create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/routes/checkout/index.ts

@@ -1,34 +0,0 @@
-/**
- * Checkout route group.
- *
- * Routes:
- *   POST /v1/checkout/sessions     — create a Stripe hosted-page checkout session
- *   GET  /v1/checkout/sessions/:id — read a session's payment status + line items (#6084)
- *
- * The GET registers inside a NESTED scope carrying its own rate limiter
- * (D16) — the same composition idiom the sibling `requests` scope uses
- * (`server.ts`'s `requestsScope`). Nesting keeps the POST above
- * byte-identical: the limiter applies only to routes registered on
- * `readScope`. Both routes inherit `requireCommerceClaim` from the OUTER
- * `checkoutScope` in `server.ts` — no gate code is written in either file.
- */
-import type { FastifyPluginAsync } from "fastify";
-
-import {
-  DEFAULT_PER_IP_PER_MINUTE_STRICT,
-  rateLimitMiddleware,
-} from "../../middleware/rate-limit.js";
-
-import { checkoutSessionReadHandler } from "./session.js";
-import { checkoutSessionsHandler } from "./sessions.js";
-
-export const checkoutRoutes: FastifyPluginAsync = async (fastify) => {
-  fastify.post("/v1/checkout/sessions", checkoutSessionsHandler);
-
-  await fastify.register(async (readScope) => {
-    await readScope.register(rateLimitMiddleware, {
-      perIpPerMinute: DEFAULT_PER_IP_PER_MINUTE_STRICT,
-    });
-    readScope.get("/v1/checkout/sessions/:id", checkoutSessionReadHandler);
-  });
-};

