create-ailk 0.1.0 → 0.2.0

package/templates/apps/api/src/routes/auth/__tests__/tokens.test.ts

@@ -247,6 +247,11 @@ describe('Token Routes', () => {
       await fastify2.close();
     });
 
+    // Well-formed apitok_ ids (ADR-0031): the :id param is validated with
+    // zApiTokenId before any query runs.
+    const REVOKE_ID = 'apitok_00000000-0000-7000-8000-000000000001';
+    const MISSING_ID = 'apitok_00000000-0000-7000-8000-000000000002';
+
     it('should revoke a token', async () => {
       // ARRANGE
       (prisma.apiToken.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
@@ -254,7 +259,7 @@ describe('Token Routes', () => {
       // ACT
       const response = await app.inject({
         method: 'DELETE',
-        url: '/v1/auth/tokens/token_123',
+        url: `/v1/auth/tokens/${REVOKE_ID}`,
       });
 
       // ASSERT
@@ -264,7 +269,7 @@ describe('Token Routes', () => {
       expect(body.message).toBe('Token revoked');
       expect(prisma.apiToken.updateMany).toHaveBeenCalledWith({
         where: {
-          id: 'token_123',
+          id: REVOKE_ID,
           userId: 'user_123',
           revokedAt: null,
         },
@@ -281,7 +286,7 @@ describe('Token Routes', () => {
       // ACT
       const response = await app.inject({
         method: 'DELETE',
-        url: '/v1/auth/tokens/nonexistent',
+        url: `/v1/auth/tokens/${MISSING_ID}`,
       });
 
       // ASSERT
@@ -290,5 +295,19 @@ describe('Token Routes', () => {
       expect(body.success).toBe(false);
       expect(body.error).toBe('Token not found');
     });
+
+    it('should return 400 for a malformed token id', async () => {
+      // ACT — not apitok_-prefixed → rejected by zApiTokenId before any query
+      const response = await app.inject({
+        method: 'DELETE',
+        url: '/v1/auth/tokens/token_123',
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(400);
+      const body = JSON.parse(response.body);
+      expect(body.success).toBe(false);
+      expect(prisma.apiToken.updateMany).not.toHaveBeenCalled();
+    });
   });
 });

package/templates/apps/api/src/routes/auth/tokens.ts

@@ -7,12 +7,17 @@
 import { randomBytes, createHash } from 'crypto';
 
 import { getClock } from '@working-theory/common';
+import { zApiTokenId } from '@working-theory/ids';
 import { logger } from '@working-theory/observability';
 import type { FastifyPluginAsync } from 'fastify';
 import { z } from 'zod';
 
 import { prisma } from '../../lib/prisma.js';
 
+// Boundary id validation (ADR-0031 rule 5): the entity-typed Zod schema,
+// not a bare string — a malformed :id is a 400, not a query.
+const tokenParamsSchema = z.object({ id: zApiTokenId });
+
 const createTokenSchema = z.object({
   name: z.string().min(1, 'Name is required'),
   clientType: z.enum(['mobile', 'api', 'cli']).default('api'),
@@ -163,7 +168,14 @@ export const tokenRoutes: FastifyPluginAsync = async (fastify) => {
         });
       }
 
-      const { id } = request.params;
+      const params = tokenParamsSchema.safeParse(request.params);
+      if (!params.success) {
+        return reply.status(400).send({
+          success: false,
+          error: 'Validation failed',
+        });
+      }
+      const { id } = params.data;
 
       // Verify ownership and revoke
       const token = await prisma.apiToken.updateMany({

