create-charcole 2.2.2 → 2.3.0

package/packages/payments/src/__tests__/LemonSqueezyAdapter.test.js

@@ -0,0 +1,236 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { LemonSqueezyAdapter } from "../adapters/LemonSqueezyAdapter.js";
+import { PaymentError } from "../errors/PaymentError.js";
+
+vi.mock("@lemonsqueezy/lemonsqueezy.js", () => {
+  return {
+    lemonSqueezySetup: vi.fn(),
+    createCheckout: vi.fn(),
+    getOrder: vi.fn(),
+  };
+});
+
+describe("LemonSqueezyAdapter", () => {
+  let adapter;
+  let mockLS;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockLS = vi.mocked(require("@lemonsqueezy/lemonsqueezy.js"));
+    adapter = new LemonSqueezyAdapter({
+      apiKey: "api_fake",
+      webhookSecret: "secret_fake",
+      storeId: "123",
+    });
+  });
+
+  it("creates a checkout", async () => {
+    mockLS.createCheckout.mockResolvedValue({
+      error: null,
+      data: {
+        data: {
+          id: 456,
+          attributes: {
+            url: "https://checkout.fake",
+          },
+        },
+      },
+    });
+
+    const result = await adapter.createPayment({
+      amount: 1000,
+      currency: "usd",
+      metadata: { variantId: "789" },
+    });
+
+    expect(result.id).toBe("456");
+    expect(result.checkoutUrl).toBe("https://checkout.fake");
+    expect(result.status).toBe("created");
+    expect(result.amount).toBe(1000);
+    expect(result.currency).toBe("usd");
+  });
+
+  it("throws MISSING_VARIANT_ID when variantId absent", async () => {
+    await expect(
+      adapter.createPayment({
+        amount: 1000,
+        currency: "usd",
+        metadata: {},
+      }),
+    ).rejects.toThrow(PaymentError);
+    await expect(
+      adapter.createPayment({
+        amount: 1000,
+        currency: "usd",
+        metadata: {},
+      }),
+    ).rejects.toMatchObject({
+      code: "MISSING_VARIANT_ID",
+    });
+  });
+
+  it("throws LS_CHECKOUT_FAILED when API returns error", async () => {
+    mockLS.createCheckout.mockResolvedValue({
+      error: { message: "Invalid variant" },
+    });
+
+    await expect(
+      adapter.createPayment({
+        amount: 1000,
+        currency: "usd",
+        metadata: { variantId: "789" },
+      }),
+    ).rejects.toThrow(PaymentError);
+    await expect(
+      adapter.createPayment({
+        amount: 1000,
+        currency: "usd",
+        metadata: { variantId: "789" },
+      }),
+    ).rejects.toMatchObject({
+      code: "LS_CHECKOUT_FAILED",
+    });
+  });
+
+  it("refunds a payment", async () => {
+    mockLS.createRefund.mockResolvedValue({
+      error: null,
+      data: {
+        data: {
+          id: 789,
+          attributes: {
+            status: "completed",
+            amount: 500,
+          },
+        },
+      },
+    });
+
+    const result = await adapter.refundPayment({
+      paymentId: "456",
+    });
+
+    expect(result.id).toBe("789");
+    expect(result.status).toBe("completed");
+    expect(result.amount).toBe(500);
+  });
+
+  it("gets payment status", async () => {
+    mockLS.getOrder.mockResolvedValue({
+      error: null,
+      data: {
+        data: {
+          id: 456,
+          attributes: {
+            status: "paid",
+            total: 1000,
+            currency: "usd",
+          },
+        },
+      },
+    });
+
+    const result = await adapter.getPaymentStatus("456");
+
+    expect(result.id).toBe("456");
