payment-kit 1.20.20 → 1.20.22

package/api/src/routes/vendor.ts

@@ -146,13 +146,19 @@ async function createVendor(req: any, res: any) {
       vendor_type: type,
       name,
       description,
-      app_url: appUrl,
       metadata,
       app_pid: appPid,
       app_logo: appLogo,
       status,
     } = value;
 
+    let appUrl = '';
+    try {
+      appUrl = new URL(value.app_url).origin;
+    } catch {
+      return res.status(400).json({ error: 'Invalid app URL' });
+    }
+
     const vendorType = (type || 'launcher') as 'launcher' | 'didnames';
     const vendorDid = VENDOR_DID[vendorType];
 
@@ -215,16 +221,14 @@ async function updateVendor(req: any, res: any) {
       });
     }
 
-    const {
-      vendor_type: type,
-      name,
-      description,
-      app_url: appUrl,
-      status,
-      metadata,
-      app_pid: appPid,
-      app_logo: appLogo,
-    } = value;
+    const { vendor_type: type, name, description, status, metadata, app_pid: appPid, app_logo: appLogo } = value;
+
+    let appUrl = '';
+    try {
+      appUrl = new URL(value.app_url).origin;
+    } catch {
+      return res.status(400).json({ error: 'Invalid app URL' });
+    }
 
     const vendorType = (type || 'launcher') as 'launcher' | 'didnames';
     const vendorDid = VENDOR_DID[vendorType];
@@ -312,42 +316,46 @@ async function testVendorConnection(req: any, res: any) {
   }
 }
 
-const getVendorById = async (vendorId: string, orderId: string) => {
+async function executeVendorOperation(vendorId: string, orderId: string, operation: 'getOrder' | 'getOrderStatus') {
   if (!vendorId || !orderId) {
-    throw new Error(`vendorId or orderId is required, vendorId: ${vendorId}, orderId: ${orderId}`);
+    return {
+      error: 'Bad Request',
+      message: `vendorId or orderId is required, vendorId: ${vendorId}, orderId: ${orderId}`,
+      code: 400,
+    };
   }
 
   const vendor = await ProductVendor.findByPk(vendorId);
   if (!vendor) {
-    throw new Error(`vendor not found, vendorId: ${vendorId}`);
-  }
-
-  const vendorAdapter = await VendorFulfillmentService.getVendorAdapter(vendor.vendor_key);
-
-  const data = await vendorAdapter.getOrder(vendor, orderId);
-
-  return data;
-};
-
-async function getVendorStatusById(vendorId: string, orderId: string) {
-  if (!vendorId || !orderId) {
-    throw new Error(`vendorId or orderId is required, vendorId: ${vendorId}, orderId: ${orderId}`);
+    return {
+      error: 'Not Found',
+      message: `vendor not found, vendorId: ${vendorId}`,
+      code: 404,
+    };
   }
 
-  const vendor = await ProductVendor.findByPk(vendorId);
+  try {
+    const vendorAdapter = await VendorFulfillmentService.getVendorAdapter(vendor.vendor_key);
+    const data = await vendorAdapter[operation](vendor, orderId);
 
-  if (!vendor) {
-    throw new Error(`vendor not found, vendorId: ${vendorId}`);
+    return { data: { ...data, vendorType: vendor.vendor_type }, code: 200 };
+  } catch (error: any) {
+    const operationName = operation === 'getOrder' ? 'order' : 'order status';
+    logger.error(`Failed to get vendor ${operationName}`, {
+      error,
+      vendorId,
+      orderId,
+      vendorKey: vendor.vendor_key,
+    });
+    return {
+      error: 'Service Unavailable',
+      message: `Failed to get vendor ${operationName}`,
+      code: 503,
+    };
   }
-
-  const vendorAdapter = await VendorFulfillmentService.getVendorAdapter(vendor.vendor_key);
-
-  const data = await vendorAdapter.getOrderStatus(vendor, orderId);
-
-  return { ...data, vendorType: vendor.vendor_type };
 }
 
