tapimo 0.5.3 → 0.7.0

package/src/apps/management/routes/billing.test.ts

@@ -2,8 +2,10 @@ import { nanoid } from 'nanoid'
 import Stripe from 'stripe'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
+import * as ApiKeys from '../../../ApiKeys.js'
 import * as TestApp from '../../../../test/App.js'
 import * as TestStripe from '../../../../test/Stripe.js'
+import * as EnabledBillingSources from '../../../db/tables/enabledBillingSources.js'
 import * as Memberships from '../../../db/tables/memberships.js'
 import * as SponsoredTransactions from '../../../db/tables/sponsoredTransactions.js'
 import * as StripeCustomers from '../../../db/tables/stripeCustomers.js'
@@ -59,13 +61,18 @@ function billingWithSandbox(): App.Billing {
 }
 
 function createApp(
-  options: { billing?: App.Billing | undefined; db?: TestApp.create.Options['db'] } = {},
+  options: {
+    billing?: App.Billing | undefined
+    db?: TestApp.create.Options['db']
+    kv?: { store: ReturnType<typeof TestApp.kvStore> }
+  } = {},
 ) {
   // prettier-ignore
   return TestApp.create({
     auth: { superAdmin: { secret } },
     billing: options.billing ?? billing(),
     db: options.db ?? TestApp.database(),
+    ...(options.kv ? { kv: options.kv } : {}),
     session: { wallet: { origin } },
   })
 }
@@ -98,6 +105,20 @@ async function seeded(app: ReturnType<typeof createApp>) {
   return { cookie, orgId: id }
 }
 
+/** Seeds an owned organization with Stripe setup enabled. */
+async function seededWithStripe(
+  app: ReturnType<typeof createApp>,
+  db: ReturnType<typeof TestApp.database>,
+) {
+  const result = await seeded(app)
+  await EnabledBillingSources.add(db, {
+    createdBy: 'test',
+    orgId: result.orgId,
+    source: 'stripe',
+  })
+  return result
+}
+
 describe('GET /orgs/:orgId/billing', () => {
   test('behavior: synthesizes none for orgs without a billing source', async () => {
     const app = createApp()
@@ -106,6 +127,7 @@ describe('GET /orgs/:orgId/billing', () => {
     expect(response.status).toBe(200)
     expect(await response.json()).toMatchInlineSnapshot(`
       {
+        "enabledSources": [],
         "spend": {
           "amount": "0",
           "currency": "usd",
@@ -129,6 +151,28 @@ describe('GET /orgs/:orgId/billing', () => {
     expect(body.updatedAt).toBeDefined()
   })
 
+  test('behavior: lists organization-wide sources in canonical order', async () => {
+    const db = TestApp.database()
+    const app = createApp({ billing: billingWithSandbox(), db })
+    const { cookie, orgId } = await seeded(app)
+    await EnabledBillingSources.add(db, { createdBy: 'test', orgId, source: 'tempo' })
+    await EnabledBillingSources.add(db, { createdBy: 'test', orgId, source: 'stripe' })
+
+    const production = await app.request(`/v1/orgs/${orgId}/billing`, { headers: { cookie } })
+    const sandbox = await app.request(`/v1/orgs/${orgId}/billing?environment=sandbox`, {
+      headers: { cookie },
+    })
+
+    expect(await production.json()).toMatchObject({
+      enabledSources: ['stripe', 'tempo'],
+      status: 'none',
+    })
+    expect(await sandbox.json()).toMatchObject({
+      enabledSources: ['stripe', 'tempo'],
+      status: 'none',
+    })
+  })
+
   test('behavior: the super admin reads any org', async () => {
     const db = TestApp.database()
     const app = createApp({ db })
@@ -155,7 +199,7 @@ describe('GET /orgs/:orgId/billing', () => {
     expect(response.status).toBe(401)
   })
 
-  test('behavior: 501 when billing is unconfigured', async () => {
+  test('behavior: reads database-backed state when Stripe is unconfigured', async () => {
     const app = TestApp.create({
       auth: { superAdmin: { secret } },
       db: TestApp.database(),
@@ -163,9 +207,18 @@ describe('GET /orgs/:orgId/billing', () => {
     })
     const { cookie, orgId } = await seeded(app)
     const response = await app.request(`/v1/orgs/${orgId}/billing`, { headers: { cookie } })
-    expect(response.status).toBe(501)
-    const body = (await response.json()) as { error: { code: string } }
-    expect(body.error.code).toMatchInlineSnapshot(`"billing_unconfigured"`)
+    expect(response.status).toBe(200)
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "enabledSources": [],
+        "spend": {
+          "amount": "0",
+          "currency": "usd",
+          "period": "month",
+        },
+        "status": "none",
+      }
+    `)
   })
 })
 
