create-ailk 0.19.0 → 0.20.0

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-livemode.test.ts

@@ -0,0 +1,158 @@
+/**
+ * POST /api/webhooks/stripe — the livemode guard, test-mode process (#8450
+ * D10; #6852 SEC-03).
+ *
+ * The real `lib/stripe.ts` runs over the package mocked for
+ * `verifyWebhookSignature` only, and nothing admits a live key, so the
+ * process is in test mode: a signed event whose `livemode` is `true` is
+ * answered 200, writes nothing, is not marked seen and logs one
+ * `livemode_mismatch` warn; the same event with `livemode: false` reaches
+ * its arm. The live-mode mirror is `stripe-livemode-live.test.ts`.
+ *
+ * The stripe-site-filter.test.ts harness: the commerce claim mocked present,
+ * the prisma manual mock, the idempotency store reset per test.
+ */
+import type { FastifyInstance } from "fastify";
+import Fastify from "fastify";
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "pro",
+    plan: "pro-monthly",
+    features: ["commerce"],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+jest.mock("@working-theory/analytics/server", () => ({
+  track: jest.fn().mockResolvedValue(undefined),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../../lib/prisma.js");
+
+const mockVerifyWebhookSignature = jest.fn();
+jest.mock("@working-theory/stripe-client", () => ({
+  ...jest.requireActual("@working-theory/stripe-client"),
+  verifyWebhookSignature: (...args: unknown[]) => mockVerifyWebhookSignature(...args),
+}));
+
+import * as configModule from "../../../config/index.js";
+import { prisma } from "../../../lib/prisma.js";
+import { stripeKeyMode } from "../../../lib/stripe.js";
+import { __resetIdempotencyStore, hasSeen } from "../../../lib/webhook-idempotency.js";
+import { stripeWebhookHandler } from "../stripe.js";
+
+const EVENT_ID = "evt_livemode_12345678";
+
+function customerCreated(livemode: boolean) {
+  return {
+    id: EVENT_ID,
+    type: "customer.created",
+    livemode,
+    data: {
+      object: {
+        id: "cus_livemode_fixture",
+        email: "client@example.com",
+        metadata: { ailk_user_id: "usr_livemode" },
+      },
+    },
+  };
+}
+
+type LogCall = [unknown, string?];
+const logCalls: LogCall[] = [];
+
+async function buildTestServer(): Promise<FastifyInstance> {
+  const server = Fastify({ logger: false });
+  await server.register(async (webhooksScope) => {
+    webhooksScope.addContentTypeParser("application/json", { parseAs: "buffer" }, (_req, body, done) => {
+      done(null, body);
+    });
+    webhooksScope.addHook("onRequest", async (request) => {
+      for (const level of ["info", "warn", "error"] as const) {
+        const original = request.log[level].bind(request.log);
+        request.log[level] = ((...args: unknown[]) => {
+          logCalls.push(args as LogCall);
+          return (original as (...a: unknown[]) => void)(...args);
+        }) as typeof request.log.info;
+      }
+    });
+    webhooksScope.post("/v1/webhooks/stripe", stripeWebhookHandler);
+  });
+  await server.ready();
+  return server;
+}
+
+function mismatchLogs(): LogCall[] {
+  return logCalls.filter(
+    ([obj]) =>
+      typeof obj === "object" && obj !== null && (obj as Record<string, unknown>)["outcome"] === "livemode_mismatch",
+  );
+}
+
+let server: FastifyInstance;
+
+beforeEach(async () => {
+  jest.clearAllMocks();
+  logCalls.length = 0;
+  __resetIdempotencyStore();
+  jest.replaceProperty(configModule, "config", {
+    ...configModule.config,
+    STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
+  });
+  (prisma.user.findFirst as jest.Mock).mockResolvedValue(null);
+  (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
+  server = await buildTestServer();
+});
+
+afterEach(async () => {
+  await server.close();
+  jest.restoreAllMocks();
+});
+
+async function post() {
+  return server.inject({
+    method: "POST",
+    url: "/v1/webhooks/stripe",
+    payload: Buffer.from(JSON.stringify({ type: "test" })),
+    headers: { "content-type": "application/json", "stripe-signature": "t=1234,v1=abc" },
+  });
+}
+
+describe("stripe webhook — livemode guard in a test-mode process (#8450 D10)", () => {
