backend-manager 5.9.4 → 5.9.6

package/test/routes/payments/intent.js

@@ -1,336 +0,0 @@
-/**
- * Test: POST /payments/intent
- * Tests intent creation endpoint validation + end-to-end flow via test processor
- *
- * Validation tests use processor=stripe (fail at SDK step, proving validation logic)
- * Success tests use processor=test (full intent→webhook→trigger pipeline)
- *
- * Product-agnostic: resolves the first paid product from config.payment.products.
- * If the brand has no paid product configured, each test skips — this is a
- * config-gap, not a code failure.
- */
-module.exports = {
-  description: 'Payment intent creation',
-  type: 'group',
-  timeout: 30000,
-
-  tests: [
-    {
-      name: 'rejects-unauthenticated',
-      auth: 'none',
-      async run({ http, assert, config, skip }) {
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-
-        const response = await http.as('none').post('backend-manager/payments/intent', {
-          processor: 'stripe',
-          productId: paidProduct.id,
-          frequency: 'monthly',
-        });
-
-        assert.isError(response, 401, 'Should reject unauthenticated request');
-      },
-    },
-
-    {
-      name: 'rejects-missing-processor',
-      async run({ http, assert, config, skip }) {
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-
-        const response = await http.as('basic').post('backend-manager/payments/intent', {
-          productId: paidProduct.id,
-          frequency: 'monthly',
-        });
-
-        assert.isError(response, 400, 'Should reject missing processor');
-      },
-    },
-
-    {
-      name: 'rejects-missing-product-id',
-      async run({ http, assert }) {
-        const response = await http.as('basic').post('backend-manager/payments/intent', {
-          processor: 'stripe',
-          frequency: 'monthly',
-        });
-
-        assert.isError(response, 400, 'Should reject missing productId');
-      },
-    },
-
-    {
-      name: 'rejects-missing-frequency-for-subscription',
-      async run({ http, assert, config, skip }) {
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.type === 'subscription' && p.prices);
-        if (!paidProduct) {
-          skip('No paid subscription product configured in this brand');
-        }
-
-        const response = await http.as('basic').post('backend-manager/payments/intent', {
-          processor: 'stripe',
-          productId: paidProduct.id,
-        });
-
-        assert.isError(response, 400, 'Should reject missing frequency for subscription product');
-      },
-    },
-
-    {
-      name: 'rejects-active-paid-user',
-      auth: 'premium-active',
-      async run({ http, assert, config, skip }) {
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-
-        const response = await http.as('premium-active').post('backend-manager/payments/intent', {
-          processor: 'stripe',
-          productId: paidProduct.id,
-          frequency: 'monthly',
-        });
-
-        assert.isError(response, 400, 'Should reject user with active subscription');
-      },
-    },
-
-    {
-      name: 'rejects-suspended-user',
-      auth: 'premium-suspended',
-      async run({ http, assert, config, skip }) {
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-
-        const response = await http.as('premium-suspended').post('backend-manager/payments/intent', {
-          processor: 'stripe',
-          productId: paidProduct.id,
-          frequency: 'monthly',
-        });
-
-        assert.isError(response, 400, 'Should reject user with suspended subscription');
-      },
-    },
-
-    {
-      name: 'rejects-cancelling-user',
-      auth: 'premium-cancelling',
-      async run({ http, assert, config, skip }) {
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-
-        const response = await http.as('premium-cancelling').post('backend-manager/payments/intent', {
-          processor: 'stripe',
-          productId: paidProduct.id,
-          frequency: 'monthly',
-        });
-
-        assert.isError(response, 400, 'Should reject user with cancelling subscription');
-      },
-    },
-
-    {
-      name: 'allows-cancelled-user',
-      auth: 'premium-expired',
-      async run({ http, assert, config, skip }) {
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-
-        const response = await http.as('premium-expired').post('backend-manager/payments/intent', {
-          processor: 'test',
-          productId: paidProduct.id,
-          frequency: 'monthly',
-        });
-
-        assert.isSuccess(response, 'Should allow user with fully cancelled subscription');
-      },
-    },
-
-    {
-      name: 'rejects-invalid-product',
-      async run({ http, assert }) {
-        const response = await http.as('basic').post('backend-manager/payments/intent', {
-          processor: 'stripe',
-          productId: 'nonexistent-product',
-          frequency: 'monthly',
-        });
-
-        assert.isError(response, 400, 'Should reject invalid product');
