tapimo 0.5.3 → 0.7.0

package/src/apps/management/routes/faucet.ts

@@ -0,0 +1,201 @@
+import { Hono, type Context } from 'hono'
+import * as z from 'zod/mini'
+
+import * as Auth from '../../../internal/Auth.js'
+import * as OpenApi from '../../../internal/OpenApi.js'
+import * as RateLimit from '../../../internal/RateLimit.js'
+import * as Response from '../../../internal/Response.js'
+import * as Schema from '../../../internal/Schema.js'
+import * as Value from '../../../internal/Value.js'
+import * as Viem from '../../../internal/Viem.js'
+import type { Environment } from '../App.js'
+
+const addressRateLimit = { perMinute: 1 } satisfies RateLimit.Limit
+const userRateLimit = { perMinute: 3 } satisfies RateLimit.Limit
+
+/** OpenAPI schemas owned by the sandbox faucet. */
+export namespace schema {
+  const Token = Schema.describe(
+    z.object({
+      address: Schema.TokenAddress.check(z.describe('The test token contract that minted funds.')),
+      currency: z
+        .string()
+        .check(z.describe('The token’s currency label.'), z.meta({ examples: ['USD'] })),
+      decimals: z
+        .number()
+        .check(
+          z.int(),
+          z.nonnegative(),
+          z.describe('The decimal places used by the token.'),
+          z.meta({ examples: [6] }),
+        ),
+      name: z
+        .string()
+        .check(z.describe('The token’s human-readable name.'), z.meta({ examples: ['Test USD'] })),
+      symbol: z.string().check(z.describe('The token’s symbol.'), z.meta({ examples: ['TUSD'] })),
+    }),
+    'A test token minted by the faucet.',
+  )
+
+  const FundedToken = Schema.describe(
+    z.object({
+      amount: Schema.TokenAmount.check(z.describe('Amount minted by the faucet.')),
+      token: Token,
+      transactionHash: Schema.Hash.check(z.describe('The transaction that minted this token.')),
+    }),
+    'One token amount minted by the faucet.',
+  )
+
+  /** Faucet request body. */
+  export const FundBody = Schema.describe(
+    z.object({ address: Schema.Address }),
+    'A Tempo testnet account to fund.',
+  )
+
+  /** Faucet response. */
+  export const FundResponse = Schema.describe(
+    z.object({
+      tokens: z
+        .array(FundedToken)
+        .check(z.describe('The configured test tokens minted to the account.')),
+      transactionHashes: z
+        .array(Schema.Hash)
+        .check(z.describe('Transactions that minted the configured test tokens.')),
+    }),
+    'Test tokens minted while funding the account.',
+  )
+
+  /** Faucet path parameters. */
+  export const Params = Schema.describe(
+    z.object({
+      orgId: z
+        .string()
+        .check(
+          z.describe('The organization id (`org_…`).'),
+          z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
+        ),
+    }),
+    'Path parameters for the organization faucet.',
+  )
+}
+
+const bodyValidation = {
+  code: 'body_invalid',
+  message: 'Enter a valid Tempo address.',
+} as const
+const paramValidation = {
+  code: 'param_invalid',
+  message: 'Check the path parameters and try again.',
+} as const
+
+/** Mounts the session-authenticated Tempo testnet faucet. */
+export function faucet() {
+  return new Hono<Environment>().post(
+    '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/faucet',
+    Auth.policy({ session: true }),
+    Auth.ensureOrg(),
+    OpenApi.validate('param', schema.Params, paramValidation),
+    OpenApi.validate('json', schema.FundBody, bodyValidation),
+    OpenApi.describeRoute({
+      description:
+        'Funds an account with the test tokens configured on Tempo testnet. This operation is available to signed-in organization members and is rate limited.',
