create-ailk 0.8.0 → 0.10.0

package/templates/apps/api/src/routes/webhooks/__tests__/stripe.test.ts

@@ -128,6 +128,13 @@ describe("POST /api/webhooks/stripe", () => {
   afterEach(async () => {
     await server.close();
     jest.restoreAllMocks();
+    // clearAllMocks keeps queued values: a case that asserts a read must NOT
+    // happen (#6852) would otherwise leak its unconsumed value into the next.
+    (prisma.user.findFirst as jest.Mock).mockReset();
+    (prisma.user.findUnique as jest.Mock).mockReset();
+    (prisma.user.update as jest.Mock).mockReset();
+    (prisma.organization.findFirst as jest.Mock).mockReset();
+    (prisma.organization.update as jest.Mock).mockReset();
   });
 
   // ── Case 1: Missing config returns 503 ──────────────────────────────────
@@ -483,6 +490,66 @@ describe("POST /api/webhooks/stripe", () => {
     expect(response.statusCode).toBe(404);
   });
 
+  // ── Log capture (shared by the #6113 and #6852 blocks) ─────────────────────
+
+  type LogLine = {
+    level: number;
+    msg?: string;
+    outcome?: string;
+    userId?: string;
+    eventType?: string;
+  };
+  const WARN = 40;
+  const INFO = 30;
+  const ERROR = 50;
+
+  // A log-capture instance built the way the "does not log customer email…"
+  // case builds one — the default buildTestServer() captures no logs.
+  async function withLogCapture(
+    event: Record<string, unknown>,
+  ): Promise<{ statusCode: number; logLines: LogLine[] }> {
+    const logLines: LogLine[] = [];
+    const logCapture = Fastify({
+      logger: {
+        level: "info",
+        stream: {
+          write(msg: string) {
+            logLines.push(JSON.parse(msg) as LogLine);
+          },
+        },
+      },
+    });
+    await logCapture.register(async (scope) => {
+      scope.addContentTypeParser(
+        "application/json",
+        { parseAs: "buffer" },
+        (_req, body, done) => {
+          done(null, body);
+        },
+      );
+      scope.post("/v1/webhooks/stripe", stripeWebhookHandler);
+    });
+    await logCapture.ready();
+    try {
+      mockVerifyWebhookSignature.mockReturnValue(event);
+      const response = await logCapture.inject({
+        method: "POST",
+        url: "/v1/webhooks/stripe",
+        payload: VALID_BODY,
+        headers: {
+          "content-type": "application/json",
+          "stripe-signature": VALID_SIGNATURE,
+        },
+      });
+      return { statusCode: response.statusCode, logLines };
+    } finally {
+      await logCapture.close();
+    }
+  }
+
+  const withOutcome = (lines: LogLine[], outcome: string) =>
+    lines.filter((l) => l.outcome === outcome);
+
   // ── Billing upsert tests (AC bullets 4-6) ──────────────────────────────────
 
   // AC bullet 4: customer.created → upsert; re-fire same event = no second write
@@ -495,6 +562,7 @@ describe("POST /api/webhooks/stripe", () => {
         object: {
           id: customerId,
           email: "alice@example.com",
+          metadata: { ailk_user_id: "usr_1" },
         },
       },
     };
@@ -507,7 +575,7 @@ describe("POST /api/webhooks/stripe", () => {
 
     // First fire: typed composite match misses (user not yet linked)
     (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    // email fallback finds the user
+    // the verified user signal resolves the user by id
     (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce({
       id: "usr_1",
       email: "alice@example.com",
@@ -553,8 +621,9 @@ describe("POST /api/webhooks/stripe", () => {
     expect(prisma.user.update).toHaveBeenCalledTimes(1);
   });
 
-  // AC bullet 5: checkout.session.completed + existing User matched by email → billing fields populated
-  it("populates billingProvider/Id on checkout.session.completed for user matched by email", async () => {
+  // AC bullet 5 (inverted by #6852): the Checkout email is payer-typed and
+  // unverified, so an email match alone never makes a first binding.
+  it("does not bind a never-bound User matched only by email (#6852)", async () => {
     const customerId = "cus_test_checkout_xyz";
     const fakeCheckout = {
       id: "evt_checkout_002",
@@ -570,23 +639,16 @@ describe("POST /api/webhooks/stripe", () => {
         },
       },
     };
-    const updatedUser = {
-      id: "usr_2",
-      email: "bob@example.com",
-      billingProvider: "stripe",
-      billingCustomerId: customerId,
-    };
 
