create-ailk 0.2.0 → 0.4.0

package/templates/apps/api/src/routes/billing/__tests__/portal.test.ts

@@ -1,450 +0,0 @@
-// oss: false
-/**
- * @file portal.test.ts
- *
- * POST /v1/billing/portal-session (spec §5.1 AC-3, AC-4).
- *
- * Fixture: two orgs. ORG_A has an active Stripe customer; ORG_B has never
- * billed (no billingCustomerId). alice owns ORG_A (active workspace WS_A);
- * bob owns ORG_B (active workspace WS_B). dave is an ADMIN of ORG_A and carol
- * is a plain MEMBER of ORG_A — the role fixtures for the #3766 role gate.
- *
- * Stripe is mocked at `../../../lib/stripe.js` (the sole Stripe-touching
- * chokepoint apps/api routes import from) — no real Stripe calls are made.
- */
-import type { FastifyInstance } from "fastify";
-import Fastify from "fastify";
-
-// ── Mocks (must precede the module-under-test import) ───────────────────────
-
-const mockCreateBillingPortalSession = jest.fn();
-const mockAssertSandboxKey = jest.fn();
-
-class MockStripeConfigError extends Error {
-  override name = "StripeConfigError";
-}
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/stripe.js", () => ({
-  assertSandboxKey: (...args: unknown[]) => mockAssertSandboxKey(...args),
-  createBillingPortalSession: (...args: unknown[]) =>
-    mockCreateBillingPortalSession(...args),
-  StripeConfigError: MockStripeConfigError,
-}));
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    workspace: { findUnique: jest.fn(), count: jest.fn() },
-    membership: { findUnique: jest.fn() },
-    organization: { findUnique: jest.fn() },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../../middleware/auth.js";
-import { tenantPreHandlerPlugin } from "../../../middleware/tenant.js";
-import { billingRoutes } from "../index.js";
-
-const FRONTEND = "https://app.example.com";
-const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
-
-const WS_A = "wksp_00000000-0000-7000-8000-0000000000aa";
-const WS_B = "wksp_00000000-0000-7000-8000-0000000000bb";
-const ORG_A = "org_00000000-0000-7000-8000-000000000aaa";
-const ORG_B = "org_00000000-0000-7000-8000-000000000bbb";
-const CUS_A = "cus_test_00000000000000aaaa";
-
-const WORKSPACES = [
-  { id: WS_A, organizationId: ORG_A },
-  { id: WS_B, organizationId: ORG_B },
-];
-
-const MEMBERSHIPS = [
-  { organizationId: ORG_A, userId: "alice", role: "owner" },
-  { organizationId: ORG_A, userId: "dave", role: "admin" },
-  { organizationId: ORG_A, userId: "carol", role: "member" },
-  { organizationId: ORG_B, userId: "bob", role: "owner" },
-];
-
-const ORGANIZATIONS: Record<string, { billingCustomerId: string | null }> = {
-  [ORG_A]: { billingCustomerId: CUS_A },
-  [ORG_B]: { billingCustomerId: null },
-};
-
-const SESSION_ROWS: Record<string, Record<string, unknown>> = {
-  cookie_alice: {
-    id: "sess_alice",
-    userId: "alice",
-    expiresAt: FUTURE,
-    activeOrganizationId: ORG_A,
-    activeWorkspaceId: WS_A,
-  },
-  cookie_bob: {
-    id: "sess_bob",
-    userId: "bob",
-    expiresAt: FUTURE,
-    activeOrganizationId: ORG_B,
-    activeWorkspaceId: WS_B,
-  },
-  cookie_dave: {
-    id: "sess_dave",
-    userId: "dave",
-    expiresAt: FUTURE,
-    activeOrganizationId: ORG_A,
-    activeWorkspaceId: WS_A,
-  },
-  cookie_carol: {
-    id: "sess_carol",
-    userId: "carol",
-    expiresAt: FUTURE,
-    activeOrganizationId: ORG_A,
-    activeWorkspaceId: WS_A,
-  },
-};
-
-function installFixtureMocks(): void {
-  (prisma.session.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { token?: string } }) =>
-      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
-  );
-
-  (prisma.workspace.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { id?: string } }) =>
-      Promise.resolve(WORKSPACES.find((w) => w.id === where.id) ?? null),
-  );
-  (prisma.workspace.count as jest.Mock).mockResolvedValue(WORKSPACES.length);
-
-  (prisma.membership.findUnique as jest.Mock).mockImplementation(
-    ({
-      where,
-    }: {
-      where: {
-        organizationId_userId?: { organizationId: string; userId: string };
-      };
-    }) => {
-      const key = where.organizationId_userId;
-      if (!key) return Promise.resolve(null);
-      return Promise.resolve(
-        MEMBERSHIPS.find(
-          (m) =>
-            m.organizationId === key.organizationId && m.userId === key.userId,
-        ) ?? null,
-      );
-    },
-  );
-
-  (prisma.organization.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { id?: string } }) =>
-      Promise.resolve(
-        where.id && ORGANIZATIONS[where.id] ? ORGANIZATIONS[where.id] : null,
-      ),
-  );
-}