+      operationId: 'fundTestnetAccount',
+      responses: OpenApi.responses({
+        errors: {
+          400: {
+            codes: ['api_key_malformed', 'body_invalid', 'param_invalid'],
+            description: 'The path or account address is invalid.',
+          },
+          404: 'No accessible organization was found.',
+        },
+        success: {
+          description: 'The account was funded.',
+          schema: schema.FundResponse,
+        },
+      }),
+      summary: 'Fund testnet account',
+      tags: ['Faucet'],
+    }),
+    async (c) => {
+      if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+      if (Auth.narrowScope) return Auth.ensureOrgError(c)
+      if (OpenApi.narrowValidation) return OpenApi.validationError(c, paramValidation)
+      if (OpenApi.narrowValidation) return OpenApi.validationError(c, bodyValidation)
+
+      const { address } = c.req.valid('json')
+      const limited = await consumeRateLimit(c, address)
+      if (limited) return rateLimitError(c, limited)
+
+      try {
+        const client = c.get('getClient')(Viem.chainId.testnet)
+        const receipts = await client.faucet.fundSync({ account: address, timeout: 30_000 })
+        const tokens = await Promise.all(
+          receipts.map(async (receipt) => {
+            const event = client.token.mint.extractEvent(receipt.logs)
+            const metadata = await client.token.getMetadata({ token: event.address })
+            return {
+              amount: Value.tokenAmount({
+                baseUnits: event.args.amount,
+                currency: metadata.currency,
+                decimals: metadata.decimals,
+              }),
+              token: {
+                address: event.address,
+                currency: metadata.currency,
+                decimals: metadata.decimals,
+                name: metadata.name,
+                symbol: metadata.symbol,
+              },
+              transactionHash: receipt.transactionHash,
+            }
+          }),
+        )
+        const transactionHashes = tokens.map((entry) => entry.transactionHash)
+        return c.json(Response.validated(schema.FundResponse, { tokens, transactionHashes }), 200)
+      } catch (cause) {
+        return Response.upstream(c, cause)
+      }
+    },
+  )
+}
+
+async function consumeRateLimit(c: Context<Environment>, address: string) {
+  const principal = Auth.getPrincipal(c)
+  const store = c.get('auth').rateLimit
+  if (!principal || !store) return undefined
+
+  const user = await store.consume({
+    key: `faucet:user:${principal.id}`,
+    limit: userRateLimit,
+  })
+  if (!user.allowed) return { result: user, scope: 'faucet-user' }
+
+  const account = await store.consume({
+    key: `faucet:address:${address}`,
+    limit: addressRateLimit,
+  })
+  if (!account.allowed) return { result: account, scope: 'faucet-address' }
+  return undefined
+}
+
+function rateLimitError(
+  c: Context<Environment>,
+  limited: {
+    /** Denied quota result. */
+    result: RateLimit.Result
+    /** Quota dimension that denied the request. */
+    scope: string
+  },
+) {
+  const { result, scope } = limited
+  c.header('RateLimit-Limit', String(result.limit))
+  c.header('RateLimit-Remaining', String(result.remaining))
+  c.header('RateLimit-Reset', String(result.reset))
+  c.header('RateLimit-Scope', scope)
+  c.header('Retry-After', String(Math.max(result.reset - Math.ceil(Date.now() / 1_000), 1)))
+  return Response.error(c, {
+    code: 'rate_limit_exceeded',
+    message: 'This account was funded recently. Try again after the cooldown.',
+    status: 429,
+  })
+}