+  it("the process is in test mode", () => {
+    expect(stripeKeyMode()).toBe("test");
+  });
+
+  it("drops a live-mode event: 200, no write, not marked seen, one warn", async () => {
+    mockVerifyWebhookSignature.mockReturnValue(customerCreated(true));
+
+    const res = await post();
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ received: true });
+    expect(prisma.user.findFirst).not.toHaveBeenCalled();
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
+    expect(prisma.user.update).not.toHaveBeenCalled();
+    expect(hasSeen(EVENT_ID)).toBe(false);
+    expect(mismatchLogs()).toHaveLength(1);
+    expect(mismatchLogs()[0]?.[0]).toEqual({
+      eventType: "customer.created",
+      eventIdPrefix: EVENT_ID.substring(0, 8),
+      outcome: "livemode_mismatch",
+    });
+  });
+
+  it("handles a test-mode event as before: it reaches its arm and is marked seen", async () => {
+    mockVerifyWebhookSignature.mockReturnValue(customerCreated(false));
+
+    const res = await post();
+
+    expect(res.statusCode).toBe(200);
+    expect(prisma.user.findFirst).toHaveBeenCalled();
+    expect(hasSeen(EVENT_ID)).toBe(true);
+    expect(mismatchLogs()).toHaveLength(0);
+  });
+});

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-proposal-paid.test.ts

@@ -0,0 +1,369 @@
+/**
+ * POST /v1/webhooks/stripe — the proposal paid stamp (#8516 D13; spec
+ * docs/specs/8516-proposals-as-an-artifact-kind-spec.md AC-6, AC-7).
+ *
+ * The signed-event harness is `stripe-request-paid.test.ts`'s (that suite is
+ * left unedited). The Prisma boundary is the in-memory, where-honouring
+ * double, so the stamp's two statements in `lib/proposal-paid-store.ts` run
+ * against real rows seeded in two workspaces, and the audit row is the one
+ * the real `recordWorkspaceAuditAction` writes through `auditLog.create`.
+ */
+import type { FastifyInstance } from "fastify";
+import Fastify from "fastify";
+
+// Commerce claim (D-64, #5796): every case here is a COMMERCE-CLAIMED
+// deployment, the same posture the sibling webhook suites take.
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "pro",
+    plan: "pro-monthly",
+    features: ["commerce"],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+jest.mock("@working-theory/analytics/server", () => ({
+  track: jest.fn().mockResolvedValue(undefined),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); the in-memory double is the repo-standard where-honouring test double for it.
+jest.mock("../../../lib/prisma.js", () =>
+  jest
+    .requireActual<typeof import("../../../__tests__/factories/in-memory-prisma")>(
+      "../../../__tests__/factories/in-memory-prisma",
+    )
+    .createInMemoryPrisma(),
+);
+
+const mockVerifyWebhookSignature = jest.fn();
+class MockStripeWebhookSignatureError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "StripeWebhookSignatureError";
+  }
+}
+jest.mock("@working-theory/stripe-client", () => ({
+  verifyWebhookSignature: (...args: unknown[]) =>
+    mockVerifyWebhookSignature(...args),
+  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
+  assertSandboxKey: jest.fn(),
+  createCheckoutSession: jest.fn(),
+  getStripeClient: jest.fn(),
+  STRIPE_API_VERSION: "2024-06-20",
+  StripeConfigError: class StripeConfigError extends Error {},
+  UnknownProductCodeError: class UnknownProductCodeError extends Error {},
+  WEBHOOK_TOLERANCE_SECONDS: 300,
+}));
+
+import * as configModule from "../../../config/index.js";
+import { stripeWebhookHandler } from "../stripe.js";
+import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
+import { prisma } from "../../../lib/prisma.js";
+
+type Row = Record<string, unknown>;
+
+// eslint-disable-next-line no-restricted-syntax -- the in-memory double exposes its store, call log and jest.fn delegates on keys the real client type does not declare
+const fake = prisma as unknown as {
+  __db: Record<string, Row[]>;
+  __calls: Array<{ model: string; op: string }>;
+  auditLog: { create: jest.Mock };
+  piece: { updateMany: jest.Mock; findFirst: jest.Mock };
+};
+const store = fake.__db;
+const calls = fake.__calls;
