backend-manager 5.9.5 → 5.9.7

package/test/routes/payments/cancel.js

@@ -1,163 +0,0 @@
-/**
- * Test: POST /payments/cancel - Validation errors
- * Tests rejection cases before any processor call is made.
- * See test/events/payments/journey-payments-cancel-endpoint.js for the full end-to-end journey.
- */
-module.exports = {
-  description: 'Payment cancel endpoint: validation errors',
-  type: 'group',
-  timeout: 15000,
-
-  tests: [
-    {
-      name: 'rejects-unauthenticated',
-      async run({ http, assert }) {
-        const response = await http.as('none').post('backend-manager/payments/cancel', {
-          confirmed: true,
-        });
-
-        assert.isError(response, 401, 'Should reject unauthenticated request');
-      },
-    },
-
-    {
-      name: 'rejects-missing-confirmed',
-      async run({ http, assert }) {
-        const response = await http.as('basic').post('backend-manager/payments/cancel', {
-          reason: 'Too expensive',
-        });
-
-        assert.isError(response, 400, 'Should reject missing confirmed field');
-      },
-    },
-
-    {
-      name: 'rejects-basic-user',
-      async run({ http, assert }) {
-        const response = await http.as('basic').post('backend-manager/payments/cancel', {
-          confirmed: true,
-        });
-
-        assert.isError(response, 400, 'Should reject basic user with no paid subscription');
-      },
-    },
-
-    {
-      name: 'rejects-no-processor-or-resource-id',
-      async run({ http, assert }) {
-        // cancel-no-processor starts with payment.processor=null
-        const response = await http.as('cancel-no-processor').post('backend-manager/payments/cancel', {
-          confirmed: true,
-        });
-
-        assert.isError(response, 400, 'Should reject when no processor or resourceId is set');
-      },
-    },
-
-    {
-      name: 'rejects-already-pending-cancellation',
-      async run({ http, assert }) {
-        // cancel-already-pending starts with cancellation.pending=true
-        const response = await http.as('cancel-already-pending').post('backend-manager/payments/cancel', {
-          confirmed: true,
-        });
-
-        assert.isError(response, 400, 'Should reject when cancellation already pending');
-      },
-    },
-
-    {
-      name: 'rejects-subscription-younger-than-24-hours',
-      async run({ http, assert }) {
-        // cancel-too-young starts with startDate set to now (< 24 hours old)
-        const response = await http.as('cancel-too-young').post('backend-manager/payments/cancel', {
-          confirmed: true,
-        });
-
-        assert.isError(response, 400, 'Should reject subscription younger than 24 hours');
-      },
-    },
-
-    {
-      name: 'rejects-unknown-processor',
-      async run({ http, assert }) {
-        // cancel-unknown-processor starts with processor='unknown-processor'
-        const response = await http.as('cancel-unknown-processor').post('backend-manager/payments/cancel', {
-          confirmed: true,
-        });
-
-        assert.isError(response, 400, 'Should reject unknown processor');
-      },
-    },
-
-    {
-      name: 'allows-suspended-subscription',
-      async run({ http, assert, config, accounts, firestore, waitFor, skip }) {
-        const uid = accounts['cancel-suspended'].uid;
-
-        const response = await http.as('cancel-suspended').post('backend-manager/payments/cancel', {
-          confirmed: true,
-          reason: 'Subscription was suspended',
-          skipGuards: true,
-        });
-
-        assert.isSuccess(response, 'Should allow cancelling a suspended subscription');
-        assert.equal(response.data.success, true, 'Should return success: true');
-
-        // Verify the subscription was reset to cancelled (via fallback or webhook)
-        await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${uid}`);