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, { frontendOrigin: FRONTEND });
-  app.register(async (scope) => {
-    await scope.register(tenantPreHandlerPlugin);
-    await scope.register(billingRoutes);
-  });
-  await app.ready();
-  return app;
-}
-
-function cookieHeaders(token: string): Record<string, string> {
-  return {
-    cookie: `better-auth.session_token=${token}`,
-    origin: FRONTEND,
-  };
-}
-
-describe("POST /v1/billing/portal-session", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installFixtureMocks();
-    // Default: a present sandbox key, so the new (#3757) emptiness check at
-    // the call site doesn't short-circuit tests that aren't exercising it.
-    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
-    // Defaults: sandbox key guard passes; portal session created successfully.
-    mockAssertSandboxKey.mockImplementation(() => undefined);
-    mockCreateBillingPortalSession.mockResolvedValue({
-      url: "https://billing.stripe.com/session/test_abc123",
-      expiresAt: 1234567890,
-    });
-
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env["STRIPE_SECRET_KEY"];
-  });
-
-  // AC-3 — portal happy path: { url } from createBillingPortalSession, called
-  // with the caller's OWN org's billingCustomerId.
-  it("returns { url } for the caller's own billed org", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_alice"),
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json();
-    expect(body.ok).toBe(true);
-    expect(body.data).toEqual({
-      url: "https://billing.stripe.com/session/test_abc123",
-    });
-    expect(mockCreateBillingPortalSession).toHaveBeenCalledWith(
-      expect.objectContaining({ stripeCustomerId: CUS_A }),
-    );
-  });
-
-  // 5.2 — the raw billingCustomerId never appears in the response body.
-  it("never echoes the raw billingCustomerId in the response", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_alice"),
-    });
-
-    expect(res.body).not.toContain(CUS_A);
-  });
-
-  // AC-4 — no billingCustomerId → 404, no Stripe call at all.
-  it("returns 404 no-billing-customer when the org has no Stripe customer, no Stripe call", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_bob"),
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(res.json().error.code).toBe("no-billing-customer");
-    expect(mockAssertSandboxKey).not.toHaveBeenCalled();
-    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
-  });
-
-  // AC-4 — a live-mode Stripe key → 500 live-mode-forbidden, no Stripe call.
-  it("returns 500 live-mode-forbidden when the sandbox guard rejects the key", async () => {
-    mockAssertSandboxKey.mockImplementation(() => {
-      throw new MockStripeConfigError("live key rejected");
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_alice"),
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json().error.code).toBe("live-mode-forbidden");
-    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
-  });
-
-  // AC-4 — a restricted-live-mode Stripe key → 500 live-mode-forbidden, no Stripe call.
-  it("returns 500 live-mode-forbidden when the sandbox guard rejects a restricted live key", async () => {
-    mockAssertSandboxKey.mockImplementation(() => {
-      throw new MockStripeConfigError("restricted live key rejected");
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_alice"),
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json().error.code).toBe("live-mode-forbidden");
-    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
-  });
-
-  // ── #3757 — missing/empty key must not be mislabeled live-mode-forbidden ──
-
-  it("returns 500 stripe-not-configured when STRIPE_SECRET_KEY is missing, not live-mode-forbidden", async () => {
-    delete process.env["STRIPE_SECRET_KEY"];
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_alice"),
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json().error.code).toBe("stripe-not-configured");
-    expect(mockAssertSandboxKey).not.toHaveBeenCalled();
-    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 500 stripe-not-configured when STRIPE_SECRET_KEY is an empty string, not live-mode-forbidden", async () => {
-    process.env["STRIPE_SECRET_KEY"] = "";
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_alice"),
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json().error.code).toBe("stripe-not-configured");
-    expect(mockAssertSandboxKey).not.toHaveBeenCalled();
-    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
-  });
-
-  // AC-4 — a StripeConfigError raised from the Stripe call itself → 500 config-error.
