backend-manager 5.9.7 → 5.9.8

package/test/routes/payments/webhook.js

@@ -0,0 +1,107 @@
+/**
+ * Test: POST /payments/webhook
+ * Tests the webhook endpoint validates requests and saves to Firestore
+ */
+const { TEST_ACCOUNTS } = require('../../../src/test/test-accounts.js');
+
+module.exports = {
+  description: 'Payment webhook endpoint',
+  type: 'group',
+  timeout: 30000,
+
+  tests: [
+    {
+      name: 'rejects-missing-processor',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.as('none').post('backend-manager/payments/webhook', {});
+
+        assert.isError(response, 400, 'Should reject missing processor');
+      },
+    },
+
+    {
+      name: 'rejects-invalid-key',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.as('none').post('backend-manager/payments/webhook?processor=stripe&key=wrong-key', {});
+
+        assert.isError(response, 401, 'Should reject invalid key');
+      },
+    },
+
+    {
+      name: 'rejects-unknown-processor',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.as('none').post(`backend-manager/payments/webhook?processor=unknown&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: 'evt_test_unknown',
+          type: 'test.event',
+          data: { object: {} },
+        });
+
+        assert.isError(response, 400, 'Should reject unknown processor');
+      },
+    },
+
+    {
+      name: 'accepts-valid-stripe-webhook',
+      auth: 'none',
+      async run({ http, assert, firestore }) {
+        const eventId = '_test-evt-valid-webhook';
+
+        const response = await http.as('none').post(`backend-manager/payments/webhook?processor=stripe&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: eventId,
+          type: 'customer.subscription.updated',
+          data: {
+            object: {
+              id: 'sub_test_valid',
+              metadata: { uid: TEST_ACCOUNTS.basic.uid },
+              status: 'active',
+            },
+          },
+        });
+
+        assert.isSuccess(response, 'Should accept valid webhook');
+        assert.equal(response.data.received, true, 'Should confirm receipt');
+
+        // Verify doc was saved to Firestore
+        const doc = await firestore.get(`payments-webhooks/${eventId}`);
+        assert.ok(doc, 'Webhook doc should exist in Firestore');
+        assert.equal(doc.processor, 'stripe', 'Processor should be stripe');
+        assert.ok(
+          doc.status === 'pending' || doc.status === 'processing' || doc.status === 'completed' || doc.status === 'failed',
+          'Status should be pending, processing, completed, or failed',
+        );
+      },
+    },
+
+    {
+      name: 'deduplicates-webhook-events',
+      auth: 'none',
+      async run({ http, assert, firestore }) {
+        const eventId = '_test-evt-duplicate';
+
+        // Use the test processor so the on-write trigger doesn't require STRIPE_SECRET_KEY
+        // (a failed first webhook would let the dedup-retry branch fire instead of returning duplicate=true)
+        const send = () => http.as('none').post(`backend-manager/payments/webhook?processor=test&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: eventId,
+          type: 'customer.subscription.updated',
+          data: {
+            object: {
+              id: 'sub_test_dup',
+              metadata: { uid: TEST_ACCOUNTS.basic.uid },
+              status: 'active',
+            },
+          },
+        });
+
+        await send();
+        const response = await send();
+
+        assert.isSuccess(response, 'Duplicate should still return 200');
+        assert.equal(response.data.duplicate, true, 'Should indicate duplicate');
+      },
+    },
+  ],
+};

package/test/routes/test/authenticate.js

@@ -0,0 +1,59 @@
+/**
+ * Test: test/authenticate
+ * Tests different authentication methods using new RESTful API
+ */
+module.exports = {
+  description: 'Authentication methods (RESTful)',
+  type: 'group',
+  tests: [
+    // Test 1: Unauthenticated request
+    {
+      name: 'no-auth',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.get('backend-manager/test/authenticate');
+
+        assert.isSuccess(response, 'Should succeed without auth');
+        assert.equal(response.data.user.authenticated, false, 'User should not be authenticated');
+      },
+    },
+
+    // Test 2: Private key authentication
+    {
+      name: 'private-key',
+      auth: 'basic',
+      async run({ http, assert, accounts }) {
+        const response = await http.as('basic').get('backend-manager/test/authenticate');
+
+        assert.isSuccess(response, 'Should succeed with privateKey');
+        assert.equal(response.data.user.authenticated, true, 'User should be authenticated');
+        assert.equal(response.data.user.auth.uid, accounts.basic.uid, 'UID should match');
+      },
+    },
+
+    // Test 3: Invalid private key
+    {
+      name: 'invalid-private-key',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.withPrivateKey('invalid-key-12345').get('backend-manager/test/authenticate');
+
+        assert.isSuccess(response, 'Should succeed but not authenticate');
+        assert.equal(response.data.user.authenticated, false, 'Invalid key should not authenticate');
+      },
+    },
+
+    // Test 4: Admin (backendManagerKey) authentication
+    {
+      name: 'backend-manager-key',
+      auth: 'admin',
+      async run({ http, assert }) {
+        const response = await http.as('admin').get('backend-manager/test/authenticate');
+
+        assert.isSuccess(response, 'Should succeed with backendManagerKey');
+        assert.equal(response.data.user.authenticated, true, 'User should be authenticated');
+        assert.equal(response.data.user.roles?.admin, true, 'Should have admin role');
+      },
+    },
+  ],
+};