create-ailk 0.24.0 → 0.25.1

package/templates/apps/api/src/routes/checkout/__tests__/session.test.ts

@@ -1,448 +0,0 @@
-/**
- * @file session.test.ts
- * Integration tests for GET /v1/checkout/sessions/:id (#6084)
- *
- * Tests use app.inject() and mock @working-theory/stripe-client so no real
- * Stripe calls are made — the same idiom as sessions.test.ts's POST suite.
- *
- * The commerce-CLAIM gate itself is NOT tested here (this harness registers
- * `checkoutRoutes` bare and greps zero for `commerce` — the exact reason
- * the spec's AC-3/T-5 point at `commerce-claim-registration.test.ts`
- * instead, §9 SA-4). This file covers the route's own logic once inside the
- * gate: the D3 response shape, the D8 shape gate, the D16 rate limiter's
- * scoping, and D3's response headers.
- *
- * Criteria tested (spec §6.2):
- *  T-3  200 body key set equals the six D3 names, set equality
- *  T-4  the serialized body contains no PII key at any depth
- *  T-6  :id shape gate — bad ids answer 400 with ZERO Stripe calls
- *  T-7  the rate limiter is armed on the GET's own scope
- *  T-12 the 200 carries Cache-Control/X-Robots-Tag/Referrer-Policy
- *  Error mapping — 404 unknown-session, 500 stripe-not-configured,
- *    500 live-mode-forbidden, 500 config-error, 502 checkout-unavailable
- */
-
-import type { FastifyInstance } from "fastify";
-
-// ── Mocks (must precede any imports of the module under test) ────────────────
-
-const mockCreateCheckoutSession = jest.fn();
-const mockAssertSandboxKey = jest.fn();
-const mockRetrieveCheckoutSession = jest.fn();
-
-jest.mock("@working-theory/stripe-client", () => ({
-  // Not exercised by this suite (GET-only) — present so `../index`'s POST
-  // import resolves cleanly, mirroring sessions.test.ts's own symmetric note.
-  createCheckoutSession: (...args: unknown[]) =>
-    mockCreateCheckoutSession(...args),
-  assertSandboxKey: (...args: unknown[]) => mockAssertSandboxKey(...args),
-  retrieveCheckoutSession: (...args: unknown[]) =>
-    mockRetrieveCheckoutSession(...args),
-  UnknownSessionError: class UnknownSessionError extends Error {
-    constructor(sessionId: string) {
-      super(`No Checkout Session found for id: ${sessionId}.`);
-      this.name = "UnknownSessionError";
-    }
-  },
-  // #6866 — sessions.ts tests `instanceof UnknownCustomerError`.
-  UnknownCustomerError: class UnknownCustomerError extends Error {},
-  UnknownProductCodeError: class UnknownProductCodeError extends Error {
-    constructor(productCode: string) {
-      super(`No active price found for lookup_key: ${productCode}`);
-      this.name = "UnknownProductCodeError";
-    }
-  },
-  StripeConfigError: class StripeConfigError extends Error {
-    constructor(message: string) {
-      super(message);
-      this.name = "StripeConfigError";
-    }
-  },
-}));
-
-// #8931 — the route now asks the Offerings service which path a request
-// takes before the env checks; every case in this suite is an env-path case,
-// so the service answers `env` for both the POST and the GET.
