evaldoc 1.0.0

package/tests/integration/api-payment.test.js

@@ -0,0 +1,664 @@
+/**
+ * Integration tests for payment API endpoints.
+ *
+ * Tests the full HTTP request/response cycle for:
+ *   - Stripe Connect account creation & onboarding
+ *   - Pricing configuration
+ *   - Payment access enforcement on chat endpoints
+ *   - Checkout session creation
+ *   - Payment intent creation
+ *   - Revenue analytics & transactions
+ *   - Webhook handling
+ */
+
+process.env.NODE_ENV = 'test';
+
+jest.mock('firebase-admin', () => require('../mocks/firebase-admin'));
+
+// Mock Stripe SDK
+const mockStripe = {
+  accounts: {
+    create: jest.fn(),
+    retrieve: jest.fn()
+  },
+  accountLinks: {
+    create: jest.fn()
+  },
+  products: {
+    create: jest.fn()
+  },
+  prices: {
+    create: jest.fn()
+  },
+  customers: {
+    create: jest.fn()
+  },
+  checkout: {
+    sessions: {
+      create: jest.fn()
+    }
+  },
+  paymentIntents: {
+    create: jest.fn()
+  },
+  subscriptions: {
+    create: jest.fn(),
+    update: jest.fn()
+  },
+  webhooks: {
+    constructEvent: jest.fn()
+  }
+};
+
+jest.mock('stripe', () => jest.fn().mockReturnValue(mockStripe));
+jest.mock('../../functions/src/stripe-config', () => ({ stripe: mockStripe }));
+
+// Mock LLM clients
+jest.mock('openai', () => jest.fn().mockImplementation(() => ({
+  chat: { completions: { create: jest.fn().mockResolvedValue({ choices: [{ message: { content: 'mock response' } }] }) } }
+})));
+jest.mock('@google/generative-ai', () => ({
+  GoogleGenerativeAI: jest.fn().mockImplementation(() => ({
+    getGenerativeModel: () => ({
+      generateContent: jest.fn().mockResolvedValue({ response: { text: () => 'mock response' } })
+    })
+  }))
+}));
+
+process.env.DEEPSEEK_API_KEY = 'test-key';
+process.env.GEMINI_API_KEY = 'test-key';
+process.env.STRIPE_PUBLISHABLE_KEY = 'pk_test_123';
+process.env.STRIPE_WEBHOOK_SECRET = 'whsec_test';
+
+const request = require('supertest');
+const admin = require('firebase-admin');
+
+// Setup auth mock
+admin.auth().verifyIdToken = jest.fn(async (token) => {
+  if (token === 'doctor-token') return { uid: 'doctor-uid-1', email: 'doc@test.com' };
+  if (token === 'patient-token') return { uid: 'patient-uid-1', email: 'patient@test.com' };
+  throw new Error('Invalid token');
+});
+
+const app = require('../../server');
+
+describe('Payment API Endpoints', () => {
+  beforeEach(() => {
+    admin.__reset();
+    jest.clearAllMocks();
+
+    // Seed a published provider
+    admin.__seed('providers', 'doctor-uid-1', {
+      ownerUid: 'doctor-uid-1',
+      handle: 'drtest',
+      displayName: 'Dr. Test',
+      status: 'published',
+      country: 'US',
+      enabledTopics: ['general_health_info'],
+      pricingModel: 'free',
+      paymentEnabled: false,
+      stripeAccountId: null,
+      chargesEnabled: false,
+      payoutsEnabled: false,
+      monthlyChatCount: 0,
+      monthlyLimit: 100,
+      monthlyChatCountMonth: null
+    });
+  });
+
+  // ============================================
+  // STRIPE CONNECT ENDPOINTS
+  // ============================================
+
+  describe('POST /api/stripe/create-connect-account', () => {
+    it('should create a Connect account for authenticated provider', async () => {
+      mockStripe.accounts.create.mockResolvedValue({
+        id: 'acct_test_123',
+        charges_enabled: false,
+        payouts_enabled: false
+      });
+
+      const res = await request(app)
+        .post('/api/stripe/create-connect-account')
+        .set('Authorization', 'Bearer doctor-token')
+        .send();
+
+      expect(res.status).toBe(200);
+      expect(res.body.accountId).toBe('acct_test_123');
+      expect(res.body.onboardingStatus).toBe('PENDING');
+    });
+
+    it('should return existing account if already created', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        ownerUid: 'doctor-uid-1',
+        handle: 'drtest',
+        stripeAccountId: 'acct_existing',
+        stripeOnboardingStatus: 'COMPLETE'
+      });
+
+      const res = await request(app)
