create-ailk 0.7.0 → 0.9.0

package/templates/apps/api/src/routes/checkout/__tests__/sessions.test.ts

@@ -62,11 +62,37 @@ jest.mock("@working-theory/stripe-client", () => ({
       this.name = "StripeConfigError";
     }
   },
+  UnknownCustomerError: class UnknownCustomerError extends Error {
+    constructor() {
+      super("The Checkout Session's pinned Stripe customer does not exist.");
+      this.name = "UnknownCustomerError";
+    }
+  },
+}));
+
+// #6866 — the route's optional cookie identity reads the Session and User
+// rows (the auth.cookie-path.test.ts pattern), so the real resolver and
+// buyer service run against this mock.
+// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted; the DB boundary, mirrors auth.cookie-path.test.ts
+jest.mock("../../../lib/prisma.js", () => ({
+  prisma: {
+    session: { findUnique: jest.fn() },
+    user: { findUnique: jest.fn() },
+    apiToken: { findUnique: jest.fn(), update: jest.fn() },
+  },
 }));
 
 // Import after mock setup
+import { config } from "../../../config/index.js";
+import { UnknownCustomerError } from "../../../lib/stripe.js";
+import { prisma } from "../../../lib/prisma.js";
 import { checkoutRoutes } from "../index";
 
+// #6877 — pin the suite's site origin to the fixtures' own origin, so every
+// anonymous case below sends same-origin redirects. Runs before any
+// `describe` is collected, so the #6866 block's SAME_ORIGIN reads it too.
+config.FRONTEND_URL = "https://example.com";
+
 // ── Helpers ─────────────────────────────────────────────────────────────────
 
 function buildApp(): FastifyInstance {
@@ -886,3 +912,605 @@ describe("CheckoutSessionRequestSchema preserves Stripe's {CHECKOUT_SESSION_ID}
     );
   });
 });
+
+// ── Signed-in buyer stamp (#6866) ────────────────────────────────────────────
+
+describe("POST /v1/checkout/sessions — signed-in buyer stamp (#6866)", () => {
+  const SESSION_TOKEN = "sess_tok_buyer";
+  const COOKIE = `better-auth.session_token=${SESSION_TOKEN}.signature`;
+  const SAME_ORIGIN = config.FRONTEND_URL;
+  const originalDatabaseUrl = process.env.DATABASE_URL;
+
+  type UserRow = {
+    id: string;
+    email: string;
+    emailVerified: boolean;
+    billingProvider: string | null;
+    billingCustomerId: string | null;
+  };
+
+  let app: FastifyInstance;
+  let logLines: Array<Record<string, unknown>>;
+  let rawLog: string;
+
+  function givenSession(overrides: Record<string, unknown> = {}) {
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue({
+      id: "ses_1",
+      userId: "usr_buyer",
+      expiresAt: new Date(Date.now() + 60_000),
+      activeOrganizationId: null,
+      activeWorkspaceId: null,
+      ...overrides,
+    });
+  }
+
+  /** Answers each `user.findUnique` with only the fields it selected. */
+  function givenUser(row: Partial<UserRow> | null) {
+    const full: UserRow = {
+      id: "usr_buyer",
+      email: "buyer@example.com",
+      emailVerified: true,
+      billingProvider: null,
+      billingCustomerId: null,
+      ...row,
+    };
+    (prisma.user.findUnique as jest.Mock).mockImplementation(
+      async (args: { select: Record<string, boolean> }) =>
+        row === null
+          ? null
+          : Object.fromEntries(
+              Object.keys(args.select).map((k) => [
+                k,
+                full[k as keyof UserRow],
+              ]),
+            ),
+    );
+  }
+
+  function post(
+    headers: Record<string, string>,
+    payload: Record<string, unknown> = VALID_BODY,
+  ) {
+    return app.inject({
+      method: "POST",
+      url: "/v1/checkout/sessions",
+      headers,
+      payload,
+    });
+  }
+
+  function signedIn(payload?: Record<string, unknown>) {
+    return post({ cookie: COOKIE, origin: SAME_ORIGIN }, payload);
+  }
+
+  function createdLog() {
+    return logLines.find((l) => l["msg"] === "[checkout] session created");
+  }
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
+    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
+    mockAssertSandboxKey.mockImplementation(() => undefined);
+    mockCreateCheckoutSession.mockResolvedValue({
+      sessionId: "cs_test_abc12345xyz",