-          return userDoc?.subscription?.status === 'cancelled'
-            || userDoc?.subscription?.cancellation?.pending === true;
-        }, 15000, 500);
-      },
-    },
-
-    {
-      name: 'succeeds-with-test-processor',
-      async run({ http, assert, config, accounts, firestore, waitFor, skip }) {
-        const uid = accounts['route-cancel-success'].uid;
-        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices?.monthly);
-        if (!paidProduct) {
-          skip('No paid product with monthly price configured in this brand');
-        }
-
-        // Step 1: Create a test subscription intent to set up a proper paid subscription
-        const intentResponse = await http.as('route-cancel-success').post('backend-manager/payments/intent', {
-          processor: 'test',
-          productId: paidProduct.id,
-          frequency: 'monthly',
-        });
-
-        assert.isSuccess(intentResponse, 'Intent should succeed');
-
-        // Wait for the auto-webhook to activate the subscription
-        await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${uid}`);
-          return userDoc?.subscription?.payment?.processor === 'test'
-            && userDoc?.subscription?.payment?.resourceId
-            && userDoc?.subscription?.status === 'active';
-        }, 15000, 500);
-
-        // Step 2: Call the cancel endpoint (skipGuards bypasses the 24-hour age guard)
-        const cancelResponse = await http.as('route-cancel-success').post('backend-manager/payments/cancel', {
-          confirmed: true,
-          reason: 'Too expensive',
-          skipGuards: true,
-        });
-
-        assert.isSuccess(cancelResponse, 'Cancel should succeed');
-        assert.equal(cancelResponse.data.success, true, 'Should return success: true');
-
-        // Step 3: Verify cancellation.pending was set via the webhook pipeline
-        await waitFor(async () => {
-          const userDoc = await firestore.get(`users/${uid}`);
-          return userDoc?.subscription?.cancellation?.pending === true;
-        }, 15000, 500);
-
-        const userDoc = await firestore.get(`users/${uid}`);
-        assert.equal(userDoc?.subscription?.cancellation?.pending, true, 'Cancellation should be pending');
-      },
-    },
-  ],
-};

package/test/routes/payments/discount.js

@@ -1,80 +0,0 @@
-/**
- * Test: GET /payments/discount
- * Tests discount code validation endpoint
- */
-module.exports = {
-  description: 'Discount code validation',
-  type: 'group',
-  timeout: 15000,
-
-  tests: [
-    {
-      name: 'rejects-missing-code',
-      async run({ http, assert }) {
-        const response = await http.as('none').get('backend-manager/payments/discount');
-
-        assert.isError(response, 400, 'Should reject missing code');
-      },
-    },
-
-    {
-      name: 'returns-valid-for-known-code',
-      async run({ http, assert }) {
-        const response = await http.as('none').get('backend-manager/payments/discount', {
-          code: 'FLASH20',
-        });
-
-        assert.isSuccess(response, 'Should succeed for valid code');
-        assert.equal(response.data.valid, true, 'Should be valid');
-        assert.equal(response.data.code, 'FLASH20', 'Should return normalized code');
-        assert.equal(response.data.percent, 20, 'Should return correct percent');
-        assert.equal(response.data.duration, 'once', 'Should return duration');
-      },
-    },
-
-    {
-      name: 'returns-valid-case-insensitive',
-      async run({ http, assert }) {
-        const response = await http.as('none').get('backend-manager/payments/discount', {
-          code: 'flash20',
-        });
-
-        assert.isSuccess(response, 'Should succeed for lowercase code');
-        assert.equal(response.data.valid, true, 'Should be valid (case-insensitive)');
-        assert.equal(response.data.code, 'FLASH20', 'Should return uppercase code');
-      },
-    },
-
