create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/routes/webhooks/__tests__/stripe.test.ts

@@ -1,1155 +0,0 @@
-/**
- * POST /api/webhooks/stripe — handler unit tests
- *
- * Uses jest.useFakeTimers for the telemetry-timeout test so the 2s wall-clock
- * wait doesn't slow the suite.
- */
-import type { FastifyInstance } from "fastify";
-import Fastify from "fastify";
-
-// ── Mocks ────────────────────────────────────────────────────────────────────
-
-// Mock analytics track (external boundary: @working-theory/analytics/server)
-const mockTrack = jest.fn().mockResolvedValue(undefined);
-// Commerce claim (D-64, #5796): the receiver is a base-tree primitive gated on
-// the JWT `commerce` claim, so every case in this file is a COMMERCE-CLAIMED
-// deployment — which is what each one was already asserting before the gate
-// existed. The unclaimed matrix lives in
-// `src/__tests__/commerce-claim-registration.test.ts`.
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "pro",
-    plan: "pro-monthly",
-    features: ["commerce"],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-jest.mock("@working-theory/analytics/server", () => ({
-  track: (...args: unknown[]) => mockTrack(...args),
-}));
-
-// Mock Prisma — lib/prisma.ts wraps the external DB boundary (PrismaClient
-// requires a live connection). This call auto-resolves to the manual mock at
-// src/lib/__mocks__/prisma.ts (covers user.findFirst/findUnique/update/create).
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../../lib/prisma.js");
-
-// Mock verifyWebhookSignature at the external boundary (@working-theory/stripe-client)
-// rather than the internal wrapper (lib/stripe.js). lib/stripe.js is a
-// thin re-export with no logic of its own; the external SDK boundary is the
-// correct mock point for signature verification.
-const mockVerifyWebhookSignature = jest.fn();
-class MockStripeWebhookSignatureError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "StripeWebhookSignatureError";
-  }
-}
-jest.mock("@working-theory/stripe-client", () => ({
-  verifyWebhookSignature: (...args: unknown[]) =>
-    mockVerifyWebhookSignature(...args),
-  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
-  assertSandboxKey: jest.fn(),
-  createCheckoutSession: jest.fn(),
-  getStripeClient: jest.fn(),
-  STRIPE_API_VERSION: "2024-06-20",
-  StripeConfigError: class StripeConfigError extends Error {},
-  UnknownProductCodeError: class UnknownProductCodeError extends Error {},
-  WEBHOOK_TOLERANCE_SECONDS: 300,
-}));
-
-// Import after mocks are in place
-import * as configModule from "../../../config/index.js";
-import { stripeWebhookHandler } from "../stripe.js";
-import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
-import { prisma } from "../../../lib/prisma.js";
-
-// ── Helpers ──────────────────────────────────────────────────────────────────
-
-function buildFakeEvent(overrides: Record<string, unknown> = {}) {
-  return {
-    id: "evt_test_12345678abcdef",
-    type: "checkout.session.completed",
-    data: {
-      object: {
-        amount_total: 4999,
-        currency: "usd",
-        metadata: { productId: "starter" },
-        customer_details: { email: "alice@example.com" },
-        id: "cs_test_session_12345678901234567890",
-      },
-    },
-    ...overrides,
-  };
-}
-
-async function buildTestServer(): Promise<FastifyInstance> {
-  const server = Fastify({ logger: false });
-
-  await server.register(async (webhooksScope) => {
-    webhooksScope.addContentTypeParser(
-      "application/json",
-      { parseAs: "buffer" },
-      (_req, body, done) => {
-        done(null, body);
-      },
-    );
-    webhooksScope.post("/v1/webhooks/stripe", stripeWebhookHandler);
-  });
-
-  await server.ready();
-  return server;
-}
-
-// Valid raw body payload
-const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
-const VALID_SIGNATURE = "t=1234,v1=abc";
-
-// ── Tests ────────────────────────────────────────────────────────────────────
-
-describe("POST /api/webhooks/stripe", () => {
-  let server: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    __resetIdempotencyStore();
-    // Control STRIPE_WEBHOOK_SECRET per-test via jest.replaceProperty.
-    // config is a module-level singleton frozen at load time; replaceProperty
-    // restores the original value automatically in afterEach.
-    jest.replaceProperty(configModule, "config", {
-      ...configModule.config,
-      STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
-    });
-    server = await buildTestServer();
-  });
-
-  afterEach(async () => {
-    await server.close();
-    jest.restoreAllMocks();
-    // clearAllMocks keeps queued values: a case that asserts a read must NOT
-    // happen (#6852) would otherwise leak its unconsumed value into the next.
