create-ailk 0.11.0 → 0.11.2

package/templates/apps/api/src/middleware/__tests__/adversarial/bearer-token-format.test.ts

@@ -37,7 +37,7 @@ import { authPreHandlerPlugin } from "../../auth.js";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/adversarial/cookie-or-bearer-precedence.test.ts

@@ -38,7 +38,7 @@ const BEARER = "tok_live_xyz";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-bearer-skip.test.ts

@@ -33,7 +33,7 @@ const BEARER = "tok_live_abc";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;
 }

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-cookie-path.test.ts

@@ -35,7 +35,7 @@ const COOKIE_NAME = "better-auth.session_token";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   // HEAD is auto-registered by Fastify when GET is declared; no explicit handler needed.
@@ -72,7 +72,7 @@ describe("S13 adversarial — CSRF on cookie path", () => {
     expect(JSON.parse(res.body)).toEqual({ error: "unauthorized" });
   });
 
-  it("rejects POST when Origin scheme differs from the configured frontendOrigin", async () => {
+  it("rejects POST when Origin scheme differs from the configured trusted origin", async () => {
     app = buildApp();
     await app.ready();
 

package/templates/apps/api/src/middleware/__tests__/adversarial/csrf-trusted-origins.test.ts

@@ -0,0 +1,142 @@
+/**
+ * @file csrf-trusted-origins.test.ts (#7395 AC-3)
+ *
+ * The cookie path's CSRF check against a multi-origin allowlist. A spoke site
+ * forwards the visitor's cookie and the browser's real `Origin` to the hub
+ * API, so a write is accepted iff that `Origin` is EXACTLY one of the
+ * configured trusted origins — never a prefix, a suffix or the first entry
+ * alone — and an empty list refuses every cookie write in every environment
+ * (the dev fail-open is gone, spec D4/D6.2). The non-rejecting resolver the
+ * checkout route uses applies the same check (#6866 D2).
+ */
+
+import Fastify from "fastify";
+import type { FastifyInstance } from "fastify";
+
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    apiToken: {
+      findUnique: jest.fn(),
+      update: jest.fn().mockResolvedValue(undefined),
+    },
+  },
+}));
+
+import { prisma } from "../../../lib/prisma.js";
+import { authPreHandlerPlugin, resolveOptionalCookieUser } from "../../auth.js";
+
+const HUB = "https://hub.example";
+const SPOKE_A = "https://spoke-a.example";
+const TRUSTED = [HUB, SPOKE_A];
+const COOKIE = "better-auth.session_token=sess_tok_abc";
+
+function buildApp(trustedOrigins: readonly string[]): FastifyInstance {
+  const app = Fastify();
+  app.register(authPreHandlerPlugin, { trustedOrigins });
+  app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
+  return app;
+}
+
+function buildResolverApp(trustedOrigins: readonly string[]): FastifyInstance {
+  const app = Fastify();
+  app.post("/resolve", async (req) =>
+    resolveOptionalCookieUser(req, { trustedOrigins }),
+  );
+  return app;
+}
+
+function post(app: FastifyInstance, url: string, origin?: string) {
+  return app.inject({
+    method: "POST",
+    url,
+    headers: { cookie: COOKIE, ...(origin !== undefined && { origin }) },
+  });
+}
+
+describe("#7395 — cookie-path CSRF against the trusted-origin allowlist", () => {
+  const originalNodeEnv = process.env.NODE_ENV;
+  const originalDatabaseUrl = process.env.DATABASE_URL;
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      id: "ses_1",
+      userId: "usr_42",
+      expiresAt: new Date(Date.now() + 60_000),
+      activeOrganizationId: null,
+      activeWorkspaceId: null,
+    });
+  });
+
+  afterEach(async () => {
+    await app.close();
+    if (originalNodeEnv === undefined) delete process.env.NODE_ENV;
+    else process.env.NODE_ENV = originalNodeEnv;
+    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
+    else process.env.DATABASE_URL = originalDatabaseUrl;
+  });
+
+  it.each([HUB, SPOKE_A])(
+    "accepts a cookie POST from the listed origin %s",
+    async (origin) => {
+      app = buildApp(TRUSTED);
+      await app.ready();
+
+      const res = await post(app, "/echo", origin);
+
+      expect(res.statusCode).toBe(200);
+      expect(res.json()).toEqual({ userId: "usr_42" });
+    },
+  );
+
+  it.each([
+    ["an unlisted spoke", "https://spoke-b.example"],
+    ["a listed origin as a host prefix", "https://spoke-a.example.evil.test"],
+    ["an opaque origin", "null"],
+    ["a case variant of a listed origin", "HTTPS://HUB.EXAMPLE"],
+    ["a listed origin with a trailing slash", "https://hub.example/"],
+    ["a listed origin with its default port", "https://hub.example:443"],
+    ["a missing Origin", undefined],
+  ])("refuses a cookie POST from %s with 401", async (_label, origin) => {
+    app = buildApp(TRUSTED);
+    await app.ready();
+
+    const res = await post(app, "/echo", origin);
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json()).toEqual({ error: "unauthorized" });
+  });
+
+  it("refuses every cookie POST with an empty list, even in development", async () => {
+    process.env.NODE_ENV = "development";
+    app = buildApp([]);
+    await app.ready();
+
+    const res = await post(app, "/echo", HUB);
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json()).toEqual({ error: "unauthorized" });
+  });
+
+  it("resolveOptionalCookieUser returns the user for a listed spoke", async () => {
+    app = buildResolverApp(TRUSTED);
+    await app.ready();
+
+    const res = await post(app, "/resolve", SPOKE_A);
+
+    expect(res.json()).toEqual({ kind: "user", userId: "usr_42" });
+  });
+
+  it("resolveOptionalCookieUser returns none/cross_origin for an unlisted spoke", async () => {
+    app = buildResolverApp(TRUSTED);
+    await app.ready();
+
+    const res = await post(app, "/resolve", "https://spoke-b.example");
+
+    expect(res.json()).toEqual({ kind: "none", reason: "cross_origin" });
+  });
+});

