create-ailk 0.22.0 → 0.24.0

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-org-billing.test.ts

@@ -2,14 +2,19 @@
  * POST /api/webhooks/stripe — org-scoped billing path (#3601, spec AC2/AC4)
  *
  * Covers the Organization billing-link branch keyed on
- * metadata.organizationId (spec D2): a checkout with organizationId links the
- * Organization (real org AND individual-as-default-org), idempotently; a
- * checkout WITHOUT organizationId takes the User path and never touches the
+ * metadata.organizationId (spec D2), proof-based since #9067 D13 (AC-7): a
+ * checkout with organizationId links the Organization (real org AND
+ * individual-as-default-org) only when the row recorded that session and has
+ * no customer, idempotently; an unrecorded session, a bound customer and any
+ * customer.created write nothing and log `org_bind_unproven`. A checkout
+ * WITHOUT organizationId takes the User path and never touches the
  * Organization (single-tenant, degrade-clean regression floor).
  *
  * Companion to stripe.test.ts (the User-path tests, which stay unmodified —
  * AC4 regression floor).
  */
+import { Writable } from "node:stream";
+
 import type { FastifyInstance } from "fastify";
 import Fastify from "fastify";
 
@@ -70,8 +75,17 @@ const REAL_ORG_ID = "org_00000000-0000-7000-8000-0000000000ab";
 const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
 const VALID_SIGNATURE = "t=1234,v1=abc";
 
+let logLines: string[] = [];
+
 async function buildTestServer(): Promise<FastifyInstance> {
-  const server = Fastify({ logger: false });
+  logLines = [];
+  const stream = new Writable({
+    write(chunk, _encoding, done) {
+      logLines.push(String(chunk));
+      done();
+    },
+  });
+  const server = Fastify({ logger: { level: "info", stream } });
   await server.register(async (scope) => {
     scope.addContentTypeParser(
       "application/json",
@@ -88,13 +102,14 @@ function checkoutEvent(
   id: string,
   metadata: Record<string, string> | null,
   customer = "cus_test_org_123",
+  sessionId = "cs_test_org",
 ) {
   return {
     id,
     type: "checkout.session.completed",
     data: {
       object: {
-        id: "cs_test_org",
+        id: sessionId,
         amount_total: 9900,
         currency: "usd",
         customer,
@@ -117,7 +132,7 @@ async function fire(server: FastifyInstance) {
   });
 }
 
-describe("POST /api/webhooks/stripe — org-scoped billing (#3601)", () => {
+describe("POST /api/webhooks/stripe — org-scoped billing (#3601, proof-based since #9067 D13)", () => {
   let server: FastifyInstance;
 
   beforeEach(async () => {
@@ -127,6 +142,8 @@ describe("POST /api/webhooks/stripe — org-scoped billing (#3601)", () => {
       ...configModule.config,
       STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
     });
+    (prisma.organization.findFirst as jest.Mock).mockResolvedValue(null);
+    (prisma.organization.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
     server = await buildTestServer();
   });
 
@@ -135,85 +152,85 @@ describe("POST /api/webhooks/stripe — org-scoped billing (#3601)", () => {
     jest.restoreAllMocks();
   });
 
-  // AC2 — a real org checkout links the Organization by id; replay is a no-op.
-  it("links the Organization on checkout with metadata.organizationId, idempotent on replay", async () => {
-    const customerId = "cus_test_org_123";
+  /** The arm's `org_bind_unproven` lines, each with no customer or Organization id. */
+  function unprovenLines(...ids: string[]): string[] {
+    const lines = logLines.filter((line) => line.includes("org_bind_unproven"));
+    for (const line of lines) for (const id of ids) expect(line).not.toContain(id);
+    return lines;
+  }
 
-    // First fire: no prior composite link → update the target org.
-    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    (prisma.organization.update as jest.Mock).mockResolvedValueOnce({
-      id: REAL_ORG_ID,
-      billingProvider: "stripe",
-      billingCustomerId: customerId,
-    });
+  function boundWrite(organizationId: string, sessionId: string, customerId: string) {
+    return {
+      where: { id: organizationId, planCheckoutSessionId: sessionId, billingCustomerId: null },
+      data: { billingProvider: "stripe", billingCustomerId: customerId, planCheckoutSessionId: null },
+    };
+  }
 