-    {
-      name: 'returns-invalid-for-unknown-code',
-      async run({ http, assert }) {
-        const response = await http.as('none').get('backend-manager/payments/discount', {
-          code: 'NOTAREALCODE',
-        });
-
-        assert.isSuccess(response, 'Should return 200 even for invalid code');
-        assert.equal(response.data.valid, false, 'Should be invalid');
-      },
-    },
-
-    {
-      name: 'validates-all-known-codes',
-      async run({ http, assert }) {
-        const codes = [
-          { code: 'FLASH20', percent: 20 },
-          { code: 'SAVE10', percent: 10 },
-          { code: 'WELCOME15', percent: 15 },
-        ];
-
-        for (const { code, percent } of codes) {
-          const response = await http.as('none').get('backend-manager/payments/discount', { code });
-
-          assert.isSuccess(response, `Should succeed for ${code}`);
-          assert.equal(response.data.valid, true, `${code} should be valid`);
-          assert.equal(response.data.percent, percent, `${code} should be ${percent}%`);
-          assert.equal(response.data.duration, 'once', `${code} should be once`);
-        }
-      },
-    },
-  ],
-};

package/test/routes/payments/dispute-alert.js

@@ -1,320 +0,0 @@
-/**
- * Test: POST /payments/dispute-alert
- * Tests the dispute alert endpoint validates requests and saves to Firestore
- */
-module.exports = {
-  description: 'Dispute alert endpoint',
-  type: 'group',
-  timeout: 30000,
-
-  tests: [
-    {
-      name: 'rejects-missing-key',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.as('none').post('backend-manager/payments/dispute-alert', {});
-
-        assert.isError(response, 401, 'Should reject missing key');
-      },
-    },
-
-    {
-      name: 'rejects-invalid-key',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.as('none').post('backend-manager/payments/dispute-alert?key=wrong-key', {});
-
-        assert.isError(response, 401, 'Should reject invalid key');
-      },
-    },
-
-    {
-      name: 'rejects-unknown-provider',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?provider=unknown&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: '_test-dispute-unknown-provider',
-          card: '4242',
-          amount: 9.99,
-          transactionDate: '2026-01-15',
-        });
-
-        assert.isError(response, 400, 'Should reject unknown alert provider');
-      },
-    },
-
-    {
-      name: 'rejects-missing-id',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          card: '4242',
-          amount: 9.99,
-          transactionDate: '2026-01-15',
-        });
-
-        assert.isError(response, 400, 'Should reject missing id');
-      },
-    },
-
-    {
-      name: 'rejects-missing-card',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: '_test-dispute-no-card',
-          amount: 9.99,
-          transactionDate: '2026-01-15',
-        });
-
-        assert.isError(response, 400, 'Should reject missing card');
-      },
-    },
-
-    {
-      name: 'rejects-missing-amount',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: '_test-dispute-no-amount',
-          card: '4242',
-          transactionDate: '2026-01-15',
-        });
-
-        assert.isError(response, 400, 'Should reject missing amount');
-      },
-    },
-
-    {
-      name: 'rejects-missing-transaction-date',
-      auth: 'none',
-      async run({ http, assert }) {
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: '_test-dispute-no-date',
-          card: '4242',
-          amount: 9.99,
-        });
-
-        assert.isError(response, 400, 'Should reject missing transactionDate');
-      },
-    },
-
-    {
-      name: 'accepts-valid-chargeblast-alert',
-      auth: 'none',
-      async run({ http, assert, firestore }) {
-        const alertId = '_test-dispute-valid';
-
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: alertId,
