backend-manager 5.9.7 → 5.9.9

package/test/routes/payments/cancel.js

@@ -0,0 +1,163 @@
+/**
+ * Test: POST /payments/cancel - Validation errors
+ * Tests rejection cases before any processor call is made.
+ * See test/events/payments/journey-payments-cancel-endpoint.js for the full end-to-end journey.
+ */
+module.exports = {
+  description: 'Payment cancel endpoint: validation errors',
+  type: 'group',
+  timeout: 15000,
+
+  tests: [
+    {
+      name: 'rejects-unauthenticated',
+      async run({ http, assert }) {
+        const response = await http.as('none').post('backend-manager/payments/cancel', {
+          confirmed: true,
+        });
+
+        assert.isError(response, 401, 'Should reject unauthenticated request');
+      },
+    },
+
+    {
+      name: 'rejects-missing-confirmed',
+      async run({ http, assert }) {
+        const response = await http.as('basic').post('backend-manager/payments/cancel', {
+          reason: 'Too expensive',
+        });
+
+        assert.isError(response, 400, 'Should reject missing confirmed field');
+      },
+    },
+
+    {
+      name: 'rejects-basic-user',
+      async run({ http, assert }) {
+        const response = await http.as('basic').post('backend-manager/payments/cancel', {
+          confirmed: true,
+        });
+
+        assert.isError(response, 400, 'Should reject basic user with no paid subscription');
+      },
+    },
+
+    {
+      name: 'rejects-no-processor-or-resource-id',
+      async run({ http, assert }) {
+        // cancel-no-processor starts with payment.processor=null
+        const response = await http.as('cancel-no-processor').post('backend-manager/payments/cancel', {
+          confirmed: true,
+        });
+
+        assert.isError(response, 400, 'Should reject when no processor or resourceId is set');
+      },
+    },
+
+    {
+      name: 'rejects-already-pending-cancellation',
+      async run({ http, assert }) {
+        // cancel-already-pending starts with cancellation.pending=true
+        const response = await http.as('cancel-already-pending').post('backend-manager/payments/cancel', {
+          confirmed: true,
+        });
+
+        assert.isError(response, 400, 'Should reject when cancellation already pending');
+      },
+    },
+
+    {
+      name: 'rejects-subscription-younger-than-24-hours',
+      async run({ http, assert }) {
+        // cancel-too-young starts with startDate set to now (< 24 hours old)
+        const response = await http.as('cancel-too-young').post('backend-manager/payments/cancel', {
+          confirmed: true,
+        });
+
+        assert.isError(response, 400, 'Should reject subscription younger than 24 hours');
+      },
+    },
+
+    {
+      name: 'rejects-unknown-processor',
+      async run({ http, assert }) {
+        // cancel-unknown-processor starts with processor='unknown-processor'
+        const response = await http.as('cancel-unknown-processor').post('backend-manager/payments/cancel', {
+          confirmed: true,
+        });
+
+        assert.isError(response, 400, 'Should reject unknown processor');
+      },
+    },
+
+    {
+      name: 'allows-suspended-subscription',
+      async run({ http, assert, config, accounts, firestore, waitFor, skip }) {
+        const uid = accounts['cancel-suspended'].uid;
+
+        const response = await http.as('cancel-suspended').post('backend-manager/payments/cancel', {
+          confirmed: true,
+          reason: 'Subscription was suspended',
+          skipGuards: true,
+        });
+
+        assert.isSuccess(response, 'Should allow cancelling a suspended subscription');
+        assert.equal(response.data.success, true, 'Should return success: true');
+
+        // Verify the subscription was reset to cancelled (via fallback or webhook)
+        await waitFor(async () => {
+          const userDoc = await firestore.get(`users/${uid}`);