+  // AC-7 — the recorded session binds into an empty column, clearing the record.
+  it("binds the Organization only to the plan session it recorded, idempotent on replay", async () => {
     mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_001", { organizationId: REAL_ORG_ID }, customerId),
+      checkoutEvent("evt_org_001", { organizationId: "org_1" }, "cus_1", "cs_1"),
     );
     const r1 = await fire(server);
     expect(r1.statusCode).toBe(200);
-    expect(prisma.organization.update).toHaveBeenCalledTimes(1);
-    expect(prisma.organization.update).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: { id: REAL_ORG_ID },
-        data: expect.objectContaining({
-          billingProvider: "stripe",
-          billingCustomerId: customerId,
-        }),
-      }),
-    );
+    expect(prisma.organization.updateMany).toHaveBeenCalledTimes(1);
+    expect(prisma.organization.updateMany).toHaveBeenCalledWith(boundWrite("org_1", "cs_1", "cus_1"));
+    expect(prisma.organization.update).not.toHaveBeenCalled();
     // The User path is never taken for an org checkout.
     expect(prisma.user.update).not.toHaveBeenCalled();
+    expect(unprovenLines()).toHaveLength(0);
 
-    // Replay the SAME event id → idempotency store short-circuits, no 2nd write.
-    mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_001", { organizationId: REAL_ORG_ID }, customerId),
-    );
+    // Replay the SAME event id → the duplicate check stops it before the arm.
     const r2 = await fire(server);
     expect(r2.statusCode).toBe(200);
-    expect(prisma.organization.update).toHaveBeenCalledTimes(1);
+    expect(prisma.organization.updateMany).toHaveBeenCalledTimes(1);
   });
 
-  // AC2 — typed-composite match already pointing at this org → no-op (a fresh
-  // event id, but the customer is already linked to the target org).
+  // AC-7 — a second delivery of the same session under a new event id, after
+  // binding, is the idempotent no-op (typed-composite match).
   it("is a no-op when the org is already linked to this customer (typed-composite match)", async () => {
-    const customerId = "cus_already_linked";
     (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce({
-      id: REAL_ORG_ID,
+      id: "org_1",
       billingProvider: "stripe",
-      billingCustomerId: customerId,
+      billingCustomerId: "cus_1",
     });
+    mockVerifyWebhookSignature.mockReturnValue(
+      checkoutEvent("evt_org_002", { organizationId: "org_1" }, "cus_1", "cs_1"),
+    );
+    const r = await fire(server);
+    expect(r.statusCode).toBe(200);
+    expect(prisma.organization.updateMany).not.toHaveBeenCalled();
+    expect(prisma.organization.update).not.toHaveBeenCalled();
+    expect(logLines.some((line) => line.includes("idempotent no-op"))).toBe(true);
+  });
 
+  // AC-7 — the row holds another session id or none, or already holds a
+  // customer: the guarded write moves no row, so nothing binds.
+  it.each([
+    ["holds another session id or none", { organizationId: "org_1" }],
+    ["already holds cus_other", { organizationId: "org_1" }],
+  ])("writes nothing and logs org_bind_unproven when the row %s", async (_label, metadata) => {
+    (prisma.organization.updateMany as jest.Mock).mockResolvedValueOnce({ count: 0 });
     mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_org_002", { organizationId: REAL_ORG_ID }, customerId),
+      checkoutEvent("evt_org_003", metadata, "cus_1", "cs_1"),
     );
     const r = await fire(server);
     expect(r.statusCode).toBe(200);
     expect(prisma.organization.update).not.toHaveBeenCalled();
+    expect(prisma.user.update).not.toHaveBeenCalled();
+    expect(unprovenLines("cus_1", "org_1")).toHaveLength(1);
   });
 