+    expect(result.status).toBe("paid");
+    expect(result.amount).toBe(1000);
+    expect(result.currency).toBe("usd");
+  });
+
+  it("throws LS_ORDER_NOT_FOUND when order not found", async () => {
+    mockLS.getOrder.mockResolvedValue({
+      error: { message: "Order not found" },
+    });
+
+    await expect(adapter.getPaymentStatus("999")).rejects.toThrow(PaymentError);
+    await expect(adapter.getPaymentStatus("999")).rejects.toMatchObject({
+      code: "LS_ORDER_NOT_FOUND",
+    });
+  });
+
+  it("verifies webhook", async () => {
+    const rawBody = Buffer.from(
+      JSON.stringify({
+        meta: { event_name: "order_created" },
+        data: { id: "123" },
+      }),
+    );
+
+    const result = await adapter.verifyWebhook(rawBody, "correct_signature");
+
+    expect(result.event).toBe("order_created");
+    expect(result.data.id).toBe("123");
+  });
+
+  it("throws WEBHOOK_INVALID on wrong signature", async () => {
+    const rawBody = Buffer.from("{}");
+
+    await expect(
+      adapter.verifyWebhook(rawBody, "wrong_signature"),
+    ).rejects.toThrow(PaymentError);
+    await expect(
+      adapter.verifyWebhook(rawBody, "wrong_signature"),
+    ).rejects.toMatchObject({
+      code: "WEBHOOK_INVALID",
+      statusCode: 401,
+    });
+  });
+
+  it("throws CONFIG_ERROR when apiKey missing", () => {
+    expect(
+      () =>
+        new LemonSqueezyAdapter({
+          webhookSecret: "secret_fake",
+          storeId: "123",
+        }),
+    ).toThrow(PaymentError);
+    expect(
+      () =>
+        new LemonSqueezyAdapter({
+          webhookSecret: "secret_fake",
+          storeId: "123",
+        }),
+    ).toMatchObject({
+      code: "CONFIG_ERROR",
+    });
+  });
+
+  it("throws CONFIG_ERROR when webhookSecret missing", () => {
+    expect(
+      () =>
+        new LemonSqueezyAdapter({
+          apiKey: "api_fake",
+          storeId: "123",
+        }),
+    ).toThrow(PaymentError);
+    expect(
+      () =>
+        new LemonSqueezyAdapter({
+          apiKey: "api_fake",
+          storeId: "123",
+        }),
+    ).toMatchObject({
+      code: "CONFIG_ERROR",
+    });
+  });
+
+  it("throws CONFIG_ERROR when storeId missing", () => {
+    expect(
+      () =>
+        new LemonSqueezyAdapter({
+          apiKey: "api_fake",
+          webhookSecret: "secret_fake",
+        }),
+    ).toThrow(PaymentError);
+    expect(
+      () =>
+        new LemonSqueezyAdapter({
+          apiKey: "api_fake",
+          webhookSecret: "secret_fake",
+        }),
+    ).toMatchObject({
+      code: "CONFIG_ERROR",
+    });
+  });
+});

package/packages/payments/src/__tests__/StripeAdapter.test.js

@@ -0,0 +1,139 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { StripeAdapter } from "../adapters/StripeAdapter.js";
+import { PaymentError } from "../errors/PaymentError.js";
+
+vi.mock("stripe", () => {
+  return {
+    default: vi.fn().mockImplementation(() => ({
+      paymentIntents: {
+        create: vi.fn(),
+        retrieve: vi.fn(),
+      },
+      refunds: {
+        create: vi.fn(),
+      },
+      webhooks: {
+        constructEvent: vi.fn(),
+      },
+    })),
+  };
+});
+
+describe("StripeAdapter", () => {
+  let adapter;
+  let mockStripe;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockStripe = new (vi.mocked(require("stripe").default))();
+    adapter = new StripeAdapter({