package/src/apps/management/routes/invite-links.test.ts

@@ -82,6 +82,7 @@ describe('inviteLinks', () => {
 
     const link = await createLink(context, org.id, admin.cookie, { role: 'member' })
     expect(link).toMatchObject({
+      allowedEmailDomains: null,
       enabled: true,
       lastUsedAt: null,
       maxUses: null,
@@ -143,6 +144,122 @@ describe('inviteLinks', () => {
     expect((await listed.json()).data).toEqual([])
   })
 
+  test('normalizes and validates allowed email domains', async () => {
+    const context = createApp()
+    const { client } = context
+    const { org, owner } = await setup(context)
+    const orgLinks = client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['invite-links']
+
+    const link = await createLink(context, org.id, owner.cookie, {
+      allowedEmailDomains: [' Example.COM ', 'example.com', 'TEMPO.XYZ'],
+      name: 'Restricted',
+    })
+    expect(link.allowedEmailDomains).toEqual(['example.com', 'tempo.xyz'])
+
+    const listed = await orgLinks.$get({ param: { orgId: org.id } }, as(owner.cookie))
+    expect(listed.status).toBe(200)
+    if (listed.status !== 200) throw new Error(`Failed to list invite links: ${listed.status}`)
+    expect((await listed.json()).data[0]?.allowedEmailDomains).toEqual(['example.com', 'tempo.xyz'])
+
+    for (const allowedEmailDomains of [
+      [],
+      ['user@example.com'],
+      ['https://example.com'],
+      ['*.example.com'],
+    ]) {
+      const response = await orgLinks.$post(
+        {
+          json: { allowedEmailDomains },
+          param: { orgId: org.id },
+        },
+        as(owner.cookie),
+      )
+      expect(response.status).toBe(400)
+      if (response.status !== 400)
+        throw new Error(`Expected invalid invite link body, received ${response.status}`)
+      expect((await response.json()).error.code).toBe('body_invalid')
+    }
+  })
+
+  test('restricts new memberships without consuming rejected attempts', async () => {
+    const db = TestApp.database()
+    const context = createApp(db)
+    const { client } = context
+    const { org, owner } = await setup(context)
+    const orgLinks = client.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}']['invite-links']
+    const publicLinks = client.v1['invite-links']
+    const link = await createLink(context, org.id, owner.cookie, {
+      allowedEmailDomains: [' Example.COM '],
+      expiresAt: null,
+      maxUses: 1,
+      name: 'Restricted',
+    })
+
+    const member = await session(context)
+    await Users.setEmail(db, member.userId, 'member@sub.example.com')
+    await Memberships.create(db, { orgId: org.id, role: 'member', userId: member.userId })
+    const memberRetry = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(member.cookie),
+    )
+    expect(memberRetry.status).toBe(200)
+
+    const subdomain = await session(context)
+    await Users.setEmail(db, subdomain.userId, 'dev@sub.example.com')
+    const rejected = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(subdomain.cookie),
+    )
+    expect(rejected.status).toBe(403)
+    if (rejected.status !== 403)
+      throw new Error(`Expected forbidden invite link acceptance, received ${rejected.status}`)
+    expect((await rejected.json()).error.code).toBe('invite_link_email_forbidden')
+    expect(await Memberships.get(db, org.id, subdomain.userId)).toBeUndefined()
+
+    const audits = await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].redemptions.$get(
+      { param: { inviteLinkId: link.id, orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(audits.status).toBe(200)
+    if (audits.status !== 200) throw new Error(`Failed to list redemptions: ${audits.status}`)
+    expect((await audits.json()).data).toEqual([])
+
+    const beforeJoin = await orgLinks.$get({ param: { orgId: org.id } }, as(owner.cookie))
+    expect(beforeJoin.status).toBe(200)
+    if (beforeJoin.status !== 200)
+      throw new Error(`Failed to list invite links: ${beforeJoin.status}`)
+    expect((await beforeJoin.json()).data[0]).toMatchObject({ status: 'active', useCount: 0 })
+
+    const exact = await session(context)
+    await Users.setEmail(db, exact.userId, 'Dev@Example.com')
+    const accepted = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(exact.cookie),
+    )
+    expect(accepted.status).toBe(200)
+
+    const exhaustedRetry = await publicLinks.accept.$post(
+      { json: { token: link.token } },
+      as(member.cookie),
+    )
+    expect(exhaustedRetry.status).toBe(200)
+
+    const afterJoin = await orgLinks.$get({ param: { orgId: org.id } }, as(owner.cookie))
+    expect(afterJoin.status).toBe(200)
+    if (afterJoin.status !== 200)
+      throw new Error(`Failed to list invite links: ${afterJoin.status}`)
+    expect((await afterJoin.json()).data[0]).toMatchObject({ status: 'exhausted', useCount: 1 })
+
+    const auditsAfterJoin = await orgLinks[':inviteLinkId{iln_[A-Za-z0-9_-]+}'].redemptions.$get(
+      { param: { inviteLinkId: link.id, orgId: org.id } },
+      as(owner.cookie),
+    )
+    expect(auditsAfterJoin.status).toBe(200)
+    if (auditsAfterJoin.status !== 200)
+      throw new Error(`Failed to list redemptions: ${auditsAfterJoin.status}`)
+    expect((await auditsAfterJoin.json()).data).toHaveLength(1)
+  })
+
   test('resolve reveals only a summary and hides every unavailable reason', async () => {
     const db = TestApp.database()
     const context = createApp(db)