package/templates/apps/api/src/routes/billing/__tests__/portal.test.ts

@@ -0,0 +1,450 @@
+// oss: false
+/**
+ * @file portal.test.ts
+ *
+ * POST /v1/billing/portal-session (spec §5.1 AC-3, AC-4).
+ *
+ * Fixture: two orgs. ORG_A has an active Stripe customer; ORG_B has never
+ * billed (no billingCustomerId). alice owns ORG_A (active workspace WS_A);
+ * bob owns ORG_B (active workspace WS_B). dave is an ADMIN of ORG_A and carol
+ * is a plain MEMBER of ORG_A — the role fixtures for the #3766 role gate.
+ *
+ * Stripe is mocked at `../../../lib/stripe.js` (the sole Stripe-touching
+ * chokepoint apps/api routes import from) — no real Stripe calls are made.
+ */
+import type { FastifyInstance } from "fastify";
+import Fastify from "fastify";
+
+// ── Mocks (must precede the module-under-test import) ───────────────────────
+
+const mockCreateBillingPortalSession = jest.fn();
+const mockAssertSandboxKey = jest.fn();
+
+class MockStripeConfigError extends Error {
+  override name = "StripeConfigError";
+}
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/stripe.js", () => ({
+  assertSandboxKey: (...args: unknown[]) => mockAssertSandboxKey(...args),
+  createBillingPortalSession: (...args: unknown[]) =>
+    mockCreateBillingPortalSession(...args),
+  StripeConfigError: MockStripeConfigError,
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    workspace: { findUnique: jest.fn(), count: jest.fn() },
+    membership: { findUnique: jest.fn() },
+    organization: { findUnique: jest.fn() },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin } from "../../../middleware/auth.js";
+import { tenantPreHandlerPlugin } from "../../../middleware/tenant.js";
+import { billingRoutes } from "../index.js";
+
+const FRONTEND = "https://app.example.com";
+const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
+
+const WS_A = "wksp_00000000-0000-7000-8000-0000000000aa";
+const WS_B = "wksp_00000000-0000-7000-8000-0000000000bb";
+const ORG_A = "org_00000000-0000-7000-8000-000000000aaa";
+const ORG_B = "org_00000000-0000-7000-8000-000000000bbb";
+const CUS_A = "cus_test_00000000000000aaaa";
+
+const WORKSPACES = [
+  { id: WS_A, organizationId: ORG_A },
+  { id: WS_B, organizationId: ORG_B },
+];
+
+const MEMBERSHIPS = [
+  { organizationId: ORG_A, userId: "alice", role: "owner" },
+  { organizationId: ORG_A, userId: "dave", role: "admin" },
+  { organizationId: ORG_A, userId: "carol", role: "member" },
+  { organizationId: ORG_B, userId: "bob", role: "owner" },
+];
+
+const ORGANIZATIONS: Record<string, { billingCustomerId: string | null }> = {
+  [ORG_A]: { billingCustomerId: CUS_A },
+  [ORG_B]: { billingCustomerId: null },
+};
+
+const SESSION_ROWS: Record<string, Record<string, unknown>> = {
+  cookie_alice: {
+    id: "sess_alice",
+    userId: "alice",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_A,
+    activeWorkspaceId: WS_A,
+  },
+  cookie_bob: {
+    id: "sess_bob",
+    userId: "bob",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_B,
+    activeWorkspaceId: WS_B,
+  },
+  cookie_dave: {
+    id: "sess_dave",
+    userId: "dave",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_A,
+    activeWorkspaceId: WS_A,
+  },
+  cookie_carol: {
+    id: "sess_carol",
+    userId: "carol",
+    expiresAt: FUTURE,
+    activeOrganizationId: ORG_A,
+    activeWorkspaceId: WS_A,
+  },
+};
+
+function installFixtureMocks(): void {
+  (prisma.session.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { token?: string } }) =>
+      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
+  );
+
+  (prisma.workspace.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { id?: string } }) =>
+      Promise.resolve(WORKSPACES.find((w) => w.id === where.id) ?? null),
+  );
+  (prisma.workspace.count as jest.Mock).mockResolvedValue(WORKSPACES.length);
+
+  (prisma.membership.findUnique as jest.Mock).mockImplementation(
+    ({
+      where,
+    }: {
+      where: {
+        organizationId_userId?: { organizationId: string; userId: string };
+      };
+    }) => {
+      const key = where.organizationId_userId;
+      if (!key) return Promise.resolve(null);
+      return Promise.resolve(
+        MEMBERSHIPS.find(
+          (m) =>
+            m.organizationId === key.organizationId && m.userId === key.userId,
+        ) ?? null,
+      );
+    },
+  );
+
+  (prisma.organization.findUnique as jest.Mock).mockImplementation(
+    ({ where }: { where: { id?: string } }) =>
+      Promise.resolve(
+        where.id && ORGANIZATIONS[where.id] ? ORGANIZATIONS[where.id] : null,
+      ),
+  );
+}
+