     // Typed composite lookup misses (no prior link)
     (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
-    // Email fallback finds user
+    // Would find the user by email — if the handler still asked
     (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce({
       id: "usr_2",
       email: "bob@example.com",
       billingProvider: null,
       billingCustomerId: null,
     });
-    (prisma.user.update as jest.Mock).mockResolvedValueOnce(updatedUser);
 
     mockVerifyWebhookSignature.mockReturnValue(fakeCheckout);
     const response = await server.inject({
@@ -600,15 +662,8 @@ describe("POST /api/webhooks/stripe", () => {
     });
 
     expect(response.statusCode).toBe(200);
-    expect(prisma.user.update).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: { id: "usr_2" },
-        data: expect.objectContaining({
-          billingProvider: "stripe",
-          billingCustomerId: customerId,
-        }),
-      }),
-    );
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
+    expect(prisma.user.update).not.toHaveBeenCalled();
   });
 
   // AC bullet 6: event with neither typed match nor email match → 200 + warning, no User row created
@@ -645,4 +700,450 @@ describe("POST /api/webhooks/stripe", () => {
     expect(prisma.user.update).not.toHaveBeenCalled();
     expect(prisma.user.create).not.toHaveBeenCalled();
   });
+
+  // ── #6113: a bound customer is never re-pointed (now on the signal, #6852) ──
+
+  describe("signal against an already-bound User (#6113)", () => {
+    function checkoutCompleted(customer: string, userId: string) {
+      return {
+        id: "evt_6113_checkout",
+        type: "checkout.session.completed",
+        data: {
+          object: {
+            id: "cs_test_6113",
+            amount_total: 4999,
+            currency: "usd",
+            customer,
+            customer_details: { email: "victim@example.com" },
+            metadata: { productId: "pro", ailk_user_id: userId },
+          },
+        },
+      };
+    }
+
+    function customerCreated(id: string, userId: string) {
+      return {
+        id: "evt_6113_customer",
+        type: "customer.created",
+        data: {
+          object: {
+            id,
+            email: "victim@example.com",
+            metadata: { ailk_user_id: userId },
+          },
+        },
+      };
+    }
+
+    const expectFirstReadById = (id: string) =>
+      expect((prisma.user.findUnique as jest.Mock).mock.calls[0]?.[0]).toEqual(
+        expect.objectContaining({ where: { id } }),
+      );
+
+    const victimRow = {
+      id: "usr_victim",
+      email: "victim@example.com",
+      billingProvider: "stripe",
+      billingCustomerId: "cus_victim",
+    };
+
+    // T6a
+    it("does not re-point a bound billingCustomerId from a Checkout naming the victim", async () => {
+      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
+      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(victimRow);
+
+      const { statusCode, logLines } = await withLogCapture(
+        checkoutCompleted("cus_attacker", "usr_victim"),
+      );
+
+      expect(statusCode).toBe(200);
+      expectFirstReadById("usr_victim");
+      expect(prisma.user.update).not.toHaveBeenCalled();
+      const conflicts = withOutcome(logLines, "billing_identity_conflict");
+      expect(conflicts).toHaveLength(1);
+      expect(conflicts[0]).toMatchObject({ level: WARN, userId: "usr_victim" });
+      const logText = JSON.stringify(logLines);
+      expect(logText).not.toContain("victim@example.com");
+      expect(logText).not.toContain("cus_attacker");
+      expect(logText).not.toContain("cus_victim");
+    });
+
+    // T6b (the customer.created branch)
+    it("does not re-point a bound billingCustomerId from customer.created naming the victim", async () => {
+      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
+      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(victimRow);
+
+      const { statusCode, logLines } = await withLogCapture(
+        customerCreated("cus_attacker", "usr_victim"),
+      );
+
+      expect(statusCode).toBe(200);
+      expectFirstReadById("usr_victim");
+      expect(prisma.user.update).not.toHaveBeenCalled();
+      const conflicts = withOutcome(logLines, "billing_identity_conflict");
+      expect(conflicts).toHaveLength(1);
+      expect(conflicts[0]).toMatchObject({ level: WARN, userId: "usr_victim" });
+    });
+