@@ -192,6 +245,7 @@ describe('PATCH /orgs/:orgId/billing', () => {
     expect(response.status).toBe(200)
     expect(await response.json()).toMatchInlineSnapshot(`
       {
+        "enabledSources": [],
         "spend": {
           "amount": "0",
           "currency": "usd",
@@ -284,7 +338,7 @@ describe('PATCH /orgs/:orgId/billing', () => {
     expect(response.status).toBe(404)
   })
 
-  test('behavior: 501 when billing is unconfigured', async () => {
+  test('behavior: updates database-backed state when Stripe is unconfigured', async () => {
     const app = TestApp.create({
       auth: { superAdmin: { secret } },
       db: TestApp.database(),
@@ -293,9 +347,12 @@ describe('PATCH /orgs/:orgId/billing', () => {
     const { cookie, orgId } = await seeded(app)
     const response = await app.request(
       `/v1/orgs/${orgId}/billing`,
-      patch(cookie, { spendLimit: null }),
+      patch(cookie, { spendLimit: { amount: '250' } }),
     )
-    expect(response.status).toBe(501)
+    expect(response.status).toBe(200)
+    expect(
+      ((await response.json()) as { spendLimit?: { amount: string } }).spendLimit?.amount,
+    ).toBe('250')
   })
 })
 
@@ -345,8 +402,9 @@ describe('POST /orgs/:orgId/billing/stripe/checkout', () => {
   })
 
   test('behavior: an unreachable Stripe maps to the upstream error envelope', async () => {
-    const app = createApp()
-    const { cookie, orgId } = await seeded(app)
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const { cookie, orgId } = await seededWithStripe(app, db)
     // First Stripe call the route makes is the customer create; the connection
     // is refused for real (no transport fake).
     const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
@@ -356,6 +414,66 @@ describe('POST /orgs/:orgId/billing/stripe/checkout', () => {
   })
 })
 
+describe('billing source access', () => {
+  test('behavior: checkout requires Stripe to be enabled', async () => {
+    const app = TestApp.create({
+      auth: { superAdmin: { secret } },
+      db: TestApp.database(),
+      session: { wallet: { origin } },
+    })
+    const { cookie, orgId } = await seeded(app)
+    const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
+    expect(response.status).toBe(403)
+    const { requestId, ...body } = (await response.json()) as { requestId?: string }
+    expect(requestId).toBeDefined()
+    expect(body).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "billing_source_disabled",
+          "message": "Stripe billing is not enabled for this organization",
+        },
+      }
+    `)
+  })
+
+  test('behavior: the source gate replaces temporary billing early access', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const { cookie, orgId } = await seededWithStripe(app, db)
+
+    // The unreachable Stripe upstream proves source access, not user early access, is the gate.
+    const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
+    expect(response.status).toBe(502)
+    expect(((await response.json()) as { error: { code: string } }).error.code).toBe('upstream_error') // prettier-ignore
+  })
+
+  test('behavior: an enabled management key reaches Stripe', async () => {
+    const db = TestApp.database()
+    const store = TestApp.kvStore({ keys: [] })
+    const app = createApp({ db, kv: { store } })
+    const { orgId } = await seededWithStripe(app, db)
+    const { token } = await ApiKeys.mint(store, { orgId, scopes: ['management:write'] })
+
+    const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, {
+      headers: { 'tempo-api-key': token },
+      method: 'POST',
+    })
+    expect(response.status).toBe(502)
+  })
+
+  test('behavior: an enabled super admin reaches Stripe', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const { orgId } = await seededWithStripe(app, db)
+
+    const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, {
+      ...as(secret),
+      method: 'POST',
+    })
+    expect(response.status).toBe(502)
+  })
+})
+
 describe('POST /orgs/:orgId/billing/stripe/manage', () => {
   test('behavior: 404 before any billing exists', async () => {
     const app = createApp()
@@ -440,6 +558,7 @@ describe('DELETE /orgs/:orgId', () => {
     const db = TestApp.database()
     const app = createApp({ db })
     const { cookie, orgId } = await seeded(app)
+    await EnabledBillingSources.add(db, { createdBy: 'test', orgId, source: 'stripe' })
     await StripeCustomers.create(db, { orgId, stripeCustomerId: 'cus_cascade' })
 
