create-ailk 0.5.0 → 0.6.0

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-org-billing.test.ts

@@ -0,0 +1,285 @@
+/**
+ * POST /api/webhooks/stripe — org-scoped billing path (#3601, spec AC2/AC4)
+ *
+ * Covers the Organization billing-link branch keyed on
+ * metadata.organizationId (spec D2): a checkout with organizationId links the
+ * Organization (real org AND individual-as-default-org), idempotently; a
+ * checkout WITHOUT organizationId takes the User path and never touches the
+ * Organization (single-tenant, degrade-clean regression floor).
+ *
+ * Companion to stripe.test.ts (the User-path tests, which stay unmodified —
+ * AC4 regression floor).
+ */
+import type { FastifyInstance } from "fastify";
+import Fastify from "fastify";
+
+// ── Mocks (mirror stripe.test.ts) ────────────────────────────────────────────
+
+const mockTrack = jest.fn().mockResolvedValue(undefined);
+// Commerce claim (D-64, #5796): the receiver is a base-tree primitive gated on
+// the JWT `commerce` claim, so every case in this file is a COMMERCE-CLAIMED
+// deployment — which is what each one was already asserting before the gate
+// existed. The unclaimed matrix lives in
+// `src/__tests__/commerce-claim-registration.test.ts`.
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "pro",
+    plan: "pro-monthly",
+    features: ["commerce"],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+jest.mock("@working-theory/analytics/server", () => ({
+  track: (...args: unknown[]) => mockTrack(...args),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../../lib/prisma.js");
+
+const mockVerifyWebhookSignature = jest.fn();
+class MockStripeWebhookSignatureError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "StripeWebhookSignatureError";
+  }
+}
+jest.mock("@working-theory/stripe-client", () => ({
+  verifyWebhookSignature: (...args: unknown[]) =>
+    mockVerifyWebhookSignature(...args),
+  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
+  assertSandboxKey: jest.fn(),
+  createCheckoutSession: jest.fn(),
+  getStripeClient: jest.fn(),
+  STRIPE_API_VERSION: "2024-06-20",
+  StripeConfigError: class StripeConfigError extends Error {},
+  UnknownProductCodeError: class UnknownProductCodeError extends Error {},
+  WEBHOOK_TOLERANCE_SECONDS: 300,
+}));
+
+import * as configModule from "../../../config/index.js";
+import { prisma } from "../../../lib/prisma.js";
+import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
+import { stripeWebhookHandler } from "../stripe.js";
+
+// The sentinel default Organization id (orgs-of-one billing anchor).
+const DEFAULT_ORG_ID = "org_00000000-0000-7000-8000-000000000001";
+const REAL_ORG_ID = "org_00000000-0000-7000-8000-0000000000ab";
+
+const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
+const VALID_SIGNATURE = "t=1234,v1=abc";
+
+async function buildTestServer(): Promise<FastifyInstance> {
+  const server = Fastify({ logger: false });
+  await server.register(async (scope) => {
+    scope.addContentTypeParser(
+      "application/json",
+      { parseAs: "buffer" },
+      (_req, body, done) => done(null, body),
+    );
+    scope.post("/v1/webhooks/stripe", stripeWebhookHandler);
+  });
+  await server.ready();
+  return server;
+}
+
+function checkoutEvent(
+  id: string,
+  metadata: Record<string, string> | null,
+  customer = "cus_test_org_123",
+) {
+  return {
+    id,
+    type: "checkout.session.completed",
+    data: {
+      object: {
+        id: "cs_test_org",
+        amount_total: 9900,
+        currency: "usd",
+        customer,
+        customer_details: { email: "org-admin@example.com" },
+        metadata,
+      },
+    },
+  };
+}
+
+async function fire(server: FastifyInstance) {
+  return server.inject({
+    method: "POST",
+    url: "/v1/webhooks/stripe",
+    payload: VALID_BODY,
+    headers: {
+      "content-type": "application/json",
+      "stripe-signature": VALID_SIGNATURE,
+    },
+  });
+}
+
+describe("POST /api/webhooks/stripe — org-scoped billing (#3601)", () => {
+  let server: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    __resetIdempotencyStore();
+    jest.replaceProperty(configModule, "config", {
+      ...configModule.config,
+      STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
+    });
+    server = await buildTestServer();
+  });
+
+  afterEach(async () => {
+    await server.close();
+    jest.restoreAllMocks();
+  });
+
+  // AC2 — a real org checkout links the Organization by id; replay is a no-op.