+    // T6c (a lost race to a different customer is a refusal, not a DB failure)
+    it("guards the write and treats a P2025 lost to another customer as a conflict", async () => {
+      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
+      (prisma.user.findUnique as jest.Mock)
+        .mockResolvedValueOnce({
+          id: "usr_race",
+          billingProvider: null,
+          billingCustomerId: null,
+        })
+        .mockResolvedValueOnce({
+          billingProvider: "stripe",
+          billingCustomerId: "cus_other",
+        });
+      (prisma.user.update as jest.Mock).mockRejectedValueOnce(
+        Object.assign(new Error("not found"), { code: "P2025" }),
+      );
+
+      const { statusCode, logLines } = await withLogCapture(
+        checkoutCompleted("cus_new", "usr_race"),
+      );
+
+      expect(statusCode).toBe(200);
+      expectFirstReadById("usr_race");
+      expect(prisma.user.update).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: { id: "usr_race", billingCustomerId: null },
+        }),
+      );
+      const conflicts = withOutcome(logLines, "billing_identity_conflict");
+      expect(conflicts).toHaveLength(1);
+      expect(conflicts[0]).toMatchObject({ level: WARN, userId: "usr_race" });
+      expect(
+        logLines.filter(
+          (l) =>
+            l.level === ERROR &&
+            l.msg?.includes("billing identity upsert failed"),
+        ),
+      ).toHaveLength(0);
+    });
+
+    // T6d (the same id under another provider is still "already bound")
+    it("does not rewrite a row holding the same id under a different provider", async () => {
+      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
+      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce({
+        id: "usr_same",
+        billingProvider: null,
+        billingCustomerId: "cus_same",
+      });
+
+      const { statusCode, logLines } = await withLogCapture(
+        customerCreated("cus_same", "usr_same"),
+      );
+
+      expect(statusCode).toBe(200);
+      expectFirstReadById("usr_same");
+      expect(prisma.user.update).not.toHaveBeenCalled();
+      expect(withOutcome(logLines, "billing_identity_conflict")).toHaveLength(
+        1,
+      );
+    });
+
+    // T6e (a race lost to a sibling event for the SAME customer is a no-op)
+    it("treats a P2025 lost to a sibling event for the same customer as already linked", async () => {
+      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
+      (prisma.user.findUnique as jest.Mock)
+        .mockResolvedValueOnce({
+          id: "usr_sib",
+          billingProvider: null,
+          billingCustomerId: null,
+        })
+        .mockResolvedValueOnce({
+          billingProvider: "stripe",
+          billingCustomerId: "cus_new",
+        });
+      (prisma.user.update as jest.Mock).mockRejectedValueOnce(
+        Object.assign(new Error("not found"), { code: "P2025" }),
+      );
+
+      const { statusCode, logLines } = await withLogCapture(
+        checkoutCompleted("cus_new", "usr_sib"),
+      );
+
+      expect(statusCode).toBe(200);
+      expectFirstReadById("usr_sib");
+      expect(withOutcome(logLines, "billing_identity_conflict")).toHaveLength(
+        0,
+      );
+      const linked = withOutcome(logLines, "billing_identity_already_linked");
+      expect(linked).toHaveLength(1);
+      expect(linked[0]).toMatchObject({ level: INFO });
+      expect(logLines.filter((l) => l.level === ERROR)).toHaveLength(0);
+    });
+
+    // T6f (the pre-check sees the sibling's binding already committed)
+    it("treats a signal-matched row already bound to this customer as a no-op", async () => {
+      (prisma.user.findFirst as jest.Mock).mockResolvedValueOnce(null);
+      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce({
+        id: "usr_sib",
+        billingProvider: "stripe",
+        billingCustomerId: "cus_new",
+      });
+
+      const { statusCode, logLines } = await withLogCapture(
+        checkoutCompleted("cus_new", "usr_sib"),
+      );
+
+      expect(statusCode).toBe(200);
+      expectFirstReadById("usr_sib");
+      expect(prisma.user.update).not.toHaveBeenCalled();
+      expect(withOutcome(logLines, "billing_identity_conflict")).toHaveLength(
+        0,
+      );
+    });
+  });
+
+  // ── #6852: a first binding needs a server-stamped user id, never an email ──
+
+  describe("verified user signal (#6852)", () => {
