create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/routes/checkout/__tests__/sessions.test.ts

@@ -1,1742 +0,0 @@
-/**
- * @file sessions.test.ts
- * Integration tests for POST /api/checkout/sessions
- *
- * Tests use app.inject() and mock @working-theory/stripe-client so no real Stripe
- * calls are made. The mock is set up before the module under test is loaded
- * to ensure the mock is in place when the handler resolves its imports.
- *
- * Criteria tested (spec §5.1):
- *  1. Happy path: 201 { sessionId, url } with correct productCode forwarded
- *  2. Validation — missing productCode: 400 validation-error
- *  3. Validation — malformed productCode (fails regex): 400 validation-error
- *  4. Validation — quantity ≤0: 400 validation-error
- *  5. Validation — quantity >999: 400 validation-error
- *  6. Validation — unparseable successUrl: 400 validation-error
- *  7. Validation — javascript: scheme successUrl: 400 validation-error
- *  8. Validation — empty host successUrl: 400 validation-error
- *  9. Unknown product code (UnknownProductCodeError): 404 unknown-product-code
- * 10. Product code NOT echoed in 404 response body
- * 11. Stripe outage (generic error): 502 checkout-unavailable
- * 12. Stripe outage detail NOT in response body
- * 13. Live-key guard: live-key prefix → 500 live-mode-forbidden, Stripe NOT called
- * 14. Defaults quantity to 1 when omitted
- * 15. PII guard: log lines contain session-id prefix only (first 8 chars), not full URL
- * 16. StripeConfigError (missing key): 500 config-error
- * 17. StripeConfigError message NOT in response body
- * 18. allowPromotionCodes forwarded when supplied, omitted when absent (#4398)
- * 19. Validation — non-boolean allowPromotionCodes: 400 validation-error (#4398)
- */
-
-import type { FastifyInstance } from "fastify";
-
-// ── Mocks (must precede any imports of the module under test) ────────────────
-
-const mockCreateCheckoutSession = jest.fn();
-const mockAssertSandboxKey = jest.fn();
-
-jest.mock("@working-theory/stripe-client", () => ({
-  createCheckoutSession: (...args: unknown[]) =>
-    mockCreateCheckoutSession(...args),
-  assertSandboxKey: (...args: unknown[]) => mockAssertSandboxKey(...args),
-  // #6084 — `../index` now also loads `./session.js` (the GET), which
-  // imports these two through the same `lib/stripe.js` chokepoint. Neither
-  // is exercised by this suite (POST-only), but they must resolve to real
-  // values rather than `undefined` for the module graph to load cleanly.
-  retrieveCheckoutSession: jest.fn(),
-  UnknownSessionError: class UnknownSessionError extends Error {
-    constructor(sessionId: string) {
-      super(`No Checkout Session found for id: ${sessionId}.`);
-      this.name = "UnknownSessionError";
-    }
-  },
-  UnknownProductCodeError: class UnknownProductCodeError extends Error {
-    constructor(productCode: string) {
-      super(`No active price found for lookup_key: ${productCode}`);
-      this.name = "UnknownProductCodeError";
-    }
-  },
-  StripeConfigError: class StripeConfigError extends Error {
-    constructor(message: string) {
-      super(message);
-      this.name = "StripeConfigError";
-    }
-  },
-  UnknownCustomerError: class UnknownCustomerError extends Error {
-    constructor() {
-      super("The Checkout Session's pinned Stripe customer does not exist.");
-      this.name = "UnknownCustomerError";
-    }
-  },
-}));
-
-// #6866 — the route's optional cookie identity reads the Session and User
-// rows (the auth.cookie-path.test.ts pattern), so the real resolver and
-// buyer service run against this mock.
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted; the DB boundary, mirrors auth.cookie-path.test.ts
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    user: { findUnique: jest.fn() },
-    apiToken: { findUnique: jest.fn(), update: jest.fn() },
-  },
-}));
-
-// #8931 — the route now asks the Offerings service which path a request
-// takes before the env checks; every case in this suite is an env-path case,
-// so the service answers `env` for both the POST and the GET.
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../services/offerings/checkout-authorization.js", () => ({
-  resolveOfferingsCheckoutPath: jest.fn(async () => ({ kind: "env" })),
-  readOfferingsCheckoutSession: jest.fn(async () => ({ kind: "env" })),
-  startOfferingsCheckout: jest.fn(),
-  OFFERINGS_CHECKOUT_PER_WORKSPACE_PER_MINUTE: 60,
-}));
-
-// Import after mock setup
-import { config } from "../../../config/index.js";
-import { UnknownCustomerError } from "../../../lib/stripe.js";
-import { prisma } from "../../../lib/prisma.js";
-import { isOfferingsProduct } from "../../../services/offerings/catalog.js";
-import { checkoutRoutes } from "../index";
-
-// #6877 — pin the suite's site origin to the fixtures' own origin, so every
-// anonymous case below sends same-origin redirects. Runs before any
-// `describe` is collected, so the #6866 block's SAME_ORIGIN reads it too.
-// #7395 — the redirect lock and the buyer's cookie check read the trusted
-// allowlist, not FRONTEND_URL, so the suite pins both.
-config.FRONTEND_URL = "https://example.com";
-config.TRUSTED_ORIGINS = ["https://example.com"];
-
-// ── Helpers ─────────────────────────────────────────────────────────────────
-
-function buildApp(): FastifyInstance {
-  const fastify = require("fastify")({ logger: false });
-  fastify.register(checkoutRoutes);
-  return fastify;
-}
-
-const VALID_BODY = {
-  productCode: "ailk-pro",
-  successUrl: "https://example.com/success",
-  cancelUrl: "https://example.com/cancel",
-};
-
-// ── Test suite ───────────────────────────────────────────────────────────────
-
-describe("POST /api/checkout/sessions", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    // Default: a present sandbox key, so the new (#3757) emptiness check at
-    // the call site doesn't short-circuit tests that aren't exercising it.
