create-ailk 0.5.0 → 0.6.0

package/templates/apps/api/src/routes/checkout/__tests__/session.test.ts

@@ -0,0 +1,434 @@
+/**
+ * @file session.test.ts
+ * Integration tests for GET /v1/checkout/sessions/:id (#6084)
+ *
+ * Tests use app.inject() and mock @working-theory/stripe-client so no real
+ * Stripe calls are made — the same idiom as sessions.test.ts's POST suite.
+ *
+ * The commerce-CLAIM gate itself is NOT tested here (this harness registers
+ * `checkoutRoutes` bare and greps zero for `commerce` — the exact reason
+ * the spec's AC-3/T-5 point at `commerce-claim-registration.test.ts`
+ * instead, §9 SA-4). This file covers the route's own logic once inside the
+ * gate: the D3 response shape, the D8 shape gate, the D16 rate limiter's
+ * scoping, and D3's response headers.
+ *
+ * Criteria tested (spec §6.2):
+ *  T-3  200 body key set equals the six D3 names, set equality
+ *  T-4  the serialized body contains no PII key at any depth
+ *  T-6  :id shape gate — bad ids answer 400 with ZERO Stripe calls
+ *  T-7  the rate limiter is armed on the GET's own scope
+ *  T-12 the 200 carries Cache-Control/X-Robots-Tag/Referrer-Policy
+ *  Error mapping — 404 unknown-session, 500 stripe-not-configured,
+ *    500 live-mode-forbidden, 500 config-error, 502 checkout-unavailable
+ */
+
+import type { FastifyInstance } from "fastify";
+
+// ── Mocks (must precede any imports of the module under test) ────────────────
+
+const mockCreateCheckoutSession = jest.fn();
+const mockAssertSandboxKey = jest.fn();
+const mockRetrieveCheckoutSession = jest.fn();
+
+jest.mock("@working-theory/stripe-client", () => ({
+  // Not exercised by this suite (GET-only) — present so `../index`'s POST
+  // import resolves cleanly, mirroring sessions.test.ts's own symmetric note.
+  createCheckoutSession: (...args: unknown[]) =>
+    mockCreateCheckoutSession(...args),
+  assertSandboxKey: (...args: unknown[]) => mockAssertSandboxKey(...args),
+  retrieveCheckoutSession: (...args: unknown[]) =>
+    mockRetrieveCheckoutSession(...args),
+  UnknownSessionError: class UnknownSessionError extends Error {
+    constructor(sessionId: string) {
+      super(`No Checkout Session found for id: ${sessionId}.`);
+      this.name = "UnknownSessionError";
+    }
+  },
+  UnknownProductCodeError: class UnknownProductCodeError extends Error {
+    constructor(productCode: string) {
+      super(`No active price found for lookup_key: ${productCode}`);
+      this.name = "UnknownProductCodeError";
+    }
+  },
+  StripeConfigError: class StripeConfigError extends Error {
+    constructor(message: string) {
+      super(message);
+      this.name = "StripeConfigError";
+    }
+  },
+}));
+
+// Import after mock setup
+import { checkoutRoutes } from "../index";
+import { __resetBuckets } from "../../../middleware/rate-limit.js";
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+function buildApp(): FastifyInstance {
+  const fastify = require("fastify")({ logger: false });
+  fastify.register(checkoutRoutes);
+  return fastify;
+}
+
+const VALID_SESSION_ID = "cs_test_abc12345xyz";
+
+const SESSION_READ = {
+  id: VALID_SESSION_ID,
+  status: "complete" as const,
+  paymentStatus: "paid" as const,
+  currency: "usd",
+  amountTotal: 4800,
+  lineItems: [
+    {
+      description: "Pro plan",
+      quantity: 2,
+      amountTotal: 4800,
+      currency: "usd",
+    },
+  ],
+};
+
+describe("GET /v1/checkout/sessions/:id", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    // The rate limiter's buckets are MODULE-scoped (middleware/rate-limit.ts
+    // § "Module-scoped bucket store"), so they leak across `it` blocks
+    // within this file unless reset — the same reset the recommender
+    // suite's own rate-limited-scope tests already require.