-    (prisma.user.findFirst as jest.Mock).mockReset();
-    (prisma.user.findUnique as jest.Mock).mockReset();
-    (prisma.user.update as jest.Mock).mockReset();
-    (prisma.organization.findFirst as jest.Mock).mockReset();
-    (prisma.organization.update as jest.Mock).mockReset();
-  });
-
-  // ── Case 1: Missing config returns 503 ──────────────────────────────────
-
-  it("returns 503 when STRIPE_WEBHOOK_SECRET is not set", async () => {
-    jest.replaceProperty(configModule, "config", {
-      ...configModule.config,
-      STRIPE_WEBHOOK_SECRET: undefined,
-    });
-
-    const response = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(response.statusCode).toBe(503);
-    expect(JSON.parse(response.body)).toEqual({
-      error: "webhook-not-configured",
-    });
-    expect(mockVerifyWebhookSignature).not.toHaveBeenCalled();
-    expect(mockTrack).not.toHaveBeenCalled();
-  });
-
-  // ── Case 2: Invalid signature returns 400 ──────────────────────────────
-
-  it("returns 400 when signature verification fails", async () => {
-    mockVerifyWebhookSignature.mockImplementation(() => {
-      throw new MockStripeWebhookSignatureError(
-        "Signature verification failed.",
-      );
-    });
-
-    const response = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(response.statusCode).toBe(400);
-    expect(JSON.parse(response.body)).toEqual({ error: "signature-invalid" });
-    expect(mockTrack).not.toHaveBeenCalled();
-  });
-
-  // ── Case 3: Missing Stripe-Signature header returns 400 ─────────────────
-
-  it("returns 400 when Stripe-Signature header is missing", async () => {
-    const response = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        // no stripe-signature
-      },
-    });
-
-    expect(response.statusCode).toBe(400);
-    expect(JSON.parse(response.body)).toEqual({ error: "signature-missing" });
-    expect(mockTrack).not.toHaveBeenCalled();
-  });
-
-  // ── Case 4: Body not a Buffer returns 400 ──────────────────────────────
-
-  it("returns 400 when body is not a Buffer (parser misconfig)", async () => {
-    // Build a server that passes a string body instead of Buffer
-    const stringBodyServer = Fastify({ logger: false });
-    await stringBodyServer.register(async (scope) => {
-      scope.addContentTypeParser(
-        "application/json",
-        { parseAs: "string" },
-        (_req, body, done) => {
-          done(null, body);
-        },
-      );
-      scope.post("/v1/webhooks/stripe", stripeWebhookHandler);
-    });
-    await stringBodyServer.ready();
-
-    try {
-      const response = await stringBodyServer.inject({
-        method: "POST",
-        url: "/v1/webhooks/stripe",
-        payload: '{"type":"test"}',
-        headers: {
-          "content-type": "application/json",
-          "stripe-signature": VALID_SIGNATURE,
-        },
-      });
-
-      expect(response.statusCode).toBe(400);
-      expect(JSON.parse(response.body)).toEqual({ error: "invalid-request" });
-      expect(mockTrack).not.toHaveBeenCalled();
-    } finally {
-      await stringBodyServer.close();
-    }
-  });
-
-  // ── Case 5: Valid checkout.session.completed fires telemetry and 200s ──
-
-  it("returns 200 and fires track on valid checkout.session.completed", async () => {
-    const fakeEvent = buildFakeEvent();
-    mockVerifyWebhookSignature.mockReturnValue(fakeEvent);
-
-    const response = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(response.statusCode).toBe(200);
-    expect(JSON.parse(response.body)).toEqual({ received: true });
-    expect(mockTrack).toHaveBeenCalledTimes(1);
-    expect(mockTrack).toHaveBeenCalledWith("purchase-completed", {
-      amount: 4999,
-      currency: "usd",
-      productId: "starter",
-      eventType: "checkout.session.completed",
-      eventIdPrefix: "evt_test",
-    });
-  });
-
-  // ── Case 6: metadata.product_id (snake_case) is accepted ───────────────
-
-  it("accepts metadata.product_id (snake_case) for productId", async () => {
-    const fakeEvent = buildFakeEvent({
-      data: {
-        object: {
-          amount_total: 9900,
-          currency: "usd",
-          metadata: { product_id: "pro" },
-        },
-      },
-    });
-    mockVerifyWebhookSignature.mockReturnValue(fakeEvent);
-
-    const response = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(response.statusCode).toBe(200);
-    expect(mockTrack).toHaveBeenCalledWith("purchase-completed", {
-      amount: 9900,
-      currency: "usd",
-      productId: "pro",
-      eventType: "checkout.session.completed",
-      eventIdPrefix: "evt_test",
-    });
-  });
-
-  // ── Case 7: no metadata produces undefined productId ───────────────────
-
-  it("sends undefined productId when metadata is absent", async () => {
-    const fakeEvent = buildFakeEvent({
-      data: {
-        object: {
-          amount_total: 1999,
-          currency: "gbp",
-          metadata: null,
-        },
-      },
-    });
-    mockVerifyWebhookSignature.mockReturnValue(fakeEvent);
-
-    await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    const call = mockTrack.mock.calls[0];
-    expect(call[1]).toMatchObject({ productId: undefined });
