fraim-hub 2.0.352 → 2.0.353

package/dist/src/api/payment/dashboard-link.js

@@ -6,6 +6,7 @@ const stripe_1 = require("../../config/stripe");
 const feature_flags_1 = require("../../config/feature-flags");
 const dashboard_access_1 = require("../../services/dashboard-access");
 const persona_entitlement_service_1 = require("../../services/persona-entitlement-service");
+const subscription_provisioning_1 = require("../../services/subscription-provisioning");
 function isCheckoutSessionReadyForDashboard(session) {
     const status = session.status;
     const paymentStatus = session.payment_status;
@@ -24,15 +25,14 @@ function getSessionSubscriptionId(session) {
     return typeof session.subscription === 'string' ? session.subscription : session.subscription.id;
 }
 async function resolveSessionEmail(session, customerId, customerRetriever) {
-    const customerDetailsEmail = session.customer_details?.email;
-    if (customerDetailsEmail)
-        return customerDetailsEmail.toLowerCase();
+    const customerDetailsEmail = (session.customer_details?.email || session.customer_email)?.trim().toLowerCase();
     if (!customerId)
         return null;
     try {
         const customer = await customerRetriever(customerId);
-        if (!('deleted' in customer) && customer.email) {
-            return customer.email.toLowerCase();
+        if (!('deleted' in customer) && customer.id === customerId && customer.email) {
+            const email = customer.email.trim().toLowerCase();
+            return !customerDetailsEmail || customerDetailsEmail === email ? email : null;
         }
     }
     catch {
@@ -40,21 +40,6 @@ async function resolveSessionEmail(session, customerId, customerRetriever) {
     }
     return null;
 }
-function extractSubscriptionPeriodEnd(subscription) {
-    if (!subscription)
-        return null;
-    const rootPeriodEnd = subscription.current_period_end;
-    if (typeof rootPeriodEnd === 'number' && rootPeriodEnd > 0) {
-        return new Date(rootPeriodEnd * 1000);
-    }
-    const itemEnds = (subscription.items?.data || [])
-        .map((item) => item?.current_period_end)
-        .filter((value) => typeof value === 'number' && value > 0);
-    if (itemEnds.length > 0) {
-        return new Date(Math.min(...itemEnds) * 1000);
-    }
-    return null;
-}
 async function resolveDashboardLinkForCheckoutSession(sessionId, dbService, deps = {}) {
     if (!sessionId || !sessionId.startsWith('cs_')) {
         return { ok: false, status: 400, error: 'Invalid session_id' };
@@ -75,11 +60,8 @@ async function resolveDashboardLinkForCheckoutSession(sessionId, dbService, deps
     const customerId = getSessionCustomerId(session);
     const subscriptionId = getSessionSubscriptionId(session);
     const email = await resolveSessionEmail(session, customerId, customerRetriever);
-    if ((0, feature_flags_1.isPersonaEntitlementsEnabled)() && session.metadata?.plan === 'persona-hire') {
-        await (0, persona_entitlement_service_1.syncPersonaEntitlementFromCheckoutSession)(dbService, {
-            ...session,
-            customer_details: session.customer_details || (email ? { email } : undefined)
-        }, 'dashboard-link');
+    if (!customerId || !email) {
+        return { ok: false, status: 409, error: 'Could not verify checkout customer identity' };
     }
     let subscription = null;
     if (subscriptionId) {
@@ -87,54 +69,46 @@ async function resolveDashboardLinkForCheckoutSession(sessionId, dbService, deps
             subscription = await subscriptionRetriever(subscriptionId);
         }
         catch (error) {
-            console.warn(`⚠️ Could not retrieve subscription ${subscriptionId} for dashboard link: ${error?.message || error}`);
+            return { ok: false, status: 503, error: 'Could not verify current subscription status' };
+        }
+        if (subscription.id !== subscriptionId || (0, subscription_provisioning_1.subscriptionCustomerId)(subscription) !== customerId) {
+            return { ok: false, status: 409, error: 'Checkout subscription customer does not match' };
+        }
+        if (['canceled', 'incomplete_expired'].includes(subscription.status)) {
+            return { ok: false, status: 409, error: 'Subscription is not active' };
         }
     }
-    const nextBillingDate = extractSubscriptionPeriodEnd(subscription);
-    let apiKey = customerId ? await dbService.getApiKeyByStripeCustomerId(customerId) : null;
-    if (!apiKey && email) {
-        apiKey = await dbService.getApiKeyByUserId(email);
+    if (!subscription && session.metadata?.plan === 'persona-hire') {
+        // A persona purchase does not grant general subscription access.