-async function doRequestVendor(sessionId: string, func: (vendorId: string, orderId: string) => Promise<any>) {
+async function processVendorOrders(sessionId: string, operation: 'getOrder' | 'getOrderStatus') {
   const doc = await CheckoutSession.findByPk(sessionId);
 
   if (!doc) {
@@ -378,8 +386,39 @@ async function doRequestVendor(sessionId: string, func: (vendorId: string, order
     };
   }
 
-  const vendors = doc.vendor_info.map((item) => {
-    return func(item.vendor_id, item.order_id);
+  const vendors = doc.vendor_info.map(async (item) => {
+    if (!item.order_id) {
+      return {
+        key: item.vendor_key,
+        progress: 0,
+        status: 'pending',
+        vendorType: item.vendor_type,
+        appUrl: item.app_url,
+      };
+    }
+
+    const result = await executeVendorOperation(item.vendor_id, item.order_id, operation);
+
+    // Handle error responses from vendor functions
+    if (result.error) {
+      logger.warn('Vendor operation returned error', {
+        vendorId: item.vendor_id,
+        orderId: item.order_id,
+        operation,
+        error: result.error,
+        message: result.message,
+      });
+      return {
+        key: item.vendor_key,
+        error: result.error,
+        message: result.message,
+        status: 'error',
+        vendorType: item.vendor_type,
+        appUrl: item.app_url,
+      };
+    }
+
+    return result.data;
   });
 
   return {
@@ -392,7 +431,7 @@ async function doRequestVendor(sessionId: string, func: (vendorId: string, order
 }
 
 async function getVendorStatus(sessionId: string) {
-  const result: any = await doRequestVendor(sessionId, getVendorStatusById);
+  const result: any = await processVendorOrders(sessionId, 'getOrderStatus');
 
   if (result.subscriptionId) {
     const subscriptionUrl = getUrl(`/customer/subscription/${result.subscriptionId}`);
@@ -407,10 +446,6 @@ async function getVendorStatus(sessionId: string) {
   return result;
 }
 
-function getVendor(sessionId: string) {
-  return doRequestVendor(sessionId, getVendorById);
-}
-
 async function getVendorFulfillmentStatus(req: any, res: any) {
   const { sessionId } = req.params;
 
@@ -430,7 +465,7 @@ async function getVendorFulfillmentDetail(req: any, res: any) {
   const { sessionId } = req.params;
 
   try {
-    const detail = await getVendor(sessionId);
+    const detail = await processVendorOrders(sessionId, 'getOrder');
     if (detail.code) {
       return res.status(detail.code).json({ error: detail.error });
     }
@@ -461,17 +496,28 @@ async function redirectToVendor(req: any, res: any) {
       return res.redirect('/404');
     }
 
-    const detail = await getVendorById(vendorId, order.order_id || '');
-    if (!detail) {
+    const isOwner = req.user.did === checkoutSession.customer_did;
+
+    if (!isOwner) {
+      if (order.app_url) {
+        return res.redirect(order.app_url);
+      }
+      return res.redirect('/404');
+    }
+
+    const result = await executeVendorOperation(vendorId, order.order_id || '', 'getOrder');
+    if (result.error || !result.data) {
       logger.warn('Vendor status detail not found', {
         subscriptionId,
         vendorId,
         orderId: order.order_id,
+        error: result.error,
+        message: result.message,
       });
       return res.redirect('/404');
     }
 
-    const redirectUrl = target === 'dashboard' ? detail.dashboardUrl : detail.homeUrl;
+    const redirectUrl = target === 'dashboard' ? result.data.dashboardUrl : result.data.homeUrl;
     return res.redirect(redirectUrl);
   } catch (error: any) {
     logger.error('Failed to redirect to vendor service', {

