create-ailk 0.21.0 → 0.23.0

package/templates/apps/web/app/api/offerings/checkout/__tests__/route.test.ts

@@ -0,0 +1,810 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * The Offerings buy route (#9051, spec
+ * docs/specs/9051-the-offerings-buy-route-api-spec.md AC-1, AC-2, AC-4–AC-6).
+ *
+ * The real api-client, mapper, `resolveBaseUrl`, `FALLBACK_BASE_URL` and
+ * `resolveCommerceClaim` run; only the licence read and `fetch` are stubbed.
+ * `fetch` routes by path: the shown-set read and the session POST each answer
+ * the case's own stub. The incoming request is addressed to `evil.example`
+ * with a buyer cookie, so a redirect built from the request or a forwarded
+ * cookie fails AC-1. The clock moves 16 seconds before every case, so no case
+ * reads another's shared answer, and each case brings its own visitor
+ * address, so none spends another's start budget.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { checkLicense } from "@working-theory/license";
+import {
+  workspaceShownSetSchema,
+  type OfferingsPrice,
+  type OfferingsProduct,
+} from "@working-theory/validation";
+
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn(),
+}));
+
+import { GET } from "../[lookupKey]/route";
+
+const mockCheckLicense = checkLicense as jest.MockedFunction<
+  typeof checkLicense
+>;
+type LicenseShape = Awaited<ReturnType<typeof checkLicense>>;
+
+/** Point the mocked reader at a licence shape, filling only the fields
+ * `resolveCommerceClaim` reads (`revoked`, `features`). */
+function licenceResolves(result: Partial<LicenseShape>): void {
+  mockCheckLicense.mockResolvedValue(result as LicenseShape);
+}
+
+const ROUTE_SOURCE = readFileSync(
+  join(__dirname, "..", "[lookupKey]", "route.ts"),
+  "utf8",
+);
+
+const API = "https://api.example.test";
+const CHECKOUT_URL = "https://checkout.stripe.com/c/pay/cs_test_a1";
+const SUCCESS_URL =
+  "https://shop.example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}";
+const CANCEL_URL = "https://shop.example.com/pricing";
+const REFUSAL_LINE = /^\[offerings-checkout\] refused reason=[a-z0-9_]+$/;
+
+// ─── The fixture: a wire shown set (no ids), parsed before use ──────────────
+
+const PERIOD_INTERVAL = {
+  monthly: "month",
+  yearly: "year",
+  once: null,
+} as const;
+
+function price(
+  plan: string,
+  period: OfferingsPrice["period"],
+  amount: number,
+): OfferingsPrice {
+  return {
+    priceId: `price_${plan.replace(/-/g, "")}${period}`,
+    lookupKey: `${plan}_${period}`,
+    plan,
+    period,
+    interval: PERIOD_INTERVAL[period],
+    amount,
+    currency: "usd",
+  };
+}
+
+function product(
+  plan: string,
+  ailkGroup: OfferingsProduct["ailkGroup"],
+  prices: OfferingsPrice[],
+): OfferingsProduct {
+  return {
+    productId: `prod_${plan.replace(/-/g, "")}`,
+    plan,
+    name: plan,
+    description: null,
+    marketingFeatures: [],
+    unitLabel: null,
+    note: null,
+    termsNote: null,
+    ailkGroup,
+    ailkOrder: null,
+    prices,
+    recommended: false,
+  };
+}
+
+const wireShownSetSchema = workspaceShownSetSchema.partial({
+  workspaceId: true,
+  organizationId: true,
+});
+
+function wireShownSet(
+  options: { state?: "current" | "expired"; withGrowth?: boolean } = {},
+): unknown {
+  const offerings = [
+    ...(options.withGrowth === false
+      ? []
+      : [
+          product("growth", "plan", [
+            price("growth", "monthly", 4900),
+            price("growth", "yearly", 49000),
+          ]),
+        ]),
+    product("seo-audit", "addon", [price("seo-audit", "monthly", 1950)]),
+  ];
+  return wireShownSetSchema.parse({
