responses-proxy 0.1.0

package/dist/telegram-bot/commands/renew.test.js

@@ -0,0 +1,1633 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { BillingRepository } from "../../billing.js";
+import { CustomerKeyRepository } from "../../customer-keys.js";
+import { AuditLogRepository } from "../../audit-log.js";
+import { BotIdentityRepository } from "../bot-identity-repository.js";
+import { CustomerWorkspaceRepository } from "../customer-workspace-repository.js";
+import { SqliteSessionStore } from "../sessions.js";
+import { registerRenewCommand } from "./renew.js";
+function createConfig(overrides = {}) {
+    return {
+        telegramBotToken: "token",
+        allowedUserIds: new Set(),
+        allowedChatIds: new Set(),
+        ownerUserIds: new Set(["1"]),
+        adminUserIds: new Set(),
+        botMode: "polling",
+        proxyAdminBaseUrl: "http://127.0.0.1:8318",
+        defaultModel: "gpt-5.5",
+        publicSignupEnabled: true,
+        requireAdminApproval: false,
+        defaultCustomerRoute: "customers",
+        publicResponsesBaseUrl: "http://127.0.0.1:8318/v1",
+        proxyRequestTimeoutMs: 30_000,
+        sessionDbPath: ":memory:",
+        sessionTtlMs: 900_000,
+        rateLimitWindowMs: 60_000,
+        rateLimitMaxRequests: 12,
+        logLevel: "info",
+        sepayAccountNumber: "8300138258001",
+        sepayBankCode: "MBBank",
+        sepayTemplate: "compact",
+        sepayDownload: false,
+        ...overrides,
+    };
+}
+function createMockProxyClient() {
+    let routeKeys = [];
+    return {
+        client: {
+            async getClientConfigs() {
+                return {
+                    clientRoutes: [{ key: "customers", apiKeys: [...routeKeys] }],
+                };
+            },
+            async setClientRouteApiKeys(input) {
+                if (input.client === "customers") {
+                    routeKeys = [...input.apiKeys];
+                }
+                return { ok: true };
+            },
+        },
+    };
+}
+function createBotHarness() {
+    const commandHandlers = new Map();
+    const messageTextHandlers = [];
+    const callbackHandlers = [];
+    return {
+        bot: {
+            command(name, handler) {
+                commandHandlers.set(name, handler);
+            },
+            callbackQuery(pattern, handler) {
+                callbackHandlers.push({ pattern, handler });
+            },
+            on(event, handler) {
+                if (event === "message:text") {
+                    messageTextHandlers.push(handler);
+                }
+            },
+        },
+        handler(name) {
+            const handler = commandHandlers.get(name);
+            assert.ok(handler);
+            return handler;
+        },
+        callbackHandler(data) {
+            for (const entry of callbackHandlers) {
+                if (typeof entry.pattern === "string") {
+                    if (entry.pattern === data) {
+                        return { handler: entry.handler, match: [data] };
+                    }
+                    continue;
+                }
+                const match = data.match(entry.pattern);
+                if (match) {
+                    return { handler: entry.handler, match };
+                }
+            }
+            assert.fail(`missing callback handler for ${data}`);
+        },
+        async runText(ctx) {
+            let index = 0;
+            const next = async () => {
+                const handler = messageTextHandlers[index];
+                index += 1;
+                if (handler) {
+                    await handler(ctx, next);
+                }
+            };
+            await next();
+        },
+    };
+}
+function createContext(input) {
+    const replies = [];
+    const sentMessages = [];
+    const sentDocuments = [];
+    const editedTexts = [];
+    const replyMarkups = [];
+    const editedMarkups = [];
+    return {
+        from: { id: input.fromId, is_bot: false, first_name: "User" },
+        chat: input.chatType === "private"
+            ? { id: input.chatId, type: "private", first_name: "User" }
+            : { id: input.chatId, type: "group", title: "Ops" },
+        message: {
+            message_id: 1,
+            date: 0,
+            chat: input.chatType === "private"
+                ? { id: input.chatId, type: "private", first_name: "User" }
+                : { id: input.chatId, type: "group", title: "Ops" },
+            text: "/renew",
+        },
+        callbackQuery: input.callbackData
+            ? {
+                id: "callback-1",
+                from: { id: input.fromId, is_bot: false, first_name: "User" },
+                chat_instance: "chat",
+                data: input.callbackData,
+                message: {
+                    message_id: 99,
+                    date: 0,
+                    chat: input.chatType === "private"
+                        ? { id: input.chatId, type: "private", first_name: "User" }
+                        : { id: input.chatId, type: "group", title: "Ops" },
+                },
+            }
+            : undefined,