+    function checkoutCompleted(
+      customer: string,
+      metadata: Record<string, unknown>,
+      extra: Record<string, unknown> = {},
+    ) {
+      return {
+        id: "evt_6852_checkout",
+        type: "checkout.session.completed",
+        data: {
+          object: {
+            id: "cs_test_6852",
+            amount_total: 4999,
+            currency: "usd",
+            customer,
+            customer_details: { email: "victim@example.com" },
+            metadata,
+            ...extra,
+          },
+        },
+      };
+    }
+
+    function customerCreated(
+      id: string,
+      email: string | null,
+      metadata?: Record<string, string>,
+    ) {
+      return {
+        id: "evt_6852_customer",
+        type: "customer.created",
+        data: { object: { id, email, ...(metadata ? { metadata } : {}) } },
+      };
+    }
+
+    const neverBound = (id: string) => ({
+      id,
+      billingProvider: null,
+      billingCustomerId: null,
+    });
+
+    const findUniqueWheres = () =>
+      (prisma.user.findUnique as jest.Mock).mock.calls.map(
+        (c) => (c[0] as { where: Record<string, unknown> }).where,
+      );
+
+    beforeEach(() => {
+      (prisma.user.findFirst as jest.Mock).mockResolvedValue(null);
+    });
+
+    // T1 (AC1 — checkout.session.completed)
+    it("T1: a Checkout under the victim's email with no signal binds nothing", async () => {
+      (prisma.user.findUnique as jest.Mock).mockResolvedValue(
+        neverBound("usr_victim"),
+      );
+
+      const { statusCode, logLines } = await withLogCapture(
+        checkoutCompleted("cus_attacker", { productId: "pro" }),
+      );
+
+      expect(statusCode).toBe(200);
+      expect(prisma.user.findUnique).not.toHaveBeenCalled();
+      expect(prisma.user.update).not.toHaveBeenCalled();
+      const unverified = withOutcome(logLines, "billing_identity_unverified");
+      expect(unverified).toHaveLength(1);
+      expect(unverified[0]).toMatchObject({
+        level: WARN,
+        eventType: "checkout.session.completed",
+      });
+      const logText = JSON.stringify(logLines);
+      expect(logText).not.toContain("victim@example.com");
+      expect(logText).not.toContain("cus_attacker");
+    });
+
+    // T2 (AC1 — customer.created)
+    it("T2: customer.created under the victim's email with no signal binds nothing", async () => {
+      (prisma.user.findUnique as jest.Mock).mockResolvedValue(
+        neverBound("usr_victim"),
+      );
+
+      const { statusCode, logLines } = await withLogCapture(
+        customerCreated("cus_attacker", "victim@example.com"),
+      );
+
+      expect(statusCode).toBe(200);
+      expect(prisma.user.findUnique).not.toHaveBeenCalled();
+      expect(prisma.user.update).not.toHaveBeenCalled();
+      expect(withOutcome(logLines, "billing_identity_unverified")).toHaveLength(
+        1,
+      );
+    });
+
+    // T3 (AC1 — a signal naming a different user binds that user, never the email's)
+    it("T3: a signal naming another user binds that user, never the email's", async () => {
+      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(
+        neverBound("usr_attacker"),
+      );
+
+      const { statusCode } = await withLogCapture(
+        checkoutCompleted("cus_attacker", { ailk_user_id: "usr_attacker" }),
+      );
+
+      expect(statusCode).toBe(200);
+      expect(findUniqueWheres()).toEqual([{ id: "usr_attacker" }]);
+      expect(prisma.user.update).toHaveBeenCalledTimes(1);
+      expect(prisma.user.update).toHaveBeenCalledWith(
+        expect.objectContaining({
+          where: { id: "usr_attacker", billingCustomerId: null },
+        }),
+      );
+    });
+
+    // T4 (AC1 — client_reference_id is payer-settable, never a signal)
+    it("T4: client_reference_id alone is not a signal", async () => {
+      (prisma.user.findUnique as jest.Mock).mockResolvedValue(
+        neverBound("usr_victim"),
+      );
+
+      const { statusCode, logLines } = await withLogCapture(
+        checkoutCompleted(
+          "cus_attacker",
+          { productId: "pro" },
+          { client_reference_id: "usr_victim" },
+        ),
+      );
+
+      expect(statusCode).toBe(200);
+      expect(prisma.user.findUnique).not.toHaveBeenCalled();
+      expect(prisma.user.update).not.toHaveBeenCalled();
+      expect(withOutcome(logLines, "billing_identity_unverified")).toHaveLength(
+        1,
+      );
+    });