+    productIds: offerings.map((o) => o.productId),
+    recommended: { plan: null, addon: null },
+    offerings,
+    state: options.state ?? "current",
+    snapshotAt: "2026-10-18T00:00:00.000Z",
+  });
+}
+
+// ─── The stubbed API ────────────────────────────────────────────────────────
+
+type Answer =
+  | { status: number; json: unknown }
+  | { status: number; text: string }
+  | "reject"
+  | "hang";
+
+const SHOWN: Answer = {
+  status: 200,
+  json: { ok: true, data: { status: "shown", shownSet: wireShownSet() } },
+};
+const STARTED: Answer = {
+  status: 201,
+  json: { sessionId: "cs_test_a1", url: CHECKOUT_URL },
+};
+
+let shownAnswer: Answer;
+let postAnswer: Answer;
+
+function respond(answer: Answer): Promise<Response> {
+  if (answer === "reject") return Promise.reject(new TypeError("fetch failed"));
+  if (answer === "hang") return new Promise<Response>(() => {});
+  if ("text" in answer) {
+    return Promise.resolve(
+      new Response(answer.text, { status: answer.status }),
+    );
+  }
+  return Promise.resolve(
+    new Response(JSON.stringify(answer.json), {
+      status: answer.status,
+      headers: { "content-type": "application/json" },
+    }),
+  );
+}
+
+const fetchMock = jest.fn(
+  (input: string | URL | Request, _init?: RequestInit) => {
+    const url = new URL(String(input));
+    if (url.pathname === "/v1/content/shown-offerings")
+      return respond(shownAnswer);
+    if (url.pathname === "/v1/checkout/sessions") return respond(postAnswer);
+    return Promise.reject(new Error(`unexpected fetch ${url.pathname}`));
+  },
+);
+
+function postCalls(): { url: string; init: RequestInit }[] {
+  return fetchMock.mock.calls
+    .filter(
+      ([input]) => new URL(String(input)).pathname === "/v1/checkout/sessions",
+    )
+    .map(([input, init]) => ({ url: String(input), init: init ?? {} }));
+}
+
+function shownCalls(): number {
+  return fetchMock.mock.calls.filter(
+    ([input]) =>
+      new URL(String(input)).pathname === "/v1/content/shown-offerings",
+  ).length;
+}
+
+function postHeaders(call: { init: RequestInit }): Record<string, string> {
+  const lower: Record<string, string> = {};
+  for (const [name, value] of Object.entries(
+    (call.init.headers ?? {}) as Record<string, string>,
+  )) {
+    lower[name.toLowerCase()] = value;
+  }
+  return lower;
+}
+
+// ─── The env, the console and the clock ─────────────────────────────────────
+
+const env = process.env as Record<string, string | undefined>;
+const ENV_NAMES = [
+  "AILK_API_URL",
+  "NEXT_PUBLIC_AILK_API_URL",
+  "NEXT_PUBLIC_API_URL",
+  "NEXT_PUBLIC_BASE_URL",
+  "NODE_ENV",
+  "OSS_API_INTERNAL_SECRET",
+  "AILK_SPOKE_KEY",
+] as const;
+const savedEnv = Object.fromEntries(ENV_NAMES.map((name) => [name, env[name]]));
+
+const CONSOLE_METHODS = ["log", "info", "warn", "error", "debug"] as const;
+let consoleSpies: jest.SpyInstance[] = [];
+let warnSpy: jest.SpyInstance;
+
+const realFetch = global.fetch;
+
+let addressCounter = 0;
+/** A visitor address no other case uses. */
+function freshAddress(): string {
+  addressCounter += 1;
+  return `10.20.${Math.floor(addressCounter / 250)}.${(addressCounter % 250) + 1}`;
+}
+
+beforeAll(() => {
+  jest.useFakeTimers({
+    doNotFake: ["nextTick", "setImmediate", "clearImmediate", "queueMicrotask"],
+  });
+  jest.setSystemTime(Date.UTC(2026, 9, 18, 12, 0, 0));
+  global.fetch = fetchMock as jest.Mock;
+});
+
+afterAll(() => {
+  jest.useRealTimers();
+  global.fetch = realFetch;
+  for (const name of ENV_NAMES) {
+    if (savedEnv[name] === undefined) delete env[name];