-  });
-
-  // ── Case 8: Unknown event type 200s with info log ───────────────────────
-
-  it("returns 200 and does not call track for unknown event type", async () => {
-    const fakeEvent = buildFakeEvent({ type: "payment_intent.created" });
-    mockVerifyWebhookSignature.mockReturnValue(fakeEvent);
-
-    const response = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(response.statusCode).toBe(200);
-    expect(JSON.parse(response.body)).toEqual({ received: true });
-    expect(mockTrack).not.toHaveBeenCalled();
-  });
-
-  // ── Case 9: Telemetry failure does not block 200 ────────────────────────
-
-  it("returns 200 even when track throws synchronously", async () => {
-    const fakeEvent = buildFakeEvent();
-    mockVerifyWebhookSignature.mockReturnValue(fakeEvent);
-    mockTrack.mockRejectedValueOnce(new Error("analytics unreachable"));
-
-    const response = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(response.statusCode).toBe(200);
-    expect(JSON.parse(response.body)).toEqual({ received: true });
-  });
-
-  // ── Case 10: Telemetry timeout does not block 200 ───────────────────────
-
-  it("returns 200 within timeout window when track never resolves", async () => {
-    const fakeEvent = buildFakeEvent();
-    mockVerifyWebhookSignature.mockReturnValue(fakeEvent);
-
-    // track returns a promise that never resolves — simulates a hung adapter
-    let resolveTimeout!: () => void;
-    const neverResolves = new Promise<void>((resolve) => {
-      resolveTimeout = resolve;
-    });
-    mockTrack.mockReturnValueOnce(neverResolves);
-
-    // Use real timers; inject completes once the 2s timeout fires.
-    // We set a generous test timeout so jest doesn't kill it first.
-    const responsePromise = server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    // Wait for the 2s telemetry timeout to fire naturally, then resolve the
-    // hung track promise so the suite doesn't leak a pending microtask.
-    const response = await responsePromise;
-    resolveTimeout();
-
-    expect(response.statusCode).toBe(200);
-    expect(JSON.parse(response.body)).toEqual({ received: true });
-  }, 6000); // 6s test timeout > 2s TELEMETRY_TIMEOUT_MS
-
-  // ── Case 11: Logs contain no PII ────────────────────────────────────────
-
-  it("does not log customer email, full event ID, or full session ID", async () => {
-    const logLines: unknown[] = [];
-    const logCapture = Fastify({
-      logger: {
-        level: "info",
-        stream: {
-          write(msg: string) {
-            logLines.push(JSON.parse(msg));
-          },
-        },
-      },
-    });
-
-    await logCapture.register(async (scope) => {
-      scope.addContentTypeParser(
-        "application/json",
-        { parseAs: "buffer" },
-        (_req, body, done) => {
-          done(null, body);
-        },
-      );
-      scope.post("/v1/webhooks/stripe", stripeWebhookHandler);
-    });
-    await logCapture.ready();
-
-    try {
-      const fakeEvent = buildFakeEvent();
-      mockVerifyWebhookSignature.mockReturnValue(fakeEvent);
-
-      await logCapture.inject({
-        method: "POST",
-        url: "/v1/webhooks/stripe",
-        payload: VALID_BODY,
-        headers: {
-          "content-type": "application/json",
-          "stripe-signature": VALID_SIGNATURE,
-        },
-      });
-
-      const logText = JSON.stringify(logLines);
-      // Must NOT contain full event ID
-      expect(logText).not.toContain("evt_test_12345678abcdef");
-      // Must NOT contain customer email
-      expect(logText).not.toContain("alice@example.com");
-      // Must NOT contain full session ID
-      expect(logText).not.toContain("cs_test_session_12345678901234567890");
-      // Should contain the 8-char prefix
-      expect(logText).toContain("evt_test");
-    } finally {
-      await logCapture.close();
-    }
-  });
-
-  // ── Case 12: Non-POST methods return 404 ────────────────────────────────
-
-  it("returns 404 for GET /api/webhooks/stripe", async () => {
-    const response = await server.inject({
-      method: "GET",
-      url: "/v1/webhooks/stripe",
-    });
-    expect(response.statusCode).toBe(404);
-  });
-
-  it("returns 404 for PUT /api/webhooks/stripe", async () => {
-    const response = await server.inject({
-      method: "PUT",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: { "content-type": "application/json" },
-    });
-    expect(response.statusCode).toBe(404);
-  });
-
-  it("returns 404 for DELETE /api/webhooks/stripe", async () => {
-    const response = await server.inject({
-      method: "DELETE",
-      url: "/v1/webhooks/stripe",
-    });
-    expect(response.statusCode).toBe(404);
-  });
-
-  // ── Log capture (shared by the #6113 and #6852 blocks) ─────────────────────
-
-  type LogLine = {
-    level: number;
-    msg?: string;
-    outcome?: string;
-    userId?: string;
-    eventType?: string;
-  };
-  const WARN = 40;
-  const INFO = 30;
-  const ERROR = 50;
-
-  // A log-capture instance built the way the "does not log customer email…"
-  // case builds one — the default buildTestServer() captures no logs.
