create-ailk 0.23.0 → 0.25.1

package/templates/apps/mcp/__tests__/start_purchase.test.ts

@@ -1,448 +0,0 @@
-/**
- * `start_purchase` — the MCP half of the API↔MCP parity proof (#5971 D7),
- * plus FR-1 and FR-2, rewritten for #6001's redirect fix.
- *
- * `apps/api` cannot import `apps/mcp` and vice versa, so neither side can
- * call the other in a test. The evidence is the SHARED SEAM asserted from
- * both ends — `CreateSessionPayload` / `CheckoutSessionResponse` in
- * `packages/api-client/src/checkout.ts`:
- *
- *   here          — the tool calls `checkout.createSession` with EXACTLY the
- *                   payload object the route validates, and its return value
- *                   deep-equals `{ url }` from the seam;
- *   the API end    — `apps/api/src/routes/checkout/__tests__/sessions.test.ts`
- *                   § "parity with the payload the MCP tool builds (#5971)"
- *                   feeds that same payload to the route and pins its reply.
- *
- * Idiom: `apps/mcp/__tests__/search_content.test.ts`, the worked example root
- * `CLAUDE.md` § API ↔ MCP parity names.
- *
- * #6001: three security reviews on PR #5991 (two High, one Medium) found
- * that an anonymous MCP caller could forward its own successUrl/cancelUrl to
- * `checkout.createSession` — the payment succeeds so no fraud signal fires,
- * making it a phishing-amplification open redirect off the seller's real
- * checkout — and that `allowPromotionCodes` had no reason to be
- * caller-controlled on an anonymous surface either. The tool now validates
- * against `purchaseMcpInputSchema` (a strict productCode+quantity-only pick
- * of the shared schema), so it can never build a payload containing a
- * caller-supplied redirect: both `successUrl` and `cancelUrl` are ALWAYS
- * derived from `AILK_BASE_URL`, and `allowPromotionCodes` is never forwarded.
- *
- * Nothing here reaches Stripe or a licence server (NFR-6).
- */
-
-import { checkout } from "@working-theory/api-client";
-import { getMcpToolCatalog } from "@working-theory/metadata";
-import { purchaseMcpInputSchema } from "@working-theory/validation";
-
-import {
-  __setMcpCommerceClaimForTest,
-  resetMcpCommerceClaim,
-} from "../src/lib/commerce-claim.js";
-import { ailkPurchase } from "../src/tools/purchase.js";
-
-jest.mock("@working-theory/api-client", () => ({
-  checkout: { createSession: jest.fn() },
-}));
-
-const createSession = checkout.createSession as jest.MockedFunction<
-  typeof checkout.createSession
->;
-
-const HOSTED_URL = "https://checkout.stripe.com/c/pay/cs_test_abc123";
-
-function sessionCreated() {
-  return {
-    ok: true as const,
-    body: { sessionId: "cs_test_abc123", url: HOSTED_URL },
-  };
-}
-
-beforeEach(() => {
-  __setMcpCommerceClaimForTest("claimed");
-  process.env.AILK_BASE_URL = "https://example.com";
-});
-
-afterEach(() => {
-  jest.clearAllMocks();
-  resetMcpCommerceClaim();
-  delete process.env.AILK_BASE_URL;
-});
-
-describe("start_purchase — parity with the payload POST /v1/checkout/sessions takes (#5971, #6001)", () => {
-  it("calls checkout.createSession with EXACTLY the route's payload shape, redirects derived — never caller-supplied", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    await ailkPurchase({
-      productCode: "growth_monthly",
-      quantity: 2,
-    });
-
-    expect(createSession).toHaveBeenCalledTimes(1);
-    expect(createSession).toHaveBeenCalledWith({
-      productCode: "growth_monthly",
-      quantity: 2,
-      successUrl:
-        "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
-      cancelUrl: "https://example.com/purchase/cancel",
-    });
-  });
-
-  it("omits quantity entirely when it is not supplied", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    await ailkPurchase({ productCode: "growth_monthly" });
-
-    const payload = createSession.mock.calls[0]![0];
-    expect(payload).not.toHaveProperty("quantity");
-    expect(payload).not.toHaveProperty("allowPromotionCodes");
-  });
-
-  it("derives both redirect URLs from AILK_BASE_URL — always, not only when omitted (#6001)", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(createSession).toHaveBeenCalledWith({
-      productCode: "growth_monthly",
-      successUrl:
-        "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
-      cancelUrl: "https://example.com/purchase/cancel",
-    });
-  });
-});
-
-describe("start_purchase — FR-1: the hosted Checkout URL", () => {
-  it("returns { url } deep-equal to the seam's url, and nothing else", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    const result = await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(result).toEqual({ url: HOSTED_URL });
-  });
-
-  it("does NOT surface the route's sessionId (D5 — it identifies a buyer's session)", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    const result = await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(result).not.toHaveProperty("sessionId");
-  });
-
-  it("the URL it returns is Stripe-hosted — nothing is charged in-tool", async () => {
-    createSession.mockResolvedValueOnce(sessionCreated());
-
-    const result = await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect((result as { url: string }).url).toMatch(
-      /^https:\/\/checkout\.stripe\.com\//,
-    );
-  });
-});
-
-describe("start_purchase — FR-2: an unknown offering", () => {
-  it("does NOT echo the caller's product code back (route invariant parity)", async () => {
-    createSession.mockResolvedValueOnce({
-      ok: false as const,
-      status: 404,
-      body: { error: "unknown-product-code" },
-    });
-
-    const result = await ailkPurchase({ productCode: "no-such-offering_monthly" });
-
-    // The HTTP twin states and tests "Error responses never echo user input";
-    // parity means the pair answers alike (#5971 security review, Low).