package/templates/apps/api/src/middleware/__tests__/adversarial/session-fixation.test.ts

@@ -40,7 +40,7 @@ const COOKIE_NAME = "better-auth.session_token";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/adversarial/session-timeout.test.ts

@@ -46,7 +46,7 @@ let CURRENT_TIME = 1_000_000_000_000;
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.bearer-path.test.ts

@@ -37,7 +37,7 @@ const BEARER_HASH = createHash("sha256").update(BEARER).digest("hex");
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.both-present-precedence.test.ts

@@ -27,7 +27,7 @@ import { authPreHandlerPlugin } from "../auth.js";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.cookie-path.test.ts

@@ -33,7 +33,7 @@ const FRONTEND = "https://app.example.com";
 
 function buildApp(): FastifyInstance {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.get("/echo", async (req) => ({ userId: req.userId ?? null }));
   app.post("/echo", async (req) => ({ userId: req.userId ?? null }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.database-not-configured.test.ts

@@ -31,7 +31,7 @@ const echoHandler = jest.fn(async () => ({ ok: true }));
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", echoHandler);
   app.post("/echo", echoHandler);

package/templates/apps/api/src/middleware/__tests__/auth.neither-present.test.ts

@@ -27,7 +27,7 @@ import { authPreHandlerPlugin } from "../auth.js";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.register(authPreHandlerPlugin, {
-    frontendOrigin: "https://app.example.com",
+    trustedOrigins: ["https://app.example.com"],
   });
   app.get("/echo", async () => ({ ok: true }));
   return app;

package/templates/apps/api/src/middleware/__tests__/auth.optional-cookie.test.ts

@@ -28,7 +28,7 @@ const COOKIE = "better-auth.session_token=sess_tok_abc.signature";
 function buildApp(): FastifyInstance {
   const app = Fastify();
   app.post("/resolve", async (req) =>
-    resolveOptionalCookieUser(req, { frontendOrigin: FRONTEND }),
+    resolveOptionalCookieUser(req, { trustedOrigins: [FRONTEND] }),
   );
   return app;
 }

package/templates/apps/api/src/middleware/auth.ts

@@ -8,9 +8,10 @@
  *      Looked up directly against the `Session` table (the row Better Auth's
  *      database adapter creates on sign-in). Cookie wins when both modes are
  *      present (locked by brief decision OQ-D / spec §3 "Both present").
- *      Non-GET requests with a cookie are required to carry a same-origin
- *      Origin header — the lightweight CSRF mechanism agreed in OQ-D. Bearer-
- *      authenticated callers skip the origin check (non-browser flow).
+ *      Non-GET requests with a cookie are required to carry an Origin header
+ *      that is exactly one of the configured trusted origins (#7395) — the
+ *      lightweight CSRF mechanism agreed in OQ-D. Bearer-authenticated callers
+ *      skip the origin check (non-browser flow).
  *
  *   2. Bearer path — Authorization: Bearer <token>. The token is sha256-hashed
  *      and matched against `ApiToken.token` (stored as hash). Revoked / expired
@@ -120,27 +121,21 @@ function readBearer(request: FastifyRequest): string | undefined {
 }
 