+        match: input.match,
+        replies,
+        sentMessages,
+        sentDocuments,
+        editedTexts,
+        replyMarkups,
+        editedMarkups,
+        reply(text, options) {
+            replies.push(text);
+            replyMarkups.push(options?.reply_markup);
+            return Promise.resolve({});
+        },
+        answerCallbackQuery() {
+            return Promise.resolve(true);
+        },
+        editMessageReplyMarkup(options) {
+            editedMarkups.push(options?.reply_markup);
+            return Promise.resolve({});
+        },
+        editMessageText(text, options) {
+            editedTexts.push(text);
+            editedMarkups.push(options?.reply_markup);
+            return Promise.resolve({});
+        },
+        api: {
+            async sendMessage(chatId, text) {
+                if (input.sendMessageImpl) {
+                    await input.sendMessageImpl(chatId, text);
+                }
+                sentMessages.push({ chatId, text });
+                return {};
+            },
+            async sendDocument(chatId, document) {
+                sentDocuments.push({
+                    chatId,
+                    filename: document.filename,
+                    content: document.fileData ? Buffer.from(document.fileData).toString("utf8") : "",
+                });
+                return {};
+            },
+            async editMessageText(_chatId, _messageId, text) {
+                editedTexts.push(text);
+                return {};
+            },
+        },
+    };
+}
+async function withRepos(fn) {
+    const dir = mkdtempSync(path.join(os.tmpdir(), "renew-command-"));
+    try {
+        const dbFile = path.join(dir, "bot.sqlite");
+        const proxy = createMockProxyClient();
+        await fn({
+            identities: BotIdentityRepository.create(dbFile),
+            workspaces: CustomerWorkspaceRepository.create(dbFile),
+            customerKeys: CustomerKeyRepository.create(dbFile),
+            billing: BillingRepository.create(dbFile),
+            auditLog: AuditLogRepository.create(dbFile),
+            sessions: SqliteSessionStore.create(dbFile, 60_000),
+            deps: {
+                config: createConfig({ sessionDbPath: dbFile }),
+                proxyClient: proxy.client,
+            },
+        });
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+test("customer /renew without args creates a 24h purchase request", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const ctx = createContext({
+            fromId: 42,
+            chatId: 42,
+            chatType: "private",
+            match: "",
+        });
+        await harness.handler("renew")(ctx);
+        const request = billing.listRenewalRequests("open")[0];
+        assert.equal(request?.requestedDays, 1);
+        assert.equal(request?.requestedPlanId, "basic");
+        assert.equal(ctx.replies[0]?.includes("API key purchase request submitted."), true);
+        assert.equal(ctx.replies[0]?.includes("plan: 5000 VND -> 10000000 tokens"), true);
+        assert.equal(ctx.replies[0]?.includes("requested_plan_id: basic"), true);
+        assert.equal(ctx.replies[0]?.includes("requested_days: 1"), true);
+    });
+});
+test("customer can request 24h renewal from the start button", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler("v1:renew:open");
+        const ctx = createContext({
+            fromId: 42,
+            chatId: 42,
+            chatType: "private",
+            match: "",
+            callbackData: "v1:renew:open",
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        const request = billing.listRenewalRequests("open")[0];
+        assert.equal(request?.requestedDays, 1);
+        assert.equal(request?.requestedPlanId, "basic");
+        assert.equal((ctx.replies[0] ?? ctx.editedTexts[0])?.includes("API key purchase request submitted."), true);
+    });
+});
+test("customer can request token top-up from the dashboard button", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+            status: "active",
+        });
+        billing.grantSubscription({
+            workspaceId: workspace.id,
+            planId: "basic",
+            days: 1,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler("v1:topup:open");
+        const ctx = createContext({
+            fromId: 42,
+            chatId: 42,
+            chatType: "private",
+            match: "",
+            callbackData: "v1:topup:open",
+        });
+        await found.handler(ctx);
+        const request = billing.listRenewalRequests("open")[0];
+        assert.equal(request?.kind, "token_topup");
+        assert.equal(request?.requestedTokenDelta, 10_000_000);
+        assert.equal(request?.requestedTokenLotDays, 1);
+        assert.equal((ctx.replies[0] ?? ctx.editedTexts[0])?.includes("Token top-up request submitted."), true);
+    });
+});
+test("customer /renew creates a renewal request and notifies admin", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            firstName: "Atger",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+        });
+        billing.grantSubscription({