-    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
-    // Default: sandbox key guard passes
-    mockAssertSandboxKey.mockImplementation(() => undefined);
-    // Default: successful checkout session
-    mockCreateCheckoutSession.mockResolvedValue({
-      sessionId: "cs_test_abc12345xyz",
-      url: "https://checkout.stripe.com/c/pay/cs_test_abc12345xyz",
-    });
-
-    app = buildApp();
-    await app.ready();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env["STRIPE_SECRET_KEY"];
-  });
-
-  // ── Happy path ─────────────────────────────────────────────────────────────
-
-  it("returns 201 with sessionId and url for a valid request", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(201);
-    const body = res.json();
-    expect(body).toHaveProperty("sessionId");
-    expect(body).toHaveProperty("url");
-    expect(body.sessionId).toBe("cs_test_abc12345xyz");
-    expect(body.url).toBe(
-      "https://checkout.stripe.com/c/pay/cs_test_abc12345xyz",
-    );
-  });
-
-  it("calls createCheckoutSession with the exact productCode from the request", async () => {
-    await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, productCode: "my-exact-product" },
-    });
-
-    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(1);
-    const callArg = mockCreateCheckoutSession.mock.calls[0][0];
-    expect(callArg.productCode).toBe("my-exact-product");
-  });
-
-  // ── allowPromotionCodes passthrough (#4398) ────────────────────────────────
-
-  it("forwards allowPromotionCodes to createCheckoutSession when supplied", async () => {
-    await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, allowPromotionCodes: true },
-    });
-
-    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
-      expect.objectContaining({ allowPromotionCodes: true }),
-      { refuseProduct: isOfferingsProduct },
-    );
-  });
-
-  it("#8931 A9: an anonymous env checkout passes the Offerings marker as refuseProduct", async () => {
-    await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(1);
-    const [, options] = mockCreateCheckoutSession.mock.calls[0];
-    expect(Object.keys(options)).toEqual(["refuseProduct"]);
-    expect(options.refuseProduct).toBe(isOfferingsProduct);
-  });
-
-  it("omits allowPromotionCodes from the client call when not supplied", async () => {
-    await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    expect(mockCreateCheckoutSession.mock.calls[0][0]).not.toHaveProperty(
-      "allowPromotionCodes",
-    );
-  });
-
-  it("returns 400 validation-error for a non-boolean allowPromotionCodes", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, allowPromotionCodes: "yes" },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("defaults quantity to 1 when omitted", async () => {
-    await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    const callArg = mockCreateCheckoutSession.mock.calls[0][0];
-    expect(callArg.quantity).toBe(1);
-  });
-
-  it("passes explicit quantity through to wrapper", async () => {
-    await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, quantity: 3 },
-    });
-
-    const callArg = mockCreateCheckoutSession.mock.calls[0][0];
-    expect(callArg.quantity).toBe(3);
-  });
-
-  // ── Validation — productCode ───────────────────────────────────────────────
-
-  it("returns 400 when productCode is missing", async () => {
-    const { productCode: _, ...body } = VALID_BODY;
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: body,
-    });
-
-    expect(res.statusCode).toBe(400);
-    const resBody = res.json();
-    expect(resBody.error).toBe("validation-error");
-    expect(resBody.details).toBeDefined();
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 400 when productCode contains invalid characters (space)", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, productCode: "invalid product code" },
-    });
-
-    expect(res.statusCode).toBe(400);
-    const resBody = res.json();
-    expect(resBody.error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 400 when productCode is empty string", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, productCode: "" },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 400 when productCode exceeds 200 characters", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, productCode: "a".repeat(201) },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("accepts productCode with allowed special characters (. _ -)", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, productCode: "ailk.pro_v2-basic" },
-    });
-
-    expect(res.statusCode).toBe(201);
-  });
-
-  // ── Validation — quantity ──────────────────────────────────────────────────
-
-  it("returns 400 when quantity is 0", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, quantity: 0 },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 400 when quantity is negative", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, quantity: -1 },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 400 when quantity is 1000", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, quantity: 1000 },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("accepts quantity of 999 (max allowed)", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, quantity: 999 },
-    });
-
-    expect(res.statusCode).toBe(201);
-  });
-
-  // ── Validation — URL fields ────────────────────────────────────────────────
-
-  it("returns 400 when successUrl is unparseable", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, successUrl: "not-a-url" },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 400 when successUrl uses javascript: scheme", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: {
-        ...VALID_BODY,
-        successUrl: "javascript:alert(1)",
-      },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 400 when cancelUrl has an empty host (data: URI)", async () => {
-    // data: URIs parse successfully but have an empty host — they are not
-    // valid redirect targets and must be rejected.
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, cancelUrl: "data:text/html,<h1>xss</h1>" },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 400 when successUrl uses ftp: scheme", async () => {
-    // ftp:// parses with a non-empty host but is not a valid http(s) redirect —
-    // the allowlist (http:/https: only) must block it.
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, successUrl: "ftp://attacker.com/path" },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 400 when cancelUrl uses ftp: scheme", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, cancelUrl: "ftp://attacker.com/path" },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 400 when successUrl is missing", async () => {
-    const { successUrl: _, ...body } = VALID_BODY;
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: body,
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  // ── 404 — unknown product code ─────────────────────────────────────────────
-
-  it("returns 404 unknown-product-code when wrapper throws UnknownProductCodeError", async () => {
-    const { UnknownProductCodeError } = jest.requireMock(
-      "@working-theory/stripe-client",
-    );
-    mockCreateCheckoutSession.mockRejectedValue(
-      new UnknownProductCodeError("no-such-product"),
-    );
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, productCode: "no-such-product" },
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(res.json().error).toBe("unknown-product-code");
-  });
-
-  it("does NOT echo the product code in the 404 response body", async () => {
-    const { UnknownProductCodeError } = jest.requireMock(
-      "@working-theory/stripe-client",
-    );
-    mockCreateCheckoutSession.mockRejectedValue(
-      new UnknownProductCodeError("secret-product-code"),
-    );
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, productCode: "secret-product-code" },
-    });
-
-    expect(res.statusCode).toBe(404);
-    const resBody = JSON.stringify(res.json());
-    expect(resBody).not.toContain("secret-product-code");
-  });
-
-  // ── 502 — Stripe outage ────────────────────────────────────────────────────
-
-  it("returns 502 checkout-unavailable when wrapper throws a generic error", async () => {
-    mockCreateCheckoutSession.mockRejectedValue(
-      new Error("Stripe connection timeout"),
-    );
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(502);
-    expect(res.json().error).toBe("checkout-unavailable");
-  });
-
-  it("does NOT include Stripe error detail in the 502 response body", async () => {
-    mockCreateCheckoutSession.mockRejectedValue(
-      new Error("Internal Stripe secret details"),
-    );
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(502);
-    const resBody = JSON.stringify(res.json());
-    expect(resBody).not.toContain("Internal Stripe secret details");
-  });
-
-  // ── 500 — config error (missing key) ─────────────────────────────────────
-
-  it("returns 500 config-error when wrapper throws StripeConfigError", async () => {
-    const { StripeConfigError } = jest.requireMock(
-      "@working-theory/stripe-client",
-    );
-    mockCreateCheckoutSession.mockRejectedValue(
-      new StripeConfigError("STRIPE_SECRET_KEY is missing"),
-    );
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json().error).toBe("config-error");
-  });
-
-  it("does NOT include StripeConfigError message in the 500 config-error response body", async () => {
-    const { StripeConfigError } = jest.requireMock(
-      "@working-theory/stripe-client",
-    );
-    mockCreateCheckoutSession.mockRejectedValue(
-      new StripeConfigError("STRIPE_SECRET_KEY is missing"),
-    );
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(500);
-    const resBody = JSON.stringify(res.json());
-    expect(resBody).not.toContain("STRIPE_SECRET_KEY is missing");
-  });
-
-  // ── 500 — live-key guard ───────────────────────────────────────────────────
-
-  it("returns 500 live-mode-forbidden when STRIPE_SECRET_KEY is a live key", async () => {
-    // Assemble the forbidden prefix at runtime from base64 to avoid writing the
-    // literal substring in source (architecture lint blocks it in all files).
