create-ailk 0.2.0 → 0.4.0

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-org-billing.test.ts

@@ -1,270 +0,0 @@
-/**
- * POST /api/webhooks/stripe — org-scoped billing path (#3601, spec AC2/AC4)
- *
- * Covers the Organization billing-link branch keyed on
- * metadata.organizationId (spec D2): a checkout with organizationId links the
- * Organization (real org AND individual-as-default-org), idempotently; a
- * checkout WITHOUT organizationId takes the User path and never touches the
- * Organization (single-tenant, degrade-clean regression floor).
- *
- * Companion to stripe.test.ts (the User-path tests, which stay unmodified —
- * AC4 regression floor).
- */
-import type { FastifyInstance } from "fastify";
-import Fastify from "fastify";
-
-// ── Mocks (mirror stripe.test.ts) ────────────────────────────────────────────
-
-const mockTrack = jest.fn().mockResolvedValue(undefined);
-jest.mock("@working-theory/analytics/server", () => ({
-  track: (...args: unknown[]) => mockTrack(...args),
-}));
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../../lib/prisma.js");
-
-const mockVerifyWebhookSignature = jest.fn();
-class MockStripeWebhookSignatureError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "StripeWebhookSignatureError";
-  }
-}
-jest.mock("@working-theory/stripe-client", () => ({
-  verifyWebhookSignature: (...args: unknown[]) =>
-    mockVerifyWebhookSignature(...args),
-  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
-  assertSandboxKey: jest.fn(),
-  createCheckoutSession: jest.fn(),
-  getStripeClient: jest.fn(),
-  STRIPE_API_VERSION: "2024-06-20",
-  StripeConfigError: class StripeConfigError extends Error {},
-  UnknownProductCodeError: class UnknownProductCodeError extends Error {},
-  WEBHOOK_TOLERANCE_SECONDS: 300,
-}));
-
-import * as configModule from "../../../config/index.js";
-import { prisma } from "../../../lib/prisma.js";
-import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
-import { stripeWebhookHandler } from "../stripe.js";
-
-// The sentinel default Organization id (orgs-of-one billing anchor).
-const DEFAULT_ORG_ID = "org_00000000-0000-7000-8000-000000000001";
-const REAL_ORG_ID = "org_00000000-0000-7000-8000-0000000000ab";
-
-const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
-const VALID_SIGNATURE = "t=1234,v1=abc";
-
-async function buildTestServer(): Promise<FastifyInstance> {
-  const server = Fastify({ logger: false });
-  await server.register(async (scope) => {
-    scope.addContentTypeParser(
-      "application/json",
-      { parseAs: "buffer" },
-      (_req, body, done) => done(null, body),
-    );
-    scope.post("/v1/webhooks/stripe", stripeWebhookHandler);
-  });
-  await server.ready();
-  return server;
-}
-
-function checkoutEvent(
-  id: string,
-  metadata: Record<string, string> | null,
-  customer = "cus_test_org_123",
-) {
-  return {
-    id,
-    type: "checkout.session.completed",
-    data: {
-      object: {
-        id: "cs_test_org",
-        amount_total: 9900,
-        currency: "usd",
-        customer,
-        customer_details: { email: "org-admin@example.com" },
-        metadata,
-      },
-    },
-  };
-}
-
-async function fire(server: FastifyInstance) {
-  return server.inject({
-    method: "POST",
-    url: "/v1/webhooks/stripe",
-    payload: VALID_BODY,
-    headers: {
-      "content-type": "application/json",
-      "stripe-signature": VALID_SIGNATURE,
-    },
-  });
-}
-
-describe("POST /api/webhooks/stripe — org-scoped billing (#3601)", () => {
-  let server: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    __resetIdempotencyStore();
-    jest.replaceProperty(configModule, "config", {
-      ...configModule.config,
-      STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
-    });
-    server = await buildTestServer();
-  });
-
-  afterEach(async () => {
-    await server.close();
-    jest.restoreAllMocks();
-  });
-
-  // AC2 — a real org checkout links the Organization by id; replay is a no-op.