-  async function withLogCapture(
-    event: Record<string, unknown>,
-  ): Promise<{ statusCode: number; logLines: LogLine[] }> {
-    const logLines: LogLine[] = [];
-    const logCapture = Fastify({
-      logger: {
-        level: "info",
-        stream: {
-          write(msg: string) {
-            logLines.push(JSON.parse(msg) as LogLine);
-          },
-        },
-      },
-    });
-    await logCapture.register(async (scope) => {
-      scope.addContentTypeParser(
-        "application/json",
-        { parseAs: "buffer" },
-        (_req, body, done) => {
-          done(null, body);
-        },
-      );
-      scope.post("/v1/webhooks/stripe", stripeWebhookHandler);
-    });
-    await logCapture.ready();
-    try {
-      mockVerifyWebhookSignature.mockReturnValue(event);
-      const response = await logCapture.inject({
-        method: "POST",
-        url: "/v1/webhooks/stripe",
-        payload: VALID_BODY,
-        headers: {
-          "content-type": "application/json",
-          "stripe-signature": VALID_SIGNATURE,
-        },
-      });
-      return { statusCode: response.statusCode, logLines };
-    } finally {
-      await logCapture.close();
-    }
-  }
-
-  const withOutcome = (lines: LogLine[], outcome: string) =>
-    lines.filter((l) => l.outcome === outcome);
-
-  // ── Billing upsert tests (AC bullets 4-6) ──────────────────────────────────
-
-  // AC bullet 4: customer.created → upsert; re-fire same event = no second write
-  it("upserts billing fields on customer.created and is idempotent on re-fire", async () => {
-    const customerId = "cus_test_abc123";
-    const fakeCustomerCreated = {
-      id: "evt_customer_created_001",
-      type: "customer.created",
-      data: {
-        object: {
-          id: customerId,
-          email: "alice@example.com",
-          metadata: { ailk_user_id: "usr_1" },
-        },
-      },
-    };
-    const upsertedUser = {
-      id: "usr_1",
-      email: "alice@example.com",
-      billingProvider: "stripe",
-      billingCustomerId: customerId,
-    };
-
-    // First fire: typed composite match misses (user not yet linked)
-    (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    // the verified user signal resolves the user by id
-    (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce({
-      id: "usr_1",
-      email: "alice@example.com",
-      billingProvider: null,
-      billingCustomerId: null,
-    });
-    (prisma.user.update as jest.Mock).mockResolvedValueOnce(upsertedUser);
-
-    mockVerifyWebhookSignature.mockReturnValue(fakeCustomerCreated);
-    const response1 = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-    expect(response1.statusCode).toBe(200);
-    expect(prisma.user.update).toHaveBeenCalledTimes(1);
-    expect(prisma.user.update).toHaveBeenCalledWith(
-      expect.objectContaining({
-        data: expect.objectContaining({
-          billingProvider: "stripe",
-          billingCustomerId: customerId,
-        }),
-      }),
-    );
-
-    // Re-fire same event: idempotency store short-circuits — no second write
-    mockVerifyWebhookSignature.mockReturnValue(fakeCustomerCreated);
-    const response2 = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-    expect(response2.statusCode).toBe(200);
-    // update should still be 1 — idempotency store prevented second execution
-    expect(prisma.user.update).toHaveBeenCalledTimes(1);
-  });
-
-  // AC bullet 5 (inverted by #6852): the Checkout email is payer-typed and
-  // unverified, so an email match alone never makes a first binding.