-    // "c2tfbGl2ZV8=" decodes to the live-key prefix.
-    const livePrefix = Buffer.from("c2tfbGl2ZV8=", "base64").toString("utf8");
-    process.env["STRIPE_SECRET_KEY"] = livePrefix + "xxxFakeKeyForTest";
-    mockAssertSandboxKey.mockImplementation(() => {
-      throw new Error("live key detected");
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json().error).toBe("live-mode-forbidden");
-    // Stripe was NOT called
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 500 live-mode-forbidden when STRIPE_SECRET_KEY is a restricted live key", async () => {
-    // "cmtfbGl2ZV8=" decodes to the restricted-live-key prefix.
-    const restrictedLivePrefix = Buffer.from("cmtfbGl2ZV8=", "base64").toString(
-      "utf8",
-    );
-    process.env["STRIPE_SECRET_KEY"] =
-      restrictedLivePrefix + "xxxFakeKeyForTest";
-    mockAssertSandboxKey.mockImplementation(() => {
-      throw new Error("live key detected");
-    });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json().error).toBe("live-mode-forbidden");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  // ── 500 — missing/empty key (#3757) ───────────────────────────────────────
-
-  it("returns 500 stripe-not-configured when STRIPE_SECRET_KEY is missing, not live-mode-forbidden", async () => {
-    delete process.env["STRIPE_SECRET_KEY"];
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json().error).toBe("stripe-not-configured");
-    expect(mockAssertSandboxKey).not.toHaveBeenCalled();
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 500 stripe-not-configured when STRIPE_SECRET_KEY is an empty string, not live-mode-forbidden", async () => {
-    process.env["STRIPE_SECRET_KEY"] = "";
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json().error).toBe("stripe-not-configured");
-    expect(mockAssertSandboxKey).not.toHaveBeenCalled();
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-});
-
-// ── X-Internal-Auth gate tests (#935) ─────────────────────────────────────────
-//
-// These tests cover the env-var-conditional internal auth gate added by #935.
-// The gate fires ONLY when OSS_API_INTERNAL_SECRET is set.
-// When unset, the existing behaviour is unchanged (backward-compat for OSS standalone).
-
-describe("POST /v1/checkout/sessions — X-Internal-Auth gate (#935)", () => {
-  let app: FastifyInstance;
-  // Value used as the OSS_API_INTERNAL_SECRET env var in gate tests.
-  const GATE_TOKEN = "x-auth-fixture-for-gate-tests";
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    // Default: a present sandbox key (see the sibling describe block above).
-    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
-    mockAssertSandboxKey.mockImplementation(() => undefined);
-    mockCreateCheckoutSession.mockResolvedValue({
-      sessionId: "cs_test_abc12345xyz",
-      url: "https://checkout.stripe.com/c/pay/cs_test_abc12345xyz",
-    });
-
-    app = buildApp();
-    await app.ready();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env["STRIPE_SECRET_KEY"];
-    delete process.env["OSS_API_INTERNAL_SECRET"];
-  });
-
-  it("allows request when OSS_API_INTERNAL_SECRET is NOT set (backward-compat)", async () => {
-    // No env var set — gate is disabled, existing public path unchanged.
-    delete process.env["OSS_API_INTERNAL_SECRET"];
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: VALID_BODY,
-    });
-
-    // Gate not active — should pass through to Stripe logic (201 or 4xx from
-    // other checks, but NOT 401 internal-auth-required).
-    expect(res.statusCode).not.toBe(401);
-    expect(res.json().error).not.toBe("internal-auth-required");
-  });
-
-  it("allows request when X-Internal-Auth header matches the env var", async () => {
-    process.env["OSS_API_INTERNAL_SECRET"] = GATE_TOKEN;
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      headers: { "x-internal-auth": GATE_TOKEN },
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(201);
-    expect(res.json().error).toBeUndefined();
-  });
-
-  it("rejects with 401 when OSS_API_INTERNAL_SECRET is set but X-Internal-Auth header is missing", async () => {
-    process.env["OSS_API_INTERNAL_SECRET"] = GATE_TOKEN;
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      // No x-internal-auth header
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(401);
-    expect(res.json().error).toBe("internal-auth-required");
-    // Stripe must NOT be called when gate rejects
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("rejects with 401 when X-Internal-Auth header does not match", async () => {
-    process.env["OSS_API_INTERNAL_SECRET"] = GATE_TOKEN;
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      headers: { "x-internal-auth": "wrong-secret" },
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(401);
-    expect(res.json().error).toBe("internal-auth-required");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("rejects with 401 when X-Internal-Auth header is present but empty", async () => {
-    process.env["OSS_API_INTERNAL_SECRET"] = GATE_TOKEN;
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      headers: { "x-internal-auth": "" },
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(401);
-    expect(res.json().error).toBe("internal-auth-required");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("does NOT leak the internal secret in the 401 response body", async () => {
-    process.env["OSS_API_INTERNAL_SECRET"] = GATE_TOKEN;
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      headers: { "x-internal-auth": "wrong" },
-      payload: VALID_BODY,
-    });
-
-    expect(res.statusCode).toBe(401);
-    const body = JSON.stringify(res.json());
-    expect(body).not.toContain(GATE_TOKEN);
-  });
-});
-
-// ── API↔MCP parity (#5971) ───────────────────────────────────────────────────
-
-/**
- * The API half of the parity proof root `CLAUDE.md` § API ↔ MCP parity
- * demands. `apps/api` cannot import `apps/mcp`, so neither side can call the
- * other: the evidence is the SHARED SEAM asserted from both ends —
- * `CreateSessionPayload` / `CheckoutSessionResponse` in
- * `packages/api-client/src/checkout.ts`.