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../services/offerings/checkout-authorization.js", () => ({
-  resolveOfferingsCheckoutPath: jest.fn(async () => ({ kind: "env" })),
-  readOfferingsCheckoutSession: jest.fn(async () => ({ kind: "env" })),
-  startOfferingsCheckout: jest.fn(),
-  OFFERINGS_CHECKOUT_PER_WORKSPACE_PER_MINUTE: 60,
-}));
-
-// Import after mock setup
-import { config } from "../../../config/index.js";
-import { checkoutRoutes } from "../index";
-import { __resetBuckets } from "../../../middleware/rate-limit.js";
-
-// ── Helpers ─────────────────────────────────────────────────────────────────
-
-function buildApp(): FastifyInstance {
-  const fastify = require("fastify")({ logger: false });
-  fastify.register(checkoutRoutes);
-  return fastify;
-}
-
-const VALID_SESSION_ID = "cs_test_abc12345xyz";
-
-const SESSION_READ = {
-  id: VALID_SESSION_ID,
-  status: "complete" as const,
-  paymentStatus: "paid" as const,
-  currency: "usd",
-  amountTotal: 4800,
-  lineItems: [
-    {
-      description: "Pro plan",
-      quantity: 2,
-      amountTotal: 4800,
-      currency: "usd",
-    },
-  ],
-};
-
-describe("GET /v1/checkout/sessions/:id", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    // The rate limiter's buckets are MODULE-scoped (middleware/rate-limit.ts
-    // § "Module-scoped bucket store"), so they leak across `it` blocks
-    // within this file unless reset — the same reset the recommender
-    // suite's own rate-limited-scope tests already require.
-    __resetBuckets();
-    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
-    mockAssertSandboxKey.mockImplementation(() => undefined);
-    mockRetrieveCheckoutSession.mockResolvedValue(SESSION_READ);
-
-    app = buildApp();
-    await app.ready();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env["STRIPE_SECRET_KEY"];
-  });
-
-  // ── Happy path — T-3, T-4, T-12 ────────────────────────────────────────────
-
-  it("returns 200 with a body key set equal to the six D3 names, exactly", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json();
-    expect(Object.keys(body).sort()).toEqual(
-      [
-        "amountTotal",
-        "currency",
-        "id",
-        "lineItems",
-        "paymentStatus",
-        "status",
-      ].sort(),
-    );
-  });
-
-  it("calls retrieveCheckoutSession with the exact id from the path", async () => {
-    await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-    });
-
-    expect(mockRetrieveCheckoutSession).toHaveBeenCalledWith({
-      sessionId: VALID_SESSION_ID,
-    });
-  });
-
-  it("the serialized body contains no PII key at any depth (T-4)", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-    });
-
-    const serialized = res.payload;
-    for (const forbidden of [
-      "customer",
-      "customer_details",
-      "customer_email",
-      "payment_intent",
-      "metadata",
-      "client_reference_id",
-    ]) {
-      expect(serialized).not.toContain(`"${forbidden}"`);
-    }
-  });
-
-  it("sets Cache-Control: no-store, X-Robots-Tag: noindex, nofollow, Referrer-Policy: no-referrer on the 200 (T-12)", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-    });
-
-    expect(res.headers["cache-control"]).toBe("no-store");
-    expect(res.headers["x-robots-tag"]).toBe("noindex, nofollow");
-    expect(res.headers["referrer-policy"]).toBe("no-referrer");
-  });
-
-  // ── :id shape gate — T-6, zero Stripe calls on a rejected id ───────────────
-
-  it.each([
-    ["a path-traversal-shaped id", "../../etc"],
-    ["an id with the wrong prefix", "sub_123"],
-  ])(
-    "answers 400 validation-error for %s, with NO Stripe call",
-    async (_label, id) => {
-      const res = await app.inject({
-        method: "GET",
-        url: `/v1/checkout/sessions/${encodeURIComponent(id)}`,
-      });
-
-      expect(res.statusCode).toBe(400);
-      expect(res.json().error).toBe("validation-error");
-      expect(mockRetrieveCheckoutSession).not.toHaveBeenCalled();
-    },
-  );
-
-  // A genuinely 400-character id can never reach the zod schema at all:
-  // Fastify's OWN find-my-way router rejects any route param over its
-  // `maxParamLength` (default 100, unconfigured here) with a 414 BEFORE any
-  // route hook or handler runs (`fastify.js`'s `onMaxParamLength`) — a layer
-  // this route does not own and does not override. The security property
-  // D8 actually needs — an oversized id never reaches Stripe — holds either
-  // way; only the exact status code differs from a same-shaped id under
-  // 100 chars, which the schema's own `{1,250}` upper bound still rejects
-  // once it IS reached (verified directly against the schema below).