-          card: '4242424242424242',
-          cardBrand: 'Visa',
-          amount: 29.99,
-          transactionDate: '2026-03-07 14:30:00',
-          processor: 'stripe',
-          alertType: 'FRAUD',
-          customerEmail: 'test@example.com',
-          externalOrder: 'ch_test123',
-          metadata: 'pi_test456',
-          externalUrl: 'https://dashboard.stripe.com/charges/ch_test123',
-          reasonCode: 'WIP',
-          subprovider: 'Ethoca',
-          isRefunded: false,
-        });
-
-        assert.isSuccess(response, 'Should accept valid Chargeblast alert');
-        assert.equal(response.data.received, true, 'Should confirm receipt');
-
-        // Verify doc was saved to Firestore
-        const doc = await firestore.get(`payments-disputes/${alertId}`);
-        assert.ok(doc, 'Dispute doc should exist in Firestore');
-        assert.equal(doc.provider, 'chargeblast', 'Provider should be chargeblast');
-        assert.ok(
-          doc.status === 'pending' || doc.status === 'processing',
-          'Status should be pending or processing',
-        );
-
-        // Verify core normalized alert data
-        assert.equal(doc.alert.card.last4, '4242', 'Should extract last4 from full card number');
-        assert.equal(doc.alert.card.brand, 'visa', 'Should lowercase card brand');
-        assert.equal(doc.alert.amount, 29.99, 'Amount should be preserved');
-        assert.equal(doc.alert.transactionDate, '2026-03-07', 'Should extract date without time');
-        assert.equal(doc.alert.processor, 'stripe', 'Processor should be stripe');
-
-        // Verify new normalized fields
-        assert.equal(doc.alert.alertType, 'FRAUD', 'Alert type should be preserved');
-        assert.equal(doc.alert.customerEmail, 'test@example.com', 'Customer email should be preserved');
-        assert.equal(doc.alert.chargeId, 'ch_test123', 'Charge ID should be extracted from externalOrder');
-        assert.equal(doc.alert.paymentIntentId, 'pi_test456', 'Payment intent ID should be extracted from metadata');
-        assert.equal(doc.alert.stripeUrl, 'https://dashboard.stripe.com/charges/ch_test123', 'Stripe URL should be preserved');
-        assert.equal(doc.alert.reasonCode, 'WIP', 'Reason code should be preserved');
-        assert.equal(doc.alert.subprovider, 'Ethoca', 'Subprovider should be preserved');
-        assert.equal(doc.alert.isRefunded, false, 'isRefunded should be preserved');
-
-        // Verify raw payload is preserved
-        assert.ok(doc.raw, 'Raw payload should be preserved');
-        assert.equal(doc.raw.id, alertId, 'Raw id should match');
-      },
-    },
-
-    {
-      name: 'accepts-alert-with-alertId-field',
-      auth: 'none',
-      async run({ http, assert, firestore }) {
-        const alertId = '_test-dispute-alertid-field';
-
-        // Chargeblast alert.created events use alertId instead of id
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          alertId: alertId,
-          card: '546616******5805',
-          cardBrand: 'Mastercard',
-          amount: 8,
-          transactionDate: '2026-03-19 00:00:00.000000Z',
-        });
-
-        assert.isSuccess(response, 'Should accept alert using alertId field');
-
-        const doc = await firestore.get(`payments-disputes/${alertId}`);
-        assert.ok(doc, 'Dispute doc should exist in Firestore');
-        assert.equal(doc.id, alertId, 'Doc ID should match alertId');
-        assert.equal(doc.alert.id, alertId, 'Alert id should be set from alertId');
-        assert.equal(doc.alert.card.last4, '5805', 'Should extract last4 from masked card');
-      },
-    },
-
-    {
-      name: 'accepts-alert-without-optional-fields',
-      auth: 'none',
-      async run({ http, assert, firestore }) {
-        const alertId = '_test-dispute-minimal';
-
-        // Send minimal alert (alert.created shape — no externalOrder, metadata, etc.)