+async function buildApp(): Promise<FastifyInstance> {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(async (scope) => {
+    await scope.register(tenantPreHandlerPlugin);
+    await scope.register(billingRoutes);
+  });
+  await app.ready();
+  return app;
+}
+
+function cookieHeaders(token: string): Record<string, string> {
+  return {
+    cookie: `better-auth.session_token=${token}`,
+    origin: FRONTEND,
+  };
+}
+
+describe("POST /v1/billing/portal-session", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installFixtureMocks();
+    // Default: a present sandbox key, so the new (#3757) emptiness check at
+    // the call site doesn't short-circuit tests that aren't exercising it.
+    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
+    // Defaults: sandbox key guard passes; portal session created successfully.
+    mockAssertSandboxKey.mockImplementation(() => undefined);
+    mockCreateBillingPortalSession.mockResolvedValue({
+      url: "https://billing.stripe.com/session/test_abc123",
+      expiresAt: 1234567890,
+    });
+
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+    delete process.env["STRIPE_SECRET_KEY"];
+  });
+
+  // AC-3 — portal happy path: { url } from createBillingPortalSession, called
+  // with the caller's OWN org's billingCustomerId.
+  it("returns { url } for the caller's own billed org", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_alice"),
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(body.ok).toBe(true);
+    expect(body.data).toEqual({
+      url: "https://billing.stripe.com/session/test_abc123",
+    });
+    expect(mockCreateBillingPortalSession).toHaveBeenCalledWith(
+      expect.objectContaining({ stripeCustomerId: CUS_A }),
+    );
+  });
+
+  // 5.2 — the raw billingCustomerId never appears in the response body.
+  it("never echoes the raw billingCustomerId in the response", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_alice"),
+    });
+
+    expect(res.body).not.toContain(CUS_A);
+  });
+
+  // AC-4 — no billingCustomerId → 404, no Stripe call at all.
+  it("returns 404 no-billing-customer when the org has no Stripe customer, no Stripe call", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_bob"),
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json().error.code).toBe("no-billing-customer");
+    expect(mockAssertSandboxKey).not.toHaveBeenCalled();
+    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
+  });
+
+  // AC-4 — a live-mode Stripe key → 500 live-mode-forbidden, no Stripe call.
+  it("returns 500 live-mode-forbidden when the sandbox guard rejects the key", async () => {
+    mockAssertSandboxKey.mockImplementation(() => {
+      throw new MockStripeConfigError("live key rejected");
+    });
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_alice"),
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json().error.code).toBe("live-mode-forbidden");
+    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
+  });
+
+  // AC-4 — a restricted-live-mode Stripe key → 500 live-mode-forbidden, no Stripe call.
+  it("returns 500 live-mode-forbidden when the sandbox guard rejects a restricted live key", async () => {
+    mockAssertSandboxKey.mockImplementation(() => {
+      throw new MockStripeConfigError("restricted live key rejected");
+    });
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_alice"),
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json().error.code).toBe("live-mode-forbidden");
+    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
+  });
+
+  // ── #3757 — missing/empty key must not be mislabeled live-mode-forbidden ──
+
+  it("returns 500 stripe-not-configured when STRIPE_SECRET_KEY is missing, not live-mode-forbidden", async () => {
+    delete process.env["STRIPE_SECRET_KEY"];
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_alice"),
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json().error.code).toBe("stripe-not-configured");
+    expect(mockAssertSandboxKey).not.toHaveBeenCalled();
+    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
+  });
+
+  it("returns 500 stripe-not-configured when STRIPE_SECRET_KEY is an empty string, not live-mode-forbidden", async () => {
+    process.env["STRIPE_SECRET_KEY"] = "";
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_alice"),
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json().error.code).toBe("stripe-not-configured");
+    expect(mockAssertSandboxKey).not.toHaveBeenCalled();
+    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
+  });
+
+  // AC-4 — a StripeConfigError raised from the Stripe call itself → 500 config-error.