+      url: "https://checkout.stripe.com/c/pay/cs_test_abc12345xyz",
+    });
+    givenSession();
+    givenUser({});
+
+    logLines = [];
+    rawLog = "";
+    app = require("fastify")({
+      logger: {
+        level: "info",
+        stream: {
+          write: (line: string) => {
+            rawLog += line;
+            logLines.push(JSON.parse(line) as Record<string, unknown>);
+          },
+        },
+      },
+    });
+    app.register(checkoutRoutes);
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    await app.close();
+    delete process.env["STRIPE_SECRET_KEY"];
+    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
+    else process.env.DATABASE_URL = originalDatabaseUrl;
+  });
+
+  it("#6866 R1: an unbound verified buyer is passed from the Session row, never the body", async () => {
+    const res = await signedIn({ ...VALID_BODY, ailk_user_id: "usr_attacker" });
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(1);
+    const arg = mockCreateCheckoutSession.mock.calls[0][0];
+    expect(arg.buyer).toEqual({
+      userId: "usr_buyer",
+      email: "buyer@example.com",
+    });
+    expect(arg.buyer).not.toHaveProperty("customerId");
+    expect(prisma.session.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { token: SESSION_TOKEN } }),
+    );
+  });
+
+  it("#6866 R2: a stripe-bound buyer passes their customerId", async () => {
+    givenUser({ billingProvider: "stripe", billingCustomerId: "cus_bound" });
+
+    await signedIn();
+
+    expect(mockCreateCheckoutSession.mock.calls[0][0].buyer.customerId).toBe(
+      "cus_bound",
+    );
+  });
+
+  it("#6866 R2b: a buyer bound to another provider checks out anonymously", async () => {
+    givenUser({ billingProvider: "paddle", billingCustomerId: "ctm_other" });
+
+    const res = await signedIn();
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession.mock.calls[0][0]).not.toHaveProperty(
+      "buyer",
+    );
+    expect(createdLog()).toMatchObject({
+      buyer: "anonymous",
+      identity: "foreign_provider",
+    });
+  });
+
+  it("#6866 R3: an anonymous body-supplied ailk_user_id reaches neither buyer nor metadata", async () => {
+    const res = await post(
+      {},
+      {
+        ...VALID_BODY,
+        ailk_user_id: "usr_attacker",
+        metadata: { ailk_user_id: "usr_attacker" },
+      },
+    );
+
+    expect(res.statusCode).toBe(201);
+    const arg = mockCreateCheckoutSession.mock.calls[0][0];
+    expect(arg).not.toHaveProperty("buyer");
+    expect(arg).not.toHaveProperty("metadata");
+    expect(arg).not.toHaveProperty("ailk_user_id");
+  });
+
+  it("#6866 R4: signed in, a body-supplied ailk_user_id loses to the session's user", async () => {
+    await signedIn({
+      ...VALID_BODY,
+      ailk_user_id: "usr_attacker",
+      metadata: { ailk_user_id: "usr_attacker" },
+    });
+
+    const arg = mockCreateCheckoutSession.mock.calls[0][0];
+    expect(arg.buyer.userId).toBe("usr_buyer");
+    expect(arg).not.toHaveProperty("metadata");
+  });
+
+  it("#6866 R5: with no cookie, the call is exactly today's argument object", async () => {
+    const res = await post({});
+
+    expect(res.statusCode).toBe(201);
+    expect(res.json()).toEqual({
+      sessionId: "cs_test_abc12345xyz",
+      url: "https://checkout.stripe.com/c/pay/cs_test_abc12345xyz",
+    });
+    expect(mockCreateCheckoutSession.mock.calls[0][0]).toEqual({
+      productCode: VALID_BODY.productCode,
+      successUrl: VALID_BODY.successUrl,
+      cancelUrl: VALID_BODY.cancelUrl,
+      quantity: 1,
+    });
+    expect(prisma.session.findUnique).not.toHaveBeenCalled();
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
+    expect(createdLog()).toMatchObject({ buyer: "anonymous" });
+    expect(createdLog()).not.toHaveProperty("identity");
+  });
+
+  it.each([
+    [
+      "an unknown session",
+      () => (prisma.session.findUnique as jest.Mock).mockResolvedValue(null),
+      {},
+      "unknown_session",
+    ],
+    [
+      "an expired session",
+      () => givenSession({ expiresAt: new Date(Date.now() - 1_000) }),
+      {},
+      "expired",
+    ],
+    [
+      "a cross-origin Origin",
+      () => undefined,