-  it("links the Organization on checkout with metadata.organizationId, idempotent on replay", async () => {
-    const customerId = "cus_test_org_123";
-
-    // First fire: no prior composite link → update the target org.
-    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    (prisma.organization.update as jest.Mock).mockResolvedValueOnce({
-      id: REAL_ORG_ID,
-      billingProvider: "stripe",
-      billingCustomerId: customerId,
-    });
-
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_001", { organizationId: REAL_ORG_ID }, customerId),
-    );
-    const r1 = await fire(server);
-    expect(r1.statusCode).toBe(200);
-    expect(prisma.organization.update).toHaveBeenCalledTimes(1);
-    expect(prisma.organization.update).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: { id: REAL_ORG_ID },
-        data: expect.objectContaining({
-          billingProvider: "stripe",
-          billingCustomerId: customerId,
-        }),
-      }),
-    );
-    // The User path is never taken for an org checkout.
-    expect(prisma.user.update).not.toHaveBeenCalled();
-
-    // Replay the SAME event id → idempotency store short-circuits, no 2nd write.
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_001", { organizationId: REAL_ORG_ID }, customerId),
-    );
-    const r2 = await fire(server);
-    expect(r2.statusCode).toBe(200);
-    expect(prisma.organization.update).toHaveBeenCalledTimes(1);
-  });
-
-  // AC2 — typed-composite match already pointing at this org → no-op (a fresh
-  // event id, but the customer is already linked to the target org).
-  it("is a no-op when the org is already linked to this customer (typed-composite match)", async () => {
-    const customerId = "cus_already_linked";
-    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce({
-      id: REAL_ORG_ID,
-      billingProvider: "stripe",
-      billingCustomerId: customerId,
-    });
-
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_002", { organizationId: REAL_ORG_ID }, customerId),
-    );
-    const r = await fire(server);
-    expect(r.statusCode).toBe(200);
-    expect(prisma.organization.update).not.toHaveBeenCalled();
-  });
-
-  // AC2 — an individual is billed on their sentinel default Organization
-  // (orgs-of-one): the SAME org path, targeting DEFAULT_ORG_ID.
-  it("bills an individual on their sentinel default Organization (orgs-of-one)", async () => {
-    const customerId = "cus_individual_xyz";
-    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    (prisma.organization.update as jest.Mock).mockResolvedValueOnce({
-      id: DEFAULT_ORG_ID,
-      billingProvider: "stripe",
-      billingCustomerId: customerId,
-    });
-
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent(
-        "evt_org_003",
-        { organizationId: DEFAULT_ORG_ID },
-        customerId,
-      ),
-    );
-    const r = await fire(server);
-    expect(r.statusCode).toBe(200);
-    expect(prisma.organization.update).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { id: DEFAULT_ORG_ID } }),
-    );
-    expect(prisma.user.update).not.toHaveBeenCalled();
-  });
-
-  // AC4 — a checkout WITHOUT organizationId takes the User path unchanged; the
-  // Organization is never touched (single-tenant degrade-clean regression).
-  it("takes the User path (never touches Organization) when no organizationId is present", async () => {
-    const customerId = "cus_single_tenant";
-    (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce({
-      id: "usr_st",
-      email: "org-admin@example.com",
-      billingProvider: null,
-      billingCustomerId: null,
-    });
-    (prisma.user.update as jest.Mock).mockResolvedValueOnce({ id: "usr_st" });
-
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_st_004", { productId: "pro" }, customerId),
-    );
-    const r = await fire(server);
-    expect(r.statusCode).toBe(200);
-    expect(prisma.user.update).toHaveBeenCalledTimes(1);
-    expect(prisma.organization.findFirst).not.toHaveBeenCalled();
-    expect(prisma.organization.update).not.toHaveBeenCalled();
-  });
-
-  // customer.created also routes on metadata.organizationId.