 /**
- * Same-origin CSRF check for cookie-authenticated mutating requests.
+ * CSRF check for cookie-authenticated mutating requests (#7395).
  * Returns true if the request is safe (GET/HEAD/OPTIONS) or the Origin header
- * matches the configured frontend origin. False otherwise.
+ * is exactly one of the trusted origins. False otherwise — including for any
+ * write when the list is empty, in every environment.
  */
 function isOriginAllowed(
   request: FastifyRequest,
-  frontendOrigin: string | undefined,
+  trustedOrigins: readonly string[],
 ): boolean {
   const method = request.method.toUpperCase();
   if (method === "GET" || method === "HEAD" || method === "OPTIONS")
     return true;
-  if (!frontendOrigin) {
-    // No FRONTEND_URL configured: fail OPEN in dev/test (zero-config OSS
-    // boot), fail CLOSED in production (security review M1 — with the
-    // multi-tenant module's state-changing routes, an unset origin must not
-    // silently disable the CSRF check in a real deployment).
-    return process.env.NODE_ENV !== "production";
-  }
   const origin = request.headers.origin;
   if (!origin) return false;
-  return origin === frontendOrigin;
+  return trustedOrigins.includes(origin);
 }
 
 type SessionRow = {
@@ -187,8 +182,11 @@ async function resolveBearerToken(
 }
 
 export type AuthPreHandlerOptions = {
-  /** Configured frontend origin used for the CSRF same-origin check. */
-  frontendOrigin?: string | undefined;
+  /**
+   * The browser origins a cookie-authenticated write may come from — exact
+   * matches only. server.ts passes `config.TRUSTED_ORIGINS` (#7395).
+   */
+  trustedOrigins: readonly string[];
 };
 
 /**
@@ -214,7 +212,7 @@ export type OptionalCookieUser =
  * route's buyer stamp).
  *
  * Applies the cookie path's own rules — the same private cookie reader,
- * Session lookup, expiry comparison and same-origin check as
+ * Session lookup, expiry comparison and trusted-origin check as
  * `makeAuthPreHandler` — so the two paths cannot drift. Reads the COOKIE only:
  * a bearer `ApiToken` never identifies a user here. Never writes a reply and
  * never throws; every failure is a `none` with its reason. The cookie is
@@ -238,7 +236,7 @@ export async function resolveOptionalCookieUser(
   if (session.expiresAt.getTime() <= getClock().now()) {
     return { kind: "none", reason: "expired" };
   }
-  if (!isOriginAllowed(request, opts.frontendOrigin)) {
+  if (!isOriginAllowed(request, opts.trustedOrigins)) {
     return { kind: "none", reason: "cross_origin" };
   }
   // Brand assertion at the Prisma read edge (ADR-0031 rule 5), as above.
@@ -251,8 +249,8 @@ export async function resolveOptionalCookieUser(
  * Exported standalone so route-test suites can register it directly without
  * spinning up the full server module.
  */
-export function makeAuthPreHandler(opts: AuthPreHandlerOptions = {}) {
-  const { frontendOrigin } = opts;
+export function makeAuthPreHandler(opts: AuthPreHandlerOptions) {
+  const { trustedOrigins } = opts;
   return async function authPreHandler(
     request: FastifyRequest,
     reply: FastifyReply,
@@ -272,7 +270,7 @@ export function makeAuthPreHandler(opts: AuthPreHandlerOptions = {}) {
         () => undefined,
       );
       if (session && session.expiresAt.getTime() > now) {
-        if (!isOriginAllowed(request, frontendOrigin)) {
+        if (!isOriginAllowed(request, trustedOrigins)) {
           reply.code(401).send(UNAUTHORIZED);
           return;
         }

package/templates/apps/api/src/routes/auth/__tests__/auth-tokens.functional.test.ts