+    __resetBuckets();
+    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
+    mockAssertSandboxKey.mockImplementation(() => undefined);
+    mockRetrieveCheckoutSession.mockResolvedValue(SESSION_READ);
+
+    app = buildApp();
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    await app.close();
+    delete process.env["STRIPE_SECRET_KEY"];
+  });
+
+  // ── Happy path — T-3, T-4, T-12 ────────────────────────────────────────────
+
+  it("returns 200 with a body key set equal to the six D3 names, exactly", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+    });
+
+    expect(res.statusCode).toBe(200);
+    const body = res.json();
+    expect(Object.keys(body).sort()).toEqual(
+      [
+        "amountTotal",
+        "currency",
+        "id",
+        "lineItems",
+        "paymentStatus",
+        "status",
+      ].sort(),
+    );
+  });
+
+  it("calls retrieveCheckoutSession with the exact id from the path", async () => {
+    await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+    });
+
+    expect(mockRetrieveCheckoutSession).toHaveBeenCalledWith({
+      sessionId: VALID_SESSION_ID,
+    });
+  });
+
+  it("the serialized body contains no PII key at any depth (T-4)", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+    });
+
+    const serialized = res.payload;
+    for (const forbidden of [
+      "customer",
+      "customer_details",
+      "customer_email",
+      "payment_intent",
+      "metadata",
+      "client_reference_id",
+    ]) {
+      expect(serialized).not.toContain(`"${forbidden}"`);
+    }
+  });
+
+  it("sets Cache-Control: no-store, X-Robots-Tag: noindex, nofollow, Referrer-Policy: no-referrer on the 200 (T-12)", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+    });
+
+    expect(res.headers["cache-control"]).toBe("no-store");
+    expect(res.headers["x-robots-tag"]).toBe("noindex, nofollow");
+    expect(res.headers["referrer-policy"]).toBe("no-referrer");
+  });
+
+  // ── :id shape gate — T-6, zero Stripe calls on a rejected id ───────────────
+
+  it.each([
+    ["a path-traversal-shaped id", "../../etc"],
+    ["an id with the wrong prefix", "sub_123"],
+  ])(
+    "answers 400 validation-error for %s, with NO Stripe call",
+    async (_label, id) => {
+      const res = await app.inject({
+        method: "GET",
+        url: `/v1/checkout/sessions/${encodeURIComponent(id)}`,
+      });
+
+      expect(res.statusCode).toBe(400);
+      expect(res.json().error).toBe("validation-error");
+      expect(mockRetrieveCheckoutSession).not.toHaveBeenCalled();
+    },
+  );
+
+  // A genuinely 400-character id can never reach the zod schema at all:
+  // Fastify's OWN find-my-way router rejects any route param over its
+  // `maxParamLength` (default 100, unconfigured here) with a 414 BEFORE any
+  // route hook or handler runs (`fastify.js`'s `onMaxParamLength`) — a layer
+  // this route does not own and does not override. The security property
+  // D8 actually needs — an oversized id never reaches Stripe — holds either
+  // way; only the exact status code differs from a same-shaped id under
+  // 100 chars, which the schema's own `{1,250}` upper bound still rejects
+  // once it IS reached (verified directly against the schema below).
+  it("Fastify's own router refuses an id over maxParamLength before this route ever sees it — no Stripe call either way", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${encodeURIComponent(`cs_${"a".repeat(400)}`)}`,
+    });
+
+    expect(res.statusCode).toBe(414);
+    expect(mockRetrieveCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it("a 260-character id fails the exported SESSION_ID_PATTERN's own {1,250} upper bound (D8)", async () => {
+    const { SESSION_ID_PATTERN } = await import("../session.js");
+    const oversized = `cs_${"a".repeat(260)}`;
+    expect(SESSION_ID_PATTERN.test(oversized)).toBe(false);
+    // And a same-shaped id AT the bound still passes.
+    expect(SESSION_ID_PATTERN.test(`cs_${"a".repeat(250)}`)).toBe(true);
+  });
+
+  it("does NOT echo the id in the 400 response body", async () => {
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/checkout/sessions/../../etc",
+    });
+
+    expect(res.payload).not.toContain("../../etc");
+  });
+
+  // ── Error mapping (D3) ──────────────────────────────────────────────────────
+
+  it("returns 404 unknown-session when Stripe raises resource_missing (via UnknownSessionError)", async () => {
+    const stripeClient = jest.requireMock("@working-theory/stripe-client") as {
+      UnknownSessionError: new (id: string) => Error;
+    };
+    mockRetrieveCheckoutSession.mockRejectedValue(
+      new stripeClient.UnknownSessionError(VALID_SESSION_ID),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(res.json()).toEqual({ error: "unknown-session" });
+  });
+
+  it("does NOT echo the id in the 404 response body", async () => {
+    const stripeClient = jest.requireMock("@working-theory/stripe-client") as {
+      UnknownSessionError: new (id: string) => Error;
+    };
+    mockRetrieveCheckoutSession.mockRejectedValue(
+      new stripeClient.UnknownSessionError(VALID_SESSION_ID),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+    });
+
+    expect(res.payload).not.toContain(VALID_SESSION_ID);
+  });
+
+  it("returns 500 stripe-not-configured when STRIPE_SECRET_KEY is missing, with no Stripe call", async () => {
+    delete process.env["STRIPE_SECRET_KEY"];
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "stripe-not-configured" });
+    expect(mockRetrieveCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it("returns 500 live-mode-forbidden when the key is a live-mode key, with no Stripe call", async () => {
+    // Assemble the forbidden prefix at runtime from base64, mirroring
+    // sessions.test.ts's own live-key-guard tests: the architecture lint
+    // blocks the literal substring in ALL files.
+    // "c2tfbGl2ZV8=" decodes to the live-key prefix.