-      },
-    },
-
-    {
-      name: 'rejects-unknown-processor',
-      async run({ http, assert, config, skip }) {
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-
-        const response = await http.as('basic').post('backend-manager/payments/intent', {
-          processor: 'unknown-processor',
-          productId: paidProduct.id,
-          frequency: 'monthly',
-        });
-
-        assert.isError(response, 400, 'Should reject unknown processor');
-      },
-    },
-
-    {
-      name: 'rejects-invalid-discount-code',
-      async run({ http, assert, config, skip }) {
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-
-        const response = await http.as('basic').post('backend-manager/payments/intent', {
-          processor: 'stripe',
-          productId: paidProduct.id,
-          frequency: 'monthly',
-          discount: 'FAKECODE',
-        });
-
-        assert.isError(response, 400, 'Should reject invalid discount code');
-      },
-    },
-
-    {
-      name: 'saves-discount-to-intent-doc',
-      async run({ http, assert, config, firestore, skip }) {
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-        const frequency = Object.keys(paidProduct.prices)[0];
-
-        const response = await http.as('intent-discount-validation').post('backend-manager/payments/intent', {
-          processor: 'test',
-          productId: paidProduct.id,
-          frequency,
-          discount: 'FLASH20',
-        });
-
-        assert.isSuccess(response, 'Should succeed with valid discount');
-
-        // Verify discount was resolved and saved to intent doc
-        const intentDoc = await firestore.get(`payments-intents/${response.data.orderId}`);
-        assert.ok(intentDoc.discount, 'Discount should be saved on intent');
-        assert.equal(intentDoc.discount.code, 'FLASH20', 'Discount code should match');
-        assert.equal(intentDoc.discount.percent, 20, 'Discount percent should be 20');
-        assert.equal(intentDoc.discount.duration, 'once', 'Discount duration should be once');
-      },
-    },
-
-    {
-      name: 'saves-attribution-and-supplemental-to-intent-doc',
-      async run({ http, assert, config, firestore, skip }) {
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-        const frequency = Object.keys(paidProduct.prices)[0];
-
-        const response = await http.as('journey-payments-intent-attribution').post('backend-manager/payments/intent', {
-          processor: 'test',
-          productId: paidProduct.id,
-          frequency,
-          attribution: { utm_source: 'test', utm_medium: 'unit-test' },
-          supplemental: { referral: 'friend' },
-        });
-
-        assert.isSuccess(response, 'Should succeed with attribution and supplemental');
-
-        const intentDoc = await firestore.get(`payments-intents/${response.data.orderId}`);
-        assert.equal(intentDoc.attribution.utm_source, 'test', 'Attribution utm_source should be saved');
-        assert.equal(intentDoc.supplemental.referral, 'friend', 'Supplemental should be saved');
-      },
-    },
-
-    {
-      name: 'succeeds-with-test-processor',
-      async run({ http, assert, config, firestore, accounts, waitFor, skip }) {
-        const uid = accounts['journey-payments-intent'].uid;
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-
-        const response = await http.as('journey-payments-intent').post('backend-manager/payments/intent', {
-          processor: 'test',
-          productId: paidProduct.id,
-          frequency: 'monthly',
-        });
-
-        assert.isSuccess(response, 'Should succeed with test processor');
-        assert.ok(response.data.id, 'Should return intent ID');
-        assert.ok(response.data.orderId, 'Should return orderId');
-        assert.match(response.data.orderId, /^\d{4}-\d{4}-\d{4}$/, 'orderId should be XXXX-XXXX-XXXX format');
-        assert.ok(response.data.url, 'Should return URL');
-
-        // Verify intent doc was saved (keyed by orderId)
-        const intentDoc = await firestore.get(`payments-intents/${response.data.orderId}`);
-        assert.ok(intentDoc, 'Intent doc should exist');
-        assert.equal(intentDoc.intentId, response.data.id, 'Intent ID should match response');
-        assert.equal(intentDoc.processor, 'test', 'Processor should be test');
-        assert.equal(intentDoc.productId, paidProduct.id, 'Product should match');
-
-        // Wait for auto-webhook to process and activate the subscription
-        await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${uid}`);
-          return userDoc?.subscription?.product?.id === paidProduct.id;
-        }, 15000, 500).catch(() => {});
-      },
-    },
-
-    {
-      name: 'downgrades-trial-for-user-with-history',
-      async run({ http, assert, config, accounts, firestore, waitFor, skip }) {
-        const uid = accounts['journey-payments-intent-trial'].uid;
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices);