package/api/src/store/migrations/20250926-change-customer-did-unique.ts

@@ -0,0 +1,49 @@
+/* eslint-disable no-console */
+import { DataTypes, QueryTypes } from 'sequelize';
+import { Migration } from '../migrate';
+
+export const up: Migration = async ({ context }) => {
+  try {
+    await context.changeColumn('customers', 'did', {
+      type: DataTypes.STRING(40),
+      allowNull: false,
+      unique: true,
+    });
+
+    console.log('Successfully added unique constraint to customers.did');
+  } catch (error) {
+    try {
+      const duplicates = await context.sequelize.query(
+        `SELECT did, COUNT(*) as count 
+         FROM customers 
+         GROUP BY did 
+         HAVING COUNT(*) > 1
+         LIMIT 5`,
+        { type: QueryTypes.SELECT }
+      );
+
+      if (duplicates.length > 0) {
+        console.warn('Found duplicate DIDs in customers table (showing first 5):', duplicates);
+        console.warn('Skipping unique constraint addition. Please clean up duplicate data manually if needed.');
+      } else {
+        console.error('Failed to add unique constraint for unknown reason:', error.message);
+      }
+    } catch (checkError) {
+      console.error('Failed to check for duplicates:', checkError.message);
+    }
+  }
+};
+
+export const down: Migration = async ({ context }) => {
+  try {
+    await context.changeColumn('customers', 'did', {
+      type: DataTypes.STRING(40),
+      allowNull: false,
+      unique: false,
+    });
+
+    console.log('Successfully removed unique constraint from customers.did');
+  } catch (error) {
+    console.warn('Failed to remove unique constraint from customers.did:', error.message);
+  }
+};

package/api/src/store/models/checkout-session.ts

@@ -220,6 +220,7 @@ export class CheckoutSession extends Model<InferAttributes<CheckoutSession>, Inf
   declare vendor_info?: Array<{
     vendor_id: string;
     vendor_key: string;
+    vendor_type: string;
     order_id: string;
     status:
       | 'pending'

package/api/src/store/models/customer.ts

@@ -81,6 +81,7 @@ export class Customer extends Model<InferAttributes<Customer>, InferCreationAttr
     did: {
       type: DataTypes.STRING(40),
       allowNull: false,
+      unique: true,
     },
     address: {
       type: DataTypes.JSON,