- *
- * The MCP half is `apps/mcp/__tests__/start_purchase.test.ts`, which pins that
- * `ailkPurchase` calls `checkout.createSession` with exactly the payload
- * objects below. Here the route receives them and its reply is pinned.
- * Together: the tool builds exactly what the route accepts, and the route
- * returns exactly what the tool reads.
- *
- * The route itself is UNTOUCHED by #5971 — this is a new `describe`, nothing
- * more (spec NFR-4).
- */
-describe("parity with the payload the MCP tool builds (#5971)", () => {
-  let app: FastifyInstance;
-
-  /** The payload `ailkPurchase` builds when every optional field is supplied. */
-  const MCP_PAYLOAD_FULL = {
-    productCode: "pro-plan",
-    quantity: 2,
-    successUrl: "https://example.com/thanks",
-    cancelUrl: "https://example.com/cancelled",
-    allowPromotionCodes: true,
-  };
-
-  /** The payload it builds from `{ productCode }` alone, with the redirect
-   * URLs derived from AILK_BASE_URL — the optional fields OMITTED, not
-   * undefined, which is what the tool's own suite pins. */
-  const MCP_PAYLOAD_MINIMAL = {
-    productCode: "pro-plan",
-    successUrl: "https://example.com/purchase/success",
-    cancelUrl: "https://example.com/purchase/cancel",
-  };
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
-    mockAssertSandboxKey.mockImplementation(() => undefined);
-    mockCreateCheckoutSession.mockResolvedValue({
-      sessionId: "cs_test_parity",
-      url: "https://checkout.stripe.com/c/pay/cs_test_parity",
-    });
-
-    app = buildApp();
-    await app.ready();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env["STRIPE_SECRET_KEY"];
-  });
-
-  it("accepts the full MCP payload and returns 201 { sessionId, url }", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: MCP_PAYLOAD_FULL,
-    });
-
-    expect(res.statusCode).toBe(201);
-    expect(res.json()).toEqual({
-      sessionId: "cs_test_parity",
-      url: "https://checkout.stripe.com/c/pay/cs_test_parity",
-    });
-  });
-
-  it("accepts the minimal MCP payload and returns 201 { sessionId, url }", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: MCP_PAYLOAD_MINIMAL,
-    });
-
-    expect(res.statusCode).toBe(201);
-    expect(res.json()).toEqual({
-      sessionId: "cs_test_parity",
-      url: "https://checkout.stripe.com/c/pay/cs_test_parity",
-    });
-  });
-
-  it("forwards every field of the full MCP payload to Stripe unchanged", async () => {
-    await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: MCP_PAYLOAD_FULL,
-    });
-
-    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(1);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
-      expect.objectContaining({
-        productCode: "pro-plan",
-        quantity: 2,
-        successUrl: "https://example.com/thanks",
-        cancelUrl: "https://example.com/cancelled",
-        allowPromotionCodes: true,
-      }),
-      { refuseProduct: isOfferingsProduct },
-    );
-  });
-
-  it("the `url` the tool surfaces is exactly the one this route returns", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: MCP_PAYLOAD_MINIMAL,
-    });
-
-    // `ailkPurchase` returns `{ url: result.body.url }` — the same value,
-    // with `sessionId` deliberately withheld (spec D5).
-    expect(res.json().url).toBe(
-      "https://checkout.stripe.com/c/pay/cs_test_parity",
-    );
-  });
-
-  it("an unknown offering is the 404 the tool maps to its typed not_found body, and creates no session", async () => {
-    const { UnknownProductCodeError } = jest.requireMock(
-      "@working-theory/stripe-client",
-    ) as { UnknownProductCodeError: new (code: string) => Error };
-    mockCreateCheckoutSession.mockRejectedValueOnce(
-      new UnknownProductCodeError("no-such-offering"),
-    );
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...MCP_PAYLOAD_MINIMAL, productCode: "no-such-offering" },
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(res.json().error).toBe("unknown-product-code");
-  });
-});
-
-describe("CheckoutSessionRequestSchema preserves Stripe's {CHECKOUT_SESSION_ID} template token (#6084 AC-6)", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
-    mockAssertSandboxKey.mockImplementation(() => undefined);
-    mockCreateCheckoutSession.mockResolvedValue({
-      sessionId: "cs_test_brace",
-      url: "https://checkout.stripe.com/c/pay/cs_test_brace",
-    });
-
-    app = buildApp();
-    await app.ready();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env["STRIPE_SECRET_KEY"];
-  });
-
-  it("a successUrl carrying the literal ?session_id={CHECKOUT_SESSION_ID} token passes validation and reaches Stripe unmodified", async () => {
-    const successUrlWithToken =
-      "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}";
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: { ...VALID_BODY, successUrl: successUrlWithToken },
-    });
-
-    // The schema's `isValidRedirectUrl` refine runs `new URL(value)` —
-    // WHATWG's URL parser is lenient with `{`/`}` in a query string and
-    // preserves them verbatim, unlike strict RFC 3986 parsers that would
-    // percent-encode or reject them. A 400 here would mean Stripe's own
-    // documented template mechanism (#6084 D1) cannot survive this
-    // schema at all.
