create-ailk 0.22.0 → 0.24.0

package/templates/apps/api/src/services/__tests__/person.test.ts

@@ -7,7 +7,10 @@
  * `resolveMemberPersonId` and `setPersonPlanOffering` (#7877 D8; AC-3, AC-5),
  * and the hub's buyer read, `resolveCallerBillingCustomerId`, with the
  * stamped-Person guard on the customer-id write (#7961, spec
- * docs/specs/7894-the-hub-signs-in-its-spec.md D13, SEC-7894-6; AC-8).
+ * docs/specs/7894-the-hub-signs-in-its-spec.md D13, SEC-7894-6; AC-8),
+ * and the held checkout plan's release on a verified first link
+ * (#8793, spec docs/specs/8793-the-hub-s-checkout-plan-spec.md D2–D5;
+ * AC-1, AC-2, AC-6).
  *
  * Runs over `createInMemoryPrisma()`, whose `person` delegate enforces the
  * declared `(workspaceId, email)` and `(workspaceId, userId)` keys the way
@@ -36,6 +39,7 @@ import { prisma } from "../../lib/prisma.js";
 import { personContactPatchSchema } from "@working-theory/validation";
 
 import {
+  checkoutPlanKey,
   contactConfirmedFromRow,
   ensureMemberPerson,
   findOrCreatePerson,
@@ -45,11 +49,13 @@ import {
   normalizeTelephone,
   personContactFromRow,
   recordCheckoutPerson,
+  releaseHeldCheckoutPlan,
   resolveCallerBillingCustomerId,
   resolveMemberPersonId,
   setOwnPersonContact,
   setPersonPlanOffering,
   stampPersonUser,
+  stripeCustomerDashboardUrl,
   updatePersonContact,
 } from "../person";
 
@@ -61,6 +67,7 @@ const store = prisma as unknown as {
   __db: Record<string, Row[]>;
   __calls: Array<{ model: string; op: string }>;
   person: Record<string, jest.Mock>;
+  lead: Record<string, jest.Mock>;
 };
 