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: alertId,
-          card: '9124',
-          amount: 10,
-          transactionDate: '2026-03-21 00:01:02',
-        });
-
-        assert.isSuccess(response, 'Should accept minimal alert');
-
-        const doc = await firestore.get(`payments-disputes/${alertId}`);
-        assert.equal(doc.alert.card.last4, '9124', 'Should use card as last4');
-        assert.equal(doc.alert.processor, 'stripe', 'Processor should default to stripe');
-        assert.equal(doc.alert.chargeId, null, 'Charge ID should be null when not provided');
-        assert.equal(doc.alert.paymentIntentId, null, 'Payment intent should be null when not provided');
-        assert.equal(doc.alert.customerEmail, null, 'Customer email should be null when not provided');
-        assert.equal(doc.alert.alertType, null, 'Alert type should be null when not provided');
-        assert.equal(doc.alert.stripeUrl, null, 'Stripe URL should be null when not provided');
-        assert.equal(doc.alert.reasonCode, null, 'Reason code should be null when not provided');
-        assert.equal(doc.alert.subprovider, null, 'Subprovider should be null when not provided');
-        assert.equal(doc.alert.isRefunded, false, 'isRefunded should default to false');
-      },
-    },
-
-    {
-      name: 'accepts-alert-with-last4-only',
-      auth: 'none',
-      async run({ http, assert, firestore }) {
-        const alertId = '_test-dispute-last4';
-
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: alertId,
-          card: '1234',
-          amount: 9.99,
-          transactionDate: '2026-01-15',
-        });
-
-        assert.isSuccess(response, 'Should accept alert with card last4 only');
-
-        const doc = await firestore.get(`payments-disputes/${alertId}`);
-        assert.equal(doc.alert.card.last4, '1234', 'Should use card value as last4 when already 4 digits');
-        assert.equal(doc.alert.processor, 'stripe', 'Processor should default to stripe');
-      },
-    },
-
-    {
-      name: 'deduplicates-dispute-alerts',
-      auth: 'none',
-      async run({ http, assert, firestore }) {
-        const alertId = '_test-dispute-duplicate';
-
-        // Pre-seed an in-flight dispute directly. We seed (rather than POST a first alert)
-        // because the route fires an async on-write trigger that, for synthetic test data
-        // with no matching charge, can transition the doc to 'failed' — at which point the
-        // dedup contract intentionally treats it as RETRYABLE, not a duplicate. Racing a
-        // live POST against that trigger made this test flaky. Seeding 'processing' (a
-        // non-failed, in-flight state) deterministically exercises the dedup path.
-        await firestore.set(`payments-disputes/${alertId}`, {
-          id: alertId,
-          status: 'processing',
-        });
-
-        // A subsequent identical alert must be reported as a duplicate (not reprocessed).
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: alertId,
-          card: '4242',
-          amount: 29.99,
-          transactionDate: '2026-03-07',
-        });
-
-        assert.isSuccess(response, 'Duplicate should still return 200');
-        assert.equal(response.data.duplicate, true, 'Should indicate duplicate');
-      },
-    },
-
-    {
-      name: 'retries-failed-alerts',
-      auth: 'none',
-      async run({ http, assert, firestore }) {
-        const alertId = '_test-dispute-retry';
-
-        // Pre-seed a failed dispute
-        await firestore.set(`payments-disputes/${alertId}`, {
-          id: alertId,
-          status: 'failed',
-          error: 'Previous error',
-        });
-
-        // Send alert with same ID — should retry since previous status was 'failed'
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: alertId,
-          card: '4242',
-          amount: 29.99,
-          transactionDate: '2026-03-07',
-        });
-
-        assert.isSuccess(response, 'Should accept retry of failed alert');
-        assert.ok(!response.data.duplicate, 'Should not indicate duplicate for failed retry');
-
-        // Verify doc was updated
-        const doc = await firestore.get(`payments-disputes/${alertId}`);
-        assert.ok(
-          doc.status === 'pending' || doc.status === 'processing',
-          'Status should be pending or processing after retry',
-        );
-      },
-    },
-
-    {
-      name: 'defaults-provider-to-chargeblast',
-      auth: 'none',
-      async run({ http, assert, firestore }) {
-        const alertId = '_test-dispute-default-provider';
-
-        // Send without provider query param
-        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
-          id: alertId,
-          card: '4242',
-          amount: 9.99,
-          transactionDate: '2026-01-15',
-        });
-
-        assert.isSuccess(response, 'Should accept without explicit provider param');
-
-        const doc = await firestore.get(`payments-disputes/${alertId}`);
-        assert.equal(doc.provider, 'chargeblast', 'Provider should default to chargeblast');
-      },
-    },
-  ],
-};