   // AC2 — an individual is billed on their sentinel default Organization
-  // (orgs-of-one): the SAME org path, targeting DEFAULT_ORG_ID.
+  // (orgs-of-one): the SAME org path, under the same proof.
   it("bills an individual on their sentinel default Organization (orgs-of-one)", async () => {
-    const customerId = "cus_individual_xyz";
-    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    (prisma.organization.update as jest.Mock).mockResolvedValueOnce({
-      id: DEFAULT_ORG_ID,
-      billingProvider: "stripe",
-      billingCustomerId: customerId,
-    });
-
     mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent(
-        "evt_org_003",
-        { organizationId: DEFAULT_ORG_ID },
-        customerId,
-      ),
+      checkoutEvent("evt_org_004", { organizationId: DEFAULT_ORG_ID }, "cus_individual_xyz", "cs_indiv"),
     );
     const r = await fire(server);
     expect(r.statusCode).toBe(200);
-    expect(prisma.organization.update).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { id: DEFAULT_ORG_ID } }),
+    expect(prisma.organization.updateMany).toHaveBeenCalledWith(
+      boundWrite(DEFAULT_ORG_ID, "cs_indiv", "cus_individual_xyz"),
     );
     expect(prisma.user.update).not.toHaveBeenCalled();
   });
@@ -243,22 +260,17 @@ describe("POST /api/webhooks/stripe — org-scoped billing (#3601)", () => {
     expect(prisma.user.update).toHaveBeenCalledTimes(1);
     expect(prisma.organization.findFirst).not.toHaveBeenCalled();
     expect(prisma.organization.update).not.toHaveBeenCalled();
+    expect(prisma.organization.updateMany).not.toHaveBeenCalled();
   });
 
-  // customer.created also routes on metadata.organizationId.
-  it("links the Organization on customer.created with metadata.organizationId", async () => {
-    const customerId = "cus_created_org";
-    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    (prisma.organization.update as jest.Mock).mockResolvedValueOnce({
-      id: REAL_ORG_ID,
-    });
-
+  // AC-7 — a customer's own metadata proves nothing: customer.created binds no Organization.
+  it("writes nothing and logs org_bind_unproven on customer.created with metadata.organizationId", async () => {
     mockVerifyWebhookSignature.mockReturnValue({
       id: "evt_cust_005",
       type: "customer.created",
       data: {
         object: {
-          id: customerId,
+          id: "cus_created_org",
           email: "org-admin@example.com",
           metadata: { organizationId: REAL_ORG_ID },
         },
@@ -266,16 +278,16 @@ describe("POST /api/webhooks/stripe — org-scoped billing (#3601)", () => {
     });
     const r = await fire(server);
     expect(r.statusCode).toBe(200);
-    expect(prisma.organization.update).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { id: REAL_ORG_ID } }),
-    );
+    expect(prisma.organization.findFirst).not.toHaveBeenCalled();
+    expect(prisma.organization.update).not.toHaveBeenCalled();
+    expect(prisma.organization.updateMany).not.toHaveBeenCalled();
     expect(prisma.user.update).not.toHaveBeenCalled();
+    expect(unprovenLines("cus_created_org", REAL_ORG_ID)).toHaveLength(1);
   });
 
   // A DB failure on the org link never throws (200 still returned).
   it("returns 200 even when the org billing update throws", async () => {
-    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    (prisma.organization.update as jest.Mock).mockRejectedValueOnce(
+    (prisma.organization.updateMany as jest.Mock).mockRejectedValueOnce(
       new Error("db unreachable"),
     );
 

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-site-filter.test.ts

@@ -200,6 +200,7 @@ function expectHandledAsToday() {
   expect(prisma.callback.updateMany).toHaveBeenCalledTimes(1);
   expect(prisma.user.findFirst).toHaveBeenCalledWith({
     where: { billingProvider: "stripe", billingCustomerId: CUSTOMER_ID },
+    select: { id: true },
   });
   expect(foreignSiteLogs()).toHaveLength(0);
 }
@@ -624,17 +625,17 @@ describe.each(HUB_STAMPS)("case 13 — a billing event with %s", (_label, stamp)
     });
   });
 