+      secretKey: "sk_test_fake",
+      webhookSecret: "whsec_fake",
+    });
+  });
+
+  it("creates a payment intent", async () => {
+    mockStripe.paymentIntents.create.mockResolvedValue({
+      id: "pi_abc123",
+      client_secret: "secret_fake",
+      status: "requires_payment_method",
+      amount: 1000,
+      currency: "usd",
+    });
+
+    const result = await adapter.createPayment({
+      amount: 1000,
+      currency: "usd",
+      metadata: { orderId: "123" },
+    });
+
+    expect(result.id).toBe("pi_abc123");
+    expect(result.clientSecret).toBe("secret_fake");
+    expect(result.status).toBe("requires_payment_method");
+    expect(result.amount).toBe(1000);
+    expect(result.currency).toBe("usd");
+  });
+
+  it("refunds a payment", async () => {
+    mockStripe.refunds.create.mockResolvedValue({
+      id: "rf_abc123",
+      status: "succeeded",
+      amount: 500,
+    });
+
+    const result = await adapter.refundPayment({
+      paymentId: "pi_abc123",
+      amount: 500,
+    });
+
+    expect(result.id).toBe("rf_abc123");
+    expect(result.status).toBe("succeeded");
+    expect(result.amount).toBe(500);
+  });
+
+  it("gets payment status", async () => {
+    mockStripe.paymentIntents.retrieve.mockResolvedValue({
+      id: "pi_abc123",
+      status: "succeeded",
+      amount: 1000,
+      currency: "usd",
+    });
+
+    const result = await adapter.getPaymentStatus("pi_abc123");
+
+    expect(result.id).toBe("pi_abc123");
+    expect(result.status).toBe("paid");
+    expect(result.amount).toBe(1000);
+    expect(result.currency).toBe("usd");
+  });
+
+  it("verifies webhook", async () => {
+    mockStripe.webhooks.constructEvent.mockReturnValue({
+      type: "payment_intent.succeeded",
+      data: { object: { id: "pi_abc123" } },
+    });
+
+    const result = await adapter.verifyWebhook(Buffer.from("{}"), "signature");
+
+    expect(result.event).toBe("payment_intent.succeeded");
+    expect(result.data.id).toBe("pi_abc123");
+  });
+
+  it("throws WEBHOOK_INVALID on bad signature", async () => {
+    mockStripe.webhooks.constructEvent.mockImplementation(() => {
+      throw new Error("Invalid signature");
+    });
+
+    await expect(
+      adapter.verifyWebhook(Buffer.from("{}"), "bad"),
+    ).rejects.toThrow(PaymentError);
+    await expect(
+      adapter.verifyWebhook(Buffer.from("{}"), "bad"),
+    ).rejects.toMatchObject({
+      code: "WEBHOOK_INVALID",
+      statusCode: 401,
+    });
+  });
+
+  it("throws CONFIG_ERROR when secretKey missing", () => {
+    expect(() => new StripeAdapter({ webhookSecret: "whsec_fake" })).toThrow(
+      PaymentError,
+    );
+    expect(
+      () => new StripeAdapter({ webhookSecret: "whsec_fake" }),
+    ).toMatchObject({
+      code: "CONFIG_ERROR",
+    });
+  });
+
+  it("throws CONFIG_ERROR when webhookSecret missing", () => {
+    expect(() => new StripeAdapter({ secretKey: "sk_test_fake" })).toThrow(
+      PaymentError,
+    );
+    expect(
+      () => new StripeAdapter({ secretKey: "sk_test_fake" }),
+    ).toMatchObject({
+      code: "CONFIG_ERROR",
+    });
+  });
+});

package/packages/payments/src/__tests__/payments.service.test.js

@@ -0,0 +1,131 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import * as paymentsService from "../services/payments.service.js";
+import { PaymentError } from "../errors/PaymentError.js";
+
+vi.mock("../adapters/StripeAdapter.js");