+        .post('/api/stripe/create-connect-account')
+        .set('Authorization', 'Bearer doctor-token')
+        .send();
+
+      expect(res.status).toBe(200);
+      expect(res.body.accountId).toBe('acct_existing');
+      expect(mockStripe.accounts.create).not.toHaveBeenCalled();
+    });
+
+    it('should reject unauthenticated requests', async () => {
+      const res = await request(app)
+        .post('/api/stripe/create-connect-account')
+        .send();
+
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('POST /api/stripe/create-account-link', () => {
+    it('should generate onboarding link', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        ownerUid: 'doctor-uid-1',
+        handle: 'drtest',
+        stripeAccountId: 'acct_test_123'
+      });
+
+      mockStripe.accountLinks.create.mockResolvedValue({
+        url: 'https://connect.stripe.com/onboarding',
+        expires_at: 9999999999
+      });
+
+      const res = await request(app)
+        .post('/api/stripe/create-account-link')
+        .set('Authorization', 'Bearer doctor-token')
+        .send();
+
+      expect(res.status).toBe(200);
+      expect(res.body.url).toBe('https://connect.stripe.com/onboarding');
+    });
+
+    it('should fail if no Stripe account exists', async () => {
+      const res = await request(app)
+        .post('/api/stripe/create-account-link')
+        .set('Authorization', 'Bearer doctor-token')
+        .send();
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toContain('No Stripe Connect account');
+    });
+  });
+
+  describe('POST /api/stripe/set-pricing', () => {
+    it('should set pricing when Stripe account is ready', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        ownerUid: 'doctor-uid-1',
+        handle: 'drtest',
+        displayName: 'Dr. Test',
+        stripeAccountId: 'acct_123',
+        chargesEnabled: true
+      });
+
+      mockStripe.products.create.mockResolvedValue({ id: 'prod_123' });
+      mockStripe.prices.create.mockResolvedValue({ id: 'price_123' });
+
+      const res = await request(app)
+        .post('/api/stripe/set-pricing')
+        .set('Authorization', 'Bearer doctor-token')
+        .send({ currency: 'usd', prices: { month: 29.99 } });
+
+      expect(res.status).toBe(200);
+      expect(res.body.productId).toBe('prod_123');
+    });
+
+    it('should reject when Stripe account is not set up', async () => {
+      const res = await request(app)
+        .post('/api/stripe/set-pricing')
+        .set('Authorization', 'Bearer doctor-token')
+        .send({ prices: { month: 10 } });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toContain('Stripe Connect onboarding');
+    });
+
+    it('should reject when charges not enabled', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        ownerUid: 'doctor-uid-1',
+        handle: 'drtest',
+        stripeAccountId: 'acct_123',
+        chargesEnabled: false
+      });
+
+      const res = await request(app)
+        .post('/api/stripe/set-pricing')
+        .set('Authorization', 'Bearer doctor-token')
+        .send({ prices: { month: 10 } });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toContain('not yet approved');
+    });
+  });
+
+  // ============================================
+  // PAYMENT CONFIG & PRICING
+  // ============================================
+
+  describe('GET /api/payment/config/:handle', () => {
+    it('should return pricing config for a provider', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        handle: 'drtest',
+        status: 'published',
+        pricingModel: 'subscription',
+        subscriptionPrice: 29.99,
+        paymentEnabled: true,
+        currency: 'usd'
+      });
+
+      const res = await request(app)
+        .get('/api/payment/config/drtest');
+
+      expect(res.status).toBe(200);
+      expect(res.body.pricingModel).toBe('subscription');
+      expect(res.body.subscriptionPrice).toBe(29.99);
+      expect(res.body.paymentEnabled).toBe(true);
+      expect(res.body.stripePublishableKey).toBe('pk_test_123');
+    });
+