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
-      expect.objectContaining({ successUrl: successUrlWithToken }),
-      { refuseProduct: isOfferingsProduct },
-    );
-  });
-});
-
-// ── Signed-in buyer stamp (#6866) ────────────────────────────────────────────
-
-describe("POST /v1/checkout/sessions — signed-in buyer stamp (#6866)", () => {
-  const SESSION_TOKEN = "sess_tok_buyer";
-  const COOKIE = `better-auth.session_token=${SESSION_TOKEN}.signature`;
-  const SAME_ORIGIN = config.FRONTEND_URL;
-  const originalDatabaseUrl = process.env.DATABASE_URL;
-
-  type UserRow = {
-    id: string;
-    email: string;
-    emailVerified: boolean;
-    billingProvider: string | null;
-    billingCustomerId: string | null;
-  };
-
-  let app: FastifyInstance;
-  let logLines: Array<Record<string, unknown>>;
-  let rawLog: string;
-
-  function givenSession(overrides: Record<string, unknown> = {}) {
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      id: "ses_1",
-      userId: "usr_buyer",
-      expiresAt: new Date(Date.now() + 60_000),
-      activeOrganizationId: null,
-      activeWorkspaceId: null,
-      ...overrides,
-    });
-  }
-
-  /** Answers each `user.findUnique` with only the fields it selected. */
-  function givenUser(row: Partial<UserRow> | null) {
-    const full: UserRow = {
-      id: "usr_buyer",
-      email: "buyer@example.com",
-      emailVerified: true,
-      billingProvider: null,
-      billingCustomerId: null,
-      ...row,
-    };
-    (prisma.user.findUnique as jest.Mock).mockImplementation(
-      async (args: { select: Record<string, boolean> }) =>
-        row === null
-          ? null
-          : Object.fromEntries(
-              Object.keys(args.select).map((k) => [
-                k,
-                full[k as keyof UserRow],
-              ]),
-            ),
-    );
-  }
-
-  function post(
-    headers: Record<string, string>,
-    payload: Record<string, unknown> = VALID_BODY,
-  ) {
-    return app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      headers,
-      payload,
-    });
-  }
-
-  function signedIn(payload?: Record<string, unknown>) {
-    return post({ cookie: COOKIE, origin: SAME_ORIGIN }, payload);
-  }
-
-  function createdLog() {
-    return logLines.find((l) => l["msg"] === "[checkout] session created");
-  }
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
-    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
-    mockAssertSandboxKey.mockImplementation(() => undefined);
-    mockCreateCheckoutSession.mockResolvedValue({
-      sessionId: "cs_test_abc12345xyz",
-      url: "https://checkout.stripe.com/c/pay/cs_test_abc12345xyz",
-    });
-    givenSession();
-    givenUser({});
-
-    logLines = [];
-    rawLog = "";
-    app = require("fastify")({
-      logger: {
-        level: "info",
-        stream: {
-          write: (line: string) => {
-            rawLog += line;
-            logLines.push(JSON.parse(line) as Record<string, unknown>);
-          },
-        },
-      },
-    });
-    app.register(checkoutRoutes);
-    await app.ready();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env["STRIPE_SECRET_KEY"];
-    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
-    else process.env.DATABASE_URL = originalDatabaseUrl;
-  });
-
-  it("#6866 R1: an unbound verified buyer is passed from the Session row, never the body", async () => {
-    const res = await signedIn({ ...VALID_BODY, ailk_user_id: "usr_attacker" });
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(1);
-    const arg = mockCreateCheckoutSession.mock.calls[0][0];
-    expect(arg.buyer).toEqual({
-      userId: "usr_buyer",
-      email: "buyer@example.com",
-    });
-    expect(arg.buyer).not.toHaveProperty("customerId");
-    expect(prisma.session.findUnique).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { token: SESSION_TOKEN } }),
-    );
-  });
-
-  it("#6866 R2: a stripe-bound buyer passes their customerId", async () => {
-    givenUser({ billingProvider: "stripe", billingCustomerId: "cus_bound" });
-
-    await signedIn();
-
-    expect(mockCreateCheckoutSession.mock.calls[0][0].buyer.customerId).toBe(
-      "cus_bound",
-    );
-  });
-
-  it("#6866 R2b: a buyer bound to another provider checks out anonymously", async () => {
-    givenUser({ billingProvider: "paddle", billingCustomerId: "ctm_other" });
-
-    const res = await signedIn();
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession.mock.calls[0][0]).not.toHaveProperty(
-      "buyer",
-    );
-    expect(createdLog()).toMatchObject({
-      buyer: "anonymous",
-      identity: "foreign_provider",
-    });
-  });
-
-  it("#6866 R3: an anonymous body-supplied ailk_user_id reaches neither buyer nor metadata", async () => {
-    const res = await post(
-      {},
-      {
-        ...VALID_BODY,
-        ailk_user_id: "usr_attacker",
-        metadata: { ailk_user_id: "usr_attacker" },
-      },
-    );
-
-    expect(res.statusCode).toBe(201);
-    const arg = mockCreateCheckoutSession.mock.calls[0][0];
-    expect(arg).not.toHaveProperty("buyer");
-    // #7868 D4 — the only metadata is the hub's own site stamp.
-    expect(arg.metadata).toEqual({ site: "default" });
-    expect(arg).not.toHaveProperty("ailk_user_id");
-  });
-
-  it("#6866 R4: signed in, a body-supplied ailk_user_id loses to the session's user", async () => {
-    await signedIn({
-      ...VALID_BODY,
-      ailk_user_id: "usr_attacker",
-      metadata: { ailk_user_id: "usr_attacker" },
-    });
-
-    const arg = mockCreateCheckoutSession.mock.calls[0][0];
-    expect(arg.buyer.userId).toBe("usr_buyer");
-    // #7868 D4 — the only metadata is the hub's own site stamp.
-    expect(arg.metadata).toEqual({ site: "default" });
-  });
-
-  it("#6866 R5: with no cookie, the call is exactly today's argument object", async () => {
-    const res = await post({});
-
-    expect(res.statusCode).toBe(201);
-    expect(res.json()).toEqual({
-      sessionId: "cs_test_abc12345xyz",
-      url: "https://checkout.stripe.com/c/pay/cs_test_abc12345xyz",
-    });
-    expect(mockCreateCheckoutSession.mock.calls[0][0]).toEqual({
-      productCode: VALID_BODY.productCode,
-      successUrl: VALID_BODY.successUrl,
-      cancelUrl: VALID_BODY.cancelUrl,
-      quantity: 1,
-      // #7868 D4 — the hub's own site stamp (AILK_SITE_ID unset).