-        if (!paidProduct) {
-          skip('No paid product configured in this brand');
-        }
-        const orderDocPath = `payments-orders/_test-order-history-${uid}`;
-
-        // Create fake subscription history so user is ineligible for trial
-        await firestore.set(orderDocPath, { owner: uid, type: 'subscription', processor: 'test', status: 'cancelled' });
-
-        try {
-          const response = await http.as('journey-payments-intent-trial').post('backend-manager/payments/intent', {
-            processor: 'test',
-            productId: paidProduct.id,
-            frequency: 'monthly',
-            trial: true,
-          });
-
-          // Should succeed (not reject with 400) — trial silently downgraded
-          assert.isSuccess(response, 'Should not reject — trial silently downgraded');
-
-          // Verify intent saved with trial=false (keyed by orderId)
-          const intentDoc = await firestore.get(`payments-intents/${response.data.orderId}`);
-          assert.equal(intentDoc.trial, false, 'Trial should be false (downgraded)');
-
-          // Wait for auto-webhook to activate the subscription
-          await waitFor(async () => {
-            const userDoc = await firestore.get(`users/${uid}`);
-            return userDoc?.subscription?.product?.id === paidProduct.id;
-          }, 15000, 500).catch(() => {});
-        } finally {
-          await firestore.delete(orderDocPath);
-        }
-      },
-    },
-  ],
-};

package/test/routes/payments/portal.js

@@ -1,92 +0,0 @@
-/**
- * Test: POST /payments/portal - Validation errors
- * Tests rejection cases before any processor call is made.
- */
-module.exports = {
-  description: 'Payment portal endpoint: validation errors',
-  type: 'group',
-  timeout: 15000,
-
-  tests: [
-    {
-      name: 'rejects-unauthenticated',
-      async run({ http, assert }) {
-        const response = await http.as('none').post('backend-manager/payments/portal', {
-          returnUrl: 'https://example.com/account',
-        });
-
-        assert.isError(response, 401, 'Should reject unauthenticated request');
-      },
-    },
-
-    {
-      name: 'rejects-basic-user',
-      async run({ http, assert }) {
-        const response = await http.as('basic').post('backend-manager/payments/portal', {
-          returnUrl: 'https://example.com/account',
-        });
-
-        assert.isError(response, 400, 'Should reject basic user with no paid subscription');
-      },
-    },
-
-    {
-      name: 'rejects-no-processor',
-      async run({ http, assert }) {
-        // portal-no-processor starts with payment.processor=null
-        const response = await http.as('portal-no-processor').post('backend-manager/payments/portal', {
-          returnUrl: 'https://example.com/account',
-        });
-
-        assert.isError(response, 400, 'Should reject when no processor is set');
-      },
-    },
-
-    {
-      name: 'rejects-unknown-processor',
-      async run({ http, assert }) {
-        // portal-unknown-processor starts with processor='unknown-processor'
-        const response = await http.as('portal-unknown-processor').post('backend-manager/payments/portal', {
-          returnUrl: 'https://example.com/account',
-        });
-
-        assert.isError(response, 400, 'Should reject unknown processor');
-      },
-    },
-
-    {
-      name: 'succeeds-with-test-processor',
-      async run({ http, assert, config, accounts, firestore, waitFor, skip }) {
-        const uid = accounts['journey-payments-portal-route'].uid;
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices?.monthly);
-        if (!paidProduct) {
-          skip('No paid product with monthly price configured in this brand');
-        }
-
-        // Set up a paid subscription with the test processor
-        const intentResponse = await http.as('journey-payments-portal-route').post('backend-manager/payments/intent', {
-          processor: 'test',
-          productId: paidProduct.id,
-          frequency: 'monthly',
-        });
-
-        assert.isSuccess(intentResponse, 'Intent should succeed');
-
-        // Wait for the auto-webhook to activate the subscription
-        await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${uid}`);
-          return userDoc?.subscription?.payment?.processor === 'test'
-            && userDoc?.subscription?.status === 'active';
-        }, 15000, 500);
-
-        // Call the portal endpoint
-        const portalResponse = await http.as('journey-payments-portal-route').post('backend-manager/payments/portal', {
-          returnUrl: 'https://example.com/account',
-        });
-
-        assert.isSuccess(portalResponse, 'Portal should succeed');
-        assert.ok(portalResponse.data.url, 'Should return a URL');
-      },
-    },
-  ],
-};

package/test/routes/payments/refund.js

@@ -1,179 +0,0 @@
-/**
- * Test: POST /payments/refund
- * Tests rejection cases and a full end-to-end refund flow with the test processor.