+          return userDoc?.subscription?.status === 'cancelled'
+            || userDoc?.subscription?.cancellation?.pending === true;
+        }, 15000, 500);
+      },
+    },
+
+    {
+      name: 'succeeds-with-test-processor',
+      async run({ http, assert, config, accounts, firestore, waitFor, skip }) {
+        const uid = accounts['route-cancel-success'].uid;
+        const paidProduct = config.payment.products.find(p => p.id !== 'basic' && p.prices?.monthly);
+        if (!paidProduct) {
+          skip('No paid product with monthly price configured in this brand');
+        }
+
+        // Step 1: Create a test subscription intent to set up a proper paid subscription
+        const intentResponse = await http.as('route-cancel-success').post('backend-manager/payments/intent', {
+          processor: 'test',
+          productId: paidProduct.id,
+          frequency: 'monthly',
+        });
+
+        assert.isSuccess(intentResponse, 'Intent should succeed');
+
+        // Wait for the auto-webhook to activate the subscription
+        await waitFor(async () => {
+          const userDoc = await firestore.get(`users/${uid}`);
+          return userDoc?.subscription?.payment?.processor === 'test'
+            && userDoc?.subscription?.payment?.resourceId
+            && userDoc?.subscription?.status === 'active';
+        }, 15000, 500);
+
+        // Step 2: Call the cancel endpoint (skipGuards bypasses the 24-hour age guard)
+        const cancelResponse = await http.as('route-cancel-success').post('backend-manager/payments/cancel', {
+          confirmed: true,
+          reason: 'Too expensive',
+          skipGuards: true,
+        });
+
+        assert.isSuccess(cancelResponse, 'Cancel should succeed');
+        assert.equal(cancelResponse.data.success, true, 'Should return success: true');
+
+        // Step 3: Verify cancellation.pending was set via the webhook pipeline
+        await waitFor(async () => {
+          const userDoc = await firestore.get(`users/${uid}`);
+          return userDoc?.subscription?.cancellation?.pending === true;
+        }, 15000, 500);
+
+        const userDoc = await firestore.get(`users/${uid}`);
+        assert.equal(userDoc?.subscription?.cancellation?.pending, true, 'Cancellation should be pending');
+      },
+    },
+  ],
+};

package/test/routes/payments/discount.js

@@ -0,0 +1,80 @@
+/**
+ * Test: GET /payments/discount
+ * Tests discount code validation endpoint
+ */
+module.exports = {
+  description: 'Discount code validation',
+  type: 'group',
+  timeout: 15000,
+
+  tests: [
+    {
+      name: 'rejects-missing-code',
+      async run({ http, assert }) {
+        const response = await http.as('none').get('backend-manager/payments/discount');
+
+        assert.isError(response, 400, 'Should reject missing code');
+      },
+    },
+
+    {
+      name: 'returns-valid-for-known-code',
+      async run({ http, assert }) {
+        const response = await http.as('none').get('backend-manager/payments/discount', {
+          code: 'FLASH20',
+        });
+
+        assert.isSuccess(response, 'Should succeed for valid code');
+        assert.equal(response.data.valid, true, 'Should be valid');
+        assert.equal(response.data.code, 'FLASH20', 'Should return normalized code');
+        assert.equal(response.data.percent, 20, 'Should return correct percent');
+        assert.equal(response.data.duration, 'once', 'Should return duration');
+      },
+    },
+
+    {
+      name: 'returns-valid-case-insensitive',
+      async run({ http, assert }) {
+        const response = await http.as('none').get('backend-manager/payments/discount', {
+          code: 'flash20',
+        });
+
+        assert.isSuccess(response, 'Should succeed for lowercase code');
+        assert.equal(response.data.valid, true, 'Should be valid (case-insensitive)');
+        assert.equal(response.data.code, 'FLASH20', 'Should return uppercase code');