-      metadata: { site: "default" },
-    });
-    expect(prisma.session.findUnique).not.toHaveBeenCalled();
-    expect(prisma.user.findUnique).not.toHaveBeenCalled();
-    expect(createdLog()).toMatchObject({ buyer: "anonymous" });
-    expect(createdLog()).not.toHaveProperty("identity");
-  });
-
-  it("#7868 D4: the site stamp follows AILK_SITE_ID", async () => {
-    const original = process.env.AILK_SITE_ID;
-    process.env.AILK_SITE_ID = "wksp_hub";
-    try {
-      const res = await post({});
-
-      expect(res.statusCode).toBe(201);
-      expect(mockCreateCheckoutSession.mock.calls[0][0].metadata).toEqual({
-        site: "wksp_hub",
-      });
-    } finally {
-      if (original === undefined) delete process.env.AILK_SITE_ID;
-      else process.env.AILK_SITE_ID = original;
-    }
-  });
-
-  it("#7868 D4: the anonymous retry after a stale customer carries the site stamp too", async () => {
-    givenUser({ billingProvider: "stripe", billingCustomerId: "cus_bound" });
-    mockCreateCheckoutSession.mockRejectedValueOnce(new UnknownCustomerError());
-
-    const res = await signedIn();
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(2);
-    expect(mockCreateCheckoutSession.mock.calls[0][0].metadata).toEqual({
-      site: "default",
-    });
-    expect(mockCreateCheckoutSession.mock.calls[1][0].metadata).toEqual({
-      site: "default",
-    });
-  });
-
-  it("#7868 D4: a signed-in call carries both the buyer and the site stamp", async () => {
-    const res = await signedIn();
-
-    expect(res.statusCode).toBe(201);
-    const arg = mockCreateCheckoutSession.mock.calls[0][0];
-    expect(arg.buyer).toEqual({
-      userId: "usr_buyer",
-      email: "buyer@example.com",
-    });
-    expect(arg.metadata).toEqual({ site: "default" });
-  });
-
-  it.each([
-    [
-      "an unknown session",
-      () => (prisma.session.findUnique as jest.Mock).mockResolvedValue(null),
-      {},
-      "unknown_session",
-    ],
-    [
-      "an expired session",
-      () => givenSession({ expiresAt: new Date(Date.now() - 1_000) }),
-      {},
-      "expired",
-    ],
-    [
-      "a cross-origin Origin",
-      () => undefined,
-      { origin: "https://evil.example.com" },
-      "cross_origin",
-    ],
-    [
-      "a rejecting session lookup",
-      () =>
-        (prisma.session.findUnique as jest.Mock).mockRejectedValue(
-          new Error("db down"),
-        ),
-      {},
-      "lookup_failed",
-    ],
-    [
-      "an unverified email",
-      () => givenUser({ emailVerified: false }),
-      {},
-      "email_unverified",
-    ],
-    ["a missing User row", () => givenUser(null), {}, "user_not_found"],
-    [
-      "a rejecting user lookup after a valid cookie",
-      () =>
-        (prisma.user.findUnique as jest.Mock).mockRejectedValue(
-          new Error("db down"),
-        ),
-      {},
-      "buyer_lookup_failed",
-    ],
-  ])(
-    "#6866 R6: %s is an anonymous 201, never an error",
-    async (_label, arrange, headers, identity) => {
-      arrange();
-
-      const res = await post({
-        cookie: COOKIE,
-        origin: SAME_ORIGIN,
-        ...(headers as Record<string, string>),
-      });
-
-      expect(res.statusCode).toBe(201);
-      expect(mockCreateCheckoutSession.mock.calls[0][0]).not.toHaveProperty(
-        "buyer",
-      );
-      expect(createdLog()).toMatchObject({ buyer: "anonymous", identity });
-    },
-  );
-
-  it("#6866 R7: a bearer token alone never stamps, and apiToken is never read", async () => {
-    const res = await post({ authorization: "Bearer tok_valid_looking_123" });
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession.mock.calls[0][0]).not.toHaveProperty(
-      "buyer",
-    );
-    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
-    expect(prisma.session.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("#6866 R8: the log names the buyer kind, never the user, email, customer or cookie", async () => {
-    givenUser({ billingProvider: "stripe", billingCustomerId: "cus_bound" });
-
-    await signedIn();
-
-    expect(createdLog()).toMatchObject({ buyer: "signed_in" });
-    expect(createdLog()).not.toHaveProperty("identity");
-    expect(rawLog).not.toContain("usr_buyer");
-    expect(rawLog).not.toContain("buyer@example.com");
-    expect(rawLog).not.toContain("cus_");
-    expect(rawLog).not.toContain(SESSION_TOKEN);
-  });
-
-  it("#6866 R9: a cross-origin cookie logs identity cross_origin", async () => {
-    await post({ cookie: COOKIE, origin: "https://evil.example.com" });
-
-    expect(createdLog()).toMatchObject({
-      buyer: "anonymous",
-      identity: "cross_origin",
-    });
-  });
-
-  it("#6866 R10: a generic Stripe failure on a signed-in call is still 502 checkout-unavailable", async () => {
-    mockCreateCheckoutSession.mockRejectedValue(new Error("stripe down"));
-
-    const res = await signedIn();
-
-    expect(res.statusCode).toBe(502);
-    expect(res.json()).toEqual({ error: "checkout-unavailable" });
-    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(1);
-  });
-
-  it("#6866 R12: a buyer the library's schema refuses retries once as anonymous (F7)", async () => {
-    givenUser({ billingProvider: "stripe", billingCustomerId: "not_a_cus" });
-    mockCreateCheckoutSession.mockRejectedValueOnce(
-      Object.assign(new Error("invalid buyer"), { name: "ZodError" }),
-    );
-
-    const res = await signedIn();
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(2);
-    expect(mockCreateCheckoutSession.mock.calls[1][0]).not.toHaveProperty(
-      "buyer",
-    );
-    expect(createdLog()).toMatchObject({
-      buyer: "anonymous",
-      identity: "buyer_invalid",
-    });
-  });
-
-  it("#8931 A9: the first try and the anonymous retry both refuse an Offerings product with the marker itself", async () => {
-    givenUser({ billingProvider: "stripe", billingCustomerId: "not_a_cus" });
-    mockCreateCheckoutSession.mockRejectedValueOnce(
-      Object.assign(new Error("invalid buyer"), { name: "ZodError" }),
-    );
-
-    const res = await signedIn();
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(2);
-    for (const call of mockCreateCheckoutSession.mock.calls) {
-      expect(call).toHaveLength(2);
-      expect(Object.keys(call[1])).toEqual(["refuseProduct"]);
-      expect(call[1].refuseProduct).toBe(isOfferingsProduct);
-    }
-  });
-
-  it("#6866 R12b: an anonymous ZodError is not retried — today's 502 mapping", async () => {
-    mockCreateCheckoutSession.mockRejectedValue(
-      Object.assign(new Error("invalid"), { name: "ZodError" }),
-    );
-
-    const res = await post({});
-
-    expect(res.statusCode).toBe(502);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(1);
-  });
-
-  it("#6866 R11: a pinned customer Stripe rejects retries once as anonymous", async () => {
-    givenUser({ billingProvider: "stripe", billingCustomerId: "cus_bound" });