+const auditCreate = fake.auditLog.create;
+
+const WS_A1 = "wksp_0190f3a2-7c1d-7e4a-9b2c-0000000000a1";
+const WS_A2 = "wksp_0190f3a2-7c1d-7e4a-9b2c-0000000000a2";
+const PERSON_A1 = "person_0190f3a2-7c1d-7e4a-9b2c-0000000000c1";
+const PERSON_A2 = "person_0190f3a2-7c1d-7e4a-9b2c-0000000000c2";
+const PIECE_A1 = "piece_0190f3a2-7c1d-7e4a-9b2c-0000000000b1";
+const PIECE_A2 = "piece_0190f3a2-7c1d-7e4a-9b2c-0000000000b2";
+const SESSION_ID = "cs_test_proposal_first_session";
+const OTHER_SESSION_ID = "cs_test_proposal_second_session";
+
+/** An approved, priced, unpaid proposal of `workspaceId`. */
+function proposal(id: string, workspaceId: string, personId: string): Row {
+  return {
+    id,
+    workspaceId,
+    personId,
+    title: "Patio proposal",
+    stage: "in-review",
+    needsClient: true,
+    kind: "proposal",
+    approvedAt: new Date("2026-10-13T10:00:00.000Z"),
+    priceAmount: 125000,
+    priceCurrency: "usd",
+    checkoutSessionId: SESSION_ID,
+    checkoutUrl: "https://checkout.stripe.com/c/pay/cs_test_proposal",
+    checkoutExpiresAt: new Date("2026-10-14T13:00:00.000Z"),
+    paidAt: null,
+    paidSessionId: null,
+    createdAt: new Date("2026-10-13T09:00:00.000Z"),
+    updatedAt: new Date("2026-10-13T10:00:00.000Z"),
+  };
+}
+
+function piece(id: string): Row {
+  const row = store["piece"]!.find((r) => r["id"] === id);
+  if (!row) throw new Error(`no seeded piece ${id}`);
+  return row;
+}
+
+function auditRows(): Row[] {
+  return store["auditLog"] ?? [];
+}
+
+function pieceCalls(): Array<{ model: string; op: string }> {
+  return calls.filter((c) => c.model === "piece");
+}
+
+function paidEvent(
+  eventId: string,
+  object: Record<string, unknown> = {},
+): Record<string, unknown> {
+  return {
+    id: eventId,
+    type: "checkout.session.completed",
+    data: {
+      object: {
+        id: SESSION_ID,
+        payment_status: "paid",
+        amount_total: 125000,
+        currency: "usd",
+        payment_link: null,
+        metadata: { ailk_proposal: PIECE_A1, ailk_workspace: WS_A1 },
+        ...object,
+      },
+    },
+  };
+}
+
+async function buildTestServer(): Promise<FastifyInstance> {
+  const server = Fastify({ logger: false });
+  await server.register(async (webhooksScope) => {
+    webhooksScope.addContentTypeParser(
+      "application/json",
+      { parseAs: "buffer" },
+      (_req, body, done) => {
+        done(null, body);
+      },
+    );
+    webhooksScope.post("/v1/webhooks/stripe", stripeWebhookHandler);
+  });
+  await server.ready();
+  return server;
+}
+
+const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
+const HEADERS = {
+  "content-type": "application/json",
+  "stripe-signature": "t=1234,v1=abc",
+};
+
+let server: FastifyInstance;
+
+beforeEach(async () => {
+  jest.clearAllMocks();
+  __resetIdempotencyStore();
+  for (const key of Object.keys(store)) delete store[key];
+  calls.length = 0;
+  store["piece"] = [
+    proposal(PIECE_A1, WS_A1, PERSON_A1),
+    proposal(PIECE_A2, WS_A2, PERSON_A2),
+  ];
+  jest.replaceProperty(configModule, "config", {
+    ...configModule.config,
+    STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
+  });
+  server = await buildTestServer();
+});
+
+afterEach(async () => {
+  await server.close();
+});
+
+async function post(event: Record<string, unknown>) {
+  mockVerifyWebhookSignature.mockReturnValue(event);
+  return server.inject({
+    method: "POST",
+    url: "/v1/webhooks/stripe",
+    payload: VALID_BODY,
+    headers: HEADERS,
+  });
+}
+
+// ── A paid session stamps once and is audited as Stripe (AC-7) ─────────────
+
+describe("a signed, paid proposal session", () => {
+  it("stamps paid_at and paid_session_id once and writes one people.proposal.paid succeeded row", async () => {
+    const res = await post(paidEvent("evt_test_proposal_paid"));
+    expect(res.statusCode).toBe(200);
+    expect(JSON.parse(res.body)).toEqual({ received: true });
+
+    const stamped = piece(PIECE_A1);
+    expect(stamped["paidAt"]).toBeInstanceOf(Date);
+    expect(stamped["paidSessionId"]).toBe(SESSION_ID);
+    // The other workspace's proposal is untouched.