+      { origin: "https://evil.example.com" },
+      "cross_origin",
+    ],
+    [
+      "a rejecting session lookup",
+      () =>
+        (prisma.session.findUnique as jest.Mock).mockRejectedValue(
+          new Error("db down"),
+        ),
+      {},
+      "lookup_failed",
+    ],
+    [
+      "an unverified email",
+      () => givenUser({ emailVerified: false }),
+      {},
+      "email_unverified",
+    ],
+    ["a missing User row", () => givenUser(null), {}, "user_not_found"],
+    [
+      "a rejecting user lookup after a valid cookie",
+      () =>
+        (prisma.user.findUnique as jest.Mock).mockRejectedValue(
+          new Error("db down"),
+        ),
+      {},
+      "buyer_lookup_failed",
+    ],
+  ])(
+    "#6866 R6: %s is an anonymous 201, never an error",
+    async (_label, arrange, headers, identity) => {
+      arrange();
+
+      const res = await post({
+        cookie: COOKIE,
+        origin: SAME_ORIGIN,
+        ...(headers as Record<string, string>),
+      });
+
+      expect(res.statusCode).toBe(201);
+      expect(mockCreateCheckoutSession.mock.calls[0][0]).not.toHaveProperty(
+        "buyer",
+      );
+      expect(createdLog()).toMatchObject({ buyer: "anonymous", identity });
+    },
+  );
+
+  it("#6866 R7: a bearer token alone never stamps, and apiToken is never read", async () => {
+    const res = await post({ authorization: "Bearer tok_valid_looking_123" });
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession.mock.calls[0][0]).not.toHaveProperty(
+      "buyer",
+    );
+    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
+    expect(prisma.session.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("#6866 R8: the log names the buyer kind, never the user, email, customer or cookie", async () => {
+    givenUser({ billingProvider: "stripe", billingCustomerId: "cus_bound" });
+
+    await signedIn();
+
+    expect(createdLog()).toMatchObject({ buyer: "signed_in" });
+    expect(createdLog()).not.toHaveProperty("identity");
+    expect(rawLog).not.toContain("usr_buyer");
+    expect(rawLog).not.toContain("buyer@example.com");
+    expect(rawLog).not.toContain("cus_");
+    expect(rawLog).not.toContain(SESSION_TOKEN);
+  });
+
+  it("#6866 R9: a cross-origin cookie logs identity cross_origin", async () => {
+    await post({ cookie: COOKIE, origin: "https://evil.example.com" });
+
+    expect(createdLog()).toMatchObject({
+      buyer: "anonymous",
+      identity: "cross_origin",
+    });
+  });
+
+  it("#6866 R10: a generic Stripe failure on a signed-in call is still 502 checkout-unavailable", async () => {
+    mockCreateCheckoutSession.mockRejectedValue(new Error("stripe down"));
+
+    const res = await signedIn();
+
+    expect(res.statusCode).toBe(502);
+    expect(res.json()).toEqual({ error: "checkout-unavailable" });
+    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(1);
+  });
+
+  it("#6866 R12: a buyer the library's schema refuses retries once as anonymous (F7)", async () => {
+    givenUser({ billingProvider: "stripe", billingCustomerId: "not_a_cus" });
+    mockCreateCheckoutSession.mockRejectedValueOnce(
+      Object.assign(new Error("invalid buyer"), { name: "ZodError" }),
+    );
+
+    const res = await signedIn();
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(2);
+    expect(mockCreateCheckoutSession.mock.calls[1][0]).not.toHaveProperty(
+      "buyer",
+    );
+    expect(createdLog()).toMatchObject({
+      buyer: "anonymous",
+      identity: "buyer_invalid",
+    });
+  });
+
+  it("#6866 R12b: an anonymous ZodError is not retried — today's 502 mapping", async () => {
+    mockCreateCheckoutSession.mockRejectedValue(
+      Object.assign(new Error("invalid"), { name: "ZodError" }),
+    );
+
+    const res = await post({});
+
+    expect(res.statusCode).toBe(502);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(1);
+  });
+
+  it("#6866 R11: a pinned customer Stripe rejects retries once as anonymous", async () => {
+    givenUser({ billingProvider: "stripe", billingCustomerId: "cus_bound" });
+    mockCreateCheckoutSession.mockRejectedValueOnce(new UnknownCustomerError());
+
+    const res = await signedIn();