-  it("does not bind a never-bound User matched only by email (#6852)", async () => {
-    const customerId = "cus_test_checkout_xyz";
-    const fakeCheckout = {
-      id: "evt_checkout_002",
-      type: "checkout.session.completed",
-      data: {
-        object: {
-          id: "cs_test_abc",
-          amount_total: 4999,
-          currency: "usd",
-          customer: customerId,
-          customer_details: { email: "bob@example.com" },
-          metadata: { productId: "pro" },
-        },
-      },
-    };
-
-    // Typed composite lookup misses (no prior link)
-    (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    // Would find the user by email — if the handler still asked
-    (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce({
-      id: "usr_2",
-      email: "bob@example.com",
-      billingProvider: null,
-      billingCustomerId: null,
-    });
-
-    mockVerifyWebhookSignature.mockReturnValue(fakeCheckout);
-    const response = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(response.statusCode).toBe(200);
-    expect(prisma.user.findUnique).not.toHaveBeenCalled();
-    expect(prisma.user.update).not.toHaveBeenCalled();
-  });
-
-  // AC bullet 6: event with neither typed match nor email match → 200 + warning, no User row created
-  it("returns 200 and logs warning when no user match found — no row created", async () => {
-    const fakeOrphan = {
-      id: "evt_orphan_003",
-      type: "customer.created",
-      data: {
-        object: {
-          id: "cus_test_orphan",
-          email: null, // no email — can't even do email fallback
-        },
-      },
-    };
-
-    // Typed composite lookup misses
-    (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    // No email fallback possible (email is null)
-
-    mockVerifyWebhookSignature.mockReturnValue(fakeOrphan);
-    const response = await server.inject({
-      method: "POST",
-      url: "/v1/webhooks/stripe",
-      payload: VALID_BODY,
-      headers: {
-        "content-type": "application/json",
-        "stripe-signature": VALID_SIGNATURE,
-      },
-    });
-
-    expect(response.statusCode).toBe(200);
-    expect(JSON.parse(response.body)).toEqual({ received: true });
-    // No user row created
-    expect(prisma.user.update).not.toHaveBeenCalled();
-    expect(prisma.user.create).not.toHaveBeenCalled();
-  });
-
-  // ── #6113: a bound customer is never re-pointed (now on the signal, #6852) ──
-
-  describe("signal against an already-bound User (#6113)", () => {
-    function checkoutCompleted(customer: string, userId: string) {
-      return {
-        id: "evt_6113_checkout",
-        type: "checkout.session.completed",
-        data: {
-          object: {
-            id: "cs_test_6113",
-            amount_total: 4999,
-            currency: "usd",
-            customer,
-            customer_details: { email: "victim@example.com" },
-            metadata: { productId: "pro", ailk_user_id: userId },
-          },
-        },
-      };
-    }
-
-    function customerCreated(id: string, userId: string) {
-      return {
-        id: "evt_6113_customer",
-        type: "customer.created",
-        data: {
-          object: {
-            id,
-            email: "victim@example.com",
-            metadata: { ailk_user_id: userId },
-          },
-        },
-      };
-    }
-
-    const expectFirstReadById = (id: string) =>
-      expect((prisma.user.findUnique as jest.Mock).mock.calls[0]?.[0]).toEqual(
-        expect.objectContaining({ where: { id } }),
-      );
-
-    const victimRow = {
-      id: "usr_victim",
-      email: "victim@example.com",
-      billingProvider: "stripe",
-      billingCustomerId: "cus_victim",
-    };
-
-    // T6a
-    it("does not re-point a bound billingCustomerId from a Checkout naming the victim", async () => {
-      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(victimRow);
-
-      const { statusCode, logLines } = await withLogCapture(
-        checkoutCompleted("cus_attacker", "usr_victim"),
-      );
-
-      expect(statusCode).toBe(200);
-      expectFirstReadById("usr_victim");
-      expect(prisma.user.update).not.toHaveBeenCalled();
-      const conflicts = withOutcome(logLines, "billing_identity_conflict");
-      expect(conflicts).toHaveLength(1);
-      expect(conflicts[0]).toMatchObject({ level: WARN, userId: "usr_victim" });
-      const logText = JSON.stringify(logLines);
-      expect(logText).not.toContain("victim@example.com");
-      expect(logText).not.toContain("cus_attacker");
-      expect(logText).not.toContain("cus_victim");
-    });
-
-    // T6b (the customer.created branch)
-    it("does not re-point a bound billingCustomerId from customer.created naming the victim", async () => {