package/api/tests/libs/coupon.spec.ts

@@ -0,0 +1,219 @@
+import {
+  validCoupon,
+  validPromotionCode,
+  calculateDiscountAmount,
+  checkPromotionCodeEligibility,
+  getValidDiscountsForSubscriptionBilling,
+  expandLineItemsWithCouponInfo,
+  expandDiscountsWithDetails,
+  createDiscountRecordsForCheckout,
+  updateSubscriptionDiscountReferences,
+} from '../../src/libs/discount/coupon';
+import { Coupon, Customer, Discount, PromotionCode, Subscription, PaymentCurrency } from '../../src/store/models';
+
+jest.mock('../../src/libs/logger', () => ({
+  __esModule: true,
+  default: { info: jest.fn(), warn: jest.fn(), error: jest.fn(), debug: jest.fn() },
+}));
+
+jest.mock('../../src/libs/event', () => ({ emitAsync: jest.fn() }));
+
+describe('libs/discount/coupon.ts', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
+  });
+
+  describe('validCoupon', () => {
+    it('rejects invalid or expired or fully redeemed coupon', () => {
+      expect(validCoupon({ valid: false } as any).valid).toBe(false);
+      const expired = Math.floor(Date.now() / 1000) - 10;
+      expect(validCoupon({ valid: true, redeem_by: expired } as any).valid).toBe(false);
+      expect(validCoupon({ valid: true, max_redemptions: 1, times_redeemed: 1 } as any).valid).toBe(false);
+    });
+
+    it('enforces applies_to products if provided', () => {
+      const coupon = { valid: true, applies_to: { products: ['p1'] } } as any;
+      const lineItems = [{ price: { product_id: 'p2' } }] as any;
+      const res = validCoupon(coupon, lineItems);
+      expect(res.valid).toBe(false);
+    });
+
+    it('passes when valid and applicable', () => {
+      const coupon = { valid: true } as any;
+      expect(validCoupon(coupon).valid).toBe(true);
+    });
+  });
+
+  describe('validPromotionCode', () => {
+    it('rejects inactive/expired/max redeemed', async () => {
+      const now = Math.floor(Date.now() / 1000);
+      await expect(validPromotionCode({ active: false } as any, {})).resolves.toEqual({
+        valid: false,
+        reason: expect.any(String),
+      });
+      await expect(validPromotionCode({ active: true, expires_at: now - 30 } as any, {})).resolves.toEqual({
+        valid: false,
+        reason: expect.any(String),
+      });
+      await expect(
+        validPromotionCode({ active: true, max_redemptions: 1, times_redeemed: 1 } as any, {})
+      ).resolves.toEqual({ valid: false, reason: expect.any(String) });
+    });
+
+    it('checks user restriction and first time transaction', async () => {
+      jest.spyOn(Customer, 'findByPkOrDid').mockResolvedValue({ did: 'did:user:1' } as any);
+      const pc: any = { active: true, verification_type: 'user_restricted', customer_dids: ['did:user:1'] };
+      await expect(validPromotionCode(pc, { customerId: 'c1' })).resolves.toEqual({ valid: true });
+
+      jest.spyOn(Discount, 'count').mockResolvedValue(1 as any);
+      const pc2: any = {
+        active: true,
+        restrictions: { first_time_transaction: true },
+      };
+      await expect(validPromotionCode(pc2, { customerId: 'c1' })).resolves.toEqual({
+        valid: false,
+        reason: expect.any(String),
+      });
+    });
+
+    it('checks minimum amount by currency', async () => {
+      jest.spyOn(PaymentCurrency, 'findByPk').mockResolvedValue({ id: 'usd', decimal: 2, symbol: 'USD' } as any);
+      const pc: any = {
+        active: true,
+        restrictions: { minimum_amount: '200', minimum_amount_currency: 'usd' },
+      };
+      await expect(validPromotionCode(pc, { amount: '100', currencyId: 'usd' })).resolves.toEqual({
+        valid: false,
+        reason: expect.stringContaining('minimum purchase'),
+      });
+    });
+  });
+
+  describe('calculateDiscountAmount', () => {
+    it('handles percent_off and amount_off with cap', () => {
+      expect(
+        calculateDiscountAmount({ percent_off: 25 } as any, '400', { id: 'usd', decimal: 2, symbol: 'USD' } as any)
+      ).toBe('100');
+
+      expect(
+        calculateDiscountAmount({ amount_off: '150', currency_id: 'usd' } as any, '100', {
+          id: 'usd',
+          decimal: 2,
+          symbol: 'USD',
+        } as any)
+      ).toBe('100');
+    });
+  });
+
+  describe('checkPromotionCodeEligibility', () => {
+    it('validates promotion and coupon together', async () => {
+      jest.spyOn(Coupon, 'findByPk').mockResolvedValue({ valid: true } as any);
+      jest.spyOn(Customer, 'findByPkOrDid').mockResolvedValue({ did: 'did:user:1' } as any);
+      jest.spyOn(PaymentCurrency, 'findByPk').mockResolvedValue({ id: 'usd', decimal: 2, symbol: 'USD' } as any);