+      },
+    },
+
+    {
+      name: 'returns-invalid-for-unknown-code',
+      async run({ http, assert }) {
+        const response = await http.as('none').get('backend-manager/payments/discount', {
+          code: 'NOTAREALCODE',
+        });
+
+        assert.isSuccess(response, 'Should return 200 even for invalid code');
+        assert.equal(response.data.valid, false, 'Should be invalid');
+      },
+    },
+
+    {
+      name: 'validates-all-known-codes',
+      async run({ http, assert }) {
+        const codes = [
+          { code: 'FLASH20', percent: 20 },
+          { code: 'SAVE10', percent: 10 },
+          { code: 'WELCOME15', percent: 15 },
+        ];
+
+        for (const { code, percent } of codes) {
+          const response = await http.as('none').get('backend-manager/payments/discount', { code });
+
+          assert.isSuccess(response, `Should succeed for ${code}`);
+          assert.equal(response.data.valid, true, `${code} should be valid`);
+          assert.equal(response.data.percent, percent, `${code} should be ${percent}%`);
+          assert.equal(response.data.duration, 'once', `${code} should be once`);
+        }
+      },
+    },
+  ],
+};

package/test/routes/payments/dispute-alert.js

@@ -0,0 +1,320 @@
+/**
+ * Test: POST /payments/dispute-alert
+ * Tests the dispute alert endpoint validates requests and saves to Firestore
+ */
+module.exports = {
+  description: 'Dispute alert endpoint',
+  type: 'group',
+  timeout: 30000,
+
+  tests: [
+    {
+      name: 'rejects-missing-key',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.as('none').post('backend-manager/payments/dispute-alert', {});
+
+        assert.isError(response, 401, 'Should reject missing key');
+      },
+    },
+
+    {
+      name: 'rejects-invalid-key',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.as('none').post('backend-manager/payments/dispute-alert?key=wrong-key', {});
+
+        assert.isError(response, 401, 'Should reject invalid key');
+      },
+    },
+
+    {
+      name: 'rejects-unknown-provider',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?provider=unknown&key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: '_test-dispute-unknown-provider',
+          card: '4242',
+          amount: 9.99,
+          transactionDate: '2026-01-15',
+        });
+
+        assert.isError(response, 400, 'Should reject unknown alert provider');
+      },
+    },
+
+    {
+      name: 'rejects-missing-id',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          card: '4242',
+          amount: 9.99,
+          transactionDate: '2026-01-15',
+        });
+
+        assert.isError(response, 400, 'Should reject missing id');
+      },
+    },
+
+    {
+      name: 'rejects-missing-card',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: '_test-dispute-no-card',
+          amount: 9.99,
+          transactionDate: '2026-01-15',
+        });
+
+        assert.isError(response, 400, 'Should reject missing card');
+      },
+    },
+
+    {
+      name: 'rejects-missing-amount',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: '_test-dispute-no-amount',
+          card: '4242',
+          transactionDate: '2026-01-15',
+        });
+
+        assert.isError(response, 400, 'Should reject missing amount');
+      },
+    },
+
+    {
+      name: 'rejects-missing-transaction-date',
+      auth: 'none',
+      async run({ http, assert }) {
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: '_test-dispute-no-date',
+          card: '4242',
+          amount: 9.99,
+        });
+
+        assert.isError(response, 400, 'Should reject missing transactionDate');
+      },
+    },
+
+    {
+      name: 'accepts-valid-chargeblast-alert',
+      auth: 'none',
+      async run({ http, assert, firestore }) {
+        const alertId = '_test-dispute-valid';
+
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: alertId,
