create-ailk 0.8.0 → 0.10.0

package/templates/apps/api/src/routes/checkout/sessions.ts

@@ -12,19 +12,40 @@
  *     Only the first 8 chars of the session ID appear in log lines.
  *   - Error responses never echo user input (productCode, URLs).
  *   - No DB write: this unit creates a Stripe session only; webhook-driven
- *     persistence is a follow-up issue.
+ *     persistence is a follow-up issue. It READS the database only to resolve
+ *     an optional signed-in buyer (below).
+ *   - Optional cookie identity (#6866): a valid, same-origin Better Auth
+ *     session cookie whose user has a verified email makes the Checkout a
+ *     signed-in one — the session is pinned to the buyer's Stripe customer and
+ *     stamped `metadata.ailk_user_id`, so the #6852 webhook binds it. The id
+ *     comes ONLY from the session cookie, never the body; a bearer token never
+ *     identifies a buyer. Any lookup failure, and a pinned customer Stripe
+ *     does not know, degrades to today's anonymous Checkout — never an error.
+ *     The stamped id is never echoed or logged.
  *   - X-Internal-Auth gate: when OSS_API_INTERNAL_SECRET env var is set,
  *     the X-Internal-Auth header must match; requests without a matching header
  *     are rejected with 401. When the env var is unset, no gate is applied
  *     (backward-compat for OSS standalone deployments). See #935.
+ *   - Same-origin redirects (#6877): a request that did not pass an ENABLED
+ *     internal-auth gate (the OSS default) must send successUrl and cancelUrl
+ *     on the site's own origin — `FRONTEND_URL`'s, exact scheme + host + port,
+ *     checked on the raw string as well as on the parse, because the raw
+ *     string is what Stripe receives. Anything else is a 400 before any Stripe
+ *     call or database read. A caller authenticated by X-Internal-Auth keeps
+ *     its redirects; that exemption holds only while every internal caller
+ *     builds its redirects itself — an internal caller MUST NEVER forward a
+ *     redirect taken from its own end user.
  *
  * Error mapping:
  *   401 internal-auth-required — X-Internal-Auth missing/mismatch (only when env var set)
- *   400 validation-error      — Zod validation failed (missing/invalid fields)
+ *   400 validation-error      — Zod validation failed (missing/invalid fields), or an
+ *                               unauthenticated redirect is off the site origin (#6877)
  *   404 unknown-product-code  — no active Stripe price for the given productCode
  *   500 stripe-not-configured — STRIPE_SECRET_KEY is missing/empty (no Stripe call)
  *   500 live-mode-forbidden   — STRIPE_SECRET_KEY is a live key
- *   500 config-error          — STRIPE_SECRET_KEY invalid configuration (from the SDK wrapper)
+ *   500 config-error          — STRIPE_SECRET_KEY invalid configuration (from the SDK wrapper),
+ *                               or FRONTEND_URL is not an absolute http(s) URL / is unset in
+ *                               production when the origin lock applies (#6877)
  *   502 checkout-unavailable  — Stripe SDK threw an unexpected error
  */
 import { timingSafeEqual } from "node:crypto";
@@ -32,12 +53,28 @@ import { timingSafeEqual } from "node:crypto";
 import type { FastifyReply, FastifyRequest } from "fastify";
 import { z } from "zod";
 
+import { config } from "../../config/index.js";
 import {
   assertSandboxKey,
   createCheckoutSession,
   StripeConfigError,
+  UnknownCustomerError,
   UnknownProductCodeError,
 } from "../../lib/stripe.js";
+import type {
+  CreateCheckoutSessionInput,
+  CreateCheckoutSessionOutput,
+} from "../../lib/stripe.js";
+import {
+  type OptionalCookieUser,
+  resolveOptionalCookieUser,
+} from "../../middleware/auth.js";
+import {
+  type CheckoutBuyerResult,
+  resolveCheckoutBuyer,
+} from "../../services/checkout-buyer.js";
+
+type OptionalCookieUserNone = Extract<OptionalCookieUser, { kind: "none" }>;
 