+      jest.spyOn(Discount, 'count').mockResolvedValue(0 as any);
+      const couponModule = await import('../../src/libs/discount/coupon');
+      jest.spyOn(couponModule, 'validCoupon').mockReturnValue({ valid: true } as any);
+      const result = await checkPromotionCodeEligibility({
+        promotionCode: { active: true } as any,
+        couponId: 'c1',
+        customerId: 'u1',
+        amount: '100',
+        currencyId: 'usd',
+      });
+      expect(result.eligible).toBe(true);
+    });
+  });
+
+  describe('validateDiscountForBilling & getValidDiscountsForSubscriptionBilling', () => {
+    it('filters discounts by duration logic', async () => {
+      const now = Math.floor(Date.now() / 1000);
+      jest.spyOn(Discount, 'findAll').mockResolvedValue([
+        { id: 'd_once', coupon_id: 'c_once' },
+        { id: 'd_repired', coupon_id: 'c_repired', end: now - 1 },
+        { id: 'd_forever', coupon_id: 'c_forever' },
+      ] as any);
+
+      jest.spyOn(Coupon, 'findByPk').mockImplementation((id) => {
+        if (id === 'c_once') return { duration: 'once' } as any;
+        if (id === 'c_repired') return { duration: 'repeating' } as any;
+        return { duration: 'forever' } as any;
+      });
+
+      const { validDiscounts, expiredDiscounts } = await getValidDiscountsForSubscriptionBilling({
+        subscriptionId: 'sub_1',
+        customerId: 'u1',
+      });
+
+      expect(validDiscounts.map((d) => d.id)).toEqual(['d_forever']);
+      expect(expiredDiscounts.map((d) => d.id).sort()).toEqual(['d_once', 'd_repired'].sort());
+    });
+  });
+
+  describe('expandLineItemsWithCouponInfo & expandDiscountsWithDetails', () => {
+    it('expands discount info on line items', async () => {
+      jest.spyOn(Coupon, 'findByPk').mockResolvedValue({
+        id: 'c1',
+        name: 'c',
+        amount_off: '10',
+        percent_off: 0,
+        currency_id: 'usd',
+        duration: 'once',
+      } as any);
+      jest.spyOn(PromotionCode, 'findByPk').mockResolvedValue({ id: 'pc1', code: 'CODE1' } as any);
+
+      const items = [{ id: 'i1', discount_amounts: [{ amount: '10', coupon: 'c1' }] }] as any;
+
+      const res = await expandLineItemsWithCouponInfo(items, [{ coupon: 'c1', promotion_code: 'pc1' }], 'usd');
+      expect(res[0]?.discount_amounts[0]?.coupon.id).toBe('c1');
+      expect(res[0]?.discount_amounts[0]?.promotion_code.id).toBe('pc1');
+    });
+
+    it('expands discounts array with details', async () => {
+      jest.spyOn(Coupon, 'findByPk').mockResolvedValue({ id: 'c1', name: 'c' } as any);
+      jest.spyOn(PromotionCode, 'findByPk').mockResolvedValue({ id: 'pc1', code: 'CODE1' } as any);
+      const res = await expandDiscountsWithDetails([{ coupon: 'c1', promotion_code: 'pc1' }]);
+      expect(res[0].coupon_details.id).toBe('c1');
+      expect(res[0].promotion_code_details.id).toBe('pc1');
+    });
+  });
+
+  describe('createDiscountRecordsForCheckout & updateSubscriptionDiscountReferences', () => {
+    it('creates/updates records and usage counts per discount config', async () => {
+      const checkoutSession: any = {
+        id: 'cs_1',
+        discounts: [{ coupon: 'c1', promotion_code: 'pc1', discount_amount: '50' }],
+      };
+
+      jest.spyOn(Discount, 'findAll').mockResolvedValue([] as any);
+      jest.spyOn(Coupon, 'findByPk').mockResolvedValue({ id: 'c1', livemode: false, duration: 'once' } as any);
+      jest.spyOn(PromotionCode, 'findByPk').mockResolvedValue({ id: 'pc1', verification_type: 'none' } as any);
+      jest
+        .spyOn(Discount, 'create')
+        .mockImplementation(
+          (data: any) => Promise.resolve({ id: `d_${Date.now()}`, update: jest.fn(), ...data }) as any
+        );
+
+      // Stubs for usage update path
+      jest.spyOn(Coupon.prototype as any, 'update').mockResolvedValue(undefined);
+      jest.spyOn(PromotionCode.prototype as any, 'update').mockResolvedValue(undefined);
+
+      const { discountRecords, subscriptionsUpdated } = await createDiscountRecordsForCheckout({
+        checkoutSession,
+        customerId: 'u1',
+        subscriptionIds: ['sub_1'],
+      });
+
+      expect(discountRecords.length).toBeGreaterThan(0);
+      expect(subscriptionsUpdated).toEqual(['sub_1']);
+
+      // updateSubscriptionDiscountReferences
+      jest.spyOn(Subscription, 'update').mockResolvedValue([1] as any);
+      const { updatedSubscriptions } = await updateSubscriptionDiscountReferences({
+        discountRecords,
+        subscriptionsUpdated,
+      });
+      expect(updatedSubscriptions).toEqual(['sub_1']);
+    });
+  });
+});