-  it("links the Organization on customer.created with metadata.organizationId", async () => {
-    const customerId = "cus_created_org";
-    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    (prisma.organization.update as jest.Mock).mockResolvedValueOnce({
-      id: REAL_ORG_ID,
-    });
-
-    mockVerifyWebhookSignature.mockReturnValue({
-      id: "evt_cust_005",
-      type: "customer.created",
-      data: {
-        object: {
-          id: customerId,
-          email: "org-admin@example.com",
-          metadata: { organizationId: REAL_ORG_ID },
-        },
-      },
-    });
-    const r = await fire(server);
-    expect(r.statusCode).toBe(200);
-    expect(prisma.organization.update).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { id: REAL_ORG_ID } }),
-    );
-    expect(prisma.user.update).not.toHaveBeenCalled();
-  });
-
-  // A DB failure on the org link never throws (200 still returned).
-  it("returns 200 even when the org billing update throws", async () => {
-    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    (prisma.organization.update as jest.Mock).mockRejectedValueOnce(
-      new Error("db unreachable"),
-    );
-
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_006", { organizationId: REAL_ORG_ID }),
-    );
-    const r = await fire(server);
-    expect(r.statusCode).toBe(200);
-    expect(JSON.parse(r.body)).toEqual({ received: true });
-  });
-});

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-rate-limit.test.ts

@@ -1,198 +0,0 @@
-/**
- * Stripe webhook rate-limit — per-IP cap on the webhook endpoint.
- *
- * The webhook is a public endpoint. Without a rate limit, an attacker can
- * trigger CPU-intensive signature verification at unbounded rate (DoS) or
- * pin our log infrastructure with garbage payloads. We allow 100 req/min
- * per IP — well above Stripe's actual retry cadence (~ a few per hour for
- * a healthy account) but tight enough to make abuse unattractive.
- *
- * The limit applies regardless of signature validity — we don't want to
- * permit unlimited *invalid* requests either, since those still consume CPU.
- */
-import type { FastifyInstance } from "fastify";
-import Fastify from "fastify";
-
-// ── Mocks ────────────────────────────────────────────────────────────────────
-
-const mockConfig: { STRIPE_WEBHOOK_SECRET: string | undefined } = {
-  STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
-};
-// eslint-disable-next-line no-restricted-syntax -- mirrors stripe.test.ts mock pattern
-jest.mock("../../../config/index.js", () => ({
-  get config() {
-    return mockConfig;
-  },
-}));
-
-jest.mock("@working-theory/analytics/server", () => ({
-  track: jest.fn().mockResolvedValue(undefined),
-}));
-
-// Mock prisma so customer.created billing upsert doesn't throw
-// eslint-disable-next-line no-restricted-syntax -- mirrors stripe.test.ts mock pattern
-jest.mock("../../../lib/prisma.js");
-
-const mockVerifyWebhookSignature = jest.fn();
-class MockStripeWebhookSignatureError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "StripeWebhookSignatureError";
-  }
-}
-// eslint-disable-next-line no-restricted-syntax -- mirrors stripe.test.ts mock pattern
-jest.mock("../../../lib/stripe.js", () => ({
-  verifyWebhookSignature: (...args: unknown[]) =>
-    mockVerifyWebhookSignature(...args),
-  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
-}));
-
-import { webhooksRoutes } from "../index.js";
-import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
-const VALID_SIGNATURE = "t=1234,v1=abc";
-
-async function buildServerWithIp(ip: string): Promise<FastifyInstance> {
-  const server = Fastify({ logger: false });
-
-  // Stub req.ip so we can simulate distinct callers reliably (light.my.request
-  // sends localhost by default which makes per-IP testing brittle).