+
+    // signalOf accepts only a non-empty string — anything else is no signal.
+    it.each([
+      ["an empty string", ""],
+      ["a non-string", 42],
+    ])(
+      "T4b: an ailk_user_id that is %s is not a signal",
+      async (_label, value) => {
+        const { statusCode, logLines } = await withLogCapture(
+          checkoutCompleted("cus_attacker", { ailk_user_id: value }),
+        );
+
+        expect(statusCode).toBe(200);
+        expect(prisma.user.findUnique).not.toHaveBeenCalled();
+        expect(prisma.user.update).not.toHaveBeenCalled();
+        expect(
+          withOutcome(logLines, "billing_identity_unverified"),
+        ).toHaveLength(1);
+      },
+    );
+
+    const buyerBind = {
+      where: { id: "usr_buyer", billingCustomerId: null },
+      data: { billingProvider: "stripe", billingCustomerId: "cus_buyer" },
+    };
+
+    // T5a (AC2 — a signed-in Checkout binds the buyer's first customer)
+    it("T5a: checkout.session.completed carrying the signal binds the buyer", async () => {
+      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(
+        neverBound("usr_buyer"),
+      );
+
+      const { statusCode } = await withLogCapture(
+        checkoutCompleted("cus_buyer", { ailk_user_id: "usr_buyer" }),
+      );
+
+      expect(statusCode).toBe(200);
+      expect(findUniqueWheres()).toEqual([{ id: "usr_buyer" }]);
+      expect(prisma.user.update).toHaveBeenCalledTimes(1);
+      expect(prisma.user.update).toHaveBeenCalledWith(buyerBind);
+    });
+
+    // T5b (AC2 — the signal is read from the customer on customer.created)
+    it("T5b: customer.created carrying the signal binds the buyer", async () => {
+      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(
+        neverBound("usr_buyer"),
+      );
+
+      const { statusCode } = await withLogCapture(
+        customerCreated("cus_buyer", null, { ailk_user_id: "usr_buyer" }),
+      );
+
+      expect(statusCode).toBe(200);
+      expect(findUniqueWheres()).toEqual([{ id: "usr_buyer" }]);
+      expect(prisma.user.update).toHaveBeenCalledTimes(1);
+      expect(prisma.user.update).toHaveBeenCalledWith(buyerBind);
+    });
+
+    // T7 (F5 — a signal naming no User writes nothing and never echoes the value)
+    it("T7: a signal naming no existing User binds nothing and is not logged", async () => {
+      (prisma.user.findUnique as jest.Mock).mockResolvedValueOnce(null);
+
+      const { statusCode, logLines } = await withLogCapture(
+        checkoutCompleted("cus_buyer", { ailk_user_id: "usr_ghost" }),
+      );
+
+      expect(statusCode).toBe(200);
+      expect(prisma.user.update).not.toHaveBeenCalled();
+      const unknown = withOutcome(logLines, "billing_identity_unknown_user");
+      expect(unknown).toHaveLength(1);
+      expect(unknown[0]).toMatchObject({ level: WARN });
+      expect(JSON.stringify(logLines)).not.toContain("usr_ghost");
+    });
+
+    // T8 (F4 / SEC-04 — an ordinary purchase's customer.created is info, not warn)
+    it("T8: a no-signal customer.created logs unverified at info", async () => {
+      const { statusCode, logLines } = await withLogCapture(
+        customerCreated("cus_buyer", null),
+      );
+
+      expect(statusCode).toBe(200);
+      expect(prisma.user.findUnique).not.toHaveBeenCalled();
+      expect(prisma.user.update).not.toHaveBeenCalled();
+      const unverified = withOutcome(logLines, "billing_identity_unverified");
+      expect(unverified).toHaveLength(1);
+      expect(unverified[0]).toMatchObject({
+        level: INFO,
+        eventType: "customer.created",
+      });
+      expect(JSON.stringify(logLines)).not.toContain("cus_buyer");
+    });
+
+    // T9 (F8 — organizationId keeps precedence over the user signal)
+    it("T9: organizationId takes the Organization path even with a user signal", async () => {
+      (prisma.organization.findFirst as jest.Mock).mockResolvedValueOnce(null);
+
+      const { statusCode } = await withLogCapture(
+        checkoutCompleted("cus_org", {
+          organizationId: "org_1",
+          ailk_user_id: "usr_buyer",
+        }),
+      );
+
+      expect(statusCode).toBe(200);
+      expect(prisma.organization.update).toHaveBeenCalledWith(
+        expect.objectContaining({ where: { id: "org_1" } }),
+      );
+      expect(prisma.user.findUnique).not.toHaveBeenCalled();
+      expect(prisma.user.update).not.toHaveBeenCalled();
+    });
+  });
 });