+    expect(piece(PIECE_A2)["paidAt"]).toBeNull();
+    expect(piece(PIECE_A2)["paidSessionId"]).toBeNull();
+
+    expect(auditCreate).toHaveBeenCalledTimes(1);
+    expect(auditRows()).toHaveLength(1);
+    expect(auditRows()[0]).toMatchObject({
+      workspaceId: WS_A1,
+      actorType: "system",
+      actorId: "stripe",
+      action: "people.proposal.paid",
+      targetType: "piece",
+      targetId: PIECE_A1,
+      metadata: {
+        v: 2,
+        outcome: "succeeded",
+        tool: "proposal.paid",
+        idempotencyKey: "evt_test_proposal_paid",
+      },
+    });
+    expect(auditRows()[0]!["metadata"]).not.toHaveProperty("failureReason");
+  });
+
+  it("stamps a zero-due completion too (no_payment_required)", async () => {
+    await post(
+      paidEvent("evt_test_proposal_zero", { payment_status: "no_payment_required" }),
+    );
+    expect(piece(PIECE_A1)["paidSessionId"]).toBe(SESSION_ID);
+    expect(auditRows()).toHaveLength(1);
+    expect(auditRows()[0]!["metadata"]).toMatchObject({ outcome: "succeeded" });
+  });
+});
+
+// ── Replays and second charges (AC-7, SEC-8516-F) ──────────────────────────
+
+describe("a repeated or second payment", () => {
+  it("the same event after a restart (hasSeen cleared) leaves the row unchanged and writes nothing", async () => {
+    const event = paidEvent("evt_test_proposal_replay");
+    await post(event);
+    const paidAt = piece(PIECE_A1)["paidAt"] as Date;
+    const rowsAfterFirst = auditRows().map((r) => ({ ...r }));
+    expect(rowsAfterFirst).toHaveLength(1);
+
+    // A fresh process has an empty in-memory dedup store.
+    __resetIdempotencyStore();
+    auditCreate.mockClear();
+
+    const res = await post(event);
+    expect(res.statusCode).toBe(200);
+    expect(piece(PIECE_A1)["paidAt"]).toBe(paidAt);
+    expect(piece(PIECE_A1)["paidSessionId"]).toBe(SESSION_ID);
+    expect(auditCreate).not.toHaveBeenCalled();
+    expect(auditRows()).toEqual(rowsAfterFirst);
+  });
+
+  it("a second, different paid session for the same proposal writes one failed row (already_paid)", async () => {
+    await post(paidEvent("evt_test_proposal_first"));
+    const paidAt = piece(PIECE_A1)["paidAt"] as Date;
+    auditCreate.mockClear();
+
+    const res = await post(
+      paidEvent("evt_test_proposal_second", { id: OTHER_SESSION_ID }),
+    );
+    expect(res.statusCode).toBe(200);
+
+    // The first payment's stamp stands.