     const response = await app.request(`/v1/orgs/${orgId}`, {
@@ -447,19 +566,30 @@ describe('DELETE /orgs/:orgId', () => {
       method: 'DELETE',
     })
     expect(response.status).toBe(200)
+    expect(await EnabledBillingSources.listByOrg(db, orgId)).toEqual([])
     expect(await StripeCustomers.get(db, orgId)).toBeUndefined()
   })
 })
 
 describe('environment scoping', () => {
-  test('behavior: sandbox is 501 when no sandbox source is configured', async () => {
+  test('behavior: sandbox billing state remains readable without a Stripe source', async () => {
     const app = createApp()
     const { cookie, orgId } = await seeded(app)
     const response = await app.request(`/v1/orgs/${orgId}/billing?environment=sandbox`, {
       headers: { cookie },
     })
-    expect(response.status).toBe(501)
-    expect(((await response.json()) as { error: { code: string } }).error.code).toBe('billing_unconfigured') // prettier-ignore
+    expect(response.status).toBe(200)
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "enabledSources": [],
+        "spend": {
+          "amount": "0",
+          "currency": "usd",
+          "period": "month",
+        },
+        "status": "none",
+      }
+    `)
   })
 
   test('behavior: rejects an unknown environment', async () => {
@@ -645,7 +775,7 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
   test('checkout provisions distinct customers per environment', { timeout: 30_000 }, async () => {
     const db = TestApp.database()
     const app = createApp({ billing: sandboxBillingBoth(), db })
-    const { cookie, orgId } = await seeded(app)
+    const { cookie, orgId } = await seededWithStripe(app, db)
 
     const prod = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
     const sbx = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout?environment=sandbox`, post(cookie)) // prettier-ignore
@@ -672,7 +802,7 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
   test('checkout provisions a real customer and setup session', { timeout: 30_000 }, async () => {
     const db = TestApp.database()
     const app = createApp({ billing: sandboxBilling(), db })
-    const { cookie, orgId } = await seeded(app)
+    const { cookie, orgId } = await seededWithStripe(app, db)
 
     const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
     // Track for teardown before asserting: a failed assertion must not leak
@@ -720,7 +850,7 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
       // prettier-ignore
       const db = TestApp.database()
       const app = createApp({ billing: sandboxBilling(), db })
-      const { cookie, orgId } = await seeded(app)
+      const { cookie, orgId } = await seededWithStripe(app, db)
       const checkout = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
       const customerId = (await StripeCustomers.get(db, orgId))?.stripeCustomerId
       if (customerId) TestStripe.track(customerId)
@@ -733,8 +863,9 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
         invoice_settings: { default_payment_method: attached.paymentMethod },
       })
       await StripeCustomers.setStatus(db, orgId, 'active')
+      await EnabledBillingSources.remove(db, { orgId, source: 'stripe' })
 
-      // The list reads live Stripe state: card details plus the default marker.
+      // Disabling setup does not block management of the existing Stripe source.
       const list = await app.request(`/v1/orgs/${orgId}/billing/payment-methods`, {
         headers: { cookie },
       })
@@ -789,7 +920,7 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
       // prettier-ignore
       const db = TestApp.database()
       const app = createApp({ billing: sandboxBilling(), db })
-      const { cookie, orgId } = await seeded(app)
+      const { cookie, orgId } = await seededWithStripe(app, db)
       const checkout = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
       const customerId = (await StripeCustomers.get(db, orgId))?.stripeCustomerId
       if (customerId) TestStripe.track(customerId)
@@ -819,11 +950,12 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (direct)', () => {
 
     const db = TestApp.database()
     const app = createApp({ billing: sandboxBilling(), db })
-    const { cookie, orgId } = await seeded(app)
+    const { cookie, orgId } = await seededWithStripe(app, db)
     const checkout = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
     const customerId = (await StripeCustomers.get(db, orgId))?.stripeCustomerId
     if (customerId) TestStripe.track(customerId)
     expect(checkout.status).toBe(200)
+    await EnabledBillingSources.remove(db, { orgId, source: 'stripe' })
 
     const response = await app.request(`/v1/orgs/${orgId}/billing/stripe/manage`, post(cookie))
     expect(response.status).toBe(200)
@@ -852,7 +984,7 @@ describe.runIf(TestStripe.secretKey)('stripe sandbox (live delivery)', () => {
   })
 
   test('attach → active, detach → none, delete → canceled', { timeout: 300_000 }, async () => {
-    const { cookie, orgId } = await seeded(app)
+    const { cookie, orgId } = await seededWithStripe(app, db)
     const checkout = await app.request(`/v1/orgs/${orgId}/billing/stripe/checkout`, post(cookie))
     const customerId = (await StripeCustomers.get(db, orgId))?.stripeCustomerId
     if (customerId) TestStripe.track(customerId)