+            workspaceId: workspace.id,
+            planId: "basic",
+            days: 30,
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        const notified = [];
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const ctx = createContext({
+            fromId: 42,
+            chatId: 42,
+            chatType: "private",
+            match: "",
+            sendMessageImpl: async (chatId, text) => {
+                notified.push({ chatId, text });
+            },
+        });
+        await harness.handler("renew")(ctx);
+        assert.equal(billing.listRenewalRequests("open").length, 1);
+        assert.equal(ctx.replies[0]?.includes("Renewal request submitted."), true);
+        assert.equal(ctx.replies[0]?.includes("plan: 5000 VND -> 10000000 tokens"), true);
+        assert.equal(ctx.replies[0]?.includes("Payment"), true);
+        assert.equal(ctx.replies[0]?.includes("• Amount: 5,000 VND"), true);
+        assert.equal(ctx.replies[0]?.includes("• Transfer note: Chuc ngon mieng ma "), true);
+        assert.equal(ctx.replies[0]?.includes("• Scan QR: https://qr.sepay.vn/img?"), true);
+        assert.equal(notified.length, 1);
+        assert.equal(notified[0]?.chatId, 1);
+        assert.equal(notified[0]?.text.includes("Renewal request"), true);
+        assert.equal(notified[0]?.text.includes("• Telegram user: Atger | id=42"), true);
+        assert.equal(notified[0]?.text.includes("• Requested plan: basic (Basic)"), true);
+        assert.equal(notified[0]?.text.includes("• Requested days: 1"), true);
+        assert.equal(notified[0]?.text.includes("• Current expiry:"), true);
+    });
+});
+test("customer sees a warning when admin notification fails", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const ctx = createContext({
+            fromId: 42,
+            chatId: 42,
+            chatType: "private",
+            match: "",
+            sendMessageImpl: async () => {
+                throw new Error("telegram send failed");
+            },
+        });
+        await harness.handler("renew")(ctx);
+        assert.equal(billing.listRenewalRequests("open").length, 1);
+        assert.equal(ctx.replies[0]?.includes("Renewal request submitted."), true);
+        assert.equal(ctx.replies[0]?.includes("admin_notification: pending_manual_follow_up"), true);
+    });
+});
+test("admin notification marks users without an active token as new access", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            firstName: "Atger",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const notified = [];
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const ctx = createContext({
+            fromId: 42,
+            chatId: 42,
+            chatType: "private",
+            match: "",
+            sendMessageImpl: async (chatId, text) => {
+                notified.push({ chatId, text });
+            },
+        });
+        await harness.handler("renew")(ctx);
+        assert.equal(billing.listRenewalRequests("open").length, 1);
+        assert.equal(notified.length, 1);
+        assert.equal(notified[0]?.text.includes("New access request"), true);
+        assert.equal(notified[0]?.text.includes("Key preview:"), false);
+    });
+});
+test("admin can mark a renewal request as paid from command", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: `paid ${request.request.id}`,
+        });
+        await harness.handler("renew")(ctx);
+        const updatedRequest = billing.getRenewalRequest(request.request.id);
+        assert.equal(updatedRequest?.status, "payment_confirmed");
+        assert.equal(ctx.replies[0]?.includes("Payment confirmed manually."), true);
+        assert.equal(ctx.replies[0]?.includes("• Amount: 5,000 VND"), true);
+        assert.equal(JSON.stringify(ctx.replyMarkups[0]).includes("v1:renew:approve:"), true);
+    });
+});
+test("admin can mark a renewal request as paid from callback button", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 1,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "confirm_payment",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:confirm-payment:${token}`);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:confirm-payment:${token}`,
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        assert.equal(billing.getRenewalRequest(request.request.id)?.status, "payment_confirmed");
+        assert.equal(ctx.editedTexts[0]?.includes("Payment confirmed manually."), true);
+        assert.equal(ctx.editedTexts[0]?.includes("• Amount: 5,000 VND"), true);
+        assert.ok(ctx.editedMarkups[0]);
+        assert.equal(JSON.stringify(ctx.editedMarkups[0]).includes("v1:renew:approve:"), true);
+    });
+});
+test("duplicate open /renew returns the existing request", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const first = createContext({
+            fromId: 42,
+            chatId: 42,
+            chatType: "private",
+            match: "",
+        });
+        const second = createContext({
+            fromId: 42,
+            chatId: 42,
+            chatType: "private",
+            match: "",
+        });
+        await harness.handler("renew")(first);