+  it("links the Organization on checkout with metadata.organizationId, idempotent on replay", async () => {
+    const customerId = "cus_test_org_123";
+
+    // First fire: no prior composite link → update the target org.
+    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
+    (prisma.organization.update as jest.Mock).mockResolvedValueOnce({
+      id: REAL_ORG_ID,
+      billingProvider: "stripe",
+      billingCustomerId: customerId,
+    });
+
+    mockVerifyWebhookSignature.mockReturnValue(
+      checkoutEvent("evt_org_001", { organizationId: REAL_ORG_ID }, customerId),
+    );
+    const r1 = await fire(server);
+    expect(r1.statusCode).toBe(200);
+    expect(prisma.organization.update).toHaveBeenCalledTimes(1);
+    expect(prisma.organization.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: REAL_ORG_ID },
+        data: expect.objectContaining({
+          billingProvider: "stripe",
+          billingCustomerId: customerId,
+        }),
+      }),
+    );
+    // The User path is never taken for an org checkout.
+    expect(prisma.user.update).not.toHaveBeenCalled();
+
+    // Replay the SAME event id → idempotency store short-circuits, no 2nd write.
+    mockVerifyWebhookSignature.mockReturnValue(
+      checkoutEvent("evt_org_001", { organizationId: REAL_ORG_ID }, customerId),
+    );
+    const r2 = await fire(server);
+    expect(r2.statusCode).toBe(200);
+    expect(prisma.organization.update).toHaveBeenCalledTimes(1);
+  });
+
+  // AC2 — typed-composite match already pointing at this org → no-op (a fresh
+  // event id, but the customer is already linked to the target org).
+  it("is a no-op when the org is already linked to this customer (typed-composite match)", async () => {
+    const customerId = "cus_already_linked";
+    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce({
+      id: REAL_ORG_ID,
+      billingProvider: "stripe",
+      billingCustomerId: customerId,
+    });
+
+    mockVerifyWebhookSignature.mockReturnValue(
+      checkoutEvent("evt_org_002", { organizationId: REAL_ORG_ID }, customerId),
+    );
+    const r = await fire(server);
+    expect(r.statusCode).toBe(200);
+    expect(prisma.organization.update).not.toHaveBeenCalled();
+  });
+
+  // AC2 — an individual is billed on their sentinel default Organization
+  // (orgs-of-one): the SAME org path, targeting DEFAULT_ORG_ID.
+  it("bills an individual on their sentinel default Organization (orgs-of-one)", async () => {
+    const customerId = "cus_individual_xyz";
+    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
+    (prisma.organization.update as jest.Mock).mockResolvedValueOnce({
+      id: DEFAULT_ORG_ID,
+      billingProvider: "stripe",
+      billingCustomerId: customerId,
+    });
+
+    mockVerifyWebhookSignature.mockReturnValue(
+      checkoutEvent(
+        "evt_org_003",
+        { organizationId: DEFAULT_ORG_ID },
+        customerId,
+      ),
+    );
+    const r = await fire(server);
+    expect(r.statusCode).toBe(200);
+    expect(prisma.organization.update).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: DEFAULT_ORG_ID } }),
+    );
+    expect(prisma.user.update).not.toHaveBeenCalled();
+  });
+
+  // AC4 — a checkout WITHOUT organizationId takes the User path unchanged; the
+  // Organization is never touched (single-tenant degrade-clean regression).
+  it("takes the User path (never touches Organization) when no organizationId is present", async () => {
+    const customerId = "cus_single_tenant";
+    (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
+    (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce({
+      id: "usr_st",
+      email: "org-admin@example.com",
+      billingProvider: null,
+      billingCustomerId: null,
+    });
+    (prisma.user.update as jest.Mock).mockResolvedValueOnce({ id: "usr_st" });
+
+    mockVerifyWebhookSignature.mockReturnValue(
+      checkoutEvent("evt_st_004", { productId: "pro" }, customerId),
+    );
+    const r = await fire(server);
+    expect(r.statusCode).toBe(200);
+    expect(prisma.user.update).toHaveBeenCalledTimes(1);
+    expect(prisma.organization.findFirst).not.toHaveBeenCalled();
+    expect(prisma.organization.update).not.toHaveBeenCalled();
+  });
+
+  // customer.created also routes on metadata.organizationId.