+    expect(piece(PIECE_A1)["paidAt"]).toBe(paidAt);
+    expect(piece(PIECE_A1)["paidSessionId"]).toBe(SESSION_ID);
+
+    expect(auditCreate).toHaveBeenCalledTimes(1);
+    expect(auditRows()).toHaveLength(2);
+    expect(auditRows()[1]).toMatchObject({
+      workspaceId: WS_A1,
+      actorType: "system",
+      actorId: "stripe",
+      action: "people.proposal.paid",
+      targetType: "piece",
+      targetId: PIECE_A1,
+      metadata: {
+        outcome: "failed",
+        failureReason: "already_paid",
+        idempotencyKey: "evt_test_proposal_second",
+      },
+    });
+  });
+});
+
+// ── A session that is not paid (AC-7) ──────────────────────────────────────
+
+describe("a completed session that is not paid", () => {
+  it("writes one failed row (not_paid) and stamps nothing", async () => {
+    const res = await post(
+      paidEvent("evt_test_proposal_unpaid", { payment_status: "unpaid" }),
+    );
+    expect(res.statusCode).toBe(200);
+
+    expect(piece(PIECE_A1)["paidAt"]).toBeNull();
+    expect(piece(PIECE_A1)["paidSessionId"]).toBeNull();
+    expect(pieceCalls()).toEqual([]);
+
+    expect(auditRows()).toHaveLength(1);
+    expect(auditRows()[0]).toMatchObject({
+      workspaceId: WS_A1,
+      actorType: "system",
+      actorId: "stripe",
+      action: "people.proposal.paid",
+      targetId: PIECE_A1,
+      metadata: {
+        outcome: "failed",
+        failureReason: "not_paid",
+        idempotencyKey: "evt_test_proposal_unpaid",
+      },
+    });
+  });
+});
+
+// ── No server metadata, no query (AC-7) ────────────────────────────────────
+
+describe("a session without the server's proposal metadata", () => {
+  it.each([
+    ["no metadata at all", undefined],
+    ["an empty metadata object", {}],
+    ["only ailk_proposal", { ailk_proposal: PIECE_A1 }],
+    ["only ailk_workspace", { ailk_workspace: WS_A1 }],
+    ["malformed ids", { ailk_proposal: "piece_nope", ailk_workspace: "wksp_nope" }],
+  ])("makes no piece query and writes no row (%s)", async (_label, metadata) => {
+    const res = await post(paidEvent("evt_test_proposal_nometa", { metadata }));
+    expect(res.statusCode).toBe(200);
+    expect(pieceCalls()).toEqual([]);
+    expect(auditRows()).toHaveLength(0);
+    expect(piece(PIECE_A1)["paidAt"]).toBeNull();
+  });
+});
+
+// ── Workspace A never reaches workspace B (AC-6) ───────────────────────────
+
+describe("a paid event whose metadata pairs WS_A1 with a piece of WS_A2", () => {
+  it("stamps nothing and writes no row", async () => {
+    const res = await post(
+      paidEvent("evt_test_proposal_cross", {
+        metadata: { ailk_proposal: PIECE_A2, ailk_workspace: WS_A1 },
+      }),
+    );
+    expect(res.statusCode).toBe(200);
+
+    expect(piece(PIECE_A2)["paidAt"]).toBeNull();
+    expect(piece(PIECE_A2)["paidSessionId"]).toBeNull();
+    expect(piece(PIECE_A1)["paidAt"]).toBeNull();
+    expect(auditRows()).toHaveLength(0);
+
+    // Every piece statement was scoped by the metadata's workspace.
+    const pieceDelegate = fake.piece;
+    expect(pieceDelegate.updateMany).toHaveBeenCalledTimes(1);
+    expect(pieceDelegate.findFirst).toHaveBeenCalledTimes(1);
+    for (const mock of [pieceDelegate.updateMany, pieceDelegate.findFirst]) {
+      for (const [args] of mock.mock.calls as Array<[{ where: Row }]>) {
+        expect(args.where).toMatchObject({ id: PIECE_A2, workspaceId: WS_A1 });
+      }
+    }
+  });
+});

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-rate-limit.test.ts

@@ -60,6 +60,8 @@ jest.mock("../../../lib/stripe.js", () => ({
   verifyWebhookSignature: (...args: unknown[]) =>
     mockVerifyWebhookSignature(...args),
   StripeWebhookSignatureError: MockStripeWebhookSignatureError,
+  // #8450 D10 — the handler compares each event's livemode with this.
+  stripeKeyMode: () => "test",
 }));
 
 import { webhooksRoutes } from "../index.js";