-      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(victimRow);
-
-      const { statusCode, logLines } = await withLogCapture(
-        customerCreated("cus_attacker", "usr_victim"),
-      );
-
-      expect(statusCode).toBe(200);
-      expectFirstReadById("usr_victim");
-      expect(prisma.user.update).not.toHaveBeenCalled();
-      const conflicts = withOutcome(logLines, "billing_identity_conflict");
-      expect(conflicts).toHaveLength(1);
-      expect(conflicts[0]).toMatchObject({ level: WARN, userId: "usr_victim" });
-    });
-
-    // T6c (a lost race to a different customer is a refusal, not a DB failure)
-    it("guards the write and treats a P2025 lost to another customer as a conflict", async () => {
-      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-      (prisma.user.findUnique as jest.Mock)
-        .mockResolvedValueOnce({
-          id: "usr_race",
-          billingProvider: null,
-          billingCustomerId: null,
-        })
-        .mockResolvedValueOnce({
-          billingProvider: "stripe",
-          billingCustomerId: "cus_other",
-        });
-      (prisma.user.update as jest.Mock).mockRejectedValueOnce(
-        Object.assign(new Error("not found"), { code: "P2025" }),
-      );
-
-      const { statusCode, logLines } = await withLogCapture(
-        checkoutCompleted("cus_new", "usr_race"),
-      );
-
-      expect(statusCode).toBe(200);
-      expectFirstReadById("usr_race");
-      expect(prisma.user.update).toHaveBeenCalledWith(
-        expect.objectContaining({
-          where: { id: "usr_race", billingCustomerId: null },
-        }),
-      );
-      const conflicts = withOutcome(logLines, "billing_identity_conflict");
-      expect(conflicts).toHaveLength(1);
-      expect(conflicts[0]).toMatchObject({ level: WARN, userId: "usr_race" });
-      expect(
-        logLines.filter(
-          (l) =>
-            l.level === ERROR &&
-            l.msg?.includes("billing identity upsert failed"),
-        ),
-      ).toHaveLength(0);
-    });
-
-    // T6d (the same id under another provider is still "already bound")
-    it("does not rewrite a row holding the same id under a different provider", async () => {
-      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce({
-        id: "usr_same",
-        billingProvider: null,
-        billingCustomerId: "cus_same",
-      });
-
-      const { statusCode, logLines } = await withLogCapture(
-        customerCreated("cus_same", "usr_same"),
-      );
-
-      expect(statusCode).toBe(200);
-      expectFirstReadById("usr_same");
-      expect(prisma.user.update).not.toHaveBeenCalled();
-      expect(withOutcome(logLines, "billing_identity_conflict")).toHaveLength(
-        1,
-      );
-    });
-
-    // T6e (a race lost to a sibling event for the SAME customer is a no-op)
-    it("treats a P2025 lost to a sibling event for the same customer as already linked", async () => {
-      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-      (prisma.user.findUnique as jest.Mock)
-        .mockResolvedValueOnce({
-          id: "usr_sib",
-          billingProvider: null,
-          billingCustomerId: null,
-        })
-        .mockResolvedValueOnce({
-          billingProvider: "stripe",
-          billingCustomerId: "cus_new",
-        });
-      (prisma.user.update as jest.Mock).mockRejectedValueOnce(
-        Object.assign(new Error("not found"), { code: "P2025" }),
-      );
-
-      const { statusCode, logLines } = await withLogCapture(
-        checkoutCompleted("cus_new", "usr_sib"),
-      );
-
-      expect(statusCode).toBe(200);
-      expectFirstReadById("usr_sib");
-      expect(withOutcome(logLines, "billing_identity_conflict")).toHaveLength(
-        0,
-      );
-      const linked = withOutcome(logLines, "billing_identity_already_linked");
-      expect(linked).toHaveLength(1);
-      expect(linked[0]).toMatchObject({ level: INFO });
-      expect(logLines.filter((l) => l.level === ERROR)).toHaveLength(0);
-    });
-
-    // T6f (the pre-check sees the sibling's binding already committed)
-    it("treats a signal-matched row already bound to this customer as a no-op", async () => {
-      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce({
-        id: "usr_sib",
-        billingProvider: "stripe",
-        billingCustomerId: "cus_new",
-      });
-
-      const { statusCode, logLines } = await withLogCapture(
-        checkoutCompleted("cus_new", "usr_sib"),
-      );
-
-      expect(statusCode).toBe(200);
-      expectFirstReadById("usr_sib");
-      expect(prisma.user.update).not.toHaveBeenCalled();
-      expect(withOutcome(logLines, "billing_identity_conflict")).toHaveLength(