 // ── Input validation schema ───────────────────────────────────────────────────
 
@@ -81,14 +118,13 @@ const CheckoutSessionRequestSchema = z.object({
 // ── Internal-auth gate ────────────────────────────────────────────────────────
 
 /**
- * Enforce the X-Internal-Auth gate when OSS_API_INTERNAL_SECRET is configured.
+ * Classify the request against the X-Internal-Auth gate (#935, #6877 D3).
  *
  * Gate is env-var-conditional:
- *   - env var SET → header must be present and must match exactly
- *   - env var UNSET → no gate applied (OSS standalone backward-compat)
- *
- * Returns true if the request should be allowed through; false if it must be
- * rejected with 401.
+ *   - env var SET, header missing or wrong → "refused" (401)
+ *   - env var SET, header matches           → "authenticated" (redirects kept)
+ *   - env var UNSET                         → "open" (OSS standalone backward-
+ *     compat; the request is anonymous, so the origin lock applies)
  *
  * Uses a constant-time string comparison to prevent timing attacks on the
  * secret value. Node's `crypto.timingSafeEqual` requires equal-length Buffers,
@@ -96,20 +132,116 @@ const CheckoutSessionRequestSchema = z.object({
  * no information about the secret's content beyond its length, which is
  * acceptable for a shared internal secret).
  */
-function passesInternalAuthGate(request: FastifyRequest): boolean {
+function internalAuthVerdict(
+  request: FastifyRequest,
+): "refused" | "open" | "authenticated" {
   const expectedSecret = process.env["OSS_API_INTERNAL_SECRET"];
   // Gate is disabled when env var is not set — OSS standalone backward-compat.
-  if (!expectedSecret) return true;
+  if (!expectedSecret) return "open";
 
   const provided = request.headers["x-internal-auth"];
-  if (typeof provided !== "string" || !provided) return false;
+  if (typeof provided !== "string" || !provided) return "refused";
 
   // Constant-time comparison.
   const expectedBuf = Buffer.from(expectedSecret, "utf8");
   const providedBuf = Buffer.from(provided, "utf8");
-  if (expectedBuf.length !== providedBuf.length) return false;
+  if (expectedBuf.length !== providedBuf.length) return "refused";
+
+  return timingSafeEqual(expectedBuf, providedBuf)
+    ? "authenticated"
+    : "refused";
+}
+
+// ── Same-origin redirect lock (#6877) ────────────────────────────────────────
+
+/**
+ * The site's own origin, from `FRONTEND_URL` (#6877 D6). `null` when the
+ * setting does not parse, parses to a non-http(s) scheme (whose origin would
+ * be the literal `"null"`), or is unset in production — where the config
+ * default `http://localhost:3000` would lock a live site to localhost.
+ */
+function siteRedirectOrigin(): string | null {
+  if (!process.env["FRONTEND_URL"] && config.NODE_ENV === "production") {
+    return null;
+  }
+  let parsed: URL;
+  try {
+    parsed = new URL(config.FRONTEND_URL);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+  return parsed.origin;
+}
+
+/** C0 controls, space, DEL and backslash — anything a parser may normalize. */
+// eslint-disable-next-line no-control-regex -- the control-character range is exactly what D2 check 1 must refuse.
+const NON_CANONICAL_URL_CHAR = /[\u0000-\u0020\u007f\\]/;
+
+/**
+ * True only when `raw` is on `siteOrigin` both as written and as parsed
+ * (#6877 D2). The raw-string checks matter because the route forwards `raw`
+ * itself to Stripe: WHATWG parses `https://example.com\@evil.test/x` to
+ * origin `https://example.com`, and another parser may not. Requiring the
+ * literal origin followed by `/`, `?`, `#` or the end keeps
+ * `https://example.com.evil.test` out, and exact origin equality keeps a
+ * scheme downgrade or another port out.
+ */
+function isSameOriginRedirect(raw: string, siteOrigin: string): boolean {
+  if (NON_CANONICAL_URL_CHAR.test(raw)) return false;
+  if (!raw.startsWith(siteOrigin)) return false;
+  const boundary = raw.charAt(siteOrigin.length);
+  if (boundary !== "" && !"/?#".includes(boundary)) return false;
+  let resolved: URL;
+  try {
+    resolved = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (resolved.protocol !== "https:" && resolved.protocol !== "http:")
+    return false;
+  return resolved.origin === siteOrigin;
+}
+
+// ── Optional signed-in buyer (#6866) ─────────────────────────────────────────
+
+type Buyer = NonNullable<CreateCheckoutSessionInput["buyer"]>;
+
+/** Why a present cookie produced no buyer — the closed set D6 logs. */
+type IdentityReason =
+  | Exclude<OptionalCookieUserNone["reason"], "no_cookie">
+  | Extract<CheckoutBuyerResult, { ok: false }>["reason"]
+  | "buyer_lookup_failed"
+  | "buyer_invalid"
+  | "stale_customer";
 
