create-ailk 0.5.0 → 0.6.0

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-request-paid.test.ts

@@ -0,0 +1,301 @@
+/**
+ * POST /v1/webhooks/stripe — the request-and-confirm `paidAt` stamp (#5970
+ * AC-3).
+ *
+ * Mock shape is `stripe-flow-checkout.test.ts`'s, deliberately unchanged: the
+ * five pre-existing webhook suites are the regression floor for this issue and
+ * none of them is edited, so this file mirrors their setup rather than
+ * refactoring a shared one.
+ */
+import type { FastifyInstance } from "fastify";
+import Fastify from "fastify";
+
+const mockTrack = jest.fn().mockResolvedValue(undefined);
+
+// Commerce claim (D-64, #5796): every case here is a COMMERCE-CLAIMED
+// deployment, the same posture the sibling webhook suites take.
+jest.mock("@working-theory/license", () => ({
+  checkLicense: jest.fn().mockResolvedValue({
+    tier: "pro",
+    plan: "pro-monthly",
+    features: ["commerce"],
+    expiresAt: null,
+    revoked: false,
+  }),
+}));
+
+jest.mock("@working-theory/analytics/server", () => ({
+  track: (...args: unknown[]) => mockTrack(...args),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../../lib/prisma.js");
+
+const mockVerifyWebhookSignature = jest.fn();
+class MockStripeWebhookSignatureError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "StripeWebhookSignatureError";
+  }
+}
+jest.mock("@working-theory/stripe-client", () => ({
+  verifyWebhookSignature: (...args: unknown[]) =>
+    mockVerifyWebhookSignature(...args),
+  StripeWebhookSignatureError: MockStripeWebhookSignatureError,
+  assertSandboxKey: jest.fn(),
+  createCheckoutSession: jest.fn(),
+  getStripeClient: jest.fn(),
+  STRIPE_API_VERSION: "2024-06-20",
+  StripeConfigError: class StripeConfigError extends Error {},
+  UnknownProductCodeError: class UnknownProductCodeError extends Error {},
+  WEBHOOK_TOLERANCE_SECONDS: 300,
+}));
+
+import * as configModule from "../../../config/index.js";
+import { stripeWebhookHandler } from "../stripe.js";
+import { __resetIdempotencyStore } from "../../../lib/webhook-idempotency.js";
+import { prisma } from "../../../lib/prisma.js";
+
+const PAYMENT_LINK_ID = "plink_test_1234567890";
+const SESSION_ID = "cs_test_session_12345678901234567890";
+const INVOICE_ID = "in_test_12345678901234567890";
+
+let eventCounter = 0;
+function sessionEvent(object: Record<string, unknown> = {}, eventId?: string) {
+  eventCounter += 1;
+  return {
+    id: eventId ?? `evt_test_${eventCounter}`,
+    type: "checkout.session.completed",
+    data: {
+      object: {
+        id: SESSION_ID,
+        payment_status: "paid",
+        amount_total: 12900,
+        currency: "usd",
+        payment_link: PAYMENT_LINK_ID,
+        ...object,
+      },
+    },
+  };
+}
+
+function invoiceEvent(object: Record<string, unknown> = {}) {
+  eventCounter += 1;
+  return {
+    id: `evt_test_${eventCounter}`,
+    type: "invoice.paid",
+    data: { object: { id: INVOICE_ID, ...object } },
+  };
+}
+
+async function buildTestServer(): Promise<FastifyInstance> {
+  const server = Fastify({ logger: false });
+  await server.register(async (webhooksScope) => {
+    webhooksScope.addContentTypeParser(
+      "application/json",
+      { parseAs: "buffer" },
+      (_req, body, done) => {
+        done(null, body);
+      },
+    );
+    webhooksScope.post("/v1/webhooks/stripe", stripeWebhookHandler);
+  });
+  await server.ready();
+  return server;
+}
+