+        await harness.handler("renew")(second);
+        assert.equal(billing.listRenewalRequests("open").length, 1);
+        assert.equal(second.replies[0]?.includes("You already have an open renewal request."), true);
+        assert.equal(second.replies[0]?.includes("admin_notification: reminder_sent"), true);
+    });
+});
+test("admin approve request extends subscription", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        billing.grantSubscription({
+            workspaceId: workspace.id,
+            planId: "basic",
+            days: 30,
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        const before = billing.getLatestSubscriptionForWorkspace(workspace.id);
+        assert.ok(before);
+        billing.confirmRenewalPayment({ id: request.request.id });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: `approve ${request.request.id} basic 15`,
+        });
+        await harness.handler("renew")(ctx);
+        const after = billing.getLatestSubscriptionForWorkspace(workspace.id);
+        const updatedRequest = billing.getRenewalRequest(request.request.id);
+        const approvedEvent = auditLog.listEvents({ event: "renewal.approved", subjectId: request.request.id, limit: 1 })[0];
+        assert.ok(after);
+        assert.ok(approvedEvent);
+        assert.ok(updatedRequest);
+        assert.equal(updatedRequest?.status, "approved");
+        assert.ok(new Date(after.currentPeriodEnd).getTime() > new Date(before.currentPeriodEnd).getTime());
+        assert.equal(ctx.replies[0]?.includes("Renewal request approved"), true);
+    });
+});
+test("admin close request records an audit event", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: `close ${request.request.id} paid_offline`,
+        });
+        await harness.handler("renew")(ctx);
+        const updatedRequest = billing.getRenewalRequest(request.request.id);
+        const closedEvent = auditLog.listEvents({ event: "renewal.closed", subjectId: request.request.id, limit: 1 })[0];
+        assert.ok(updatedRequest);
+        assert.ok(closedEvent);
+        assert.equal(updatedRequest?.status, "closed");
+        assert.equal(updatedRequest?.resolution, "paid_offline");
+        assert.equal(ctx.replies[0]?.includes("Renewal request closed."), true);
+    });
+});
+test("admin can approve a renewal request from callback button", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        billing.grantSubscription({
+            workspaceId: workspace.id,
+            planId: "basic",
+            days: 30,
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        billing.confirmRenewalPayment({ id: request.request.id });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "approve",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:approve:${token}`);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve:${token}`,
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        assert.equal(billing.getRenewalRequest(request.request.id)?.status, "approved");
+        assert.equal(ctx.editedTexts[0]?.includes("Renewal request approved"), true);
+        assert.equal(ctx.editedTexts[0]?.includes("• Value: approved"), true);
+        assert.equal(ctx.editedMarkups[0], undefined);
+    });
+});
+test("admin approval of a new access request sends the full key to the customer", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        billing.confirmRenewalPayment({ id: request.request.id });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "approve",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:approve:${token}`);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve:${token}`,
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        assert.equal(billing.getRenewalRequest(request.request.id)?.status, "approved");
+        assert.equal(customerKeys.getActiveKeyForUser("42")?.status, "active");
+        assert.equal(ctx.sentMessages[0]?.chatId, 42);
+        assert.equal(ctx.sentMessages[0]?.text.includes("Your access has been approved"), true);
+        assert.equal(ctx.sentMessages[0]?.text.includes("api_key:"), false);
+        assert.deepEqual(ctx.sentDocuments.map((document) => document.filename), ["config.toml", "auth.json"]);
+        assert.match(ctx.sentDocuments[0]?.content ?? "", /base_url = "http:\/\/127\.0\.0\.1:8318\/v1"/);
+        assert.match(ctx.sentDocuments[0]?.content ?? "", /api_key = "sk-/);
+        assert.match(ctx.sentDocuments[1]?.content ?? "", /"OPENAI_API_KEY": "sk-/);
+        assert.equal(auditLog.listEvents({ event: "api_key.revealed", limit: 5 }).length, 2);
+    });
+});
+test("admin can approve a token top-up request and create a new lot", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+            status: "active",
+        });
+        billing.grantSubscription({
+            workspaceId: workspace.id,
+            planId: "basic",
+            days: 1,
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            kind: "token_topup",
+            requestedTokenDelta: 1_000_000,
+            requestedTokenLotDays: 7,
+            priceVnd: 5_000,
+        });