-    expect(JSON.stringify(result)).not.toContain("no-such-offering");
-  });
-
-  it("returns a typed not_found body rather than throwing", async () => {
-    createSession.mockResolvedValueOnce({
-      ok: false as const,
-      status: 404,
-      body: { error: "unknown-product-code" },
-    });
-
-    const result = await ailkPurchase({ productCode: "no-such-offering_monthly" });
-
-    expect(result).toMatchObject({ error: "not_found" });
-  });
-
-  it("makes exactly one call — createSession — and reaches no Stripe stub", async () => {
-    createSession.mockResolvedValueOnce({
-      ok: false as const,
-      status: 404,
-      body: { error: "unknown-product-code" },
-    });
-
-    await ailkPurchase({ productCode: "no-such-offering_monthly" });
-
-    expect(createSession).toHaveBeenCalledTimes(1);
-  });
-
-  it("maps a non-404 route failure to a typed body too", async () => {
-    createSession.mockResolvedValueOnce({
-      ok: false as const,
-      status: 502,
-      body: { error: "checkout-unavailable" },
-    });
-
-    const result = await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-  });
-});
-
-describe("start_purchase — invalid input never reaches the seam", () => {
-  it("rejects a product code the route's regex would reject", async () => {
-    const result = await ailkPurchase({ productCode: "has spaces" });
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("rejects a quantity above the route's maximum", async () => {
-    const result = await ailkPurchase({
-      productCode: "pro-plan",
-      quantity: 1000,
-    });
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-});
-
-describe("start_purchase — the redirect fix (#6001): a caller-supplied redirect fails validation, not merely gets ignored", () => {
-  it("rejects a call carrying a caller-supplied successUrl — even a plausible-looking one, not just javascript:", async () => {
-    const result = await ailkPurchase({
-      productCode: "pro-plan",
-      successUrl: "https://attacker.example/phish",
-    } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("rejects a javascript: redirect URL exactly as the route would — via the same rejection path as any other successUrl", async () => {
-    const result = await ailkPurchase({
-      productCode: "pro-plan",
-      successUrl: "javascript:alert(1)",
-    } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("rejects a call carrying a caller-supplied cancelUrl", async () => {
-    const result = await ailkPurchase({
-      productCode: "pro-plan",
-      cancelUrl: "https://attacker.example/cancelled",
-    } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("rejects a call carrying allowPromotionCodes", async () => {
-    const result = await ailkPurchase({
-      productCode: "pro-plan",
-      allowPromotionCodes: true,
-    } as never);
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-});
-
-// ── #8935 — the full Offerings lookup_key ───────────────────────────────────
-//
-// The tool takes a price by its full lookup_key (contract §3.7) and refuses an
-// ungrammatical one before any HTTP call, with the same not-found body every
-// route 404 maps to (A3, A5). The route decides the workspace and whether the
-// key is shown and org-enabled (A1, #8931); the mocked seam below answers with
-// the route's Offerings-path `201` body, `reply.status(201).send({ sessionId,
-// url })`. Spec: `docs/specs/8935-start-purchase-sells-a-named-spec.md`.
-
-const OFFERINGS_URL = "https://checkout.stripe.com/c/pay/cs_test_offerings";
-
-function offeringsSessionCreated() {
-  return {
-    ok: true as const,
-    body: { sessionId: "cs_test_offerings", url: OFFERINGS_URL },
-  };
-}
-
-const NOT_FOUND = {
-  error: "not_found",
-  message: "No offering matches that product code.",
-};
-
-describe("start_purchase — a shown, org-enabled lookup_key gets the route's hosted URL (#8935 AC-1)", () => {
-  const keys = [
-    "growth_monthly",
-    "growth_yearly",
-    "basic_once",
-    "samhenry-coaching_monthly",
-    `${"a".repeat(40)}_monthly`,
-  ];
-
-  it.each(keys)(
-    "%s reaches the route byte for byte and returns { url } only",
-    async (key) => {
-      createSession.mockResolvedValueOnce(offeringsSessionCreated());
-
-      const result = await ailkPurchase({ productCode: key });
-
-      expect(result).toEqual({ url: OFFERINGS_URL });
-      expect(result).not.toHaveProperty("sessionId");
-      expect(createSession).toHaveBeenCalledTimes(1);
-      // One argument, the payload — no init, so no header of the tool's own.