@@ -42,7 +42,7 @@ const FRONTEND = "https://app.example.com";
 
 async function buildApp(): Promise<FastifyInstance> {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.register(tokenRoutes);
   await app.ready();
   return app;

package/templates/apps/api/src/routes/auth/__tests__/auth-user.functional.test.ts

@@ -37,7 +37,7 @@ const FRONTEND = "https://app.example.com";
 
 async function buildApp(): Promise<FastifyInstance> {
   const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
+  app.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
   app.register(userRoutes);
   await app.ready();
   return app;

package/templates/apps/api/src/routes/checkout/__tests__/sessions.test.ts

@@ -91,7 +91,10 @@ import { checkoutRoutes } from "../index";
 // #6877 — pin the suite's site origin to the fixtures' own origin, so every
 // anonymous case below sends same-origin redirects. Runs before any
 // `describe` is collected, so the #6866 block's SAME_ORIGIN reads it too.
+// #7395 — the redirect lock and the buyer's cookie check read the trusted
+// allowlist, not FRONTEND_URL, so the suite pins both.
 config.FRONTEND_URL = "https://example.com";
+config.TRUSTED_ORIGINS = ["https://example.com"];
 
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -1298,6 +1301,7 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
   beforeEach(async () => {
     jest.clearAllMocks();
     config.FRONTEND_URL = SITE_ORIGIN;
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
     process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
     delete process.env["OSS_API_INTERNAL_SECRET"];
     mockAssertSandboxKey.mockImplementation(() => undefined);
@@ -1328,6 +1332,7 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
     delete process.env["STRIPE_SECRET_KEY"];
     delete process.env["OSS_API_INTERNAL_SECRET"];
     config.FRONTEND_URL = SITE_ORIGIN;
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
     if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
     else process.env.DATABASE_URL = originalDatabaseUrl;
   });
@@ -1453,45 +1458,24 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
     expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
   });
 
-  it.each([
-    [
-      "an unparseable FRONTEND_URL",
-      () => {
-        config.FRONTEND_URL = "not a url";
-      },
-    ],
-    [
-      "a non-http(s) FRONTEND_URL",
-      () => {
-        config.FRONTEND_URL = "mailto:ops@example.com";
-      },
-    ],
-    [
-      "an unset FRONTEND_URL in production",
-      () => {
-        delete process.env.FRONTEND_URL;
-        config.NODE_ENV = "production";
-      },
-    ],
-  ])(
-    "#6877 R8: %s answers 500 config-error with no Stripe call",
-    async (_label, arrange) => {
-      const envFrontendUrl = process.env.FRONTEND_URL;
-      const nodeEnv = config.NODE_ENV;
-      try {
-        arrange();
-        const res = await post(VALID_BODY);
-
-        expect(res.statusCode).toBe(500);
-        expect(res.json()).toEqual({ error: "config-error" });
-        expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-      } finally {
-        config.FRONTEND_URL = SITE_ORIGIN;
-        config.NODE_ENV = nodeEnv;
-        process.env.FRONTEND_URL = envFrontendUrl;
-      }
-    },
-  );
+  // #7395 D4 — what an unusable or unset FRONTEND_URL did here before
+  // (#6877 R8) is now an empty trusted list: config resolves both to `[]`
+  // (config/__tests__/trusted-origins.test.ts), and the route answers the
+  // same 500.
+  it("#6877 R8: an empty trusted-origin list answers 500 config-error with no Stripe call", async () => {
+    config.TRUSTED_ORIGINS = [];
+
+    const res = await post(VALID_BODY);
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "config-error" });
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+    expect(
+      logLines.some(
+        (l) => l["msg"] === "[checkout] no trusted browser origin is configured",
+      ),
+    ).toBe(true);
+  });
 