+  it("links the Organization on customer.created with metadata.organizationId", async () => {
+    const customerId = "cus_created_org";
+    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
+    (prisma.organization.update as jest.Mock).mockResolvedValueOnce({
+      id: REAL_ORG_ID,
+    });
+
+    mockVerifyWebhookSignature.mockReturnValue({
+      id: "evt_cust_005",
+      type: "customer.created",
+      data: {
+        object: {
+          id: customerId,
+          email: "org-admin@example.com",
+          metadata: { organizationId: REAL_ORG_ID },
+        },
+      },
+    });
+    const r = await fire(server);
+    expect(r.statusCode).toBe(200);
+    expect(prisma.organization.update).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: REAL_ORG_ID } }),
+    );
+    expect(prisma.user.update).not.toHaveBeenCalled();
+  });
+
+  // A DB failure on the org link never throws (200 still returned).
+  it("returns 200 even when the org billing update throws", async () => {
+    (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
+    (prisma.organization.update as jest.Mock).mockRejectedValueOnce(
+      new Error("db unreachable"),
+    );
+
+    mockVerifyWebhookSignature.mockReturnValue(
+      checkoutEvent("evt_org_006", { organizationId: REAL_ORG_ID }),
+    );
+    const r = await fire(server);
+    expect(r.statusCode).toBe(200);
+    expect(JSON.parse(r.body)).toEqual({ received: true });
+  });
+});

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-rate-limit.test.ts

@@ -0,0 +1,213 @@
+/**
+ * Stripe webhook rate-limit — per-IP cap on the webhook endpoint.
+ *
+ * The webhook is a public endpoint. Without a rate limit, an attacker can
+ * trigger CPU-intensive signature verification at unbounded rate (DoS) or
+ * pin our log infrastructure with garbage payloads. We allow 100 req/min
+ * per IP — well above Stripe's actual retry cadence (~ a few per hour for
+ * a healthy account) but tight enough to make abuse unattractive.
+ *
+ * The limit applies regardless of signature validity — we don't want to
+ * permit unlimited *invalid* requests either, since those still consume CPU.
+ */
+import type { FastifyInstance } from "fastify";
+import Fastify from "fastify";
+
+// ── Mocks ────────────────────────────────────────────────────────────────────
+
+const mockConfig: { STRIPE_WEBHOOK_SECRET: string | undefined } = {
+  STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
+};
+// eslint-disable-next-line no-restricted-syntax -- mirrors stripe.test.ts mock pattern
+jest.mock("../../../config/index.js", () => ({
+  get config() {
+    return mockConfig;
+  },
+}));
+
+// Commerce claim (D-64, #5796): the receiver is a base-tree primitive gated on
+// the JWT `commerce` claim, so every case in this file is a COMMERCE-CLAIMED
+// deployment — which is what each one was already asserting before the gate
+// existed. The unclaimed matrix lives in
+// `src/__tests__/commerce-claim-registration.test.ts`.
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "pro",
+    plan: "pro-monthly",
+    features: ["commerce"],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+jest.mock("@working-theory/analytics/server", () => ({
+  track: jest.fn().mockResolvedValue(undefined),
+}));
+
+// Mock prisma so customer.created billing upsert doesn't throw
+// eslint-disable-next-line no-restricted-syntax -- mirrors stripe.test.ts mock pattern
+jest.mock("../../../lib/prisma.js");
+
+const mockVerifyWebhookSignature = jest.fn();
+class MockStripeWebhookSignatureError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "StripeWebhookSignatureError";
+  }
+}
+// eslint-disable-next-line no-restricted-syntax -- mirrors stripe.test.ts mock pattern
+jest.mock("../../../lib/stripe.js", () => ({
+  verifyWebhookSignature: (...args: unknown[]) =>
+    mockVerifyWebhookSignature(...args),
+  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
+}));
+
+import { webhooksRoutes } from "../index.js";
+import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
+const VALID_SIGNATURE = "t=1234,v1=abc";
+
+async function buildServerWithIp(ip: string): Promise<FastifyInstance> {
+  const server = Fastify({ logger: false });
+
+  // Stub req.ip so we can simulate distinct callers reliably (light.my.request
+  // sends localhost by default which makes per-IP testing brittle).