+    it('should return 404 for unknown handle', async () => {
+      const res = await request(app)
+        .get('/api/payment/config/unknown');
+
+      expect(res.status).toBe(404);
+    });
+  });
+
+  describe('POST /api/payment/update-pricing', () => {
+    it('should update pricing configuration', async () => {
+      const res = await request(app)
+        .post('/api/payment/update-pricing')
+        .set('Authorization', 'Bearer doctor-token')
+        .send({
+          pricingModel: 'subscription',
+          subscriptionPrice: 19.99,
+          paymentEnabled: true
+        });
+
+      expect(res.status).toBe(200);
+      expect(res.body.ok).toBe(true);
+    });
+
+    it('should reject invalid pricing model', async () => {
+      const res = await request(app)
+        .post('/api/payment/update-pricing')
+        .set('Authorization', 'Bearer doctor-token')
+        .send({ pricingModel: 'invalid_model' });
+
+      expect(res.status).toBe(400);
+    });
+
+    it('should reject out-of-range subscription price', async () => {
+      const res = await request(app)
+        .post('/api/payment/update-pricing')
+        .set('Authorization', 'Bearer doctor-token')
+        .send({ subscriptionPrice: 50000 });
+
+      expect(res.status).toBe(400);
+    });
+  });
+
+  // ============================================
+  // PAYMENT ACCESS ENFORCEMENT ON CHAT
+  // ============================================
+
+  describe('Payment enforcement on POST /api/chat', () => {
+    it('should allow chat when payment is not enabled', async () => {
+      const res = await request(app)
+        .post('/api/chat')
+        .send({
+          handle: 'drtest',
+          sessionId: 'sess_test',
+          message: 'Hello'
+        });
+
+      expect(res.status).toBe(200);
+      expect(res.body.response).toBeDefined();
+    });
+
+    it('should return 402 when payment is required and not paid', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        ownerUid: 'doctor-uid-1',
+        handle: 'drtest',
+        displayName: 'Dr. Test',
+        status: 'published',
+        enabledTopics: ['general_health_info'],
+        pricingModel: 'subscription',
+        paymentEnabled: true,
+        subscriptionPrice: 29.99,
+        currency: 'usd',
+        monthlyChatCount: 0,
+        monthlyLimit: 100,
+        monthlyChatCountMonth: null
+      });
+
+      const res = await request(app)
+        .post('/api/chat')
+        .send({
+          handle: 'drtest',
+          sessionId: 'sess_test',
+          message: 'Hello'
+        });
+
+      expect(res.status).toBe(402);
+      expect(res.body.paymentRequired).toBe(true);
+      expect(res.body.paymentConfig).toBeDefined();
+      expect(res.body.paymentConfig.pricingModel).toBe('subscription');
+      expect(res.body.paymentConfig.subscriptionPrice).toBe(29.99);
+    });
+
+    it('should allow chat when patient has active subscription', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        ownerUid: 'doctor-uid-1',
+        handle: 'drtest',
+        displayName: 'Dr. Test',
+        status: 'published',
+        enabledTopics: ['general_health_info'],
+        pricingModel: 'subscription',
+        paymentEnabled: true,
+        subscriptionPrice: 29.99,
+        monthlyChatCount: 0,
+        monthlyLimit: 100,
+        monthlyChatCountMonth: null
+      });
+
+      // Seed an active subscription
+      const futureDate = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+
+      // Patch Timestamp.now to support toMillis
+      const origNow = admin.firestore.Timestamp.now;
+      admin.firestore.Timestamp.now = () => ({
+        _seconds: Math.floor(Date.now() / 1000),
+        _nanoseconds: 0,
+        toMillis: () => Date.now()
+      });
+
+      admin.__seed('subscriptions', 'sub-1', {
+        providerId: 'doctor-uid-1',
+        patientId: 'sess_paid',
+        status: 'active',
+        currentPeriodEnd: {
+          _seconds: Math.floor(futureDate.getTime() / 1000),
+          toMillis: () => futureDate.getTime()
+        }
+      });
+
+      const res = await request(app)