+    else env[name] = savedEnv[name];
+  }
+});
+
+beforeEach(() => {
+  jest.setSystemTime(Date.now() + 16_000);
+  for (const name of ENV_NAMES) delete env[name];
+  env.AILK_API_URL = API;
+  env.NEXT_PUBLIC_BASE_URL = "https://shop.example.com";
+  env.NODE_ENV = "test";
+  shownAnswer = SHOWN;
+  postAnswer = STARTED;
+  fetchMock.mockClear();
+  mockCheckLicense.mockReset();
+  licenceResolves({ features: ["commerce"] });
+  consoleSpies = CONSOLE_METHODS.map((method) =>
+    jest.spyOn(console, method).mockImplementation(() => {}),
+  );
+  warnSpy = consoleSpies[CONSOLE_METHODS.indexOf("warn")]!;
+});
+
+afterEach(() => {
+  for (const spy of consoleSpies) spy.mockRestore();
+});
+
+// ─── The request ────────────────────────────────────────────────────────────
+
+/**
+ * A buyer's card click on `key`: a top-level same-origin navigation to the
+ * wrong host, with a session cookie and a fresh forwarded address. A header
+ * set to `null` is left out.
+ */
+function buyRequest(
+  key: string,
+  options: { method?: string; headers?: Record<string, string | null> } = {},
+): Request {
+  const headers: Record<string, string | null> = {
+    host: "evil.example",
+    cookie: "better-auth.session_token=abc",
+    "sec-fetch-mode": "navigate",
+    "sec-fetch-dest": "document",
+    "sec-fetch-site": "same-origin",
+    "x-forwarded-for": freshAddress(),
+    ...options.headers,
+  };
+  const sent = new Headers();
+  for (const [name, value] of Object.entries(headers)) {
+    if (value !== null) sent.set(name, value);
+  }
+  return new Request(`https://evil.example/api/offerings/checkout/${key}`, {
+    method: options.method ?? "GET",
+    headers: sent,
+  });
+}
+
+function buy(
+  key: string,
+  request: Request = buyRequest(key),
+): Promise<Response> {
+  return GET(request, { params: Promise.resolve({ lookupKey: key }) });
+}
+
+/** Every argument of every console call, as text. */
+function consoleText(): string {
+  return consoleSpies
+    .flatMap((spy) => spy.mock.calls.flat())
+    .map((arg) => String(arg))
+    .join("\n");
+}
+
+async function expectStarted(res: Response, url = CHECKOUT_URL): Promise<void> {
+  expect(res.status).toBe(303);
+  expect(res.headers.get("location")).toBe(url);
+  expect(res.headers.get("cache-control")).toBe("no-store");
+  expect(await res.text()).toBe("");
+}
+
+/** Refused: 303 to `/pricing`, no-store, no body, one fixed warn line, no key anywhere. */
+async function expectRefused(
+  res: Response,
+  key: string,
+  reason?: string,
+): Promise<void> {
+  expect(res.status).toBe(303);
+  expect(res.headers.get("location")).toBe("/pricing");
+  expect(res.headers.get("cache-control")).toBe("no-store");
+  const body = await res.text();
+  expect(body).toBe("");
+  expect(warnSpy).toHaveBeenCalledTimes(1);
+  expect(warnSpy.mock.calls[0]).toHaveLength(1);
+  expect(warnSpy.mock.calls[0]![0]).toMatch(REFUSAL_LINE);
+  if (reason) {
+    expect(warnSpy.mock.calls[0]![0]).toBe(
+      `[offerings-checkout] refused reason=${reason}`,
+    );
+  }
+  for (const spy of consoleSpies) {
+    if (spy !== warnSpy) expect(spy).not.toHaveBeenCalled();
+  }
+  expect(consoleText()).not.toContain(key);
+  for (const [, value] of res.headers) expect(value).not.toContain(key);
+}
+
+// ─── AC-1 ───────────────────────────────────────────────────────────────────
+
+describe("AC-1 — a shown key on a connected site starts its Checkout", () => {
+  it.each(["growth_monthly", "growth_yearly"])(
+    "answers 303 to the API's Checkout URL for %s, posting the full key and site-origin redirects",
+    async (key) => {