- *
- * Refund requires the subscription to be cancelled or pending cancellation.
- * The test processor simulates refund by writing a customer.subscription.deleted
- * webhook which triggers the existing pipeline.
- */
-module.exports = {
-  description: 'Payment refund endpoint',
-  type: 'group',
-  timeout: 30000,
-
-  tests: [
-    {
-      name: 'rejects-unauthenticated',
-      async run({ http, assert }) {
-        const response = await http.as('none').post('backend-manager/payments/refund', {
-          confirmed: true,
-          reason: 'Too expensive',
-        });
-
-        assert.isError(response, 401, 'Should reject unauthenticated request');
-      },
-    },
-
-    {
-      name: 'rejects-missing-confirmed',
-      async run({ http, assert }) {
-        const response = await http.as('basic').post('backend-manager/payments/refund', {
-          reason: 'Too expensive',
-        });
-
-        assert.isError(response, 400, 'Should reject missing confirmed field');
-      },
-    },
-
-    {
-      name: 'rejects-missing-reason',
-      async run({ http, assert }) {
-        const response = await http.as('basic').post('backend-manager/payments/refund', {
-          confirmed: true,
-        });
-
-        assert.isError(response, 400, 'Should reject missing reason field');
-      },
-    },
-
-    {
-      name: 'rejects-basic-user',
-      async run({ http, assert }) {
-        const response = await http.as('basic').post('backend-manager/payments/refund', {
-          confirmed: true,
-          reason: 'Too expensive',
-        });
-
-        assert.isError(response, 400, 'Should reject basic user with no paid subscription');
-      },
-    },
-
-    {
-      name: 'rejects-active-subscription-without-cancellation',
-      async run({ http, assert }) {
-        // refund-active-no-cancel has an active subscription without pending cancellation
-        const response = await http.as('refund-active-no-cancel').post('backend-manager/payments/refund', {
-          confirmed: true,
-          reason: 'Too expensive',
-        });
-
-        assert.isError(response, 400, 'Should reject active subscription that is not cancelled or pending cancellation');
-      },
-    },
-
-    {
-      name: 'rejects-payment-older-than-6-months',
-      async run({ http, assert }) {
-        // refund-expired-payment has a cancelled subscription with a payment older than 6 months
-        const response = await http.as('refund-expired-payment').post('backend-manager/payments/refund', {
-          confirmed: true,
-          reason: 'Too expensive',
-        });
-
-        assert.isError(response, 400, 'Should reject payment older than 6 months');
-      },
-    },
-
-    {
-      name: 'rejects-no-processor-or-resource-id',
-      async run({ http, assert }) {
-        // refund-no-processor has a cancelled subscription but no processor
-        const response = await http.as('refund-no-processor').post('backend-manager/payments/refund', {
-          confirmed: true,
-          reason: 'Too expensive',
-        });
-
-        assert.isError(response, 400, 'Should reject when no processor or resourceId is set');
-      },
-    },
-
-    {
-      name: 'rejects-unknown-processor',
-      async run({ http, assert }) {
-        // refund-unknown-processor has a cancelled subscription with unknown processor
-        const response = await http.as('refund-unknown-processor').post('backend-manager/payments/refund', {
-          confirmed: true,
-          reason: 'Too expensive',
-        });
-
-        assert.isError(response, 400, 'Should reject unknown processor');
-      },
-    },
-
-    {
-      name: 'succeeds-with-test-processor',
-      async run({ http, assert, config, accounts, firestore, waitFor, skip }) {
-        const uid = accounts['route-refund-success'].uid;
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices?.monthly);
-        if (!paidProduct) {
-          skip('No paid product with monthly price configured in this brand');
-        }
-
-        // Step 1: Create a test subscription intent to set up a proper paid subscription
-        const intentResponse = await http.as('route-refund-success').post('backend-manager/payments/intent', {
-          processor: 'test',
-          productId: paidProduct.id,
-          frequency: 'monthly',
-        });
-
-        assert.isSuccess(intentResponse, 'Intent should succeed');
-
-        // Wait for the auto-webhook to activate the subscription
-        await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${uid}`);
-          return userDoc?.subscription?.payment?.processor === 'test'
-            && userDoc?.subscription?.payment?.resourceId
-            && userDoc?.subscription?.status === 'active';
-        }, 15000, 500);
-
-        // Step 2: Cancel the subscription first (refund requires cancellation).