package/src/apps/management/routes/invite-links.ts

@@ -10,8 +10,34 @@ import * as Response from '../../../internal/Response.js'
 import * as Schema from '../../../internal/Schema.js'
 import type { Environment } from '../App.js'
 
+// A bare domain (`example.org`), normalized before validation.
+const domainPattern = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/
+
 /** OpenAPI schemas owned by reusable invite links. */
 export namespace schema {
+  const allowedEmailDomains = z
+    .nullable(
+      z.readonly(
+        z
+          .array(
+            z
+              .string()
+              .check(
+                z.trim(),
+                z.toLowerCase(),
+                z.regex(domainPattern, 'Must be a bare domain (example.org).'),
+              ),
+          )
+          .check(
+            z.minLength(1),
+            z.overwrite((domains) => [...new Set(domains)]),
+          ),
+      ),
+    )
+    .check(
+      z.describe('Email domains allowed to redeem, or null for unrestricted.'),
+      z.meta({ examples: [['example.org'], null] }),
+    )
   const nullableExpiry = z
     .nullable(z.iso.datetime({ offset: true }))
     .check(
@@ -31,6 +57,7 @@ export namespace schema {
   /** Management representation, including the recopyable bearer id. */
   export const InviteLink = Schema.describe(
     z.object({
+      allowedEmailDomains,
       createdAt: z
         .string()
         .check(
@@ -146,6 +173,7 @@ export namespace schema {
   /** Create body. */
   export const CreateBody = z
     .object({
+      allowedEmailDomains: z.optional(allowedEmailDomains),
       expiresAt: z.optional(nullableExpiry),
       maxUses: z.optional(nullableUses),
       name: z.optional(
@@ -318,6 +346,7 @@ export function inviteLinks() {
         const body = c.req.valid('json')
         try {
           const record = await InviteLinks.create(Db.get(c.get('db')), {
+            allowedEmailDomains: body.allowedEmailDomains ?? null,
             createdBy: Auth.membership(c)?.userId ?? 'super_admin',
             expiresAt:
               body.expiresAt === undefined
@@ -498,7 +527,13 @@ export function inviteLinks() {
       OpenApi.describeRoute({
         operationId: 'acceptInviteLink',
         responses: OpenApi.responses({
-          errors: { 403: 'A verified session email is required.', ...errors },
+          errors: {
+            403: {
+              codes: ['forbidden', 'invite_link_email_forbidden'],
+              description: 'A verified session email from an allowed domain is required.',
+            },
+            ...errors,
+          },
           success: { description: 'Membership.', schema: schema.AcceptResponse },
         }),
         summary: 'Accept invite link',
@@ -531,6 +566,12 @@ export function inviteLinks() {
             200,
           )
         } catch (cause) {
+          if (cause instanceof InviteLinks.EmailDomainForbiddenError)
+            return Response.error(c, {
+              code: 'invite_link_email_forbidden',
+              message: 'Sign in with an email address on an allowed domain',
+              status: 403,
+            })
           return Response.upstream(c, cause)
         }
       },
@@ -539,6 +580,7 @@ export function inviteLinks() {
 
 function serialize(record: InviteLinks.Record) {
   return {
+    allowedEmailDomains: record.allowedEmailDomains,
     createdAt: record.createdAt,
     createdBy: record.createdBy,
     enabled: record.enabled,

package/src/apps/management/routes/me.test.ts

@@ -182,13 +182,13 @@ describe('sign-in email requirement', () => {
   })
 })
 