+        .post('/api/chat')
+        .send({
+          handle: 'drtest',
+          sessionId: 'sess_paid',
+          message: 'Hello'
+        });
+
+      expect(res.status).toBe(200);
+      expect(res.body.response).toBeDefined();
+
+      admin.firestore.Timestamp.now = origNow;
+    });
+  });
+
+  // ============================================
+  // CHECKOUT & PAYMENT INTENT ENDPOINTS
+  // ============================================
+
+  describe('POST /api/payment/create-checkout-session', () => {
+    it('should create checkout session for valid provider', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        handle: 'drtest',
+        stripeAccountId: 'acct_123',
+        chargesEnabled: true,
+        stripePriceIds: { month: 'price_123' }
+      });
+
+      mockStripe.customers.create.mockResolvedValue({ id: 'cus_123' });
+      mockStripe.checkout.sessions.create.mockResolvedValue({
+        id: 'cs_test',
+        url: 'https://checkout.stripe.com/cs_test'
+      });
+
+      const res = await request(app)
+        .post('/api/payment/create-checkout-session')
+        .send({
+          handle: 'drtest',
+          sessionId: 'sess_123',
+          interval: 'month'
+        });
+
+      expect(res.status).toBe(200);
+      expect(res.body.url).toBe('https://checkout.stripe.com/cs_test');
+    });
+
+    it('should reject when provider has no Stripe account', async () => {
+      const res = await request(app)
+        .post('/api/payment/create-checkout-session')
+        .send({
+          handle: 'drtest',
+          sessionId: 'sess_123',
+          interval: 'month'
+        });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toContain('not set up payments');
+    });
+
+    it('should reject missing required fields', async () => {
+      const res = await request(app)
+        .post('/api/payment/create-checkout-session')
+        .send({ handle: 'drtest' });
+
+      expect(res.status).toBe(400);
+    });
+  });
+
+  describe('POST /api/payment/create-intent', () => {
+    it('should create payment intent with Connect', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        handle: 'drtest',
+        paymentEnabled: true,
+        perChatPrice: 5,
+        currency: 'usd',
+        stripeAccountId: 'acct_123',
+        chargesEnabled: true
+      });
+
+      mockStripe.paymentIntents.create.mockResolvedValue({
+        id: 'pi_123',
+        client_secret: 'pi_123_secret'
+      });
+
+      const res = await request(app)
+        .post('/api/payment/create-intent')
+        .send({
+          handle: 'drtest',
+          sessionId: 'sess_123'
+        });
+
+      expect(res.status).toBe(200);
+      expect(res.body.clientSecret).toBe('pi_123_secret');
+    });
+
+    it('should reject when per-chat payment not enabled', async () => {
+      const res = await request(app)
+        .post('/api/payment/create-intent')
+        .send({
+          handle: 'drtest',
+          sessionId: 'sess_123'
+        });
+
+      expect(res.status).toBe(400);
+    });
+
+    it('should reject when provider has no Stripe account', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        handle: 'drtest',
+        paymentEnabled: true,
+        perChatPrice: 5
+      });
+
+      const res = await request(app)
+        .post('/api/payment/create-intent')
+        .send({
+          handle: 'drtest',
+          sessionId: 'sess_123'
+        });
+
+      expect(res.status).toBe(400);
+      expect(res.body.error).toContain('not set up payments');
+    });
+  });
+
+  // ============================================
+  // ACCESS CHECK ENDPOINT
+  // ============================================
+
+  describe('POST /api/payment/check-access', () => {
+    it('should return hasAccess: true for free providers', async () => {
+      const res = await request(app)
+        .post('/api/payment/check-access')
+        .send({
+          handle: 'drtest',
+          sessionId: 'sess_123'
+        });
+
+      expect(res.status).toBe(200);
+      expect(res.body.hasAccess).toBe(true);