-  it("customer.created with organizationId binds the Organization's billing customer", async () => {
+  // #9067 D13 — a customer's own metadata proves no plan checkout: the
+  // event passes the site filter and still binds no Organization.
+  it("customer.created with organizationId passes the filter and writes no Organization", async () => {
     mockVerifyWebhookSignature.mockReturnValue(
       customerEvent("customer.created", { ...stamp, organizationId: ORG_ID }),
     );
     const res = await post();
 
     expect(res.statusCode).toBe(200);
-    expect(prisma.organization.update).toHaveBeenCalledWith({
-      where: { id: ORG_ID },
-      data: { billingProvider: "stripe", billingCustomerId: CUSTOMER_ID },
-    });
+    expect(prisma.organization.update).not.toHaveBeenCalled();
+    expect(prisma.organization.updateMany).not.toHaveBeenCalled();
   });
 
   it("customer.subscription.updated writes the subscriber's dunning record", async () => {

package/templates/apps/api/src/routes/webhooks/__tests__/stripe.test.ts

@@ -1129,7 +1129,10 @@ describe("POST /api/webhooks/stripe", () => {
 
     // T9 (F8 — organizationId keeps precedence over the user signal)
     it("T9: organizationId takes the Organization path even with a user signal", async () => {
+      // #9067 D13 — under the proof rule: the arm binds only the session the
+      // Organization recorded, and the User path is still never reached.
       (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
+      (prisma.organization.updateMany as jest.Mock).mockResolvedValueOnce({ count: 1 });
 
       const { statusCode } = await withLogCapture(
         checkoutCompleted("cus_org", {
@@ -1139,9 +1142,12 @@ describe("POST /api/webhooks/stripe", () => {
       );
 
       expect(statusCode).toBe(200);
-      expect(prisma.organization.update).toHaveBeenCalledWith(
-        expect.objectContaining({ where: { id: "org_1" } }),
+      expect(prisma.organization.updateMany).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: { id: "org_1", planCheckoutSessionId: "cs_test_6852", billingCustomerId: null },
+        }),
       );
+      expect(prisma.organization.update).not.toHaveBeenCalled();
       expect(prisma.user.findUnique).not.toHaveBeenCalled();
       expect(prisma.user.update).not.toHaveBeenCalled();
     });

package/templates/apps/api/src/routes/webhooks/index.ts

@@ -4,6 +4,14 @@
  * Routes:
  *   POST /v1/webhooks/stripe — verify Stripe signature, dispatch event,
  *                               fire telemetry, respond 200.
+ *   POST /v1/webhooks/stripe/:connectionToken — the per-Organization
+ *                               receiver (#8932 D1): the token names ONE
+ *                               Organization's StripeConnection, whose own
+ *                               secret verifies the delivery and whose
+ *                               recorded Offerings sessions it fulfils.
+ *                               Base tree like the legacy receiver — the
+ *                               commerce claim is read at call time — with
+ *                               its own rate-limit bucket.
  *   POST /v1/webhooks/calcom — verify the scheduling provider's signature,
  *                               normalize a booking event into an
  *                               Appointment row (#6085, brief H7).
@@ -32,9 +40,11 @@ import type { FastifyPluginAsync, FastifyReply, FastifyRequest } from "fastify";
 import { isModuleEnabled } from "../../config/modules.js";
 import { loadSlice } from "../../lib/slice-load.js";
 
+import { stripeOfferingsWebhookHandler } from "./stripe-offerings.js";
 import { stripeWebhookHandler } from "./stripe.js";
 
 export const STRIPE_WEBHOOK_RATE_LIMIT_PER_MIN = 100;
+export const STRIPE_OFFERINGS_WEBHOOK_RATE_LIMIT_PER_MIN = 100;
 export const CALCOM_WEBHOOK_RATE_LIMIT_PER_MIN = 100;
 
 // Kept off the `import()` call site so `tsc` never resolves it and the OSS
@@ -70,6 +80,19 @@ export const webhooksRoutes: FastifyPluginAsync = async (fastify) => {
     stripeWebhookHandler,
   );
 
+  fastify.post(
+    "/v1/webhooks/stripe/:connectionToken",
+    {
+      config: {
+        rateLimit: {
+          max: STRIPE_OFFERINGS_WEBHOOK_RATE_LIMIT_PER_MIN,
+          timeWindow: "1 minute",
+        },
+      },
+    },
+    stripeOfferingsWebhookHandler,
+  );
+
   if (isModuleEnabled("scheduling")) {
     const mod = (await loadSlice(CALCOM_HANDLER, () => import(CALCOM_HANDLER))) as {
       calcomWebhookHandler?: (request: FastifyRequest, reply: FastifyReply) => Promise<void>;