+  it("returns 500 config-error when createBillingPortalSession raises StripeConfigError", async () => {
+    mockCreateBillingPortalSession.mockRejectedValue(
+      new MockStripeConfigError("STRIPE_SECRET_KEY missing"),
+    );
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_alice"),
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json().error.code).toBe("config-error");
+    expect(res.body).not.toContain("STRIPE_SECRET_KEY missing");
+  });
+
+  // AC-4 — a generic Stripe SDK throw → 502 portal-unavailable; detail not leaked.
+  it("returns 502 portal-unavailable on a generic Stripe error, detail not leaked", async () => {
+    mockCreateBillingPortalSession.mockRejectedValue(
+      new Error("stripe outage detail"),
+    );
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_alice"),
+    });
+
+    expect(res.statusCode).toBe(502);
+    expect(res.json().error.code).toBe("portal-unavailable");
+    expect(res.body).not.toContain("stripe outage detail");
+  });
+
+  // AC-2 — org scope is the caller's own resolved org, never a foreign one.
+  it("creates the portal session for the caller's own org only", async () => {
+    await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_alice"),
+    });
+
+    expect(prisma.organization.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: ORG_A } }),
+    );
+    expect(prisma.organization.findUnique).not.toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: ORG_B } }),
+    );
+  });
+
+  // ── #3766 role gate ───────────────────────────────────────────────────────
+
+  // A plain org MEMBER must be refused: the billing portal is a privileged,
+  // mutating capability, and membership alone is not authorization.
+  it("returns 403 for a plain member, without ever calling Stripe", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_carol"),
+    });
+
+    expect(res.statusCode).toBe(403);
+    expect(res.json().error.code).toBe("forbidden");
+    // The load-bearing assertion: the capability was never exercised.
+    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
+    expect(mockAssertSandboxKey).not.toHaveBeenCalled();
+  });
+
+  // Default-deny ordering: the refusal lands BEFORE the billing-identity
+  // lookup, so a member cannot even infer whether the org has a customer.
+  it("denies a member before the billing-identity lookup", async () => {
+    await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_carol"),
+    });
+
+    expect(prisma.organization.findUnique).not.toHaveBeenCalled();
+  });
+
+  // The refusal must not leak the org's billing state in any form.
+  it("leaks no billing detail in the member refusal", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_carol"),
+    });
+
+    expect(res.body).not.toContain(CUS_A);
+    expect(res.body).not.toContain("billing.stripe.com");
+  });
+
+  // owner (alice) is covered by the happy path above; admin must also pass.
+  it("allows an admin to open the portal", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_dave"),
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json().data.url).toBe(
+      "https://billing.stripe.com/session/test_abc123",
+    );
+    expect(mockCreateBillingPortalSession).toHaveBeenCalledWith(
+      expect.objectContaining({ stripeCustomerId: CUS_A }),
+    );
+  });
+
+  // The role gate must not have disturbed the pre-existing error paths for a
+  // privileged caller (AC: 404 / 500 unchanged for owner+admin).
+  it("still returns 404 no-billing-customer for a privileged caller on an unbilled org", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_bob"),
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json().error.code).toBe("no-billing-customer");
+  });
+
+  // Fail-closed: an unrecognized role is refused rather than falling through
+  // into the privileged path. Proves the allow-list is default-deny, so a role
+  // added to `MembershipRole` later cannot silently gain portal access.
+  it("denies an unrecognized role (default-deny allow-list)", async () => {
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: "billing_viewer",
+    });
+
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: cookieHeaders("cookie_alice"),
+    });
+
+    expect(res.statusCode).toBe(403);
+    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
+  });
+
+  // AC-2 — unauthenticated → 401, no Stripe call.
+  it("returns 401 without a session, no Stripe call", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/billing/portal-session",
+      headers: { origin: FRONTEND },
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
+  });
+});