-        0,
-      );
-    });
-  });
-
-  // ── #6852: a first binding needs a server-stamped user id, never an email ──
-
-  describe("verified user signal (#6852)", () => {
-    function checkoutCompleted(
-      customer: string,
-      metadata: Record<string, unknown>,
-      extra: Record<string, unknown> = {},
-    ) {
-      return {
-        id: "evt_6852_checkout",
-        type: "checkout.session.completed",
-        data: {
-          object: {
-            id: "cs_test_6852",
-            amount_total: 4999,
-            currency: "usd",
-            customer,
-            customer_details: { email: "victim@example.com" },
-            metadata,
-            ...extra,
-          },
-        },
-      };
-    }
-
-    function customerCreated(
-      id: string,
-      email: string | null,
-      metadata?: Record<string, string>,
-    ) {
-      return {
-        id: "evt_6852_customer",
-        type: "customer.created",
-        data: { object: { id, email, ...(metadata ? { metadata } : {}) } },
-      };
-    }
-
-    const neverBound = (id: string) => ({
-      id,
-      billingProvider: null,
-      billingCustomerId: null,
-    });
-
-    const findUniqueWheres = () =>
-      (prisma.user.findUnique as jest.Mock).mock.calls.map(
-        (c) => (c[0] as { where: Record<string, unknown> }).where,
-      );
-
-    beforeEach(() => {
-      (prisma.user.findFirst as jest.Mock).mockResolvedValue(null);
-    });
-
-    // T1 (AC1 — checkout.session.completed)
-    it("T1: a Checkout under the victim's email with no signal binds nothing", async () => {
-      (prisma.user.findUnique as jest.Mock).mockResolvedValue(
-        neverBound("usr_victim"),
-      );
-
-      const { statusCode, logLines } = await withLogCapture(
-        checkoutCompleted("cus_attacker", { productId: "pro" }),
-      );
-
-      expect(statusCode).toBe(200);
-      expect(prisma.user.findUnique).not.toHaveBeenCalled();
-      expect(prisma.user.update).not.toHaveBeenCalled();
-      const unverified = withOutcome(logLines, "billing_identity_unverified");
-      expect(unverified).toHaveLength(1);
-      expect(unverified[0]).toMatchObject({
-        level: WARN,
-        eventType: "checkout.session.completed",
-      });
-      const logText = JSON.stringify(logLines);
-      expect(logText).not.toContain("victim@example.com");
-      expect(logText).not.toContain("cus_attacker");
-    });
-
-    // T2 (AC1 — customer.created)
-    it("T2: customer.created under the victim's email with no signal binds nothing", async () => {
-      (prisma.user.findUnique as jest.Mock).mockResolvedValue(
-        neverBound("usr_victim"),
-      );
-
-      const { statusCode, logLines } = await withLogCapture(
-        customerCreated("cus_attacker", "victim@example.com"),
-      );
-
-      expect(statusCode).toBe(200);
-      expect(prisma.user.findUnique).not.toHaveBeenCalled();
-      expect(prisma.user.update).not.toHaveBeenCalled();
-      expect(withOutcome(logLines, "billing_identity_unverified")).toHaveLength(
-        1,
-      );
-    });
-
-    // T3 (AC1 — a signal naming a different user binds that user, never the email's)
-    it("T3: a signal naming another user binds that user, never the email's", async () => {
-      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(
-        neverBound("usr_attacker"),
-      );
-
-      const { statusCode } = await withLogCapture(
-        checkoutCompleted("cus_attacker", { ailk_user_id: "usr_attacker" }),
-      );
-
-      expect(statusCode).toBe(200);
-      expect(findUniqueWheres()).toEqual([{ id: "usr_attacker" }]);
-      expect(prisma.user.update).toHaveBeenCalledTimes(1);
-      expect(prisma.user.update).toHaveBeenCalledWith(
-        expect.objectContaining({
-          where: { id: "usr_attacker", billingCustomerId: null },
-        }),
-      );
-    });
-
-    // T4 (AC1 — client_reference_id is payer-settable, never a signal)
-    it("T4: client_reference_id alone is not a signal", async () => {
-      (prisma.user.findUnique as jest.Mock).mockResolvedValue(
-        neverBound("usr_victim"),
-      );
-
-      const { statusCode, logLines } = await withLogCapture(
-        checkoutCompleted(
-          "cus_attacker",
-          { productId: "pro" },
-          { client_reference_id: "usr_victim" },
-        ),
-      );
-
-      expect(statusCode).toBe(200);
-      expect(prisma.user.findUnique).not.toHaveBeenCalled();
-      expect(prisma.user.update).not.toHaveBeenCalled();
-      expect(withOutcome(logLines, "billing_identity_unverified")).toHaveLength(
-        1,
-      );
-    });
-
-    // signalOf accepts only a non-empty string — anything else is no signal.