package/src/apps/management/routes/billing.ts

@@ -6,6 +6,7 @@ import * as ApiKeys from '../../../ApiKeys.js'
 import * as Auth from '../../../internal/Auth.js'
 import * as BillingSettings from '../../../db/tables/billingSettings.js'
 import * as Db from '../../../db/Db.js'
+import * as EnabledBillingSources from '../../../db/tables/enabledBillingSources.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Response from '../../../internal/Response.js'
 import * as Schema from '../../../internal/Schema.js'
@@ -113,6 +114,12 @@ export namespace schema {
   /** An organization's billing state. */
   export const Billing = Schema.describe(
     z.object({
+      enabledSources: z
+        .array(z.enum(EnabledBillingSources.sources))
+        .check(
+          z.describe('Billing sources this organization may set up.'),
+          z.meta({ examples: [['stripe']] }),
+        ),
       spend: z
         .optional(
           z.object({
@@ -234,7 +241,7 @@ export namespace schema {
 }
 
 /**
- * Mounts billing routes. Reads require membership or scoped API key access; organizations without Stripe state return `none`.
+ * Mounts billing routes. Reads require membership or scoped API key access; organizations without provider state return `none`.
  */
 export function billing() {
   return new Hono<Environment>()
@@ -255,7 +262,6 @@ export function billing() {
         responses: OpenApi.responses({
           errors: {
             404: 'No accessible organization was found for this id.',
-            501: 'Billing is not configured on this deployment.',
           },
           success: { description: "The organization's billing state.", schema: schema.Billing },
         }),
@@ -276,10 +282,7 @@ export function billing() {
             message: 'Check the query parameters and try again.',
           })
 
-        const billing = c.get('billing')
-        if (!billing) return billingUnconfigured(c)
         const environment = c.req.valid('query').environment
-        if (!stripeFor(billing, environment)) return billingUnconfigured(c)
 
         try {
           return c.json(
@@ -313,7 +316,6 @@ export function billing() {
           errors: {
             403: 'Requires the owner role.',
             404: 'No accessible organization was found for this id.',
-            501: 'Billing is not configured on this deployment.',
           },
           success: {
             description: "The organization's updated billing state.",
@@ -342,10 +344,7 @@ export function billing() {
             message: 'Check the request body and try again.',
           })
 
-        const billing = c.get('billing')
-        if (!billing) return billingUnconfigured(c)
         const environment = c.req.valid('query').environment
-        if (!stripeFor(billing, environment)) return billingUnconfigured(c)
 
         const body = c.req.valid('json')
         const org = Auth.org(c)
@@ -394,7 +393,10 @@ export function billing() {
         operationId: 'createStripeCheckout',
         responses: OpenApi.responses({
           errors: {
-            403: 'Requires the owner role.',
+            403: {
+              codes: ['api_key_forbidden', 'billing_source_disabled', 'forbidden'],
+              description: 'Requires the owner role and Stripe billing enabled.',
+            },
             404: 'No accessible organization was found for this id.',
             501: 'Billing is not configured on this deployment.',
           },
@@ -409,6 +411,7 @@ export function billing() {
       async (c) => {
         if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
+        if (Auth.narrowOrgRole) return Auth.ensureOrgRoleError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
             code: 'param_invalid',
@@ -420,16 +423,19 @@ export function billing() {
             message: 'Check the query parameters and try again.',
           })
 
-        const billing = c.get('billing')
-        if (!billing) return billingUnconfigured(c)
-        const environment = c.req.valid('query').environment
-        const source = stripeFor(billing, environment)
-        if (!source) return billingUnconfigured(c)
-
-        const { client } = source
         const org = Auth.org(c)
         const db = Db.get(c.get('db'))
         try {
+          if (!(await EnabledBillingSources.isEnabled(db, { orgId: org.id, source: 'stripe' })))
+            return billingSourceDisabled(c)
+
+          const billing = c.get('billing')
+          if (!billing) return billingUnconfigured(c)
+          const environment = c.req.valid('query').environment
+          const source = stripeFor(billing, environment)
+          if (!source) return billingUnconfigured(c)
+
+          const { client } = source
           const existing = await StripeCustomers.get(db, org.id, environment)
           const customerId = existing
             ? existing.stripeCustomerId
@@ -880,7 +886,8 @@ async function billingBody(
   environment: ResourceEnvironment,
 ) {
   const db = Db.get(c.get('db'))
-  const [record, settings] = await Promise.all([
+  const [enabledSources, record, settings] = await Promise.all([
+    EnabledBillingSources.listByOrg(db, orgId),
     StripeCustomers.get(db, orgId, environment),
     BillingSettings.get(db, orgId, environment),
   ])
@@ -895,6 +902,7 @@ async function billingBody(
     since: core_Billing.periodStart(period),
   })
   return {
+    enabledSources: enabledSources.map((record) => record.source),
     spend: { amount: core_Billing.fromBaseUnits(spend), currency, period },
     ...(settings?.spendLimit != null
       ? { spendLimit: { amount: settings.spendLimit, currency, period } }
@@ -954,6 +962,14 @@ function billingNotFound(c: Context<Environment>) {
   })
 }
 