-      expect(createSession.mock.calls[0]).toHaveLength(1);
-      expect(createSession.mock.calls[0]![0]).toEqual({
-        productCode: key,
-        successUrl:
-          "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
-        cancelUrl: "https://example.com/purchase/cancel",
-      });
-    },
-  );
-
-  it("the 48-character key is the longest §3.7 allows", () => {
-    expect(keys[4]).toHaveLength(48);
-  });
-
-  it("forwards quantity alongside the key", async () => {
-    createSession.mockResolvedValueOnce(offeringsSessionCreated());
-
-    await ailkPurchase({ productCode: "growth_monthly", quantity: 2 });
-
-    expect(createSession.mock.calls[0]![0]).toEqual({
-      productCode: "growth_monthly",
-      quantity: 2,
-      successUrl:
-        "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
-      cancelUrl: "https://example.com/purchase/cancel",
-    });
-  });
-});
-
-describe("start_purchase — an ungrammatical key is refused before any call, with the route-404 body (#8935 AC-2)", () => {
-  const ungrammatical = [
-    "pro-plan",
-    "Growth_Monthly",
-    "growth_pro_monthly",
-    "wendi_retainer",
-    "growth_quarterly",
-    "growth_",
-    "_monthly",
-    `${"a".repeat(41)}_monthly`,
-  ];
-
-  it.each(ungrammatical)(
-    "%s passes the shared schema but answers not_found with no call and no echo",
-    async (key) => {
-      expect(purchaseMcpInputSchema.safeParse({ productCode: key }).success).toBe(
-        true,
-      );
-
-      const result = await ailkPurchase({ productCode: key });
-
-      expect(result).toEqual(NOT_FOUND);
-      expect(createSession).not.toHaveBeenCalled();
-      expect(JSON.stringify(result)).not.toContain(key);
-    },
-  );
-
-  it("the 49-character key is one past the §3.7 bound", () => {
-    expect(ungrammatical[7]).toHaveLength(49);
-  });
-
-  it.each([
-    ["{ error: unknown-product-code }", { error: "unknown-product-code" }],
-    ["null", null],
-    ["{}", {}],
-  ])(
-    "every route 404 maps to the same body, whatever the route's body (%s)",
-    async (_label, body) => {
-      createSession.mockResolvedValueOnce({
-        ok: false as const,
-        status: 404,
-        body,
-      } as never);
-
-      const result = await ailkPurchase({ productCode: "growth_monthly" });
-
-      expect(result).toEqual(NOT_FOUND);
-      expect(JSON.stringify(result)).not.toContain("growth_monthly");
-    },
-  );
-
-  it("the pre-call refusal and the route-404 mapping are one value", async () => {
-    const refused = await ailkPurchase({ productCode: "pro-plan" });
-    createSession.mockResolvedValueOnce({
-      ok: false as const,
-      status: 404,
-      body: { error: "unknown-product-code" },
-    });
-    const mapped = await ailkPurchase({ productCode: "growth_monthly" });
-
-    expect(refused).toEqual(mapped);
-  });
-
-  it("a code the route's regex refuses still answers validation_failed, with no call", async () => {
-    const result = await ailkPurchase({ productCode: "has spaces" });
-
-    expect(result).toMatchObject({ error: "validation_failed" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-});
-
-describe("start_purchase — the claim and the strict schema still answer first (#8935 AC-3)", () => {
-  it("an unclaimed site answers the module-disabled body for an ungrammatical key, with no call", async () => {
-    __setMcpCommerceClaimForTest("unclaimed");
-
-    const result = await ailkPurchase({ productCode: "Growth_Monthly" });
-
-    expect(result).toEqual({ error: "not_found", message: "Not found" });
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it.each(["workspaceId", "organizationId", "site", "metadata"])(
-    "a direct call carrying %s fails validation, with no call",
-    async (field) => {
-      const result = await ailkPurchase({
-        productCode: "growth_monthly",
-        [field]: "attacker-chosen",
-      } as never);
-
-      expect(result).toMatchObject({ error: "validation_failed" });
-      expect(createSession).not.toHaveBeenCalled();
-    },
-  );
-
-  it("the input schema has exactly productCode and quantity", () => {
-    expect(Object.keys(purchaseMcpInputSchema.shape)).toEqual([
-      "productCode",
-      "quantity",
-    ]);
-  });
-});
-
-describe("start_purchase — the catalog description names the lookup key (#8935 AC-5)", () => {
-  it("tells an agent to pass the lookupKey get_pricing or get_offerings returns", () => {
-    const entry = getMcpToolCatalog({ addons: { commerce: true } }).find(
-      (tool) => tool.name === "start_purchase",
-    );
-
-    expect(entry?.description).toBe(
-      "Start a purchase for an offering on this site. Provide the price's full lookup key as productCode — the lookupKey that get_pricing or get_offerings returns, such as growth_monthly — and an optional quantity; returns a Stripe-hosted Checkout URL for the buyer to complete payment on. Nothing is charged by this tool.",
-    );
-    for (const phrase of [
-      "lookupKey",
-      "get_pricing",
-      "get_offerings",
-      "Nothing is charged by this tool",
-    ]) {
-      expect(entry?.description).toContain(phrase);
-    }
-  });
-});