   it("#6877 R9: a refused request never reads the session cookie's row", async () => {
     process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
@@ -1514,3 +1498,148 @@ describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", ()
     expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
   });
 });
+
+// ── Trusted-origin allowlist (#7395) ──────────────────────────────────────────
+
+describe("POST /v1/checkout/sessions — trusted-origin allowlist (#7395)", () => {
+  const SITE_ORIGIN = "https://example.com";
+  const SPOKE_A = "https://spoke-a.example";
+  const SESSION_TOKEN = "sess_tok_7395";
+  const COOKIE = `better-auth.session_token=${SESSION_TOKEN}.signature`;
+  const originalDatabaseUrl = process.env.DATABASE_URL;
+
+  let app: FastifyInstance;
+
+  function post(
+    payload: Record<string, unknown>,
+    headers: Record<string, string> = {},
+  ) {
+    return app.inject({
+      method: "POST",
+      url: "/v1/checkout/sessions",
+      headers,
+      payload,
+    });
+  }
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN, SPOKE_A];
+    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
+    delete process.env["OSS_API_INTERNAL_SECRET"];
+    mockAssertSandboxKey.mockImplementation(() => undefined);
+    mockCreateCheckoutSession.mockResolvedValue({
+      sessionId: "cs_test_allow7395",
+      url: "https://checkout.stripe.com/c/pay/cs_test_allow7395",
+    });
+
+    app = buildApp();
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    await app.close();
+    delete process.env["STRIPE_SECRET_KEY"];
+    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
+    (prisma.session.findUnique as jest.Mock).mockReset();
+    (prisma.user.findUnique as jest.Mock).mockReset();
+    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
+    else process.env.DATABASE_URL = originalDatabaseUrl;
+  });
+
+  it("accepts an anonymous checkout with both redirects on a listed spoke", async () => {
+    const successUrl = `${SPOKE_A}/purchase/success`;
+    const cancelUrl = `${SPOKE_A}/purchase/cancel`;
+
+    const res = await post({ productCode: "ailk-pro", successUrl, cancelUrl });
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
+      expect.objectContaining({ successUrl, cancelUrl }),
+    );
+  });
+
+  it("accepts redirects split across two listed origins", async () => {
+    const successUrl = `${SPOKE_A}/purchase/success`;
+    const cancelUrl = `${SITE_ORIGIN}/pricing`;
+
+    const res = await post({ productCode: "ailk-pro", successUrl, cancelUrl });
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
+      expect.objectContaining({ successUrl, cancelUrl }),
+    );
+  });
+
+  it.each([
+    ["successUrl", "https://spoke-b.example/x"],
+    ["successUrl", "https://spoke-a.example.evil.test/x"],
+    ["cancelUrl", "https://spoke-b.example/x"],
+    ["cancelUrl", "https://spoke-a.example.evil.test/x"],
+  ])(
+    "refuses a %s on the unlisted %j with 400 naming the field and no Stripe call",
+    async (field, url) => {
+      const res = await post({ ...VALID_BODY, [field]: url });
+
+      expect(res.statusCode).toBe(400);
+      const body = res.json();
+      expect(body.error).toBe("validation-error");
+      expect(body.details).toHaveLength(1);
+      expect(body.details[0].path).toEqual([field]);
+      expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+    },
+  );
+
+  it("answers 500 config-error with no Stripe call when the list is empty", async () => {
+    config.TRUSTED_ORIGINS = [];
+
+    const res = await post({
+      ...VALID_BODY,
+      successUrl: `${SPOKE_A}/purchase/success`,
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "config-error" });
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it("signs the buyer in for a valid cookie forwarded with a listed spoke's Origin", async () => {
+    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      id: "ses_1",
+      userId: "usr_buyer",
+      expiresAt: new Date(Date.now() + 60_000),
+      activeOrganizationId: null,
+      activeWorkspaceId: null,
+    });
+    (prisma.user.findUnique as jest.Mock).mockImplementation(
+      async (args: { select: Record<string, boolean> }) => {
+        const row: Record<string, unknown> = {
+          id: "usr_buyer",
+          email: "buyer@example.com",
+          emailVerified: true,
+          billingProvider: null,
+          billingCustomerId: null,
+        };
+        return Object.fromEntries(
+          Object.keys(args.select).map((k) => [k, row[k]]),
+        );
+      },
+    );
+
+    const res = await post(
+      {
+        productCode: "ailk-pro",
+        successUrl: `${SPOKE_A}/purchase/success`,
+        cancelUrl: `${SPOKE_A}/purchase/cancel`,
+      },
+      { cookie: COOKIE, origin: SPOKE_A },
+    );
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession.mock.calls[0][0].buyer).toEqual({
+      userId: "usr_buyer",
+      email: "buyer@example.com",
+    });
+  });
+});