+vi.mock("../adapters/LemonSqueezyAdapter.js");
+
+describe("payments.service", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    paymentsService.resetAdapter();
+    delete process.env.PAYMENT_PROVIDER;
+    delete process.env.STRIPE_SECRET_KEY;
+    delete process.env.STRIPE_WEBHOOK_SECRET;
+    delete process.env.LEMONSQUEEZY_API_KEY;
+    delete process.env.LEMONSQUEEZY_WEBHOOK_SECRET;
+    delete process.env.LEMONSQUEEZY_STORE_ID;
+  });
+
+  it("getAdapter returns StripeAdapter when PAYMENT_PROVIDER=stripe", () => {
+    process.env.PAYMENT_PROVIDER = "stripe";
+    process.env.STRIPE_SECRET_KEY = "sk_test_fake";
+    process.env.STRIPE_WEBHOOK_SECRET = "whsec_fake";
+
+    const adapter = paymentsService.getAdapter();
+    expect(
+      vi.mocked(require("../adapters/StripeAdapter.js")).StripeAdapter,
+    ).toHaveBeenCalledWith({
+      secretKey: "sk_test_fake",
+      webhookSecret: "whsec_fake",
+    });
+  });
+
+  it("getAdapter returns LemonSqueezyAdapter when PAYMENT_PROVIDER=lemonsqueezy", () => {
+    process.env.PAYMENT_PROVIDER = "lemonsqueezy";
+    process.env.LEMONSQUEEZY_API_KEY = "api_fake";
+    process.env.LEMONSQUEEZY_WEBHOOK_SECRET = "secret_fake";
+    process.env.LEMONSQUEEZY_STORE_ID = "123";
+
+    const adapter = paymentsService.getAdapter();
+    expect(
+      vi.mocked(require("../adapters/LemonSqueezyAdapter.js"))
+        .LemonSqueezyAdapter,
+    ).toHaveBeenCalledWith({
+      apiKey: "api_fake",
+      webhookSecret: "secret_fake",
+      storeId: "123",
+    });
+  });
+
+  it("getAdapter throws PROVIDER_NOT_CONFIGURED when env var not set", () => {
+    expect(() => paymentsService.getAdapter()).toThrow(PaymentError);
+    expect(() => paymentsService.getAdapter()).toMatchObject({
+      code: "PROVIDER_NOT_CONFIGURED",
+    });
+  });
+
+  it("getAdapter throws CONFIG_ERROR for unknown provider", () => {
+    process.env.PAYMENT_PROVIDER = "unknown";
+    expect(() => paymentsService.getAdapter()).toThrow(PaymentError);
+    expect(() => paymentsService.getAdapter()).toMatchObject({
+      code: "CONFIG_ERROR",
+    });
+  });
+
+  it("getAdapter caches instance", () => {
+    process.env.PAYMENT_PROVIDER = "stripe";
+    process.env.STRIPE_SECRET_KEY = "sk_test_fake";
+    process.env.STRIPE_WEBHOOK_SECRET = "whsec_fake";
+
+    const adapter1 = paymentsService.getAdapter();
+    const adapter2 = paymentsService.getAdapter();
+    expect(adapter1).toBe(adapter2);
+  });
+
+  it("resetAdapter creates new instance", () => {
+    process.env.PAYMENT_PROVIDER = "stripe";
+    process.env.STRIPE_SECRET_KEY = "sk_test_fake";
+    process.env.STRIPE_WEBHOOK_SECRET = "whsec_fake";
+
+    const adapter1 = paymentsService.getAdapter();
+    paymentsService.resetAdapter();
+    const adapter2 = paymentsService.getAdapter();
+    expect(adapter1).not.toBe(adapter2);
+  });
+
+  it("processWebhook returns duplicate: false on first call", async () => {
+    process.env.PAYMENT_PROVIDER = "stripe";
+    process.env.STRIPE_SECRET_KEY = "sk_test_fake";
+    process.env.STRIPE_WEBHOOK_SECRET = "whsec_fake";
+
+    const mockAdapter = {
+      verifyWebhook: vi.fn().mockResolvedValue({
+        event: "payment_intent.succeeded",
+        data: { id: "pi_123" },
+      }),
+    };
+    vi.mocked(
+      require("../adapters/StripeAdapter.js"),
+    ).StripeAdapter.mockReturnValue(mockAdapter);
+