+      expect(res.body.type).toBe('free');
+    });
+
+    it('should return hasAccess: false for paid provider without payment', async () => {
+      admin.__seed('providers', 'doctor-uid-1', {
+        handle: 'drtest',
+        paymentEnabled: true,
+        pricingModel: 'subscription'
+      });
+
+      const res = await request(app)
+        .post('/api/payment/check-access')
+        .send({
+          handle: 'drtest',
+          sessionId: 'sess_123'
+        });
+
+      expect(res.status).toBe(200);
+      expect(res.body.hasAccess).toBe(false);
+    });
+
+    it('should reject missing fields', async () => {
+      const res = await request(app)
+        .post('/api/payment/check-access')
+        .send({ handle: 'drtest' });
+
+      expect(res.status).toBe(400);
+    });
+  });
+
+  // ============================================
+  // REVENUE & TRANSACTIONS
+  // ============================================
+
+  describe('GET /api/payment/revenue', () => {
+    it('should return revenue analytics for authenticated provider', async () => {
+      const res = await request(app)
+        .get('/api/payment/revenue')
+        .set('Authorization', 'Bearer doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body).toHaveProperty('totalRevenue');
+      expect(res.body).toHaveProperty('transactionCount');
+      expect(res.body).toHaveProperty('activeSubscriptions');
+    });
+
+    it('should reject unauthenticated requests', async () => {
+      const res = await request(app)
+        .get('/api/payment/revenue');
+
+      expect(res.status).toBe(401);
+    });
+  });
+
+  describe('GET /api/payment/transactions', () => {
+    it('should return transaction history', async () => {
+      admin.__seed('transactions', 'tx-1', {
+        providerId: 'doctor-uid-1',
+        amount: 2000,
+        status: 'succeeded',
+        createdAt: { toDate: () => new Date(), _seconds: Math.floor(Date.now() / 1000) }
+      });
+
+      const res = await request(app)
+        .get('/api/payment/transactions')
+        .set('Authorization', 'Bearer doctor-token');
+
+      expect(res.status).toBe(200);
+      expect(res.body.transactions).toBeDefined();
+    });
+  });
+
+  // ============================================
+  // SUBSCRIPTION MANAGEMENT
+  // ============================================
+
+  describe('POST /api/payment/cancel-subscription', () => {
+    it('should cancel subscription', async () => {
+      mockStripe.subscriptions.update.mockResolvedValue({
+        id: 'sub_123',
+        status: 'active',
+        cancel_at_period_end: true
+      });
+
+      admin.__seed('subscriptions', 'sub-1', {
+        stripeSubscriptionId: 'sub_123',
+        providerId: 'doctor-uid-1',
+        status: 'active'
+      });
+
+      const res = await request(app)
+        .post('/api/payment/cancel-subscription')
+        .set('Authorization', 'Bearer doctor-token')
+        .send({ subscriptionId: 'sub_123' });
+
+      expect(res.status).toBe(200);
+      expect(res.body.ok).toBe(true);
+    });
+
+    it('should reject cancelling a subscription owned by another provider (IDOR)', async () => {
+      admin.__seed('subscriptions', 'sub-foreign', {
+        stripeSubscriptionId: 'sub_foreign',
+        providerId: 'someone-else',
+        status: 'active'
+      });
+
+      const res = await request(app)
+        .post('/api/payment/cancel-subscription')
+        .set('Authorization', 'Bearer doctor-token')
+        .send({ subscriptionId: 'sub_foreign' });
+
+      expect(res.status).toBe(403);
+    });
+
+    it('should reject missing subscriptionId', async () => {
+      const res = await request(app)
+        .post('/api/payment/cancel-subscription')
+        .set('Authorization', 'Bearer doctor-token')
+        .send({});
+
+      expect(res.status).toBe(400);
+    });
+
+    it('should reject unauthenticated cancel requests', async () => {
+      const res = await request(app)
+        .post('/api/payment/cancel-subscription')
+        .send({ subscriptionId: 'sub_123' });
+
+      expect(res.status).toBe(401);
+    });
+  });
+});