-    it.each([
-      ["an empty string", ""],
-      ["a non-string", 42],
-    ])(
-      "T4b: an ailk_user_id that is %s is not a signal",
-      async (_label, value) => {
-        const { statusCode, logLines } = await withLogCapture(
-          checkoutCompleted("cus_attacker", { ailk_user_id: value }),
-        );
-
-        expect(statusCode).toBe(200);
-        expect(prisma.user.findUnique).not.toHaveBeenCalled();
-        expect(prisma.user.update).not.toHaveBeenCalled();
-        expect(
-          withOutcome(logLines, "billing_identity_unverified"),
-        ).toHaveLength(1);
-      },
-    );
-
-    const buyerBind = {
-      where: { id: "usr_buyer", billingCustomerId: null },
-      data: { billingProvider: "stripe", billingCustomerId: "cus_buyer" },
-    };
-
-    // T5a (AC2 — a signed-in Checkout binds the buyer's first customer)
-    it("T5a: checkout.session.completed carrying the signal binds the buyer", async () => {
-      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(
-        neverBound("usr_buyer"),
-      );
-
-      const { statusCode } = await withLogCapture(
-        checkoutCompleted("cus_buyer", { ailk_user_id: "usr_buyer" }),
-      );
-
-      expect(statusCode).toBe(200);
-      expect(findUniqueWheres()).toEqual([{ id: "usr_buyer" }]);
-      expect(prisma.user.update).toHaveBeenCalledTimes(1);
-      expect(prisma.user.update).toHaveBeenCalledWith(buyerBind);
-    });
-
-    // T5b (AC2 — the signal is read from the customer on customer.created)
-    it("T5b: customer.created carrying the signal binds the buyer", async () => {
-      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(
-        neverBound("usr_buyer"),
-      );
-
-      const { statusCode } = await withLogCapture(
-        customerCreated("cus_buyer", null, { ailk_user_id: "usr_buyer" }),
-      );
-
-      expect(statusCode).toBe(200);
-      expect(findUniqueWheres()).toEqual([{ id: "usr_buyer" }]);
-      expect(prisma.user.update).toHaveBeenCalledTimes(1);
-      expect(prisma.user.update).toHaveBeenCalledWith(buyerBind);
-    });
-
-    // T7 (F5 — a signal naming no User writes nothing and never echoes the value)
-    it("T7: a signal naming no existing User binds nothing and is not logged", async () => {
-      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(null);
-
-      const { statusCode, logLines } = await withLogCapture(
-        checkoutCompleted("cus_buyer", { ailk_user_id: "usr_ghost" }),
-      );
-
-      expect(statusCode).toBe(200);
-      expect(prisma.user.update).not.toHaveBeenCalled();
-      const unknown = withOutcome(logLines, "billing_identity_unknown_user");
-      expect(unknown).toHaveLength(1);
-      expect(unknown[0]).toMatchObject({ level: WARN });
-      expect(JSON.stringify(logLines)).not.toContain("usr_ghost");
-    });
-
-    // T8 (F4 / SEC-04 — an ordinary purchase's customer.created is info, not warn)
-    it("T8: a no-signal customer.created logs unverified at info", async () => {
-      const { statusCode, logLines } = await withLogCapture(
-        customerCreated("cus_buyer", null),
-      );
-
-      expect(statusCode).toBe(200);
-      expect(prisma.user.findUnique).not.toHaveBeenCalled();
-      expect(prisma.user.update).not.toHaveBeenCalled();
-      const unverified = withOutcome(logLines, "billing_identity_unverified");
-      expect(unverified).toHaveLength(1);
-      expect(unverified[0]).toMatchObject({
-        level: INFO,
-        eventType: "customer.created",
-      });
-      expect(JSON.stringify(logLines)).not.toContain("cus_buyer");
-    });
-
-    // T9 (F8 — organizationId keeps precedence over the user signal)
-    it("T9: organizationId takes the Organization path even with a user signal", async () => {
-      // #9067 D13 — under the proof rule: the arm binds only the session the
-      // Organization recorded, and the User path is still never reached.
-      (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
-      (prisma.organization.updateMany as jest.Mock).mockResolvedValueOnce({ count: 1 });
-
-      const { statusCode } = await withLogCapture(
-        checkoutCompleted("cus_org", {
-          organizationId: "org_1",
-          ailk_user_id: "usr_buyer",
-        }),
-      );
-
-      expect(statusCode).toBe(200);
-      expect(prisma.organization.updateMany).toHaveBeenCalledWith(
-        expect.objectContaining({
-          where: { id: "org_1", planCheckoutSessionId: "cs_test_6852", billingCustomerId: null },
-        }),
-      );
-      expect(prisma.organization.update).not.toHaveBeenCalled();
-      expect(prisma.user.findUnique).not.toHaveBeenCalled();
-      expect(prisma.user.update).not.toHaveBeenCalled();
-    });
-  });
-});