+      const res = await buy(key);
+      await expectStarted(res);
+
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      expect(new URL(String(fetchMock.mock.calls[0]![0])).pathname).toBe(
+        "/v1/content/shown-offerings",
+      );
+      const [call] = postCalls();
+      expect(call!.url).toBe(`${API}/v1/checkout/sessions`);
+      expect(call!.init.method).toBe("POST");
+      expect(JSON.parse(String(call!.init.body))).toEqual({
+        productCode: key,
+        successUrl: SUCCESS_URL,
+        cancelUrl: CANCEL_URL,
+      });
+      expect(postHeaders(call!).cookie).toBeUndefined();
+      for (const spy of consoleSpies) expect(spy).not.toHaveBeenCalled();
+    },
+  );
+
+  it("forwards the visitor's x-forwarded-for, never the cookie", async () => {
+    await expectStarted(
+      await buy(
+        "growth_monthly",
+        buyRequest("growth_monthly", {
+          headers: { "x-forwarded-for": "203.0.113.7" },
+        }),
+      ),
+    );
+    const headers = postHeaders(postCalls()[0]!);
+    expect(headers["x-forwarded-for"]).toBe("203.0.113.7");
+    expect(headers.cookie).toBeUndefined();
+    expect(headers.origin).toBeUndefined();
+    expect(headers.authorization).toBeUndefined();
+  });
+
+  it("forwards x-real-ip as x-forwarded-for when no x-forwarded-for came in", async () => {
+    await expectStarted(
+      await buy(
+        "growth_monthly",
+        buyRequest("growth_monthly", {
+          headers: { "x-forwarded-for": null, "x-real-ip": "198.51.100.9" },
+        }),
+      ),
+    );
+    const headers = postHeaders(postCalls()[0]!);
+    expect(headers["x-forwarded-for"]).toBe("198.51.100.9");
+    expect(headers.cookie).toBeUndefined();
+  });
+
+  it("forwards x-real-ip when the incoming x-forwarded-for is empty", async () => {
+    await expectStarted(
+      await buy(
+        "growth_monthly",
+        buyRequest("growth_monthly", {
+          headers: { "x-forwarded-for": "", "x-real-ip": "198.51.100.10" },
+        }),
+      ),
+    );
+    expect(postHeaders(postCalls()[0]!)["x-forwarded-for"]).toBe(
+      "198.51.100.10",
+    );
+  });
+
+  it("sends x-internal-auth from OSS_API_INTERNAL_SECRET to an https API", async () => {
+    env.OSS_API_INTERNAL_SECRET = "s3cret";
+    await expectStarted(await buy("growth_monthly"));
+    expect(postHeaders(postCalls()[0]!)["x-internal-auth"]).toBe("s3cret");
+  });
+
+  it("sends no x-internal-auth when OSS_API_INTERNAL_SECRET is unset", async () => {
+    await expectStarted(await buy("growth_monthly"));
+    expect(postHeaders(postCalls()[0]!)["x-internal-auth"]).toBeUndefined();
+  });
+
+  it("never sends the secret from a spoke; the spoke's own key goes instead", async () => {
+    env.OSS_API_INTERNAL_SECRET = "s3cret";
+    env.AILK_SPOKE_KEY = "spk_test_1";
+    await expectStarted(await buy("growth_monthly"));
+    const headers = postHeaders(postCalls()[0]!);
+    expect(headers["x-internal-auth"]).toBeUndefined();
+    expect(headers["x-ailk-spoke-key"]).toBe("spk_test_1");
+  });
+
+  it("never sends the secret over clear text to a remote API", async () => {
+    env.OSS_API_INTERNAL_SECRET = "s3cret";
+    env.AILK_API_URL = "http://api.remote.example";
+    await expectStarted(await buy("growth_monthly"));
+    const [call] = postCalls();
+    expect(call!.url).toBe("http://api.remote.example/v1/checkout/sessions");
+    expect(postHeaders(call!)["x-internal-auth"]).toBeUndefined();
+  });
+});
+
+// ─── AC-2 ───────────────────────────────────────────────────────────────────
+
