id',
       auth: 'none',
       async run({ http, assert }) {
-        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           card: '4242',
           amount: 9.99,
           transactionDate: '2026-01-15',
@@ -61,7 +61,7 @@ module.exports = {
       name: 'rejects-missing-card',
       auth: 'none',
       async run({ http, assert }) {
-        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: '_test-dispute-no-card',
           amount: 9.99,
           transactionDate: '2026-01-15',
@@ -75,7 +75,7 @@ module.exports = {
       name: 'rejects-missing-amount',
       auth: 'none',
       async run({ http, assert }) {
-        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: '_test-dispute-no-amount',
           card: '4242',
           transactionDate: '2026-01-15',
@@ -89,7 +89,7 @@ module.exports = {
       name: 'rejects-missing-transaction-date',
       auth: 'none',
       async run({ http, assert }) {
-        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: '_test-dispute-no-date',
           card: '4242',
           amount: 9.99,
@@ -105,7 +105,7 @@ module.exports = {
       async run({ http, assert, firestore }) {
         const alertId = '_test-dispute-valid';
 
-        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: alertId,
           card: '4242424242424242',
           cardBrand: 'Visa',
@@ -164,7 +164,7 @@ module.exports = {
         const alertId = '_test-dispute-alertid-field';
 
         // Chargeblast alert.created events use alertId instead of id
-        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           alertId: alertId,
           card: '546616******5805',
           cardBrand: 'Mastercard',
@@ -189,7 +189,7 @@ module.exports = {
         const alertId = '_test-dispute-minimal';
 
         // Send minimal alert (alert.created shape — no externalOrder, metadata, etc.)
-        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: alertId,
           card: '9124',
           amount: 10,
@@ -218,7 +218,7 @@ module.exports = {
       async run({ http, assert, firestore }) {
         const alertId = '_test-dispute-last4';
 
-        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: alertId,
           card: '1234',
           amount: 9.99,
@@ -240,7 +240,7 @@ module.exports = {
         const alertId = '_test-dispute-duplicate';
 
         // Send first alert
-        await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: alertId,
           card: '4242',
           amount: 29.99,
@@ -248,7 +248,7 @@ module.exports = {
         });
 
         // Send duplicate
-        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: alertId,
           card: '4242',
           amount: 29.99,
@@ -274,7 +274,7 @@ module.exports = {
         });
 
         // Send alert with same ID — should retry since previous status was 'failed'
-        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: alertId,
           card: '4242',
           amount: 29.99,
@@ -300,7 +300,7 @@ module.exports = {
         const alertId = '_test-dispute-default-provider';
 
         // Send without provider query param
-        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: alertId,
           card: '4242',
           amount: 9.99,

package/test/routes/payments/webhook.js

@@ -34,7 +34,7 @@ module.exports = {
       name: 'rejects-unknown-processor',
       auth: 'none',
       async run({ http, assert }) {
-        const response = await http.as('none').post(`payments/webhook?processor=unknown&key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=unknown&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: 'evt_test_unknown',
           type: 'test.event',
           data: { object: {} },
@@ -50,7 +50,7 @@ module.exports = {
       async run({ http, assert, firestore }) {
         const eventId = '_test-evt-valid-webhook';
 
-        const response = await http.as('none').post(`payments/webhook?processor=stripe&key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const response = await http.as('none').post(`payments/webhook?processor=stripe&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: eventId,
           type: 'customer.subscription.updated',
           data: {
@@ -84,7 +84,7 @@ module.exports = {
 
         // Use the test processor so the on-write trigger doesn't require STRIPE_SECRET_KEY
         // (a failed first webhook would let the dedup-retry branch fire instead of returning duplicate=true)
-        const send = () => http.as('none').post(`payments/webhook?processor=test&key=${process.env.BACKEND_MANAGER_KEY}`, {
+        const send = () => http.as('none').post(`payments/webhook?processor=test&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
           id: eventId,
           type: 'customer.subscription.updated',
           data: {