 const WS_A1 = "wksp_00000000-0000-7000-8000-0000000000a1";
@@ -943,3 +950,255 @@ describe("setPersonPlanOffering (#7877 D8, AC-4, AC-5)", () => {
     expect(await setPersonPlanOffering(WS_A1, "person_x", "retainer")).toBe("internal_error");
   });
 });
+
+// ─── The held checkout plan (#8793) ──────────────────────────────────────────
+
+const leads = () => (store.__db["lead"] ??= []);
+const leadCalls = () => store.__calls.filter((c) => c.model === "lead");
+
+/** A spoke checkout lead on a Person, newest last unless `createdAt` says otherwise. */
+function seedMarkedLead(personId: string, row: Row = {}): Row {
+  const full: Row = {
+    id: `lead_00000000-0000-7000-8000-${String(leads().length + 700).padStart(12, "0")}`,
+    workspaceId: WS_A1,
+    personId,
+    email: "Ada@Example.com",
+    source: "web",
+    spokeCheckout: true,
+    payload: { site: "wendi", page: "checkout", offering: "wendi_retainer" },
+    createdAt: new Date(Date.UTC(2026, 1, 1 + leads().length)),
+    ...row,
+  };
+  leads().push(full);
+  return full;
+}
+
+describe("checkoutPlanKey (#8793 D4)", () => {
+  it("strips a leading <site>_ and answers a plan key, else null", () => {
+    expect(checkoutPlanKey("wendi_retainer", "wendi")).toBe("retainer");
+    expect(checkoutPlanKey("retainer", "wendi")).toBe("retainer");
+    expect(checkoutPlanKey("wendi_Not A Key!", "wendi")).toBeNull();
+    expect(checkoutPlanKey(42, "wendi")).toBeNull();
+  });
+});
+
+describe("setPersonPlanOffering's link guard (#8793 D5, AC-1, AC-6)", () => {
+  const U = "user_00000000-0000-7000-8000-000000000031";
+  const V = "user_00000000-0000-7000-8000-000000000032";
+
+  it("a guarded write never overwrites a set plan", async () => {
+    const p = seedPerson({ email: "ada@example.com", userId: U, planOffering: "premium" });
+    expect(
+      await setPersonPlanOffering(WS_A1, p["id"] as string, "x", { linkedUserId: U }),
+    ).toBe("not_found");
+    expect(people()[0]!["planOffering"]).toBe("premium");
+  });
+
+  it("a guarded write never reaches a Person linked to another user", async () => {
+    const p = seedPerson({ email: "ada@example.com", userId: U });
+    expect(
+      await setPersonPlanOffering(WS_A1, p["id"] as string, "x", { linkedUserId: V }),
+    ).toBe("not_found");
+    expect(people()[0]!["planOffering"]).toBeNull();
+  });
+
+  it("the operator's three-argument write still overwrites a set plan", async () => {
+    const p = seedPerson({ email: "ada@example.com", userId: U, planOffering: "premium" });
+    expect(await setPersonPlanOffering(WS_A1, p["id"] as string, "basic")).toBe("set");
+    expect(people()[0]!["planOffering"]).toBe("basic");
+  });
+});
+
+describe("releaseHeldCheckoutPlan (#8793 D3, AC-1)", () => {
+  const U = "user_00000000-0000-7000-8000-000000000041";
+  const EMAIL = "ada@example.com";
+  let personId: string;
+
+  const release = () => releaseHeldCheckoutPlan(WS_A1, personId, U, EMAIL);
+  const plan = () => people()[0]!["planOffering"];
+
+  beforeEach(() => {
+    personId = seedPerson({ email: EMAIL, userId: U })["id"] as string;
+  });
+
+  it("one marked lead sets its key", async () => {
+    seedMarkedLead(personId);
+    expect(await release()).toBe("set");
+    expect(plan()).toBe("retainer");
+  });
+
+  it("two marked leads naming one key, with and without the site prefix, set it", async () => {
+    seedMarkedLead(personId);
+    seedMarkedLead(personId, {
+      payload: { site: "wendi", page: "checkout", offering: "retainer" },
+    });
+    expect(await release()).toBe("set");
+    expect(plan()).toBe("retainer");
+  });
+
+  it.each([
+    ["the basic purchase is newer", 1, 2],
+    ["the retainer purchase is newer", 2, 1],
+  ])("two marked leads naming different keys are ambiguous whatever their order (%s)", async (_label, retainerDay, basicDay) => {
+    seedMarkedLead(personId, { createdAt: new Date(Date.UTC(2026, 2, retainerDay)) });
+    seedMarkedLead(personId, {
+      createdAt: new Date(Date.UTC(2026, 2, basicDay)),
+      payload: { site: "wendi", page: "checkout", offering: "wendi_basic" },
+    });
+    expect(await release()).toBe("ambiguous");
+    expect(plan()).toBeNull();
+  });
+
+  it("a marked lead under another email is ignored", async () => {
+    seedMarkedLead(personId);
+    seedMarkedLead(personId, {
+      email: "other@example.com",
+      payload: { site: "wendi", page: "checkout", offering: "wendi_basic" },
+    });
+    expect(await release()).toBe("set");
+    expect(plan()).toBe("retainer");
+  });
+
+  it("only unmarked leads are none", async () => {
+    seedMarkedLead(personId, { spokeCheckout: false });
+    expect(await release()).toBe("none");
+    expect(plan()).toBeNull();
+  });
+
+  it("only an offering that is no plan key is none", async () => {
+    seedMarkedLead(personId, {
+      payload: { site: "wendi", page: "checkout", offering: "wendi_Not A Key!" },
+    });
+    expect(await release()).toBe("none");
+    expect(plan()).toBeNull();
+  });
+