+        billing.confirmRenewalPayment({ id: request.request.id });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "approve",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:approve:${token}`);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve:${token}`,
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        const lots = billing.getActiveEntitlementLotsForWorkspace(workspace.id);
+        assert.equal(billing.getRenewalRequest(request.request.id)?.status, "approved");
+        assert.equal(lots.length >= 2, true);
+        assert.equal(ctx.editedTexts[0]?.includes("Token top-up request approved"), true);
+        assert.equal(ctx.editedTexts[0]?.includes("• Value: approved"), true);
+    });
+});
+test("failed renewal approval closes request so customer can buy again", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const first = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 1,
+        });
+        billing.confirmRenewalPayment({ id: first.request.id });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "approve",
+            requestId: first.request.id,
+        });
+        const proxy = deps.proxyClient;
+        proxy.getClientConfigs = async () => {
+            throw new Error("Dashboard login required");
+        };
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const approveFound = harness.callbackHandler(`v1:renew:approve:${token}`);
+        const approveCtx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve:${token}`,
+        });
+        approveCtx.match = approveFound.match;
+        await approveFound.handler(approveCtx);
+        const failedRequest = billing.getRenewalRequest(first.request.id);
+        assert.equal(failedRequest?.status, "closed");
+        assert.equal(failedRequest?.resolution, "approval_failed");
+        assert.equal(approveCtx.sentMessages.some((message) => message.chatId === 42), true);
+        assert.equal(approveCtx.editedTexts[0]?.includes("Renewal approval failed."), true);
+        assert.equal(approveCtx.editedTexts[0]?.includes("status: closed"), true);
+        assert.equal(approveCtx.editedMarkups[0], undefined);
+        const renewCtx = createContext({
+            fromId: 42,
+            chatId: 42,
+            chatType: "private",
+            match: "",
+        });
+        await harness.handler("renew")(renewCtx);
+        const renewalRequests = billing.listRenewalRequests();
+        assert.equal(renewalRequests.filter((request) => request.workspaceId === workspace.id).length, 2);
+        assert.equal(renewalRequests[0]?.status, "open");
+        assert.notEqual(renewalRequests[0]?.id, first.request.id);
+        assert.equal(renewCtx.replies[0]?.includes("API key purchase request submitted."), true);
+    });
+});
+test("admin approval falls back to default purchase plan for legacy 24h requests", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedDays: 1,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        billing.confirmRenewalPayment({ id: request.request.id });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "approve",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:approve:${token}`);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve:${token}`,
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        const approved = billing.getRenewalRequest(request.request.id);
+        assert.equal(approved?.status, "approved");
+        assert.equal(approved?.approvedPlanId, "basic");
+        assert.equal(customerKeys.getActiveKeyForUser("42")?.status, "active");
+        assert.equal(ctx.editedTexts[0]?.includes("• Plan ID: basic"), true);
+    });
+});
+test("admin can approve and rotate key from callback button", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        const firstKey = customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        billing.grantSubscription({
+            workspaceId: workspace.id,
+            planId: "basic",
+            days: 30,
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        billing.confirmRenewalPayment({ id: request.request.id });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "approve_rotate",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:approve-rotate:${token}`);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve-rotate:${token}`,
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        assert.equal(billing.getRenewalRequest(request.request.id)?.status, "approved");
+        assert.equal(customerKeys.getById(firstKey.record.id)?.status, "revoked");
+        assert.equal(customerKeys.getActiveKeyForUser("42")?.id === firstKey.record.id, false);
+        assert.equal(ctx.sentMessages[0]?.chatId, 42);
+        assert.equal(ctx.sentMessages[0]?.text.includes("Your access has been approved"), true);
+        assert.equal(ctx.sentMessages[0]?.text.includes("api_key:"), false);
+        assert.deepEqual(ctx.sentDocuments.map((document) => document.filename), ["config.toml", "auth.json"]);
+        assert.match(ctx.sentDocuments[0]?.content ?? "", /base_url = "http:\/\/127\.0\.0\.1:8318\/v1"/);
+        assert.match(ctx.sentDocuments[0]?.content ?? "", /api_key = "sk-/);
+        assert.equal(ctx.editedTexts[0]?.includes("Renewal request approved"), true);