+    const result = await paymentsService.processWebhook(
+      Buffer.from("{}"),
+      "sig",
+    );
+    expect(result.duplicate).toBe(false);
+  });
+
+  it("processWebhook returns duplicate: true on second call", async () => {
+    process.env.PAYMENT_PROVIDER = "stripe";
+    process.env.STRIPE_SECRET_KEY = "sk_test_fake";
+    process.env.STRIPE_WEBHOOK_SECRET = "whsec_fake";
+
+    const mockAdapter = {
+      verifyWebhook: vi.fn().mockResolvedValue({
+        event: "payment_intent.succeeded",
+        data: { id: "pi_123" },
+      }),
+    };
+    vi.mocked(
+      require("../adapters/StripeAdapter.js"),
+    ).StripeAdapter.mockReturnValue(mockAdapter);
+
+    await paymentsService.processWebhook(Buffer.from("{}"), "sig");
+    const result = await paymentsService.processWebhook(
+      Buffer.from("{}"),
+      "sig",
+    );
+    expect(result.duplicate).toBe(true);
+  });
+});

package/packages/payments/src/__tests__/webhookUtils.test.js

@@ -0,0 +1,47 @@
+import { describe, it, expect } from "vitest";
+import {
+  getWebhookSignatureHeader,
+  extractSignature,
+} from "../helpers/webhookUtils.js";
+import { PaymentError } from "../errors/PaymentError.js";
+
+describe("webhookUtils", () => {
+  describe("getWebhookSignatureHeader", () => {
+    it("returns stripe-signature for stripe", () => {
+      expect(getWebhookSignatureHeader("stripe")).toBe("stripe-signature");
+    });
+
+    it("returns x-signature for lemonsqueezy", () => {
+      expect(getWebhookSignatureHeader("lemonsqueezy")).toBe("x-signature");
+    });
+
+    it("throws PaymentError for unknown provider", () => {
+      expect(() => getWebhookSignatureHeader("unknown")).toThrow(PaymentError);
+      expect(() => getWebhookSignatureHeader("unknown")).toMatchObject({
+        code: "CONFIG_ERROR",
+      });
+    });
+  });
+
+  describe("extractSignature", () => {
+    it("returns header value when present", () => {
+      const req = {
+        headers: {
+          "stripe-signature": "t=123,v1=abc",
+        },
+      };
+      expect(extractSignature(req, "stripe")).toBe("t=123,v1=abc");
+    });
+
+    it("throws WEBHOOK_INVALID when header missing", () => {
+      const req = {
+        headers: {},
+      };
+      expect(() => extractSignature(req, "stripe")).toThrow(PaymentError);
+      expect(() => extractSignature(req, "stripe")).toMatchObject({
+        code: "WEBHOOK_INVALID",
+        statusCode: 401,
+      });
+    });
+  });
+});

package/packages/payments/src/adapters/LemonSqueezyAdapter.js

@@ -0,0 +1,150 @@
+import {
+  lemonSqueezySetup,
+  createCheckout,
+  getOrder,
+} from "@lemonsqueezy/lemonsqueezy.js";
+import { createHmac } from "crypto";
+import { PaymentAdapter } from "./PaymentAdapter.js";
+import { PaymentError } from "../errors/PaymentError.js";
+
+export class LemonSqueezyAdapter extends PaymentAdapter {
+  #apiKey;
+  #webhookSecret;
+  #storeId;
+
+  constructor({ apiKey, webhookSecret, storeId }) {
+    super();
+    if (!apiKey) {
+      throw new PaymentError(
+        "LemonSqueezy API key is required",
+        "CONFIG_ERROR",
+      );
+    }
+    if (!webhookSecret) {
+      throw new PaymentError(
+        "LemonSqueezy webhook secret is required",
+        "CONFIG_ERROR",
+      );
+    }
+    if (!storeId) {
+      throw new PaymentError(
+        "LemonSqueezy store ID is required",
+        "CONFIG_ERROR",
+      );
+    }