-  it("returns 500 config-error when createBillingPortalSession raises StripeConfigError", async () => {
-    mockCreateBillingPortalSession.mockRejectedValue(
-      new MockStripeConfigError("STRIPE_SECRET_KEY missing"),
-    );
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_alice"),
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json().error.code).toBe("config-error");
-    expect(res.body).not.toContain("STRIPE_SECRET_KEY missing");
-  });
-
-  // AC-4 — a generic Stripe SDK throw → 502 portal-unavailable; detail not leaked.
-  it("returns 502 portal-unavailable on a generic Stripe error, detail not leaked", async () => {
-    mockCreateBillingPortalSession.mockRejectedValue(
-      new Error("stripe outage detail"),
-    );
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_alice"),
-    });
-
-    expect(res.statusCode).toBe(502);
-    expect(res.json().error.code).toBe("portal-unavailable");
-    expect(res.body).not.toContain("stripe outage detail");
-  });
-
-  // AC-2 — org scope is the caller's own resolved org, never a foreign one.
-  it("creates the portal session for the caller's own org only", async () => {
-    await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_alice"),
-    });
-
-    expect(prisma.organization.findUnique).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { id: ORG_A } }),
-    );
-    expect(prisma.organization.findUnique).not.toHaveBeenCalledWith(
-      expect.objectContaining({ where: { id: ORG_B } }),
-    );
-  });
-
-  // ── #3766 role gate ───────────────────────────────────────────────────────
-
-  // A plain org MEMBER must be refused: the billing portal is a privileged,
-  // mutating capability, and membership alone is not authorization.
-  it("returns 403 for a plain member, without ever calling Stripe", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_carol"),
-    });
-
-    expect(res.statusCode).toBe(403);
-    expect(res.json().error.code).toBe("forbidden");
-    // The load-bearing assertion: the capability was never exercised.
-    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
-    expect(mockAssertSandboxKey).not.toHaveBeenCalled();
-  });
-
-  // Default-deny ordering: the refusal lands BEFORE the billing-identity
-  // lookup, so a member cannot even infer whether the org has a customer.
-  it("denies a member before the billing-identity lookup", async () => {
-    await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_carol"),
-    });
-
-    expect(prisma.organization.findUnique).not.toHaveBeenCalled();
-  });
-
-  // The refusal must not leak the org's billing state in any form.
-  it("leaks no billing detail in the member refusal", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_carol"),
-    });
-
-    expect(res.body).not.toContain(CUS_A);
-    expect(res.body).not.toContain("billing.stripe.com");
-  });
-
-  // owner (alice) is covered by the happy path above; admin must also pass.
-  it("allows an admin to open the portal", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_dave"),
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json().data.url).toBe(
-      "https://billing.stripe.com/session/test_abc123",
-    );
-    expect(mockCreateBillingPortalSession).toHaveBeenCalledWith(
-      expect.objectContaining({ stripeCustomerId: CUS_A }),
-    );
-  });
-
-  // The role gate must not have disturbed the pre-existing error paths for a
-  // privileged caller (AC: 404 / 500 unchanged for owner+admin).
-  it("still returns 404 no-billing-customer for a privileged caller on an unbilled org", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_bob"),
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(res.json().error.code).toBe("no-billing-customer");
-  });
-
-  // Fail-closed: an unrecognized role is refused rather than falling through
-  // into the privileged path. Proves the allow-list is default-deny, so a role
-  // added to `MembershipRole` later cannot silently gain portal access.
-  it("denies an unrecognized role (default-deny allow-list)", async () => {
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      role: "billing_viewer",
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: cookieHeaders("cookie_alice"),
-    });
-
-    expect(res.statusCode).toBe(403);
-    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
-  });
-
-  // AC-2 — unauthenticated → 401, no Stripe call.
-  it("returns 401 without a session, no Stripe call", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/billing/portal-session",
-      headers: { origin: FRONTEND },
-    });
-
-    expect(res.statusCode).toBe(401);
-    expect(mockCreateBillingPortalSession).not.toHaveBeenCalled();
-  });
-});