+        const apiKey = await dbService.getApiKeyByUserId(email, false);
+        if (!apiKey) {
+            return { ok: false, status: 404, error: 'Could not resolve account for persona purchase' };
+        }
+        if (apiKey.isActive === false || apiKey.revokedAt) {
+            return { ok: false, status: 403, error: 'Account credential has been revoked' };
+        }
+        if ((0, feature_flags_1.isPersonaEntitlementsEnabled)()) {
+            await (0, persona_entitlement_service_1.syncPersonaEntitlementFromCheckoutSession)(dbService, {
+                ...session, customer_details: { ...session.customer_details, email }
+            }, 'dashboard-link');
+        }
+        return { ok: true, dashboardUrl: await (0, dashboard_access_1.createDashboardAccessUrl)(dbService, email, apiKey.key) };
     }
-    if (apiKey) {
-        const updatePatch = {
-            tier: 'paid-subscription',
-            status: 'active',
-            expiresAt: null,
-        };
-        if (customerId)
-            updatePatch.stripeCustomerId = customerId;
-        if (subscriptionId)
-            updatePatch.stripeSubscriptionId = subscriptionId;
-        if (nextBillingDate)
-            updatePatch.currentPeriodEnd = nextBillingDate;
-        await dbService.updateApiKey(apiKey.key, updatePatch);
+    if (!subscription) {
+        return { ok: false, status: 409, error: 'Checkout session has no subscription' };
     }
-    else {
-        if (!email) {
-            return { ok: false, status: 404, error: 'Could not resolve customer email for session' };
-        }
-        const newKey = dbService.generateApiKey(email, 'default');
-        await dbService.createApiKey({
-            key: newKey,
-            userId: email,
-            orgId: 'default',
-            tier: 'paid-subscription',
-            status: 'active',
-            expiresAt: null,
-            stripeCustomerId: customerId,
-            stripeSubscriptionId: subscriptionId,
-            currentPeriodEnd: nextBillingDate,
-            cancelAt: null,
-            suspendedAt: null,
-            suspensionReason: null,
-            lastUsedAt: null,
-            apiCallCount: 0,
-            personaSystemActive: (0, feature_flags_1.isPersonaEntitlementsEnabled)() || undefined
-        });
-        apiKey = { key: newKey, userId: email };
+    let apiKey;
+    try {
+        apiKey = await (0, subscription_provisioning_1.provisionSubscriptionApiKey)(dbService, email, subscription, (0, subscription_provisioning_1.subscriptionPeriodEnd)(subscription));
+    }
+    catch {
+        return { ok: false, status: 503, error: 'Could not verify subscription payment' };
+    }
+    if (apiKey.isActive === false || apiKey.revokedAt) {
+        return { ok: false, status: 403, error: 'Account credential has been revoked' };
     }
-    if (!apiKey) {
-        return { ok: false, status: 500, error: 'Could not resolve API key for checkout session' };
+    if (apiKey.status !== 'active' || apiKey.stripeSubscriptionEndedAt) {
+        return { ok: false, status: 409, error: 'Subscription is no longer active' };
     }
     const dashboardUrl = await (0, dashboard_access_1.createDashboardAccessUrl)(dbService, apiKey.userId, apiKey.key);
     return { ok: true, dashboardUrl };