+const VALID_BODY = Buffer.from(JSON.stringify({ type: "test" }));
+const HEADERS = {
+  "content-type": "application/json",
+  "stripe-signature": "t=1234,v1=abc",
+};
+
+let server: FastifyInstance;
+
+beforeEach(async () => {
+  jest.clearAllMocks();
+  __resetIdempotencyStore();
+  jest.replaceProperty(configModule, "config", {
+    ...configModule.config,
+    STRIPE_WEBHOOK_SECRET: "whsec_test_secret",
+  });
+  (prisma.callback.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
+  (prisma.flowCheckout.findUnique as jest.Mock).mockResolvedValue(null);
+  (prisma.flowCheckout.updateMany as jest.Mock).mockResolvedValue({ count: 0 });
+  (prisma.user.findFirst as jest.Mock).mockResolvedValue(null);
+  (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
+  server = await buildTestServer();
+});
+
+afterEach(async () => {
+  await server.close();
+  jest.restoreAllMocks();
+});
+
+async function post() {
+  return server.inject({
+    method: "POST",
+    url: "/v1/webhooks/stripe",
+    payload: VALID_BODY,
+    headers: HEADERS,
+  });
+}
+
+// ── The match, and the guard that makes it once-only ───────────────────────
+
+describe("a paid Payment-Link session stamps the matching row exactly once", () => {
+  it("matches on the artifact id and guards on paidAt: null", async () => {
+    mockVerifyWebhookSignature.mockReturnValue(sessionEvent());
+    const res = await post();
+    expect(res.statusCode).toBe(200);
+
+    expect(prisma.callback.updateMany).toHaveBeenCalledTimes(1);
+    const call = (prisma.callback.updateMany as jest.Mock).mock.calls[0][0];
+    expect(call.where).toEqual({
+      stripePaymentLinkId: PAYMENT_LINK_ID,
+      paidAt: null,
+    });
+    expect(call.data.paidAt).toBeInstanceOf(Date);
+    // Written from the same event, for support lookups — never a match key.
+    expect(call.data.stripeCheckoutSessionId).toBe(SESSION_ID);
+  });
+
+  it("stamps a zero-due completion too (no_payment_required)", async () => {
+    mockVerifyWebhookSignature.mockReturnValue(
+      sessionEvent({ payment_status: "no_payment_required" }),
+    );
+    await post();
+    expect(prisma.callback.updateMany).toHaveBeenCalledTimes(1);
+  });
+
+  it("does NOT stamp a completed-but-unpaid session", async () => {
+    mockVerifyWebhookSignature.mockReturnValue(
+      sessionEvent({ payment_status: "unpaid" }),
+    );
+    const res = await post();
+    expect(res.statusCode).toBe(200);
+    expect(prisma.callback.updateMany).not.toHaveBeenCalled();
+  });
+});
+
+// ── Replay, both layers ────────────────────────────────────────────────────
+
+describe("a replayed event is a no-op", () => {
+  it("short-circuits on the same event id with no DB call at all", async () => {
+    const event = sessionEvent({}, "evt_test_replay");
+    mockVerifyWebhookSignature.mockReturnValue(event);
+    await post();
+    expect(prisma.callback.updateMany).toHaveBeenCalledTimes(1);
+
+    (prisma.callback.updateMany as jest.Mock).mockClear();
+    mockVerifyWebhookSignature.mockReturnValue(event);
+    const second = await post();
+    expect(second.statusCode).toBe(200);
+    expect(prisma.callback.updateMany).not.toHaveBeenCalled();
+  });
+
+  it("stamps nothing on a DIFFERENT event id for the same session — the dedup-lost-on-restart case", async () => {
+    // The in-memory dedup cannot help here; the `paidAt: null` guard is what
+    // does, and it reports zero rows because the row is already paid.