-    mockCreateCheckoutSession.mockRejectedValueOnce(new UnknownCustomerError());
-
-    const res = await signedIn();
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(2);
-    expect(mockCreateCheckoutSession.mock.calls[0][0].buyer.customerId).toBe(
-      "cus_bound",
-    );
-    expect(mockCreateCheckoutSession.mock.calls[1][0]).not.toHaveProperty(
-      "buyer",
-    );
-    expect(createdLog()).toMatchObject({
-      buyer: "anonymous",
-      identity: "stale_customer",
-    });
-  });
-});
-
-// ── Same-origin redirect lock (#6877) ─────────────────────────────────────────
-
-describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", () => {
-  const SITE_ORIGIN = "https://example.com";
-  const GATE_TOKEN = "x-auth-fixture-for-6877";
-  const SESSION_TOKEN = "sess_tok_6877";
-  const COOKIE = `better-auth.session_token=${SESSION_TOKEN}.signature`;
-  const originalDatabaseUrl = process.env.DATABASE_URL;
-
-  let app: FastifyInstance;
-  let logLines: Array<Record<string, unknown>>;
-  let rawLog: string;
-
-  function post(
-    payload: Record<string, unknown>,
-    headers: Record<string, string> = {},
-  ) {
-    return app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      headers,
-      payload,
-    });
-  }
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    config.FRONTEND_URL = SITE_ORIGIN;
-    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
-    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
-    delete process.env["OSS_API_INTERNAL_SECRET"];
-    mockAssertSandboxKey.mockImplementation(() => undefined);
-    mockCreateCheckoutSession.mockResolvedValue({
-      sessionId: "cs_test_lock6877",
-      url: "https://checkout.stripe.com/c/pay/cs_test_lock6877",
-    });
-
-    logLines = [];
-    rawLog = "";
-    app = require("fastify")({
-      logger: {
-        level: "info",
-        stream: {
-          write: (line: string) => {
-            rawLog += line;
-            logLines.push(JSON.parse(line) as Record<string, unknown>);
-          },
-        },
-      },
-    });
-    app.register(checkoutRoutes);
-    await app.ready();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env["STRIPE_SECRET_KEY"];
-    delete process.env["OSS_API_INTERNAL_SECRET"];
-    config.FRONTEND_URL = SITE_ORIGIN;
-    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
-    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
-    else process.env.DATABASE_URL = originalDatabaseUrl;
-  });
-
-  it("#6877 R1: an off-origin successUrl is refused with 400 and no Stripe call", async () => {
-    const res = await post({
-      ...VALID_BODY,
-      successUrl: "https://evil.test/x",
-    });
-
-    expect(res.statusCode).toBe(400);
-    const body = res.json();
-    expect(body.error).toBe("validation-error");
-    expect(body.details).toHaveLength(1);
-    expect(body.details[0].path).toEqual(["successUrl"]);
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("#6877 R2: an off-origin cancelUrl alone is refused with 400 and no Stripe call", async () => {
-    const res = await post({ ...VALID_BODY, cancelUrl: "https://evil.test/x" });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().details[0].path).toEqual(["cancelUrl"]);
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  /** Lookalikes WHATWG still parses to the site origin — refused only by the
-   * raw-string checks (D2 checks 1 and 2). */
-  const PARSER_DIFFERENTIAL = [
-    "https://example.com\\@evil.test/x",
-    "https://evil.test%40@example.com/",
-    "https:example.com/x",
-    "https://\uff45xample.com/x",
-    " https://example.com/x",
-    "https://example.com\t/x",
-  ];
-
-  it("#6877 R3 precondition: every parser-differential row parses to the site origin", () => {
-    for (const raw of PARSER_DIFFERENTIAL) {
-      expect(new URL(raw).origin).toBe(SITE_ORIGIN);
-    }
-  });
-
-  it.each([
-    "https://example.com.evil.test/x",
-    "https://example.com@evil.test/x",
-    "http://example.com/x",
-    "https://example.com:8443/x",
-    ...PARSER_DIFFERENTIAL,
-  ])("#6877 R3: the lookalike %j is refused", async (successUrl) => {
-    const res = await post({ ...VALID_BODY, successUrl });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.json().error).toBe("validation-error");
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("#6877 R3b: a raw space on the site origin is refused (D2 check 1)", async () => {
-    const res = await post({
-      ...VALID_BODY,
-      successUrl: "https://example.com/x y",
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("#6877 R4: the refused URL is never echoed or logged", async () => {
-    const res = await post({
-      ...VALID_BODY,
-      successUrl: "https://evil.test/x",
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(res.body).not.toContain("evil.test");
-    expect(rawLog).not.toContain("evil.test");
-    const refusals = logLines.filter(
-      (l) => l["outcome"] === "redirect_origin_refused",
-    );
-    expect(refusals).toHaveLength(1);
-    expect(refusals[0]).toMatchObject({ fields: ["successUrl"] });
-  });
-
-  it("#6877 R5: a same-origin checkout is forwarded byte-for-byte", async () => {
-    const successUrl =
-      "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}";
-    const cancelUrl = "https://example.com/purchase/cancel";
-
-    const res = await post({ productCode: "ailk-pro", successUrl, cancelUrl });
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
-      expect.objectContaining({ successUrl, cancelUrl }),
-      { refuseProduct: isOfferingsProduct },
-    );
-  });
-
-  it("#6877 R6: an authenticated internal caller keeps its two-host redirects", async () => {
-    process.env["OSS_API_INTERNAL_SECRET"] = GATE_TOKEN;
-    const successUrl = "https://app.ailaunchkit.ai/dashboard?checkout=success";
-    const cancelUrl = "https://ailaunchkit.ai/pricing?checkout=cancel";
-
-    const res = await post(
-      { productCode: "ailk-pro", successUrl, cancelUrl },
-      { "x-internal-auth": GATE_TOKEN },
-    );
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
-      expect.objectContaining({ successUrl, cancelUrl }),
-      { refuseProduct: isOfferingsProduct },
-    );
-  });
-
-  it("#6877 R7: the gate refuses a missing header with 401 before any origin check", async () => {
-    process.env["OSS_API_INTERNAL_SECRET"] = GATE_TOKEN;
-
-    const res = await post({
-      ...VALID_BODY,
-      successUrl: "https://evil.test/x",
-    });
-
-    expect(res.statusCode).toBe(401);
-    expect(res.json()).toEqual({ error: "internal-auth-required" });
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  // #7395 D4 — what an unusable or unset FRONTEND_URL did here before
-  // (#6877 R8) is now an empty trusted list: config resolves both to `[]`
-  // (config/__tests__/trusted-origins.test.ts), and the route answers the
-  // same 500.
