backend-manager 5.9.4 → 5.9.6

package/test/routes/payments/webhook.js

@@ -1,107 +0,0 @@
-/**
- * Test: POST /payments/webhook
- * Tests the webhook endpoint validates requests and saves to Firestore
- */
-const { TEST_ACCOUNTS } = require('../../../src/test/test-accounts.js');
-
-module.exports = {
-  description: 'Payment webhook endpoint',
-  type: 'group',
-  timeout: 30000,
-
-  tests: [
-    {
-      name: 'rejects-missing-processor',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.as('none').post('backend-manager/payments/webhook', {});
-
-        assert.isError(response, 400, 'Should reject missing processor');
-      },
-    },
-
-    {
-      name: 'rejects-invalid-key',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.as('none').post('backend-manager/payments/webhook?processor=stripe&key=wrong-key', {});
-
-        assert.isError(response, 401, 'Should reject invalid key');
-      },
-    },
-
-    {
-      name: 'rejects-unknown-processor',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.as('none').post(`backend-manager/payments/webhook?processor=unknown&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: 'evt_test_unknown',
-          type: 'test.event',
-          data: { object: {} },
-        });
-
-        assert.isError(response, 400, 'Should reject unknown processor');
-      },
-    },
-
-    {
-      name: 'accepts-valid-stripe-webhook',
-      auth: 'none',
-      async run({ http, assert, firestore }) {
-        const eventId = '_test-evt-valid-webhook';
-
-        const response = await http.as('none').post(`backend-manager/payments/webhook?processor=stripe&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: eventId,
-          type: 'customer.subscription.updated',
-          data: {
-            object: {
-              id: 'sub_test_valid',
-              metadata: { uid: TEST_ACCOUNTS.basic.uid },
-              status: 'active',
-            },
-          },
-        });
-
-        assert.isSuccess(response, 'Should accept valid webhook');
-        assert.equal(response.data.received, true, 'Should confirm receipt');
-
-        // Verify doc was saved to Firestore
-        const doc = await firestore.get(`payments-webhooks/${eventId}`);
-        assert.ok(doc, 'Webhook doc should exist in Firestore');
-        assert.equal(doc.processor, 'stripe', 'Processor should be stripe');
-        assert.ok(
-          doc.status === 'pending' || doc.status === 'processing' || doc.status === 'completed' || doc.status === 'failed',
-          'Status should be pending, processing, completed, or failed',
-        );
-      },
-    },
-
-    {
-      name: 'deduplicates-webhook-events',
-      auth: 'none',
-      async run({ http, assert, firestore }) {
-        const eventId = '_test-evt-duplicate';
-
-        // Use the test processor so the on-write trigger doesn't require STRIPE_SECRET_KEY
-        // (a failed first webhook would let the dedup-retry branch fire instead of returning duplicate=true)
-        const send = () => http.as('none').post(`backend-manager/payments/webhook?processor=test&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: eventId,
-          type: 'customer.subscription.updated',
-          data: {
-            object: {
-              id: 'sub_test_dup',
-              metadata: { uid: TEST_ACCOUNTS.basic.uid },
-              status: 'active',
-            },
-          },
-        });
-
-        await send();
-        const response = await send();
-
-        assert.isSuccess(response, 'Duplicate should still return 200');
-        assert.equal(response.data.duplicate, true, 'Should indicate duplicate');
-      },
-    },
-  ],
-};

package/test/routes/test/authenticate.js

@@ -1,59 +0,0 @@
-/**
- * Test: test/authenticate
- * Tests different authentication methods using new RESTful API
- */
-module.exports = {
-  description: 'Authentication methods (RESTful)',
-  type: 'group',
-  tests: [
-    // Test 1: Unauthenticated request
-    {
-      name: 'no-auth',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.get('backend-manager/test/authenticate');
-
-        assert.isSuccess(response, 'Should succeed without auth');
-        assert.equal(response.data.user.authenticated, false, 'User should not be authenticated');
-      },
-    },
-
-    // Test 2: Private key authentication
-    {
-      name: 'private-key',
-      auth: 'basic',
-      async run({ http, assert, accounts }) {
-        const response = await http.as('basic').get('backend-manager/test/authenticate');
-
-        assert.isSuccess(response, 'Should succeed with privateKey');
-        assert.equal(response.data.user.authenticated, true, 'User should be authenticated');
-        assert.equal(response.data.user.auth.uid, accounts.basic.uid, 'UID should match');
-      },
-    },
-
-    // Test 3: Invalid private key
-    {
-      name: 'invalid-private-key',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.withPrivateKey('invalid-key-12345').get('backend-manager/test/authenticate');
-
-        assert.isSuccess(response, 'Should succeed but not authenticate');
-        assert.equal(response.data.user.authenticated, false, 'Invalid key should not authenticate');
-      },
-    },
-
-    // Test 4: Admin (backendManagerKey) authentication
-    {
-      name: 'backend-manager-key',
-      auth: 'admin',
-      async run({ http, assert }) {
-        const response = await http.as('admin').get('backend-manager/test/authenticate');
-
-        assert.isSuccess(response, 'Should succeed with backendManagerKey');
-        assert.equal(response.data.user.authenticated, true, 'User should be authenticated');
-        assert.equal(response.data.user.roles?.admin, true, 'Should have admin role');
-      },
-    },
-  ],
-};