+    (prisma.callback.updateMany as jest.Mock).mockResolvedValue({ count: 0 });
+    mockVerifyWebhookSignature.mockReturnValue(sessionEvent());
+    const res = await post();
+    expect(res.statusCode).toBe(200);
+    const call = (prisma.callback.updateMany as jest.Mock).mock.calls[0][0];
+    expect(call.where.paidAt).toBeNull();
+  });
+});
+
+// ── Unmatched events leave every row untouched ─────────────────────────────
+
+describe("an unmatched event touches nothing", () => {
+  it("issues NO query at all for an ordinary checkout with no payment_link", async () => {
+    mockVerifyWebhookSignature.mockReturnValue(
+      sessionEvent({ payment_link: null }),
+    );
+    const res = await post();
+    expect(res.statusCode).toBe(200);
+    expect(prisma.callback.updateMany).not.toHaveBeenCalled();
+  });
+
+  it("stamps no row for an unknown payment link, and still answers 200", async () => {
+    (prisma.callback.updateMany as jest.Mock).mockResolvedValue({ count: 0 });
+    mockVerifyWebhookSignature.mockReturnValue(
+      sessionEvent({ payment_link: "plink_never_minted_here" }),
+    );
+    const res = await post();
+    expect(res.statusCode).toBe(200);
+    expect(JSON.parse(res.body)).toEqual({ received: true });
+  });
+
+  it("never throws out of the handler when the stamp's own query rejects", async () => {
+    (prisma.callback.updateMany as jest.Mock).mockRejectedValue(
+      new Error("connection reset"),
+    );
+    mockVerifyWebhookSignature.mockReturnValue(sessionEvent());
+    const res = await post();
+    // Always 200 for a verified event — a throw here would make Stripe retry
+    // and re-fire the sibling telemetry and billing tasks.
+    expect(res.statusCode).toBe(200);
+  });
+});
+
+// ── The inert invoice rung ─────────────────────────────────────────────────
+
+describe("invoice.paid carries the same guarded stamp", () => {
+  it("matches on stripeInvoiceId under the same paidAt: null guard", async () => {
+    mockVerifyWebhookSignature.mockReturnValue(invoiceEvent());
+    const res = await post();
+    expect(res.statusCode).toBe(200);
+    const call = (prisma.callback.updateMany as jest.Mock).mock.calls[0][0];
+    expect(call.where).toEqual({ stripeInvoiceId: INVOICE_ID, paidAt: null });
+    expect(call.data.paidAt).toBeInstanceOf(Date);
+  });
+
+  it("is a 200 no-op when the invoice belongs to something else", async () => {
+    (prisma.callback.updateMany as jest.Mock).mockResolvedValue({ count: 0 });
+    mockVerifyWebhookSignature.mockReturnValue(invoiceEvent());
+    expect((await post()).statusCode).toBe(200);
+  });
+});
+
+// ── The signature still settles first ──────────────────────────────────────
+
+describe("the signature is still settled before anything else", () => {
+  it("answers 400 on an unsigned body and stamps nothing", async () => {
+    mockVerifyWebhookSignature.mockImplementation(() => {
+      throw new MockStripeWebhookSignatureError("bad signature");
+    });
+    const res = await server.inject({
+      method: "POST",
+      url: "/v1/webhooks/stripe",
+      payload: VALID_BODY,
+      headers: { "content-type": "application/json" },
+    });
+    expect(res.statusCode).toBe(400);
+    expect(prisma.callback.updateMany).not.toHaveBeenCalled();
+  });
+});
+
+// ── The existing flow-checkout behaviour is byte-identical ─────────────────
+
+describe("the recommender's own stamp is unchanged beside it", () => {
+  it("still runs its own guarded update for an ordinary recommender session", async () => {
+    (prisma.flowCheckout.updateMany as jest.Mock).mockResolvedValue({ count: 1 });
+    (prisma.flowCheckout.findUnique as jest.Mock).mockResolvedValue({
+      amountMinor: 12900,
+    });
+    mockVerifyWebhookSignature.mockReturnValue(
+      sessionEvent({
+        payment_link: null,
+        metadata: { flowCheckoutId: "flchk_1" },
+      }),
+    );
+    const res = await post();
+    expect(res.statusCode).toBe(200);
+    const call = (prisma.flowCheckout.updateMany as jest.Mock).mock.calls[0][0];
+    expect(call.where).toEqual({ id: "flchk_1", status: "created" });
+    // And the request stamp stayed out of it entirely.
+    expect(prisma.callback.updateMany).not.toHaveBeenCalled();
+  });
+});