-  it("Fastify's own router refuses an id over maxParamLength before this route ever sees it — no Stripe call either way", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${encodeURIComponent(`cs_${"a".repeat(400)}`)}`,
-    });
-
-    expect(res.statusCode).toBe(414);
-    expect(mockRetrieveCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("a 260-character id fails the exported SESSION_ID_PATTERN's own {1,250} upper bound (D8)", async () => {
-    const { SESSION_ID_PATTERN } = await import("../session.js");
-    const oversized = `cs_${"a".repeat(260)}`;
-    expect(SESSION_ID_PATTERN.test(oversized)).toBe(false);
-    // And a same-shaped id AT the bound still passes.
-    expect(SESSION_ID_PATTERN.test(`cs_${"a".repeat(250)}`)).toBe(true);
-  });
-
-  it("does NOT echo the id in the 400 response body", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/checkout/sessions/../../etc",
-    });
-
-    expect(res.payload).not.toContain("../../etc");
-  });
-
-  // ── Error mapping (D3) ──────────────────────────────────────────────────────
-
-  it("returns 404 unknown-session when Stripe raises resource_missing (via UnknownSessionError)", async () => {
-    const stripeClient = jest.requireMock("@working-theory/stripe-client") as {
-      UnknownSessionError: new (id: string) => Error;
-    };
-    mockRetrieveCheckoutSession.mockRejectedValue(
-      new stripeClient.UnknownSessionError(VALID_SESSION_ID),
-    );
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(res.json()).toEqual({ error: "unknown-session" });
-  });
-
-  it("does NOT echo the id in the 404 response body", async () => {
-    const stripeClient = jest.requireMock("@working-theory/stripe-client") as {
-      UnknownSessionError: new (id: string) => Error;
-    };
-    mockRetrieveCheckoutSession.mockRejectedValue(
-      new stripeClient.UnknownSessionError(VALID_SESSION_ID),
-    );
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-    });
-
-    expect(res.payload).not.toContain(VALID_SESSION_ID);
-  });
-
-  it("returns 500 stripe-not-configured when STRIPE_SECRET_KEY is missing, with no Stripe call", async () => {
-    delete process.env["STRIPE_SECRET_KEY"];
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json()).toEqual({ error: "stripe-not-configured" });
-    expect(mockRetrieveCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 500 live-mode-forbidden when the key is a live-mode key, with no Stripe call", async () => {
-    // Assemble the forbidden prefix at runtime from base64, mirroring
-    // sessions.test.ts's own live-key-guard tests: the architecture lint
-    // blocks the literal substring in ALL files.
-    // "c2tfbGl2ZV8=" decodes to the live-key prefix.
-    const livePrefix = Buffer.from("c2tfbGl2ZV8=", "base64").toString("utf8");
-    process.env["STRIPE_SECRET_KEY"] = `${livePrefix}shouldBeRejected`;
-    mockAssertSandboxKey.mockImplementation(() => {
-      throw new Error("live key rejected");
-    });
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json()).toEqual({ error: "live-mode-forbidden" });
-    expect(mockRetrieveCheckoutSession).not.toHaveBeenCalled();
-  });
-
-  it("returns 500 config-error on a StripeConfigError from the retrieve, without echoing the message", async () => {
-    const stripeClient = jest.requireMock("@working-theory/stripe-client") as {
-      StripeConfigError: new (message: string) => Error;
-    };
-    mockRetrieveCheckoutSession.mockRejectedValue(
-      new stripeClient.StripeConfigError("secret configuration detail"),
-    );
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-    });
-
-    expect(res.statusCode).toBe(500);
-    expect(res.json()).toEqual({ error: "config-error" });
-    expect(res.payload).not.toContain("secret configuration detail");
-  });
-
-  it("returns 502 checkout-unavailable on any other Stripe error, without echoing its detail", async () => {
-    mockRetrieveCheckoutSession.mockRejectedValue(
-      new Error("stripe outage detail"),
-    );
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-    });
-
-    expect(res.statusCode).toBe(502);
-    expect(res.json()).toEqual({ error: "checkout-unavailable" });
-    expect(res.payload).not.toContain("stripe outage detail");
-  });
-
-  // ── D16 — the rate limiter is armed on the GET's scope, POST unaffected ────
-
-  it("the rate limiter is armed on the GET's scope — the (N+1)th request in the window is 429 (T-7)", async () => {
-    // DEFAULT_PER_IP_PER_MINUTE_STRICT is 10 — issue 10 successful requests,
-    // then the 11th on the same (injected, unset) IP must be limited.