-  return timingSafeEqual(expectedBuf, providedBuf);
+/**
+ * Resolve the signed-in buyer from the session cookie alone (#6866 D2/D3).
+ * Never throws: a failed lookup is anonymous (F7). `identity` is the reason a
+ * present cookie produced no buyer — logged, never the user's id; absent for
+ * a call with no cookie (D6).
+ */
+async function resolveBuyer(
+  request: FastifyRequest,
+): Promise<{ buyer?: Buyer; identity?: IdentityReason }> {
+  const cookieUser = await resolveOptionalCookieUser(request, {
+    frontendOrigin: config.FRONTEND_URL,
+  });
+  if (cookieUser.kind === "none") {
+    return cookieUser.reason === "no_cookie"
+      ? {}
+      : { identity: cookieUser.reason };
+  }
+  try {
+    const result = await resolveCheckoutBuyer(cookieUser.userId);
+    if (!result.ok) return { identity: result.reason };
+    const { userId, email, customerId } = result.buyer;
+    return {
+      buyer: { userId, email, ...(customerId !== null && { customerId }) },
+    };
+  } catch {
+    return { identity: "buyer_lookup_failed" };
+  }
 }
 
 // ── Handler ───────────────────────────────────────────────────────────────────
@@ -119,7 +251,8 @@ export async function checkoutSessionsHandler(
   reply: FastifyReply,
 ): Promise<void> {
   // ── X-Internal-Auth gate (env-var-conditional) ────────────────────────────
-  if (!passesInternalAuthGate(request)) {
+  const authVerdict = internalAuthVerdict(request);
+  if (authVerdict === "refused") {
     return reply.status(401).send({ error: "internal-auth-required" });
   }
 
@@ -144,16 +277,79 @@ export async function checkoutSessionsHandler(
   const { productCode, successUrl, cancelUrl, quantity, allowPromotionCodes } =
     parsed.data;
 