+          card: '4242424242424242',
+          cardBrand: 'Visa',
+          amount: 29.99,
+          transactionDate: '2026-03-07 14:30:00',
+          processor: 'stripe',
+          alertType: 'FRAUD',
+          customerEmail: 'test@example.com',
+          externalOrder: 'ch_test123',
+          metadata: 'pi_test456',
+          externalUrl: 'https://dashboard.stripe.com/charges/ch_test123',
+          reasonCode: 'WIP',
+          subprovider: 'Ethoca',
+          isRefunded: false,
+        });
+
+        assert.isSuccess(response, 'Should accept valid Chargeblast alert');
+        assert.equal(response.data.received, true, 'Should confirm receipt');
+
+        // Verify doc was saved to Firestore
+        const doc = await firestore.get(`payments-disputes/${alertId}`);
+        assert.ok(doc, 'Dispute doc should exist in Firestore');
+        assert.equal(doc.provider, 'chargeblast', 'Provider should be chargeblast');
+        assert.ok(
+          doc.status === 'pending' || doc.status === 'processing',
+          'Status should be pending or processing',
+        );
+
+        // Verify core normalized alert data
+        assert.equal(doc.alert.card.last4, '4242', 'Should extract last4 from full card number');
+        assert.equal(doc.alert.card.brand, 'visa', 'Should lowercase card brand');
+        assert.equal(doc.alert.amount, 29.99, 'Amount should be preserved');
+        assert.equal(doc.alert.transactionDate, '2026-03-07', 'Should extract date without time');
+        assert.equal(doc.alert.processor, 'stripe', 'Processor should be stripe');
+
+        // Verify new normalized fields
+        assert.equal(doc.alert.alertType, 'FRAUD', 'Alert type should be preserved');
+        assert.equal(doc.alert.customerEmail, 'test@example.com', 'Customer email should be preserved');
+        assert.equal(doc.alert.chargeId, 'ch_test123', 'Charge ID should be extracted from externalOrder');
+        assert.equal(doc.alert.paymentIntentId, 'pi_test456', 'Payment intent ID should be extracted from metadata');
+        assert.equal(doc.alert.stripeUrl, 'https://dashboard.stripe.com/charges/ch_test123', 'Stripe URL should be preserved');
+        assert.equal(doc.alert.reasonCode, 'WIP', 'Reason code should be preserved');
+        assert.equal(doc.alert.subprovider, 'Ethoca', 'Subprovider should be preserved');
+        assert.equal(doc.alert.isRefunded, false, 'isRefunded should be preserved');
+
+        // Verify raw payload is preserved
+        assert.ok(doc.raw, 'Raw payload should be preserved');
+        assert.equal(doc.raw.id, alertId, 'Raw id should match');
+      },
+    },
+
+    {
+      name: 'accepts-alert-with-alertId-field',
+      auth: 'none',
+      async run({ http, assert, firestore }) {
+        const alertId = '_test-dispute-alertid-field';
+
+        // Chargeblast alert.created events use alertId instead of id
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          alertId: alertId,
+          card: '546616******5805',
+          cardBrand: 'Mastercard',
+          amount: 8,
+          transactionDate: '2026-03-19 00:00:00.000000Z',
+        });
+
+        assert.isSuccess(response, 'Should accept alert using alertId field');
+
+        const doc = await firestore.get(`payments-disputes/${alertId}`);
+        assert.ok(doc, 'Dispute doc should exist in Firestore');
+        assert.equal(doc.id, alertId, 'Doc ID should match alertId');
+        assert.equal(doc.alert.id, alertId, 'Alert id should be set from alertId');
+        assert.equal(doc.alert.card.last4, '5805', 'Should extract last4 from masked card');
+      },
+    },
+
+    {
+      name: 'accepts-alert-without-optional-fields',
+      auth: 'none',
+      async run({ http, assert, firestore }) {
+        const alertId = '_test-dispute-minimal';
+
+        // Send minimal alert (alert.created shape — no externalOrder, metadata, etc.)