+    });
+});
+test("admin can approve a renewal request with 90 day override", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        billing.grantSubscription({
+            workspaceId: workspace.id,
+            planId: "basic",
+            days: 30,
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        const before = billing.getLatestSubscriptionForWorkspace(workspace.id);
+        assert.ok(before);
+        billing.confirmRenewalPayment({ id: request.request.id });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "approve_override",
+            requestId: request.request.id,
+            overrideDays: 90,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:approve-90:${token}`);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve-90:${token}`,
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        const after = billing.getLatestSubscriptionForWorkspace(workspace.id);
+        assert.ok(after);
+        assert.equal(billing.getRenewalRequest(request.request.id)?.status, "approved");
+        assert.ok(new Date(after.currentPeriodEnd).getTime() > new Date(before.currentPeriodEnd).getTime());
+        assert.equal(ctx.editedTexts[0]?.includes("• Days: 90"), true);
+    });
+});
+test("admin can reject a renewal request with a canned reason", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        billing.confirmRenewalPayment({ id: request.request.id });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "reject_reason",
+            requestId: request.request.id,
+            resolution: "rejected_unpaid",
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:reject:${token}`);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:reject:${token}`,
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        assert.equal(billing.getRenewalRequest(request.request.id)?.status, "closed");
+        assert.equal(billing.getRenewalRequest(request.request.id)?.resolution, "rejected_unpaid");
+        assert.equal(ctx.editedTexts[0]?.includes("resolution: rejected_unpaid"), true);
+        assert.equal(ctx.editedMarkups[0], undefined);
+        assert.equal(ctx.sentMessages[0]?.chatId, 42);
+        assert.equal(ctx.sentMessages[0]?.text.includes("Your renewal request was not approved."), true);
+        assert.equal(ctx.sentMessages[0]?.text.includes("reason: rejected_unpaid"), true);
+    });
+});
+test("admin can switch between reject reasons and main renewal actions", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        const rejectToken = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "show_reject_reasons",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const rejectFound = harness.callbackHandler(`v1:renew:reject-reasons:${rejectToken}`);
+        const rejectCtx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:reject-reasons:${rejectToken}`,
+        });
+        rejectCtx.match = rejectFound.match;
+        await rejectFound.handler(rejectCtx);
+        assert.equal(rejectCtx.editedTexts[0]?.includes("Choose a rejection reason."), true);
+        const backToken = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "show_main_actions",
+            requestId: request.request.id,
+        });
+        const backFound = harness.callbackHandler(`v1:renew:back:${backToken}`);
+        const backCtx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:back:${backToken}`,
+        });
+        backCtx.match = backFound.match;
+        await backFound.handler(backCtx);
+        assert.equal(backCtx.editedTexts[0]?.includes("Renewal request") || backCtx.editedTexts[0]?.includes("New access request"), true);
+        assert.equal(backCtx.editedTexts[0]?.includes(`• Request ID: ${request.request.id}`), true);
+    });
+});
+test("admin can approve a renewal request with custom days input", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        billing.grantSubscription({
+            workspaceId: workspace.id,
+            planId: "basic",
+            days: 30,
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        billing.confirmRenewalPayment({ id: request.request.id });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "prompt_custom_days",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:approve-custom:${token}`);
+        const callbackCtx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve-custom:${token}`,
+        });
+        callbackCtx.match = found.match;
+        await found.handler(callbackCtx);
+        assert.equal(callbackCtx.editedTexts[0]?.includes("Awaiting custom approval days."), true);
+        const inputCtx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+        });
+        inputCtx.message.text = "45";
+        await harness.runText(inputCtx);
+        assert.equal(billing.getRenewalRequest(request.request.id)?.status, "approved");
+        assert.equal(inputCtx.editedTexts.at(-1)?.includes("• Days: 45"), true);
+    });
+});
+test("admin can reject a renewal request with custom reason input", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        billing.confirmRenewalPayment({ id: request.request.id });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "prompt_custom_reason",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:reject-custom:${token}`);