-  it("#6877 R8: an empty trusted-origin list answers 500 config-error with no Stripe call", async () => {
-    config.TRUSTED_ORIGINS = [];
-
-    const res = await post(VALID_BODY);
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json()).toEqual({ error: "config-error" });
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-    expect(
-      logLines.some(
-        (l) => l["msg"] === "[checkout] no trusted browser origin is configured",
-      ),
-    ).toBe(true);
-  });
-
-  it("#6877 R9: a refused request never reads the session cookie's row", async () => {
-    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue(null);
-    const headers = { cookie: COOKIE, origin: SITE_ORIGIN };
-
-    // Control: the same signed-in request on-origin DOES reach the lookup.
-    const control = await post(VALID_BODY, headers);
-    expect(control.statusCode).toBe(201);
-    expect(prisma.session.findUnique).toHaveBeenCalled();
-    jest.clearAllMocks();
-
-    const res = await post(
-      { ...VALID_BODY, successUrl: "https://evil.test/x" },
-      headers,
-    );
-
-    expect(res.statusCode).toBe(400);
-    expect(prisma.session.findUnique).not.toHaveBeenCalled();
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-});
-
-// ── Trusted-origin allowlist (#7395) ──────────────────────────────────────────
-
-describe("POST /v1/checkout/sessions — trusted-origin allowlist (#7395)", () => {
-  const SITE_ORIGIN = "https://example.com";
-  const SPOKE_A = "https://spoke-a.example";
-  const SESSION_TOKEN = "sess_tok_7395";
-  const COOKIE = `better-auth.session_token=${SESSION_TOKEN}.signature`;
-  const originalDatabaseUrl = process.env.DATABASE_URL;
-
-  let app: FastifyInstance;
-
-  function post(
-    payload: Record<string, unknown>,
-    headers: Record<string, string> = {},
-  ) {
-    return app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      headers,
-      payload,
-    });
-  }
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    config.TRUSTED_ORIGINS = [SITE_ORIGIN, SPOKE_A];
-    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
-    delete process.env["OSS_API_INTERNAL_SECRET"];
-    mockAssertSandboxKey.mockImplementation(() => undefined);
-    mockCreateCheckoutSession.mockResolvedValue({
-      sessionId: "cs_test_allow7395",
-      url: "https://checkout.stripe.com/c/pay/cs_test_allow7395",
-    });
-
-    app = buildApp();
-    await app.ready();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env["STRIPE_SECRET_KEY"];
-    config.TRUSTED_ORIGINS = [SITE_ORIGIN];
-    (prisma.session.findUnique as jest.Mock).mockReset();
-    (prisma.user.findUnique as jest.Mock).mockReset();
-    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
-    else process.env.DATABASE_URL = originalDatabaseUrl;
-  });
-
-  it("accepts an anonymous checkout with both redirects on a listed spoke", async () => {
-    const successUrl = `${SPOKE_A}/purchase/success`;
-    const cancelUrl = `${SPOKE_A}/purchase/cancel`;
-
-    const res = await post({ productCode: "ailk-pro", successUrl, cancelUrl });
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
-      expect.objectContaining({ successUrl, cancelUrl }),
-      { refuseProduct: isOfferingsProduct },
-    );
-  });
-
-  it("accepts redirects split across two listed origins", async () => {
-    const successUrl = `${SPOKE_A}/purchase/success`;
-    const cancelUrl = `${SITE_ORIGIN}/pricing`;
-
-    const res = await post({ productCode: "ailk-pro", successUrl, cancelUrl });
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
-      expect.objectContaining({ successUrl, cancelUrl }),
-      { refuseProduct: isOfferingsProduct },
-    );
-  });
-
-  it.each([
-    ["successUrl", "https://spoke-b.example/x"],
-    ["successUrl", "https://spoke-a.example.evil.test/x"],
-    ["cancelUrl", "https://spoke-b.example/x"],
-    ["cancelUrl", "https://spoke-a.example.evil.test/x"],
-  ])(
-    "refuses a %s on the unlisted %j with 400 naming the field and no Stripe call",
-    async (field, url) => {
-      const res = await post({ ...VALID_BODY, [field]: url });
-
-      expect(res.statusCode).toBe(400);
-      const body = res.json();
-      expect(body.error).toBe("validation-error");
-      expect(body.details).toHaveLength(1);
-      expect(body.details[0].path).toEqual([field]);
-      expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-    },
-  );
-
-  it("answers 500 config-error with no Stripe call when the list is empty", async () => {
-    config.TRUSTED_ORIGINS = [];
-
-    const res = await post({
-      ...VALID_BODY,
-      successUrl: `${SPOKE_A}/purchase/success`,
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json()).toEqual({ error: "config-error" });
-    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("signs the buyer in for a valid cookie forwarded with a listed spoke's Origin", async () => {
-    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
-    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
-      id: "ses_1",
-      userId: "usr_buyer",
-      expiresAt: new Date(Date.now() + 60_000),
-      activeOrganizationId: null,
-      activeWorkspaceId: null,
-    });
-    (prisma.user.findUnique as jest.Mock).mockImplementation(
-      async (args: { select: Record<string, boolean> }) => {
-        const row: Record<string, unknown> = {
-          id: "usr_buyer",
-          email: "buyer@example.com",
-          emailVerified: true,
-          billingProvider: null,
-          billingCustomerId: null,
-        };
-        return Object.fromEntries(
-          Object.keys(args.select).map((k) => [k, row[k]]),
-        );
-      },
-    );
-
-    const res = await post(
-      {
-        productCode: "ailk-pro",
-        successUrl: `${SPOKE_A}/purchase/success`,
-        cancelUrl: `${SPOKE_A}/purchase/cancel`,
-      },
-      { cookie: COOKIE, origin: SPOKE_A },
-    );
-
-    expect(res.statusCode).toBe(201);
-    expect(mockCreateCheckoutSession.mock.calls[0][0].buyer).toEqual({
-      userId: "usr_buyer",
-      email: "buyer@example.com",
-    });
-  });
-});