-    for (let i = 0; i < 10; i += 1) {
-      const res = await app.inject({
-        method: "GET",
-        url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-      });
-      expect(res.statusCode).toBe(200);
-    }
-
-    const eleventh = await app.inject({
-      method: "GET",
-      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-    });
-    expect(eleventh.statusCode).toBe(429);
-  });
-
-  it("POST /v1/checkout/sessions is UNAFFECTED by the GET's rate limiter (D16)", async () => {
-    mockCreateCheckoutSession.mockResolvedValue({
-      sessionId: "cs_test_unaffected",
-      url: "https://checkout.stripe.com/c/pay/cs_test_unaffected",
-    });
-
-    // Exhaust the GET-scoped limiter's window.
-    for (let i = 0; i < 11; i += 1) {
-      await app.inject({
-        method: "GET",
-        url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
-      });
-    }
-
-    const postRes = await app.inject({
-      method: "POST",
-      url: "/v1/checkout/sessions",
-      payload: {
-        productCode: "ailk-pro",
-        successUrl: `${config.FRONTEND_URL}/success`,
-        cancelUrl: `${config.FRONTEND_URL}/cancel`,
-      },
-    });
-
-    expect(postRes.statusCode).toBe(201);
-  });
-
-  // ── D14/D8 log redaction — code-review finding on #6084's PR ─────────────
-  // # SUPPRESSION_OK: the `.toBeDefined()` line below mirrors the identical,
-  // already-accepted `logCapture` idiom in
-  // apps/api/src/routes/leads/__tests__/index.test.ts ("the 'lead routed'
-  // log line carries no email or payload value..."), verbatim — it guards
-  // the line-lookup itself (a captured log line was found at all), not the
-  // redaction claim, which the two not.toContain assertions below it make.
-
-  it("the 'session read' log line carries no more than the first 8 chars of the id", async () => {
-    const fullId = "cs_test_abc12345_the_rest_of_the_id_must_never_reach_a_log_line";
-    mockRetrieveCheckoutSession.mockResolvedValue({
-      ...SESSION_READ,
-      id: fullId,
-    });
-
-    const logLines: string[] = [];
-    const logCapture = require("fastify")({
-      logger: {
-        level: "info",
-        stream: { write: (msg: string) => logLines.push(msg) },
-      },
-    }) as FastifyInstance;
-    await logCapture.register(checkoutRoutes);
-    await logCapture.ready();
-
-    try {
-      const res = await logCapture.inject({
-        method: "GET",
-        url: `/v1/checkout/sessions/${fullId}`,
-      });
-
-      expect(res.statusCode).toBe(200);
-
-      const routedLine = logLines.find((line) =>
-        line.includes("session read"),
-      );
-      expect(routedLine).toBeDefined();
-      // The FULL id — and specifically its non-redacted tail — must never
-      // reach the serialized log line, in either an app-level field (the
-      // `path: request.url` this test guards against re-introducing) or
-      // Fastify's own `req` serializer.
-      expect(routedLine).not.toContain(fullId);
-      expect(routedLine).not.toContain(
-        fullId.slice("cs_test_abc12345".length),
-      );
-
-      const logged = JSON.parse(routedLine!) as Record<string, unknown>;
-      expect(logged).not.toHaveProperty("path");
-      expect(logged["sessionIdPrefix"]).toBe("cs_test_");
-    } finally {
-      await logCapture.close();
-    }
-  });
-});