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: alertId,
+          card: '9124',
+          amount: 10,
+          transactionDate: '2026-03-21 00:01:02',
+        });
+
+        assert.isSuccess(response, 'Should accept minimal alert');
+
+        const doc = await firestore.get(`payments-disputes/${alertId}`);
+        assert.equal(doc.alert.card.last4, '9124', 'Should use card as last4');
+        assert.equal(doc.alert.processor, 'stripe', 'Processor should default to stripe');
+        assert.equal(doc.alert.chargeId, null, 'Charge ID should be null when not provided');
+        assert.equal(doc.alert.paymentIntentId, null, 'Payment intent should be null when not provided');
+        assert.equal(doc.alert.customerEmail, null, 'Customer email should be null when not provided');
+        assert.equal(doc.alert.alertType, null, 'Alert type should be null when not provided');
+        assert.equal(doc.alert.stripeUrl, null, 'Stripe URL should be null when not provided');
+        assert.equal(doc.alert.reasonCode, null, 'Reason code should be null when not provided');
+        assert.equal(doc.alert.subprovider, null, 'Subprovider should be null when not provided');
+        assert.equal(doc.alert.isRefunded, false, 'isRefunded should default to false');
+      },
+    },
+
+    {
+      name: 'accepts-alert-with-last4-only',
+      auth: 'none',
+      async run({ http, assert, firestore }) {
+        const alertId = '_test-dispute-last4';
+
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: alertId,
+          card: '1234',
+          amount: 9.99,
+          transactionDate: '2026-01-15',
+        });
+
+        assert.isSuccess(response, 'Should accept alert with card last4 only');
+
+        const doc = await firestore.get(`payments-disputes/${alertId}`);
+        assert.equal(doc.alert.card.last4, '1234', 'Should use card value as last4 when already 4 digits');
+        assert.equal(doc.alert.processor, 'stripe', 'Processor should default to stripe');
+      },
+    },
+
+    {
+      name: 'deduplicates-dispute-alerts',
+      auth: 'none',
+      async run({ http, assert, firestore }) {
+        const alertId = '_test-dispute-duplicate';
+
+        // Pre-seed an in-flight dispute directly. We seed (rather than POST a first alert)
+        // because the route fires an async on-write trigger that, for synthetic test data
+        // with no matching charge, can transition the doc to 'failed' — at which point the
+        // dedup contract intentionally treats it as RETRYABLE, not a duplicate. Racing a
+        // live POST against that trigger made this test flaky. Seeding 'processing' (a
+        // non-failed, in-flight state) deterministically exercises the dedup path.
+        await firestore.set(`payments-disputes/${alertId}`, {
+          id: alertId,
+          status: 'processing',
+        });
+
+        // A subsequent identical alert must be reported as a duplicate (not reprocessed).
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: alertId,
+          card: '4242',
+          amount: 29.99,
+          transactionDate: '2026-03-07',
+        });
+
+        assert.isSuccess(response, 'Duplicate should still return 200');
+        assert.equal(response.data.duplicate, true, 'Should indicate duplicate');
+      },
+    },
+
+    {
+      name: 'retries-failed-alerts',
+      auth: 'none',
+      async run({ http, assert, firestore }) {
+        const alertId = '_test-dispute-retry';
+
+        // Pre-seed a failed dispute
+        await firestore.set(`payments-disputes/${alertId}`, {
+          id: alertId,
+          status: 'failed',
+          error: 'Previous error',
+        });
+
+        // Send alert with same ID — should retry since previous status was 'failed'
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: alertId,
+          card: '4242',
+          amount: 29.99,
+          transactionDate: '2026-03-07',
+        });
+
+        assert.isSuccess(response, 'Should accept retry of failed alert');
+        assert.ok(!response.data.duplicate, 'Should not indicate duplicate for failed retry');
+
+        // Verify doc was updated
+        const doc = await firestore.get(`payments-disputes/${alertId}`);
+        assert.ok(
+          doc.status === 'pending' || doc.status === 'processing',
+          'Status should be pending or processing after retry',
+        );
+      },
+    },
+
+    {
+      name: 'defaults-provider-to-chargeblast',
+      auth: 'none',
+      async run({ http, assert, firestore }) {
+        const alertId = '_test-dispute-default-provider';
+
+        // Send without provider query param
+        const response = await http.as('none').post(`backend-manager/payments/dispute-alert?key=${process.env.BACKEND_MANAGER_WEBHOOK_KEY}`, {
+          id: alertId,
+          card: '4242',
+          amount: 9.99,
+          transactionDate: '2026-01-15',
+        });
+
+        assert.isSuccess(response, 'Should accept without explicit provider param');
+
+        const doc = await firestore.get(`payments-disputes/${alertId}`);
+        assert.equal(doc.provider, 'chargeblast', 'Provider should default to chargeblast');
+      },
+    },
+  ],
+};