+  // ── Same-origin redirect lock (#6877) — before any Stripe or DB call ──────
+  if (authVerdict === "open") {
+    const siteOrigin = siteRedirectOrigin();
+    if (siteOrigin === null) {
+      request.log.error(
+        { method: request.method, path: request.url },
+        "[checkout] FRONTEND_URL is not a valid absolute URL",
+      );
+      return reply.status(500).send({ error: "config-error" });
+    }
+    const refused = (["successUrl", "cancelUrl"] as const).filter(
+      (field) => !isSameOriginRedirect(parsed.data[field], siteOrigin),
+    );
+    if (refused.length > 0) {
+      // Field names only — the refused URL is never logged or echoed.
+      request.log.warn(
+        {
+          method: request.method,
+          path: request.url,
+          outcome: "redirect_origin_refused",
+          fields: refused,
+        },
+        "[checkout] redirect origin refused",
+      );
+      return reply.status(400).send({
+        error: "validation-error",
+        details: refused.map((field) => ({
+          code: "custom",
+          path: [field],
+          message: `${field} must be on this site's origin`,
+        })),
+      });
+    }
+  }
+
+  const sessionInput: CreateCheckoutSessionInput = {
+    productCode,
+    successUrl,
+    cancelUrl,
+    quantity: quantity ?? 1,
+    // Omitted when the caller says nothing — Stripe's default (no promo-code
+    // field) is unchanged for every existing caller.
+    ...(allowPromotionCodes !== undefined && { allowPromotionCodes }),
+  };
+  // Built only from the session cookie — never from `parsed.data` (#6866 D5).
+  let { buyer, identity } = await resolveBuyer(request);
+
   try {
-    const { sessionId, url } = await createCheckoutSession({
-      productCode,
-      successUrl,
-      cancelUrl,
-      quantity: quantity ?? 1,
-      // Omitted when the caller says nothing — Stripe's default (no promo-code
-      // field) is unchanged for every existing caller.
-      ...(allowPromotionCodes !== undefined && { allowPromotionCodes }),
-    });
+    let created: CreateCheckoutSessionOutput;
+    try {
+      created = await createCheckoutSession({
+        ...sessionInput,
+        ...(buyer !== undefined && { buyer }),
+      });
+    } catch (err) {
+      // The buyer itself cannot be used — a pinned customer Stripe does not
+      // know (#6866 D8), or a stored email / customer id the library's schema
+      // refuses (F7: no new failure mode). Retry once as anonymous; the
+      // stored binding is never touched here. The request fields already
+      // passed the route's schema, so an anonymous retry that still fails
+      // maps exactly as today.
+      const reason: IdentityReason | undefined =
+        err instanceof UnknownCustomerError
+          ? "stale_customer"
+          : err instanceof Error && err.name === "ZodError"
+            ? "buyer_invalid"
+            : undefined;
+      if (buyer === undefined || reason === undefined) throw err;
+      buyer = undefined;
+      identity = reason;
+      created = await createCheckoutSession(sessionInput);
+    }
+    const { sessionId, url } = created;
 
     request.log.info(
       {
@@ -161,6 +357,8 @@ export async function checkoutSessionsHandler(
         path: request.url,
         sessionIdPrefix: sessionId.substring(0, 8),
         status: 201,
+        buyer: buyer !== undefined ? "signed_in" : "anonymous",
+        ...(identity !== undefined && { identity }),
       },
       "[checkout] session created",
     );

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-flow-checkout.test.ts

@@ -170,7 +170,7 @@ describe("AC-1 — completed stamps the row once, guarded, beside the legacy tas
     expect(prisma.user.findFirst).toHaveBeenCalledWith({
       where: { billingProvider: "stripe", billingCustomerId: CUSTOMER_ID },
     });
-    expect(prisma.user.findUnique).toHaveBeenCalledWith({ where: { email: EMAIL } });
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
   });
 });
 

package/templates/apps/api/src/routes/webhooks/__tests__/stripe-org-billing.test.ts

@@ -232,7 +232,11 @@ describe("POST /api/webhooks/stripe — org-scoped billing (#3601)", () => {
     (prisma.user.update as jest.Mock).mockResolvedValueOnce({ id: "usr_st" });
 
     mockVerifyWebhookSignature.mockReturnValue(
-      checkoutEvent("evt_st_004", { productId: "pro" }, customerId),
+      checkoutEvent(
+        "evt_st_004",
+        { productId: "pro", ailk_user_id: "usr_st" },
+        customerId,
+      ),
     );
     const r = await fire(server);
     expect(r.statusCode).toBe(200);