+        const callbackCtx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:reject-custom:${token}`,
+        });
+        callbackCtx.match = found.match;
+        await found.handler(callbackCtx);
+        assert.equal(callbackCtx.editedTexts[0]?.includes("Awaiting custom rejection reason."), true);
+        const inputCtx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+        });
+        inputCtx.message.text = "customer asked to pay later";
+        await harness.runText(inputCtx);
+        assert.equal(billing.getRenewalRequest(request.request.id)?.status, "closed");
+        assert.equal(billing.getRenewalRequest(request.request.id)?.resolution, "customer asked to pay later");
+        assert.equal(inputCtx.editedTexts.at(-1)?.includes("resolution: customer asked to pay later"), true);
+        assert.equal(inputCtx.sentMessages[0]?.chatId, 42);
+        assert.equal(inputCtx.sentMessages[0]?.text.includes("Your renewal request was not approved."), true);
+        assert.equal(inputCtx.sentMessages[0]?.text.includes("reason: customer asked to pay later"), true);
+    });
+});
+test("admin /renew list renders open requests in one admin screen", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "list",
+        });
+        await harness.handler("renew")(ctx);
+        assert.equal(ctx.replies[0]?.includes("Open renewal requests:"), true);
+        assert.equal(ctx.replies[0]?.includes(request.request.id), true);
+        assert.ok(ctx.replyMarkups[0]);
+    });
+});
+test("admin can view customer details from callback button", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            firstName: "Atger",
+            username: "atger",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        const created = customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        billing.grantSubscription({
+            workspaceId: workspace.id,
+            planId: "basic",
+            days: 30,
+            now: new Date("2026-04-27T00:00:00.000Z"),
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+            now: new Date("2026-04-28T00:00:00.000Z"),
+        });
+        billing.confirmRenewalPayment({ id: request.request.id });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "view_customer",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:view-customer:${token}`);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:view-customer:${token}`,
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        assert.equal(ctx.editedTexts[0]?.includes("Customer renewal review"), true);
+        assert.equal(ctx.editedTexts[0]?.includes("customer: Atger | @atger | id=42"), true);
+        assert.equal(ctx.editedTexts[0]?.includes(`api_key: ${created.apiKey}`), true);
+        assert.equal(ctx.editedTexts[0]?.includes("request_status: payment_confirmed"), true);
+        assert.equal(auditLog.listEvents({ event: "api_key.revealed", limit: 1 })[0]?.metadata.apiKey, "[redacted]");
+    });
+});
+test("v1:renew:open callback refuses to run in a group chat", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler("v1:renew:open");
+        const ctx = createContext({
+            fromId: 42,
+            chatId: 999,
+            chatType: "group",
+            match: "",
+            callbackData: "v1:renew:open",
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        assert.equal(billing.listRenewalRequests("open").length, 0);
+        assert.equal(ctx.replies.length, 0);
+        assert.equal(ctx.editedTexts.length, 0);
+    });
+});
+test("v1:topup:open callback refuses to run in a group chat", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+            status: "active",
+        });
+        billing.grantSubscription({ workspaceId: workspace.id, planId: "basic", days: 1 });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler("v1:topup:open");
+        const ctx = createContext({
+            fromId: 42,
+            chatId: 999,
+            chatType: "group",
+            match: "",
+            callbackData: "v1:topup:open",
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        assert.equal(billing.listRenewalRequests("open").length, 0);
+        assert.equal(ctx.replies.length, 0);
+    });
+});
+test("/renew shows payment amount that matches the plan price", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        billing.createPlan({
+            id: "premium",
+            name: "Premium",
+            monthlyTokenLimit: 50_000_000,
+            maxApiKeys: 1,
+            priceCents: 20_000,
+            currency: "VND",
+            billingInterval: "month",
+        });
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+        });
+        // Seed an open request with explicit priceVnd matching premium plan.
+        const created = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "premium",
+            requestedDays: 30,
+            priceVnd: 20_000,
+        });
+        // Confirm via the admin command path which derives amount from the request.