+describe("AC-2 — a refused key, an ungrammatical key and an unconnected site return to /pricing", () => {
+  it.each([
+    [404, { error: "unknown-product-code" }],
+    [503, { error: "tenant_unresolved" }],
+  ])("refuses when the API answers %i", async (status, json) => {
+    postAnswer = { status, json };
+    await expectRefused(
+      await buy("growth_monthly"),
+      "growth_monthly",
+      `api_${status}`,
+    );
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(postCalls()).toHaveLength(1);
+  });
+
+  it.each([
+    "Growth_monthly",
+    "growth",
+    "growth_weekly",
+    "growth_monthly_x",
+    `${"a".repeat(41)}_monthly`,
+  ])("refuses the ungrammatical key %s with no fetch", async (key) => {
+    await expectRefused(await buy(key), key, "ungrammatical");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("refuses an unconnected site after the read, with no POST", async () => {
+    shownAnswer = {
+      status: 200,
+      json: { ok: true, data: { status: "unconnected" } },
+    };
+    await expectRefused(
+      await buy("growth_monthly"),
+      "growth_monthly",
+      "unconnected",
+    );
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(postCalls()).toHaveLength(0);
+  });
+});
+
+// ─── AC-4 ───────────────────────────────────────────────────────────────────
+
+describe("AC-4 — every other outcome returns to /pricing, without throwing and within its bound", () => {
+  it.each([400, 401, 429, 500, 502])(
+    "refuses when the API answers %i",
+    async (status) => {
+      postAnswer = { status, json: { error: "x" } };
+      await expectRefused(
+        await buy("growth_monthly"),
+        "growth_monthly",
+        `api_${status}`,
+      );
+    },
+  );
+
+  it.each([
+    "http://checkout.stripe.com/c/pay/x",
+    "javascript:alert(1)",
+    "/purchase/success",
+    "",
+    "https://user:pw@checkout.stripe.com/c/pay/x",
+    "https://checkout.stripe.com/c/pay/x\r\nSet-Cookie: a=b",
+    "https://checkout.stripe.com/c/pay/ü",
+    "https://checkout.stripe.com",
+  ])("refuses a 201 whose url is %j", async (url) => {
+    postAnswer = { status: 201, json: { sessionId: "cs_test_a1", url } };
+    await expectRefused(
+      await buy("growth_monthly"),
+      "growth_monthly",
+      "bad_answer",
+    );
+  });
+
+  it("refuses a 201 with no url", async () => {
+    postAnswer = { status: 201, json: { sessionId: "cs_test_a1" } };
+    await expectRefused(
+      await buy("growth_monthly"),
+      "growth_monthly",
+      "bad_answer",
+    );
+  });
+
+  it("refuses a 201 whose body is not JSON", async () => {
+    postAnswer = { status: 201, text: "<html>ok</html>" };
+    await expectRefused(
+      await buy("growth_monthly"),
+      "growth_monthly",
+      "bad_answer",
+    );
+  });
+
+  it("refuses when the POST fetch rejects", async () => {
+    postAnswer = "reject";
+    await expectRefused(
+      await buy("growth_monthly"),
+      "growth_monthly",
+      "unreachable",
+    );
+  });
+
+  it("refuses a POST that never settles once 10 seconds pass", async () => {
+    postAnswer = "hang";
+    const pending = buy("growth_monthly");
+    await jest.advanceTimersByTimeAsync(10_000);
+    await expectRefused(await pending, "growth_monthly", "unreachable");
+  });
+
+  it.each<[string, Answer]>([
+    ["empty", { status: 200, json: { ok: true, data: { status: "empty" } } }],
+    [
+      "an expired set",
+      {
+        status: 200,
+        json: {
+          ok: true,
+          data: {
+            status: "shown",
+            shownSet: wireShownSet({ state: "expired" }),
+          },
+        },
+      },
+    ],