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledTimes(2);
+    expect(mockCreateCheckoutSession.mock.calls[0][0].buyer.customerId).toBe(
+      "cus_bound",
+    );
+    expect(mockCreateCheckoutSession.mock.calls[1][0]).not.toHaveProperty(
+      "buyer",
+    );
+    expect(createdLog()).toMatchObject({
+      buyer: "anonymous",
+      identity: "stale_customer",
+    });
+  });
+});
+
+// ── Same-origin redirect lock (#6877) ─────────────────────────────────────────
+
+describe("POST /v1/checkout/sessions — same-origin redirect lock (#6877)", () => {
+  const SITE_ORIGIN = "https://example.com";
+  const GATE_TOKEN = "x-auth-fixture-for-6877";
+  const SESSION_TOKEN = "sess_tok_6877";
+  const COOKIE = `better-auth.session_token=${SESSION_TOKEN}.signature`;
+  const originalDatabaseUrl = process.env.DATABASE_URL;
+
+  let app: FastifyInstance;
+  let logLines: Array<Record<string, unknown>>;
+  let rawLog: string;
+
+  function post(
+    payload: Record<string, unknown>,
+    headers: Record<string, string> = {},
+  ) {
+    return app.inject({
+      method: "POST",
+      url: "/v1/checkout/sessions",
+      headers,
+      payload,
+    });
+  }
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    config.FRONTEND_URL = SITE_ORIGIN;
+    process.env["STRIPE_SECRET_KEY"] = "sk_test_route_fixture";
+    delete process.env["OSS_API_INTERNAL_SECRET"];
+    mockAssertSandboxKey.mockImplementation(() => undefined);
+    mockCreateCheckoutSession.mockResolvedValue({
+      sessionId: "cs_test_lock6877",
+      url: "https://checkout.stripe.com/c/pay/cs_test_lock6877",
+    });
+
+    logLines = [];
+    rawLog = "";
+    app = require("fastify")({
+      logger: {
+        level: "info",
+        stream: {
+          write: (line: string) => {
+            rawLog += line;
+            logLines.push(JSON.parse(line) as Record<string, unknown>);
+          },
+        },
+      },
+    });
+    app.register(checkoutRoutes);
+    await app.ready();
+  });
+
+  afterEach(async () => {
+    await app.close();
+    delete process.env["STRIPE_SECRET_KEY"];
+    delete process.env["OSS_API_INTERNAL_SECRET"];
+    config.FRONTEND_URL = SITE_ORIGIN;
+    if (originalDatabaseUrl === undefined) delete process.env.DATABASE_URL;
+    else process.env.DATABASE_URL = originalDatabaseUrl;
+  });
+
+  it("#6877 R1: an off-origin successUrl is refused with 400 and no Stripe call", async () => {
+    const res = await post({
+      ...VALID_BODY,
+      successUrl: "https://evil.test/x",
+    });
+
+    expect(res.statusCode).toBe(400);
+    const body = res.json();
+    expect(body.error).toBe("validation-error");
+    expect(body.details).toHaveLength(1);
+    expect(body.details[0].path).toEqual(["successUrl"]);
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it("#6877 R2: an off-origin cancelUrl alone is refused with 400 and no Stripe call", async () => {
+    const res = await post({ ...VALID_BODY, cancelUrl: "https://evil.test/x" });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json().details[0].path).toEqual(["cancelUrl"]);
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  /** Lookalikes WHATWG still parses to the site origin — refused only by the
+   * raw-string checks (D2 checks 1 and 2). */
+  const PARSER_DIFFERENTIAL = [
+    "https://example.com\\@evil.test/x",
+    "https://evil.test%40@example.com/",
+    "https:example.com/x",
+    "https://\uff45xample.com/x",
+    " https://example.com/x",
+    "https://example.com\t/x",
+  ];
+
+  it("#6877 R3 precondition: every parser-differential row parses to the site origin", () => {
+    for (const raw of PARSER_DIFFERENTIAL) {
+      expect(new URL(raw).origin).toBe(SITE_ORIGIN);
+    }
+  });
+
+  it.each([
+    "https://example.com.evil.test/x",
+    "https://example.com@evil.test/x",
+    "http://example.com/x",
+    "https://example.com:8443/x",
+    ...PARSER_DIFFERENTIAL,
+  ])("#6877 R3: the lookalike %j is refused", async (successUrl) => {
+    const res = await post({ ...VALID_BODY, successUrl });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json().error).toBe("validation-error");