-describe('sign-up email domains', () => {
-  test('allows new users on an allowlisted domain', async () => {
-    const oidc = await createIssuer({ email: 'dev@TEMPO.xyz' })
+describe('open sign-up', () => {
+  test('allows new users on any domain', async () => {
+    const oidc = await createIssuer({ email: 'dev@example.com' })
     try {
       const app = TestApp.create({
         auth: { keys: [TestApp.key] },
-        session: { emailAllowlist: ['Tempo.XYZ'], wallet: { issuer: oidc.url, origin } },
+        session: { wallet: { issuer: oidc.url, origin } },
       })
       const account = privateKeyToAccount(generatePrivateKey())
       const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
@@ -199,109 +199,19 @@ describe('sign-up email domains', () => {
       const response = await app.request('/v1/me', { headers: { cookie: cookie! } })
       expect(response.status).toBe(200)
       const body = await TestApp.json(response, Me.schema.User)
-      expect(body.email).toBe('dev@TEMPO.xyz')
-    } finally {
-      await oidc.close()
-    }
-  })
-
-  test('rejects new users on other domains', async () => {
-    const oidc = await createIssuer({ email: 'dev@example.com' })
-    try {
-      const app = TestApp.create({
-        auth: { keys: [TestApp.key] },
-        session: { emailAllowlist: ['tempo.xyz'], wallet: { issuer: oidc.url, origin } },
-      })
-      const account = privateKeyToAccount(generatePrivateKey())
-      const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
-        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
-      })
-
-      expect(verifyResponse.status).toBe(403)
-      expect(cookie).toBeUndefined()
-      expect(await verifyResponse.json()).toMatchInlineSnapshot(`
-        {
-          "error": "sign-ups are restricted to approved email domains or invited emails",
-        }
-      `)
+      expect(body.email).toBe('dev@example.com')
     } finally {
       await oidc.close()
     }
   })
 
-  test('rejects new users without an identity token', async () => {
-    const app = TestApp.create({
-      auth: { keys: [TestApp.key] },
-      session: { emailAllowlist: ['tempo.xyz'], wallet: { origin } },
-    })
+  test('allows new users without an identity token', async () => {
+    const app = createApp()
     const account = privateKeyToAccount(generatePrivateKey())
     const { cookie, verifyResponse } = await TestApp.signIn(app, account)
 
-    expect(verifyResponse.status).toBe(403)
-    expect(cookie).toBeUndefined()
-  })
-
-  test('allows invited emails regardless of domain', async () => {
-    const oidc = await createIssuer({ email: 'Invited@Example.com' })
-    try {
-      const db = TestApp.database()
-
-      // Owner signs up while sign-up is open and issues the invitation.
-      const open = TestApp.create({
-        auth: { keys: [TestApp.key] },
-        db,
-        session: { wallet: { origin } },
-      })
-      const owner = privateKeyToAccount(generatePrivateKey())
-      const { cookie } = await TestApp.signIn(open, owner)
-      const created = await open.request('/v1/orgs', {
-        body: JSON.stringify({ name: 'Acme' }),
-        headers: { 'content-type': 'application/json', cookie: cookie! },
-        method: 'POST',
-      })
-      const org = (await created.json()) as { id: string }
-      const invited = await open.request(`/v1/orgs/${org.id}/invitations`, {
-        body: JSON.stringify({ email: 'invited@example.com', role: 'member' }),
-        headers: { 'content-type': 'application/json', cookie: cookie! },
-        method: 'POST',
-      })
-      expect(invited.status).toBe(200)
-
-      const restricted = TestApp.create({
-        auth: { keys: [TestApp.key] },
-        db,
-        session: { emailAllowlist: ['tempo.xyz'], wallet: { issuer: oidc.url, origin } },
-      })
-      const account = privateKeyToAccount(generatePrivateKey())
-      const { verifyResponse } = await TestApp.signIn(restricted, account, {
-        idToken: ({ nonce }) => oidc.mint({ address: account.address, nonce }),
-      })
-      expect(verifyResponse.status).toBe(200)
-    } finally {
-      await oidc.close()
-    }
-  })
-
-  test('allows existing users regardless of domain', async () => {
-    const db = TestApp.database()
-    const account = privateKeyToAccount(generatePrivateKey())
-
-    // Row created before the restriction (open sign-up deployment).
-    const open = TestApp.create({
-      auth: { keys: [TestApp.key] },
-      db,
-      session: { wallet: { origin } },
-    })
-    const first = await TestApp.signIn(open, account)
-    expect(first.verifyResponse.status).toBe(200)
-
-    const restricted = TestApp.create({
-      auth: { keys: [TestApp.key] },
-      db,
-      session: { emailAllowlist: ['tempo.xyz'], wallet: { origin } },
-    })
-    const second = await TestApp.signIn(restricted, account)
-    expect(second.verifyResponse.status).toBe(200)
+    expect(verifyResponse.status).toBe(200)
+    expect(cookie).toBeDefined()
   })
 })
 