+  server.addHook("onRequest", async (req) => {
+    Object.defineProperty(req, "ip", { value: ip, configurable: true });
+  });
+
+  await server.register(async (scope) => {
+    scope.addContentTypeParser(
+      "application/json",
+      { parseAs: "buffer" },
+      (_req, body, done) => {
+        done(null, body);
+      },
+    );
+    await scope.register(webhooksRoutes);
+  });
+
+  await server.ready();
+  return server;
+}
+
+// ── Tests ────────────────────────────────────────────────────────────────────
+
+describe("POST /api/webhooks/stripe — rate limit", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    __resetIdempotencyStore();
+    mockConfig.STRIPE_WEBHOOK_SECRET = "whsec_test_secret";
+    // Each request gets a unique event.id so idempotency doesn't short-circuit
+    let counter = 0;
+    mockVerifyWebhookSignature.mockImplementation(() => ({
+      id: `evt_rate_${(counter++).toString().padStart(12, "0")}`,
+      type: "customer.created",
+      data: { object: {} },
+    }));
+  });
+
+  it("allows requests up to the per-minute cap", async () => {
+    const server = await buildServerWithIp("10.10.10.1");
+
+    try {
+      // 100 requests within the cap should all succeed
+      for (let i = 0; i < 100; i++) {
+        const response = await server.inject({
+          method: "POST",
+          url: "/v1/webhooks/stripe",
+          payload: VALID_BODY,
+          headers: {
+            "content-type": "application/json",
+            "stripe-signature": VALID_SIGNATURE,
+          },
+        });
+        expect(response.statusCode).toBe(200);
+      }
+    } finally {
+      await server.close();
+    }
+  });
+
+  it("returns 429 on the 101st request within the window", async () => {
+    const server = await buildServerWithIp("10.10.10.2");
+
+    try {
+      for (let i = 0; i < 100; i++) {
+        await server.inject({
+          method: "POST",
+          url: "/v1/webhooks/stripe",
+          payload: VALID_BODY,
+          headers: {
+            "content-type": "application/json",
+            "stripe-signature": VALID_SIGNATURE,
+          },
+        });
+      }
+
+      const overLimit = await server.inject({
+        method: "POST",
+        url: "/v1/webhooks/stripe",
+        payload: VALID_BODY,
+        headers: {
+          "content-type": "application/json",
+          "stripe-signature": VALID_SIGNATURE,
+        },
+      });
+
+      expect(overLimit.statusCode).toBe(429);
+    } finally {
+      await server.close();
+    }
+  });
+
+  it("tracks rate-limit buckets per IP independently", async () => {
+    const serverA = await buildServerWithIp("10.10.10.3");
+    const serverB = await buildServerWithIp("10.10.10.4");
+
+    try {
+      // Saturate server A
+      for (let i = 0; i < 100; i++) {
+        await serverA.inject({
+          method: "POST",
+          url: "/v1/webhooks/stripe",
+          payload: VALID_BODY,
+          headers: {
+            "content-type": "application/json",
+            "stripe-signature": VALID_SIGNATURE,
+          },
+        });
+      }
+
+      // A is over the cap
+      const aOverLimit = await serverA.inject({
+        method: "POST",
+        url: "/v1/webhooks/stripe",
+        payload: VALID_BODY,
+        headers: {
+          "content-type": "application/json",
+          "stripe-signature": VALID_SIGNATURE,
+        },
+      });
+      expect(aOverLimit.statusCode).toBe(429);
+
+      // B still has its full budget
+      const bFirst = await serverB.inject({
+        method: "POST",
+        url: "/v1/webhooks/stripe",
+        payload: VALID_BODY,
+        headers: {
+          "content-type": "application/json",
+          "stripe-signature": VALID_SIGNATURE,
+        },
+      });
+      expect(bFirst.statusCode).toBe(200);
+    } finally {
+      await serverA.close();
+      await serverB.close();
+    }
+  });
+});