package/templates/apps/api/src/routes/checkout/session.ts

@@ -1,171 +0,0 @@
-/**
- * GET /v1/checkout/sessions/:id
- *
- * Reads a Checkout Session's payment status + paid line items — a READ,
- * never a write (the webhook already granted; #6084 spec §1.2). Registered
- * inside `checkoutRoutes` (`index.ts`), which inherits the SAME
- * `requireCommerceClaim` scope preHandler `sessions.ts`'s POST does — no
- * gate code is written here (spec §1.4, D8 layer 3).
- *
- * Security invariants (spec D8):
- *   - `:id` shape-gated BEFORE any Stripe call — a non-matching id answers
- *     400 with zero SDK invocations, so this route is not a free Stripe-API
- *     proxy.
- *   - PII-free response: an explicit six-key allow-list (D3) — never a
- *     spread of the retrieve's projection.
- *   - The id is never echoed in an error body, and only the first 8
- *     characters ever reach a log line — mirroring `sessions.ts`'s own
- *     stated invariant.
- *   - `Cache-Control: no-store`, `X-Robots-Tag: noindex, nofollow`,
- *     `Referrer-Policy: no-referrer` on the 200 — the same three headers
- *     `routes/requests/confirm.ts` sets on its own unauthenticated,
- *     token-bearing response (D3, AC-9).
- *   - Deliberately NOT gated by `X-Internal-Auth` (D8 layer 4 — withdrawn;
- *     no `apps/web` file holds `OSS_API_INTERNAL_SECRET`).
- *   - A session the Offerings checkout recorded (#8931 D9, contract A13) is
- *     read with its record's own connection, in the record's mode, never the
- *     env key; its line-item names pass the catalog's T1 normalizer. A record
- *     that cannot be read, or a connection that is gone, unusable or in
- *     another mode, is 502 — never the env path. No record is today's read.
- *
- * Error mapping mirrors `sessions.ts`'s own vocabulary (D3):
- *   400 validation-error      — `:id` fails the shape check
- *   404 unknown-session       — Stripe raised `resource_missing`
- *   500 stripe-not-configured — STRIPE_SECRET_KEY is missing/empty
- *   500 live-mode-forbidden   — STRIPE_SECRET_KEY is a live key the process did not admit
- *   500 config-error          — STRIPE_SECRET_KEY invalid configuration
- *   502 checkout-unavailable  — Stripe SDK threw an unexpected error; a recorded
- *                               Offerings session cannot be read on its connection (#8931)
- */
-import type { FastifyReply, FastifyRequest } from "fastify";
-import { z } from "zod";
-
-import {
-  assertAdmittedStripeKey,
-  retrieveCheckoutSession,
-  type RetrieveCheckoutSessionOutput,
-  StripeConfigError,
-  UnknownSessionError,
-} from "../../lib/stripe.js";
-import { readOfferingsCheckoutSession } from "../../services/offerings/checkout-authorization.js";
-
-// A Stripe Checkout Session id is an unguessable bearer capability, not an
-// authorization-checked resource (D8). The shape gate is layer 2 of D8's
-// defense: it runs BEFORE any Stripe call, so a non-matching id can never
-// spend a Stripe API call. Exported so the test suite can assert the upper
-// bound directly — an id over Fastify's OWN `maxParamLength` (default 100,
-// unconfigured here) never reaches this schema at all, and the test suite
-// covers that layer separately.
-export const SESSION_ID_PATTERN = /^cs_[A-Za-z0-9_]{1,250}$/;
-
-const CheckoutSessionParamsSchema = z.object({
-  id: z
-    .string()
-    .regex(SESSION_ID_PATTERN, "id must match /^cs_[A-Za-z0-9_]{1,250}$/"),
-});
-
-/** D3's response headers — the unauthenticated-bearer-credential precedent (`confirm.ts:41-43`). */
-function setPrivateResponseHeaders(reply: FastifyReply): void {
-  reply.header("Cache-Control", "no-store");
-  reply.header("X-Robots-Tag", "noindex, nofollow");
-  reply.header("Referrer-Policy", "no-referrer");
-}
-
-/** The 200: D3's headers and allow-list, named field-for-field. */
-function sendSessionRead(
-  request: FastifyRequest,
-  reply: FastifyReply,
-  id: string,
-  session: RetrieveCheckoutSessionOutput,
-): FastifyReply {
-  request.log.info(
-    {
-      method: request.method,
-      sessionIdPrefix: id.substring(0, 8),
-      status: 200,
-    },
-    "[checkout] session read",
-  );
-
-  setPrivateResponseHeaders(reply);
-  // The D3 allow-list, named field-for-field — never a spread. Nothing
-  // else may join this object (AC-3's set-equality test pins exactly
-  // these six keys).
-  return reply.status(200).send({
-    id: session.id,
-    status: session.status,
-    paymentStatus: session.paymentStatus,
-    currency: session.currency,
-    amountTotal: session.amountTotal,
-    lineItems: session.lineItems,
-  });
-}
-
-export async function checkoutSessionReadHandler(
-  request: FastifyRequest,
-  reply: FastifyReply,
-): Promise<void> {
-  const parsed = CheckoutSessionParamsSchema.safeParse(request.params);
-  if (!parsed.success) {
-    return reply.status(400).send({
-      error: "validation-error",
-      details: parsed.error.issues,
-    });
-  }
-
-  const { id } = parsed.data;
-
-  // A recorded Offerings session reads on its own connection (#8931 D9). No
-  // record can exist without a database.
-  if (process.env.DATABASE_URL) {
-    const offerings = await readOfferingsCheckoutSession(id);
-    if (offerings.kind === "read") {
-      return sendSessionRead(request, reply, id, offerings.session);
-    }
-    if (offerings.kind === "unknown") {
-      return reply.status(404).send({ error: "unknown-session" });
-    }
-    if (offerings.kind === "unavailable") {
-      return reply.status(502).send({ error: "checkout-unavailable" });
-    }
-  }
-
-  const stripeSecretKey = process.env["STRIPE_SECRET_KEY"];
-  if (!stripeSecretKey) {
-    return reply.status(500).send({ error: "stripe-not-configured" });
-  }
-  try {
-    assertAdmittedStripeKey(stripeSecretKey);
-  } catch {
-    return reply.status(500).send({ error: "live-mode-forbidden" });
-  }
-
-  try {
-    const session = await retrieveCheckoutSession({ sessionId: id });
-    return sendSessionRead(request, reply, id, session);
-  } catch (err) {
-    if (err instanceof UnknownSessionError) {
-      // 404 — never echo the id in the response body.
-      return reply.status(404).send({ error: "unknown-session" });
-    }
-    if (err instanceof StripeConfigError) {
-      request.log.error(
-        {
-          method: request.method,
-          errName: err.name,
-          message: err.message,
-        },
-        "[checkout] config error",
-      );
-      return reply.status(500).send({ error: "config-error" });
-    }
-    request.log.error(
-      {
-        method: request.method,
-        errName: err instanceof Error ? err.name : "unknown",
-      },
-      "[checkout] stripe error; checkout-unavailable",
-    );
-    return reply.status(502).send({ error: "checkout-unavailable" });
-  }
-}