+    [
+      "a set without the key",
+      {
+        status: 200,
+        json: {
+          ok: true,
+          data: {
+            status: "shown",
+            shownSet: wireShownSet({ withGrowth: false }),
+          },
+        },
+      },
+    ],
+    ["a 500", { status: 500, json: { error: "internal" } }],
+    ["a rejected read", "reject"],
+  ])(
+    "refuses with no POST when the shown read is %s",
+    async (_label, answer) => {
+      shownAnswer = answer;
+      await expectRefused(
+        await buy("growth_monthly"),
+        "growth_monthly",
+        "not_shown",
+      );
+      expect(postCalls()).toHaveLength(0);
+    },
+  );
+
+  it("refuses with no POST once a hung shown read passes 5 seconds", async () => {
+    shownAnswer = "hang";
+    const pending = buy("growth_monthly");
+    await jest.advanceTimersByTimeAsync(5_000);
+    await expectRefused(await pending, "growth_monthly", "not_shown");
+    expect(postCalls()).toHaveLength(0);
+  });
+
+  it.each<[string, () => void]>([
+    ["no commerce feature", () => licenceResolves({ features: [] })],
+    [
+      "a revoked licence",
+      () => licenceResolves({ features: ["commerce"], revoked: true }),
+    ],
+    [
+      "a licence read that throws",
+      () => mockCheckLicense.mockRejectedValue(new Error("no licence")),
+    ],
+  ])("refuses with no fetch on %s", async (_label, arrange) => {
+    arrange();
+    await expectRefused(
+      await buy("growth_monthly"),
+      "growth_monthly",
+      "no_claim",
+    );
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("refuses with no fetch in production with no API origin", async () => {
+    env.NODE_ENV = "production";
+    delete env.AILK_API_URL;
+    await expectRefused(
+      await buy("growth_monthly"),
+      "growth_monthly",
+      "unconnected",
+    );
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it.each(["not a url", "https://example.com"])(
+    "refuses with no POST when NEXT_PUBLIC_BASE_URL is %j",
+    async (base) => {
+      env.NEXT_PUBLIC_BASE_URL = base;
+      await expectRefused(
+        await buy("growth_monthly"),
+        "growth_monthly",
+        "no_origin",
+      );
+      expect(postCalls()).toHaveLength(0);
+    },
+  );
+});
+
+// ─── AC-5 ───────────────────────────────────────────────────────────────────
+
+describe("AC-5 — only a buyer's page load starts anything", () => {
+  it.each<
+    [string, { method?: string; headers?: Record<string, string | null> }]
+  >([
+    ["HEAD", { method: "HEAD" }],
+    [
+      "no fetch metadata (a crawler)",
+      { headers: { "sec-fetch-mode": null, "sec-fetch-dest": null } },
+    ],
+    [
+      "an <img> load",
+      { headers: { "sec-fetch-mode": "no-cors", "sec-fetch-dest": "image" } },
+    ],
+    [
+      "a fetch()",
+      { headers: { "sec-fetch-mode": "cors", "sec-fetch-dest": "empty" } },
+    ],
+    [
+      "a document load that is not a navigation",
+      { headers: { "sec-fetch-mode": "cors" } },
+    ],
+    ["a cross-site load", { headers: { "sec-fetch-site": "cross-site" } }],
+    ["sec-purpose: prefetch", { headers: { "sec-purpose": "prefetch" } }],
+    ["purpose: prefetch", { headers: { purpose: "prefetch" } }],
+    ["x-moz: prefetch", { headers: { "x-moz": "prefetch" } }],
+    ["a Next router prefetch", { headers: { "next-router-prefetch": "1" } }],
+    ["an RSC fetch", { headers: { rsc: "1" } }],
+  ])("refuses %s with no fetch", async (_label, options) => {
+    const key = "growth_monthly";
+    await expectRefused(
+      await buy(key, buyRequest(key, options)),
+      key,