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it("#6877 R3b: a raw space on the site origin is refused (D2 check 1)", async () => {
+    const res = await post({
+      ...VALID_BODY,
+      successUrl: "https://example.com/x y",
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it("#6877 R4: the refused URL is never echoed or logged", async () => {
+    const res = await post({
+      ...VALID_BODY,
+      successUrl: "https://evil.test/x",
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.body).not.toContain("evil.test");
+    expect(rawLog).not.toContain("evil.test");
+    const refusals = logLines.filter(
+      (l) => l["outcome"] === "redirect_origin_refused",
+    );
+    expect(refusals).toHaveLength(1);
+    expect(refusals[0]).toMatchObject({ fields: ["successUrl"] });
+  });
+
+  it("#6877 R5: a same-origin checkout is forwarded byte-for-byte", async () => {
+    const successUrl =
+      "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}";
+    const cancelUrl = "https://example.com/purchase/cancel";
+
+    const res = await post({ productCode: "ailk-pro", successUrl, cancelUrl });
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
+      expect.objectContaining({ successUrl, cancelUrl }),
+    );
+  });
+
+  it("#6877 R6: an authenticated internal caller keeps its two-host redirects", async () => {
+    process.env["OSS_API_INTERNAL_SECRET"] = GATE_TOKEN;
+    const successUrl = "https://app.ailaunchkit.ai/dashboard?checkout=success";
+    const cancelUrl = "https://ailaunchkit.ai/pricing?checkout=cancel";
+
+    const res = await post(
+      { productCode: "ailk-pro", successUrl, cancelUrl },
+      { "x-internal-auth": GATE_TOKEN },
+    );
+
+    expect(res.statusCode).toBe(201);
+    expect(mockCreateCheckoutSession).toHaveBeenCalledWith(
+      expect.objectContaining({ successUrl, cancelUrl }),
+    );
+  });
+
+  it("#6877 R7: the gate refuses a missing header with 401 before any origin check", async () => {
+    process.env["OSS_API_INTERNAL_SECRET"] = GATE_TOKEN;
+
+    const res = await post({
+      ...VALID_BODY,
+      successUrl: "https://evil.test/x",
+    });
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json()).toEqual({ error: "internal-auth-required" });
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    [
+      "an unparseable FRONTEND_URL",
+      () => {
+        config.FRONTEND_URL = "not a url";
+      },
+    ],
+    [
+      "a non-http(s) FRONTEND_URL",
+      () => {
+        config.FRONTEND_URL = "mailto:ops@example.com";
+      },
+    ],
+    [
+      "an unset FRONTEND_URL in production",
+      () => {
+        delete process.env.FRONTEND_URL;
+        config.NODE_ENV = "production";
+      },
+    ],
+  ])(
+    "#6877 R8: %s answers 500 config-error with no Stripe call",
+    async (_label, arrange) => {
+      const envFrontendUrl = process.env.FRONTEND_URL;
+      const nodeEnv = config.NODE_ENV;
+      try {
+        arrange();
+        const res = await post(VALID_BODY);
+
+        expect(res.statusCode).toBe(500);
+        expect(res.json()).toEqual({ error: "config-error" });
+        expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+      } finally {
+        config.FRONTEND_URL = SITE_ORIGIN;
+        config.NODE_ENV = nodeEnv;
+        process.env.FRONTEND_URL = envFrontendUrl;
+      }
+    },
+  );
+
+  it("#6877 R9: a refused request never reads the session cookie's row", async () => {
+    process.env.DATABASE_URL = "postgresql://test:test@localhost/test";
+    (prisma.session.findUnique as jest.Mock).mockResolvedValue(null);
+    const headers = { cookie: COOKIE, origin: SITE_ORIGIN };
+
+    // Control: the same signed-in request on-origin DOES reach the lookup.
+    const control = await post(VALID_BODY, headers);
+    expect(control.statusCode).toBe(201);
+    expect(prisma.session.findUnique).toHaveBeenCalled();
+    jest.clearAllMocks();
+
+    const res = await post(
+      { ...VALID_BODY, successUrl: "https://evil.test/x" },
+      headers,
+    );
+
+    expect(res.statusCode).toBe(400);
+    expect(prisma.session.findUnique).not.toHaveBeenCalled();
+    expect(mockCreateCheckoutSession).not.toHaveBeenCalled();
+  });
+});