-  server.addHook("onRequest", async (req) => {
-    Object.defineProperty(req, "ip", { value: ip, configurable: true });
-  });
-
-  await server.register(async (scope) => {
-    scope.addContentTypeParser(
-      "application/json",
-      { parseAs: "buffer" },
-      (_req, body, done) => {
-        done(null, body);
-      },
-    );
-    await scope.register(webhooksRoutes);
-  });
-
-  await server.ready();
-  return server;
-}
-
-// ── Tests ────────────────────────────────────────────────────────────────────
-
-describe("POST /api/webhooks/stripe — rate limit", () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    __resetIdempotencyStore();
-    mockConfig.STRIPE_WEBHOOK_SECRET = "whsec_test_secret";
-    // Each request gets a unique event.id so idempotency doesn't short-circuit
-    let counter = 0;
-    mockVerifyWebhookSignature.mockImplementation(() => ({
-      id: `evt_rate_${(counter++).toString().padStart(12, "0")}`,
-      type: "customer.created",
-      data: { object: {} },
-    }));
-  });
-
-  it("allows requests up to the per-minute cap", async () => {
-    const server = await buildServerWithIp("10.10.10.1");
-
-    try {
-      // 100 requests within the cap should all succeed
-      for (let i = 0; i < 100; i++) {
-        const response = await server.inject({
-          method: "POST",
-          url: "/v1/webhooks/stripe",
-          payload: VALID_BODY,
-          headers: {
-            "content-type": "application/json",
-            "stripe-signature": VALID_SIGNATURE,
-          },
-        });
-        expect(response.statusCode).toBe(200);
-      }
-    } finally {
-      await server.close();
-    }
-  });
-
-  it("returns 429 on the 101st request within the window", async () => {
-    const server = await buildServerWithIp("10.10.10.2");
-
-    try {
-      for (let i = 0; i < 100; i++) {
-        await server.inject({
-          method: "POST",
-          url: "/v1/webhooks/stripe",
-          payload: VALID_BODY,
-          headers: {
-            "content-type": "application/json",
-            "stripe-signature": VALID_SIGNATURE,
-          },
-        });
-      }
-
-      const overLimit = await server.inject({
-        method: "POST",
-        url: "/v1/webhooks/stripe",
-        payload: VALID_BODY,
-        headers: {
-          "content-type": "application/json",
-          "stripe-signature": VALID_SIGNATURE,
-        },
-      });
-
-      expect(overLimit.statusCode).toBe(429);
-    } finally {
-      await server.close();
-    }
-  });
-
-  it("tracks rate-limit buckets per IP independently", async () => {
-    const serverA = await buildServerWithIp("10.10.10.3");
-    const serverB = await buildServerWithIp("10.10.10.4");
-
-    try {
-      // Saturate server A
-      for (let i = 0; i < 100; i++) {
-        await serverA.inject({
-          method: "POST",
-          url: "/v1/webhooks/stripe",
-          payload: VALID_BODY,
-          headers: {
-            "content-type": "application/json",
-            "stripe-signature": VALID_SIGNATURE,
-          },
-        });
-      }
-
-      // A is over the cap
-      const aOverLimit = await serverA.inject({
-        method: "POST",
-        url: "/v1/webhooks/stripe",
-        payload: VALID_BODY,
-        headers: {
-          "content-type": "application/json",
-          "stripe-signature": VALID_SIGNATURE,
-        },
-      });
-      expect(aOverLimit.statusCode).toBe(429);
-
-      // B still has its full budget
-      const bFirst = await serverB.inject({
-        method: "POST",
-        url: "/v1/webhooks/stripe",
-        payload: VALID_BODY,
-        headers: {
-          "content-type": "application/json",
-          "stripe-signature": VALID_SIGNATURE,
-        },
-      });
-      expect(bFirst.statusCode).toBe(200);
-    } finally {
-      await serverA.close();
-      await serverB.close();
-    }
-  });
-});