+  it("51 marked leads are ambiguous, even when they all agree", async () => {
+    for (let i = 0; i < 51; i += 1) seedMarkedLead(personId);
+    expect(await release()).toBe("ambiguous");
+    expect(plan()).toBeNull();
+  });
+
+  it("a plan already set is kept", async () => {
+    people()[0]!["planOffering"] = "premium";
+    seedMarkedLead(personId);
+    expect(await release()).toBe("kept");
+    expect(plan()).toBe("premium");
+  });
+
+  it("a failed lead read is internal_error, with no write", async () => {
+    seedMarkedLead(personId);
+    store.lead["findMany"]!.mockRejectedValueOnce(new Error("down"));
+    expect(await release()).toBe("internal_error");
+    expect(personCalls().filter((c) => c.op === "updateMany")).toHaveLength(0);
+    expect(plan()).toBeNull();
+  });
+});
+
+describe("resolveMemberPersonId releases a held plan on a fresh link only (#8793 D2, AC-2)", () => {
+  const users = () => (store.__db["user"] ??= []);
+  const U = "user_00000000-0000-7000-8000-000000000051";
+  const EMAIL = "ada@example.com";
+  const log = { warn: jest.fn() };
+  let personId: string;
+
+  const plan = () => people()[0]!["planOffering"];
+  const releaseLines = () =>
+    log.warn.mock.calls
+      .map(([fields]) => fields as Record<string, unknown>)
+      .filter((fields) => fields["event"] === "checkout-plan-release");
+
+  beforeEach(() => {
+    log.warn.mockClear();
+    personId = seedPerson({ email: EMAIL })["id"] as string;
+    seedMarkedLead(personId);
+  });
+
+  it("a verified caller's first link releases the held plan, logging nothing", async () => {
+    users().push({ id: U, email: EMAIL, emailVerified: true });
+    expect(await resolveMemberPersonId(WS_A1, U, EMAIL, log)).toBe(personId);
+    expect(people()[0]!["userId"]).toBe(U);
+    expect(plan()).toBe("retainer");
+    expect(releaseLines()).toEqual([]);
+  });
+
+  it("an unverified caller links nothing and releases nothing", async () => {
+    users().push({ id: U, email: EMAIL, emailVerified: false });
+    expect(await resolveMemberPersonId(WS_A1, U, EMAIL, log)).toBeNull();
+    expect(plan()).toBeNull();
+  });
+
+  it("a Person linked before the call is answered with no release and no lead read", async () => {
+    people()[0]!["userId"] = U;
+    expect(await resolveMemberPersonId(WS_A1, U, EMAIL, log)).toBe(personId);
+    expect(plan()).toBeNull();
+    expect(leadCalls()).toHaveLength(0);
+  });
+
+  it("a direct stamp (the inbox accept's and the consents route's path) releases nothing", async () => {
+    users().push({ id: U, email: EMAIL, emailVerified: true });
+    expect(await stampPersonUser(WS_A1, personId, U)).toBe("stamped");
+    expect(plan()).toBeNull();
+    expect(leadCalls()).toHaveLength(0);
+  });
+
+  it("a failed release still answers the Person and logs its kind only", async () => {
+    users().push({ id: U, email: EMAIL, emailVerified: true });
+    store.lead["findMany"]!.mockRejectedValueOnce(new Error("down"));
+    expect(await resolveMemberPersonId(WS_A1, U, EMAIL, log)).toBe(personId);
+    expect(plan()).toBeNull();
+    expect(releaseLines()).toEqual([
+      { event: "checkout-plan-release", outcome: "internal_error" },
+    ]);
+    const logged = JSON.stringify(log.warn.mock.calls);
+    expect(logged).not.toContain(EMAIL);
+    expect(logged).not.toContain("retainer");
+  });
+
+  it("disagreeing purchases release nothing and log ambiguous", async () => {
+    users().push({ id: U, email: EMAIL, emailVerified: true });
+    seedMarkedLead(personId, {
+      payload: { site: "wendi", page: "checkout", offering: "wendi_basic" },
+    });
+    expect(await resolveMemberPersonId(WS_A1, U, EMAIL, log)).toBe(personId);
+    expect(plan()).toBeNull();
+    expect(releaseLines()).toEqual([
+      { event: "checkout-plan-release", outcome: "ambiguous" },
+    ]);
+  });
+
+  it("a release that finds nothing to set logs nothing", async () => {
+    leads().length = 0;
+    users().push({ id: U, email: EMAIL, emailVerified: true });
+    expect(await resolveMemberPersonId(WS_A1, U, EMAIL, log)).toBe(personId);
+    expect(plan()).toBeNull();
+    expect(log.warn).not.toHaveBeenCalled();
+  });
+});
+
+describe("stripeCustomerDashboardUrl (#9349 DD5, AC-9)", () => {
+  it("builds the live and the test Dashboard links", () => {
+    expect(stripeCustomerDashboardUrl("cus_ABC123", "live")).toBe(
+      "https://dashboard.stripe.com/customers/cus_ABC123",
+    );
+    expect(stripeCustomerDashboardUrl("cus_ABC123", "test")).toBe(
+      "https://dashboard.stripe.com/test/customers/cus_ABC123",
+    );
+  });
+
+  it("refuses an id outside the cus_ grammar or over 255 characters", () => {
+    for (const id of [
+      "cus_a/../../settings",
+      "cus_",
+      "acct_1",
+      "cus_a?x=1",
+      "cus_a#x",
+      `cus_${"a".repeat(252)}`,
+    ]) {
+      expect(stripeCustomerDashboardUrl(id, "live")).toBeNull();
+    }
+    expect(
+      stripeCustomerDashboardUrl(`cus_${"a".repeat(251)}`, "live"),
+    ).not.toBeNull();
+  });
+});