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: `paid ${created.request.id}`,
+        });
+        await harness.handler("renew")(ctx);
+        assert.equal(ctx.replies[0]?.includes("Payment"), true);
+        assert.equal(ctx.replies[0]?.includes("• Amount: 20,000 VND"), true);
+        const paidEvent = auditLog.listEvents({ event: "payment.confirmed_manual", limit: 1 })[0];
+        assert.equal(paidEvent?.metadata.amountVnd, 20_000);
+    });
+});
+test("second admin approval does not double-provision the request", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 15,
+        });
+        billing.confirmRenewalPayment({ id: request.request.id, expectedStatus: "open" });
+        const firstToken = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "approve",
+            requestId: request.request.id,
+        });
+        const secondToken = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "approve",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const first = harness.callbackHandler(`v1:renew:approve:${firstToken}`);
+        const firstCtx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve:${firstToken}`,
+        });
+        firstCtx.match = first.match;
+        await first.handler(firstCtx);
+        const second = harness.callbackHandler(`v1:renew:approve:${secondToken}`);
+        const secondCtx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve:${secondToken}`,
+        });
+        secondCtx.match = second.match;
+        await second.handler(secondCtx);
+        assert.equal(billing.getRenewalRequest(request.request.id)?.status, "approved");
+        assert.equal(auditLog.listEvents({ event: "renewal.approved", subjectId: request.request.id, limit: 5 }).length, 1);
+        assert.equal(auditLog.listEvents({ event: "subscription.renewed", limit: 5 }).length, 1);
+    });
+});
+test("concurrent approve-transition guard prevents a second DB side-effect", () => {
+    const dir = mkdtempSync(path.join(os.tmpdir(), "approve-race-"));
+    try {
+        const dbFile = path.join(dir, "bot.sqlite");
+        const billing = BillingRepository.create(dbFile);
+        const workspaces = CustomerWorkspaceRepository.create(dbFile);
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 1,
+        });
+        billing.confirmRenewalPayment({ id: request.request.id, expectedStatus: "open" });
+        const firstApprove = billing.approveRenewalRequest({
+            id: request.request.id,
+            approvedPlanId: "basic",
+            approvedDays: 1,
+            expectedStatus: "payment_confirmed",
+        });
+        assert.ok(firstApprove);
+        const secondApprove = billing.approveRenewalRequest({
+            id: request.request.id,
+            approvedPlanId: "basic",
+            approvedDays: 1,
+            expectedStatus: "payment_confirmed",
+        });
+        assert.equal(secondApprove, undefined);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+test("token top-up rolls back the lot when approve transition fails", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "active",
+        });
+        const workspace = workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "active",
+        });
+        customerKeys.createKey({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            clientRoute: "customers",
+            status: "active",
+        });
+        billing.grantSubscription({ workspaceId: workspace.id, planId: "basic", days: 1 });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspace.id,
+            telegramUserId: "42",
+            kind: "token_topup",
+            requestedTokenDelta: 1_000_000,
+            requestedTokenLotDays: 7,
+            priceVnd: 5_000,
+        });
+        // Mark as approved directly: second approve attempt must not create a lot.
+        billing.confirmRenewalPayment({ id: request.request.id, expectedStatus: "open" });
+        billing.approveTokenTopUpRequest({
+            id: request.request.id,
+            approvedTokenDelta: 1_000_000,
+            approvedTokenLotDays: 7,
+        });
+        const lotsBefore = billing.getActiveEntitlementLotsForWorkspace(workspace.id);
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "approve",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:approve:${token}`);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve:${token}`,
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        const lotsAfter = billing.getActiveEntitlementLotsForWorkspace(workspace.id);
+        assert.equal(lotsAfter.length, lotsBefore.length);
+    });
+});
+test("approving renewal also records user.approved when user is pending_approval", async () => {
+    await withRepos(async ({ identities, workspaces, customerKeys, billing, auditLog, sessions, deps }) => {
+        identities.upsertUser({
+            telegramUserId: "42",
+            defaultRole: "customer",
+            defaultStatus: "pending_approval",
+        });
+        workspaces.ensureDefaultWorkspace({
+            ownerTelegramUserId: "42",
+            defaultClientRoute: "customers",
+            status: "pending_approval",
+        });
+        const request = billing.createRenewalRequest({
+            workspaceId: workspaces.getDefaultWorkspace("42").id,
+            telegramUserId: "42",
+            requestedPlanId: "basic",
+            requestedDays: 1,
+        });
+        billing.confirmRenewalPayment({ id: request.request.id, expectedStatus: "open" });
+        const token = sessions.issueCallbackToken({
+            kind: "renewal_request_action",
+            action: "approve",
+            requestId: request.request.id,
+        });
+        const harness = createBotHarness();
+        registerRenewCommand(harness.bot, deps, sessions, identities, workspaces, customerKeys, billing, auditLog);
+        const found = harness.callbackHandler(`v1:renew:approve:${token}`);
+        const ctx = createContext({
+            fromId: 1,
+            chatId: 1,
+            chatType: "private",
+            match: "",
+            callbackData: `v1:renew:approve:${token}`,
+        });
+        ctx.match = found.match;
+        await found.handler(ctx);
+        assert.equal(identities.getUser("42")?.status, "active");
+        assert.equal(auditLog.listEvents({ event: "user.approved", limit: 5 }).length, 1);
+        assert.equal(auditLog.listEvents({ event: "workspace.approved", limit: 5 }).length, 1);
+    });
+});