-        // skipGuards bypasses the 24-hour subscription-age guard on the cancel route.
-        const cancelResponse = await http.as('route-refund-success').post('backend-manager/payments/cancel', {
-          confirmed: true,
-          reason: 'Too expensive',
-          skipGuards: true,
-        });
-
-        assert.isSuccess(cancelResponse, 'Cancel should succeed');
-
-        // Wait for cancellation.pending to be set via the webhook pipeline
-        await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${uid}`);
-          return userDoc?.subscription?.cancellation?.pending === true;
-        }, 15000, 500);
-
-        // Step 3: Request a refund
-        const refundResponse = await http.as('route-refund-success').post('backend-manager/payments/refund', {
-          confirmed: true,
-          reason: 'Not satisfied with the service',
-          feedback: 'Testing refund flow',
-        });
-
-        assert.isSuccess(refundResponse, 'Refund should succeed');
-        assert.ok(refundResponse.data.success, 'Should return success: true');
-        assert.ok(refundResponse.data.refund, 'Should return refund details');
-        assert.isType(refundResponse.data.refund.amount, 'number', 'Refund amount should be a number');
-        assert.equal(refundResponse.data.refund.full, true, 'Should be a full refund (test processor)');
-
-        // Step 4: Verify subscription is cancelled via the webhook pipeline
-        await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${uid}`);
-          return userDoc?.subscription?.status === 'cancelled';
-        }, 15000, 500);
-
-        const userDoc = await firestore.get(`users/${uid}`);
-        assert.equal(userDoc?.subscription?.status, 'cancelled', 'Subscription should be cancelled after refund');
-      },
-    },
-  ],
-};

package/test/routes/payments/trial-eligibility.js

@@ -1,71 +0,0 @@
-/**
- * Test: GET /payments/trial-eligibility
- * Tests trial eligibility check based on subscription order history
- */
-module.exports = {
-  description: 'Trial eligibility check',
-  type: 'group',
-  timeout: 15000,
-
-  tests: [
-    {
-      name: 'rejects-unauthenticated',
-      async run({ http, assert }) {
-        const response = await http.as('none').get('backend-manager/payments/trial-eligibility');
-
-        assert.isError(response, 401, 'Should reject unauthenticated request');
-      },
-    },
-
-    {
-      name: 'eligible-when-no-orders',
-      async run({ http, assert }) {
-        // Basic user with no subscription history should be eligible
-        const response = await http.as('basic').get('backend-manager/payments/trial-eligibility');
-
-        assert.isSuccess(response, 'Should succeed for authenticated user');
-        assert.equal(response.data.eligible, true, 'Should be eligible with no order history');
-      },
-    },
-
-    {
-      name: 'ineligible-when-has-subscription-history',
-      async run({ http, assert, accounts, firestore }) {
-        const uid = accounts['basic'].uid;
-        const orderDocPath = `payments-orders/_test-trial-eligibility-${uid}`;
-
-        // Create fake subscription order history
-        await firestore.set(orderDocPath, { owner: uid, type: 'subscription', processor: 'test', status: 'cancelled' });
-
-        try {
-          const response = await http.as('basic').get('backend-manager/payments/trial-eligibility');
-
-          assert.isSuccess(response, 'Should succeed for authenticated user');
-          assert.equal(response.data.eligible, false, 'Should be ineligible with subscription history');
-        } finally {
-          await firestore.delete(orderDocPath);
-        }
-      },
-    },
-
-    {
-      name: 'eligible-when-only-non-subscription-orders',
-      async run({ http, assert, accounts, firestore }) {
-        const uid = accounts['basic'].uid;
-        const orderDocPath = `payments-orders/_test-trial-eligibility-onetime-${uid}`;
-
-        // Create a non-subscription order (one-time purchase)
-        await firestore.set(orderDocPath, { owner: uid, type: 'one-time', processor: 'test', status: 'completed' });
-
-        try {
-          const response = await http.as('basic').get('backend-manager/payments/trial-eligibility');
-
-          assert.isSuccess(response, 'Should succeed for authenticated user');
-          assert.equal(response.data.eligible, true, 'Should be eligible — only non-subscription orders');
-        } finally {
-          await firestore.delete(orderDocPath);
-        }
-      },
-    },
-  ],
-};