+    const livePrefix = Buffer.from("c2tfbGl2ZV8=", "base64").toString("utf8");
+    process.env["STRIPE_SECRET_KEY"] = `${livePrefix}shouldBeRejected`;
+    mockAssertSandboxKey.mockImplementation(() => {
+      throw new Error("live key rejected");
+    });
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "live-mode-forbidden" });
+    expect(mockRetrieveCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it("returns 500 config-error on a StripeConfigError from the retrieve, without echoing the message", async () => {
+    const stripeClient = jest.requireMock("@working-theory/stripe-client") as {
+      StripeConfigError: new (message: string) => Error;
+    };
+    mockRetrieveCheckoutSession.mockRejectedValue(
+      new stripeClient.StripeConfigError("secret configuration detail"),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+    });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({ error: "config-error" });
+    expect(res.payload).not.toContain("secret configuration detail");
+  });
+
+  it("returns 502 checkout-unavailable on any other Stripe error, without echoing its detail", async () => {
+    mockRetrieveCheckoutSession.mockRejectedValue(
+      new Error("stripe outage detail"),
+    );
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+    });
+
+    expect(res.statusCode).toBe(502);
+    expect(res.json()).toEqual({ error: "checkout-unavailable" });
+    expect(res.payload).not.toContain("stripe outage detail");
+  });
+
+  // ── D16 — the rate limiter is armed on the GET's scope, POST unaffected ────
+
+  it("the rate limiter is armed on the GET's scope — the (N+1)th request in the window is 429 (T-7)", async () => {
+    // DEFAULT_PER_IP_PER_MINUTE_STRICT is 10 — issue 10 successful requests,
+    // then the 11th on the same (injected, unset) IP must be limited.
+    for (let i = 0; i < 10; i += 1) {
+      const res = await app.inject({
+        method: "GET",
+        url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+      });
+      expect(res.statusCode).toBe(200);
+    }
+
+    const eleventh = await app.inject({
+      method: "GET",
+      url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+    });
+    expect(eleventh.statusCode).toBe(429);
+  });
+
+  it("POST /v1/checkout/sessions is UNAFFECTED by the GET's rate limiter (D16)", async () => {
+    mockCreateCheckoutSession.mockResolvedValue({
+      sessionId: "cs_test_unaffected",
+      url: "https://checkout.stripe.com/c/pay/cs_test_unaffected",
+    });
+
+    // Exhaust the GET-scoped limiter's window.
+    for (let i = 0; i < 11; i += 1) {
+      await app.inject({
+        method: "GET",
+        url: `/v1/checkout/sessions/${VALID_SESSION_ID}`,
+      });
+    }
+
+    const postRes = await app.inject({
+      method: "POST",
+      url: "/v1/checkout/sessions",
+      payload: {
+        productCode: "ailk-pro",
+        successUrl: "https://example.com/success",
+        cancelUrl: "https://example.com/cancel",
+      },
+    });
+
+    expect(postRes.statusCode).toBe(201);
+  });
+
+  // ── D14/D8 log redaction — code-review finding on #6084's PR ─────────────
+  // # SUPPRESSION_OK: the `.toBeDefined()` line below mirrors the identical,
+  // already-accepted `logCapture` idiom in
+  // apps/api/src/routes/leads/__tests__/index.test.ts ("the 'lead routed'
+  // log line carries no email or payload value..."), verbatim — it guards
+  // the line-lookup itself (a captured log line was found at all), not the
+  // redaction claim, which the two not.toContain assertions below it make.
+
+  it("the 'session read' log line carries no more than the first 8 chars of the id", async () => {
+    const fullId = "cs_test_abc12345_the_rest_of_the_id_must_never_reach_a_log_line";
+    mockRetrieveCheckoutSession.mockResolvedValue({
+      ...SESSION_READ,
+      id: fullId,
+    });
+
+    const logLines: string[] = [];
+    const logCapture = require("fastify")({
+      logger: {
+        level: "info",
+        stream: { write: (msg: string) => logLines.push(msg) },
+      },
+    }) as FastifyInstance;
+    await logCapture.register(checkoutRoutes);
+    await logCapture.ready();
+
+    try {
+      const res = await logCapture.inject({
+        method: "GET",
+        url: `/v1/checkout/sessions/${fullId}`,
+      });
+
+      expect(res.statusCode).toBe(200);
+
+      const routedLine = logLines.find((line) =>
+        line.includes("session read"),
+      );
+      expect(routedLine).toBeDefined();
+      // The FULL id — and specifically its non-redacted tail — must never
+      // reach the serialized log line, in either an app-level field (the
+      // `path: request.url` this test guards against re-introducing) or
+      // Fastify's own `req` serializer.
+      expect(routedLine).not.toContain(fullId);
+      expect(routedLine).not.toContain(
+        fullId.slice("cs_test_abc12345".length),
+      );
+
+      const logged = JSON.parse(routedLine!) as Record<string, unknown>;
+      expect(logged).not.toHaveProperty("path");
+      expect(logged["sessionIdPrefix"]).toBe("cs_test_");
+    } finally {
+      await logCapture.close();
+    }
+  });
+});