+function billingSourceDisabled(c: Context<Environment>) {
+  return Response.error(c, {
+    code: 'billing_source_disabled',
+    message: 'Stripe billing is not enabled for this organization',
+    status: 403,
+  })
+}
+
 function billingUnconfigured(c: Context<Environment>) {
   return Response.error(c, {
     code: 'billing_unconfigured',

package/src/apps/management/routes/faucet.test.ts

@@ -0,0 +1,87 @@
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as TestApp from '../../../../test/App.js'
+import * as Faucet from './faucet.js'
+import * as Orgs from './orgs.js'
+
+const origin = 'http://localhost'
+
+function createApp() {
+  return TestApp.create({
+    rateLimit: { now: () => new Date('2026-01-01T00:00:00.000Z') },
+    session: { wallet: { origin } },
+  })
+}
+
+async function session(app: TestApp.signIn.App) {
+  const account = privateKeyToAccount(generatePrivateKey())
+  const { cookie } = await TestApp.signIn(app, account)
+  return cookie!
+}
+
+async function organization(app: ReturnType<typeof createApp>, cookie: string) {
+  const response = await app.request('/v1/orgs', {
+    body: JSON.stringify({ name: 'Acme' }),
+    headers: { 'content-type': 'application/json', cookie },
+    method: 'POST',
+  })
+  return TestApp.json(response, Orgs.schema.Organization)
+}
+
+describe('faucet', () => {
+  test('funds a member account and rate limits repeated funding', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const recipient = privateKeyToAccount(generatePrivateKey()).address
+
+    const funded = await app.request(`/v1/orgs/${org.id}/faucet`, {
+      body: JSON.stringify({ address: recipient }),
+      headers: { 'content-type': 'application/json', cookie },
+      method: 'POST',
+    })
+    expect(funded.status).toBe(200)
+    const result = await TestApp.json(funded, Faucet.schema.FundResponse)
+    expect(result.tokens.length).toBeGreaterThan(0)
+    expect(
+      result.tokens.every(
+        (entry) =>
+          entry.token.symbol.length > 0 &&
+          BigInt(entry.amount.baseUnits) > 0n &&
+          entry.amount.currency === entry.token.currency &&
+          entry.amount.decimals === entry.token.decimals &&
+          /^\d+(\.\d+)?$/.test(entry.amount.formatted),
+      ),
+    ).toBe(true)
+    expect(result.transactionHashes).toEqual(result.tokens.map((entry) => entry.transactionHash))
+
+    const repeated = await app.request(`/v1/orgs/${org.id}/faucet`, {
+      body: JSON.stringify({ address: recipient }),
+      headers: { 'content-type': 'application/json', cookie },
+      method: 'POST',
+    })
+    expect(repeated.status).toBe(429)
+    expect(repeated.headers.get('ratelimit-scope')).toBe('faucet-address')
+  })
+
+  test('requires membership and a valid address', async () => {
+    const app = createApp()
+    const owner = await session(app)
+    const org = await organization(app, owner)
+    const stranger = await session(app)
+
+    const inaccessible = await app.request(`/v1/orgs/${org.id}/faucet`, {
+      body: JSON.stringify({ address: privateKeyToAccount(generatePrivateKey()).address }),
+      headers: { 'content-type': 'application/json', cookie: stranger },
+      method: 'POST',
+    })
+    expect(inaccessible.status).toBe(404)
+
+    const invalid = await app.request(`/v1/orgs/${org.id}/faucet`, {
+      body: JSON.stringify({ address: 'not-an-address' }),
+      headers: { 'content-type': 'application/json', cookie: owner },
+      method: 'POST',
+    })
+    expect(invalid.status).toBe(400)
+  })
+})