+    this.#apiKey = apiKey;
+    this.#webhookSecret = webhookSecret;
+    this.#storeId = storeId;
+    lemonSqueezySetup({ apiKey });
+  }
+
+  async createPayment({ amount, currency, metadata = {} }) {
+    if (!metadata.variantId) {
+      throw new PaymentError(
+        "variantId is required in metadata for LemonSqueezy",
+        "MISSING_VARIANT_ID",
+      );
+    }
+    try {
+      const checkout = await createCheckout(this.#storeId, metadata.variantId, {
+        checkoutOptions: {
+          embed: false,
+          media: false,
+          logo: false,
+        },
+        checkoutData: {
+          custom: metadata,
+        },
+      });
+      if (checkout.error) {
+        throw new PaymentError(
+          `LemonSqueezy checkout failed: ${checkout.error.message}`,
+          "LS_CHECKOUT_FAILED",
+        );
+      }
+      return {
+        id: String(checkout.data.data.id),
+        checkoutUrl: checkout.data.data.attributes.url,
+        status: "created",
+        amount,
+        currency,
+        metadata: checkout.data,
+      };
+    } catch (error) {
+      if (error instanceof PaymentError) throw error;
+      throw new PaymentError(
+        `LemonSqueezy createPayment failed: ${error.message}`,
+        "LS_CHECKOUT_FAILED",
+      );
+    }
+  }
+
+  async refundPayment({ paymentId, amount }) {
+    try {
+      // LemonSqueezy SDK v4 requires manual refund creation via API
+      // This is a placeholder implementation - full refund support requires
+      // direct API calls with authentication
+      throw new PaymentError(
+        "LemonSqueezy refunds require manual implementation with API client",
+        "LS_REFUND_NOT_SUPPORTED",
+      );
+    } catch (error) {
+      if (error instanceof PaymentError) throw error;
+      throw new PaymentError(
+        `LemonSqueezy refundPayment failed: ${error.message}`,
+        "LS_REFUND_FAILED",
+      );
+    }
+  }
+
+  async getPaymentStatus(paymentId) {
+    try {
+      const order = await getOrder(paymentId);
+      if (order.error) {
+        throw new PaymentError(
+          `LemonSqueezy order not found: ${order.error.message}`,
+          "LS_ORDER_NOT_FOUND",
+        );
+      }
+      const statusMap = {
+        paid: "paid",
+        pending: "pending",
+        failed: "failed",
+        refunded: "refunded",
+      };
+      const normalizedStatus =
+        statusMap[order.data.data.attributes.status] || "pending";
+      return {
+        id: String(order.data.data.id),
+        status: normalizedStatus,
+        amount: order.data.data.attributes.total,
+        currency: order.data.data.attributes.currency,
+        metadata: order.data,
+      };
+    } catch (error) {
+      if (error instanceof PaymentError) throw error;
+      throw new PaymentError(
+        `LemonSqueezy getPaymentStatus failed: ${error.message}`,
+        "LS_ORDER_NOT_FOUND",
+      );
+    }
+  }
+
+  async verifyWebhook(rawBody, signature) {
+    const expectedSignature = createHmac("sha256", this.#webhookSecret)
+      .update(rawBody)
+      .digest("hex");
+    if (signature !== expectedSignature) {
+      throw new PaymentError(
+        "Invalid webhook signature",
+        "WEBHOOK_INVALID",
+        401,
+      );
+    }
+    const payload = JSON.parse(rawBody.toString());
+    return {
+      event: payload.meta.event_name,
+      data: payload.data,
+    };
+  }
+}