+      "unintended",
+    );
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it.each(["same-origin", "same-site", "none"])(
+    "starts the Checkout for a navigation with sec-fetch-site %s",
+    async (site) => {
+      const key = "growth_monthly";
+      await expectStarted(
+        await buy(
+          key,
+          buyRequest(key, { headers: { "sec-fetch-site": site } }),
+        ),
+      );
+    },
+  );
+});
+
+// ─── AC-6 ───────────────────────────────────────────────────────────────────
+
+describe("AC-6 — one shared read, a switched-off product stops within it, a per-visitor budget", () => {
+  it("shares one read across concurrent clicks and re-reads after 15 seconds", async () => {
+    const [first, second] = await Promise.all([
+      buy("growth_monthly"),
+      buy("growth_monthly"),
+    ]);
+    await expectStarted(first!);
+    await expectStarted(second!);
+    expect(shownCalls()).toBe(1);
+    expect(postCalls()).toHaveLength(2);
+
+    shownAnswer = {
+      status: 200,
+      json: {
+        ok: true,
+        data: {
+          status: "shown",
+          shownSet: wireShownSet({ withGrowth: false }),
+        },
+      },
+    };
+    jest.setSystemTime(Date.now() + 16_000);
+    await expectRefused(
+      await buy("growth_monthly"),
+      "growth_monthly",
+      "not_shown",
+    );
+    expect(shownCalls()).toBe(2);
+    expect(postCalls()).toHaveLength(2);
+  });
+
+  it("starts at most 5 Checkouts per visitor per 10 minutes", async () => {
+    const from = (address: string) =>
+      buyRequest("growth_monthly", { headers: { "x-forwarded-for": address } });
+
+    for (let i = 0; i < 5; i += 1) {
+      await expectStarted(await buy("growth_monthly", from("192.0.2.50")));
+    }
+    expect(postCalls()).toHaveLength(5);
+
+    await expectRefused(
+      await buy("growth_monthly", from("192.0.2.50")),
+      "growth_monthly",
+      "rate_limited",
+    );
+    expect(postCalls()).toHaveLength(5);
+
+    await expectStarted(await buy("growth_monthly", from("192.0.2.51")));
+    expect(postCalls()).toHaveLength(6);
+
+    jest.setSystemTime(Date.now() + 10 * 60_000);
+    await expectStarted(await buy("growth_monthly", from("192.0.2.50")));
+    expect(postCalls()).toHaveLength(7);
+  });
+
+  it("keys the budget on the first 64 characters of an address", async () => {
+    const prefix = "f".repeat(64);
+    for (let i = 0; i < 5; i += 1) {
+      await expectStarted(
+        await buy(
+          "growth_monthly",
+          buyRequest("growth_monthly", {
+            headers: { "x-forwarded-for": `${prefix}${i}` },
+          }),
+        ),
+      );
+    }
+    await expectRefused(
+      await buy(
+        "growth_monthly",
+        buyRequest("growth_monthly", {
+          headers: { "x-forwarded-for": `${prefix}x` },
+        }),
+      ),
+      "growth_monthly",
+      "rate_limited",
+    );
+    expect(postCalls()).toHaveLength(5);
+  });
+
+  it("does not count a request with no visitor address", async () => {
+    for (let i = 0; i < 7; i += 1) {
+      await expectStarted(
+        await buy(
+          "growth_monthly",
+          buyRequest("growth_monthly", {
+            headers: { "x-forwarded-for": null },
+          }),
+        ),
+      );
+    }
+    expect(postCalls()).toHaveLength(7);
+  });
+
+  it("reaches neither Stripe nor the session cookie itself", () => {
+    for (const banned of [
+      "stripe-client",
+      "spoke-checkout",
+      "STRIPE_",
+      "cookies(",
+      "lib/checkout",
+    ]) {
+      expect(ROUTE_SOURCE).not.toContain(banned);
+    }
+  });
+});