package/src/apps/management/routes/orgs.test.ts

@@ -1,8 +1,11 @@
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as TestApp from '../../../../test/App.js'
+import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
+import * as EnabledBillingSources from '../../../db/tables/enabledBillingSources.js'
 import * as Organizations from '../../../db/tables/organizations.js'
 import * as Projects from '../../../db/tables/projects.js'
+import * as Users from '../../../db/tables/users.js'
 import type * as Log from '../../../internal/Log.js'
 import * as Orgs from './orgs.js'
 
@@ -196,7 +199,8 @@ describe('GET /orgs', () => {
 
 describe('POST /orgs', () => {
   test('creates a session-owned organization', async () => {
-    const app = createApp()
+    const db = TestApp.database()
+    const app = createApp(db)
     const cookie = await session(app)
 
     const response = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
@@ -204,10 +208,48 @@ describe('POST /orgs', () => {
     const body = await TestApp.json(response, Orgs.schema.Organization)
     expect(body.id.startsWith('org_')).toBe(true)
     expect(body.name).toBe('Acme')
+    expect(await EnabledBillingSources.listByOrg(db, body.id)).toEqual([])
+  })
+
+  test.each([
+    { email: 'Dev@Example.NET', entry: 'dev@example.net', kind: 'email' },
+    { email: 'Dev@Example.ORG', entry: 'example.org', kind: 'domain' },
+  ])('enables Stripe for a session matching an early-access $kind', async ({ email, entry }) => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    await EarlyAccess.add(db, { createdBy: 'test', entry })
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { cookie } = await TestApp.signIn(app, account)
+    const user = await Users.getByAddress(db, account.address)
+    if (!user) throw new Error('sign-in did not create a user')
+    await Users.setEmail(db, user.id, email)
+
+    const response = await app.request('/v1/orgs', json('POST', cookie!, { name: 'Acme' }))
+    expect(response.status).toBe(200)
+    const org = await TestApp.json(response, Orgs.schema.Organization)
+    const sources = await EnabledBillingSources.listByOrg(db, org.id)
+    expect(sources.map(({ createdBy, source }) => ({ createdBy, source }))).toEqual([
+      { createdBy: user.id, source: 'stripe' },
+    ])
+  })
+
+  test('does not enable Stripe without an early-access grant', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { cookie } = await TestApp.signIn(app, account)
+    const user = await Users.getByAddress(db, account.address)
+    if (!user) throw new Error('sign-in did not create a user')
+    await Users.setEmail(db, user.id, 'dev@example.net')
+
+    const response = await app.request('/v1/orgs', json('POST', cookie!, { name: 'Acme' }))
+    const org = await TestApp.json(response, Orgs.schema.Organization)
+    expect(await EnabledBillingSources.listByOrg(db, org.id)).toEqual([])
   })
 
   test('creates a memberless org as the super admin', async () => {
-    const app = createApp()
+    const db = TestApp.database()
+    const app = createApp(db)
     const response = await app.request('/v1/orgs', {
       body: JSON.stringify({ name: 'Ops' }),
       headers: { 'content-type': 'application/json', 'tempo-api-key': secret },
@@ -216,6 +258,7 @@ describe('POST /orgs', () => {
     expect(response.status).toBe(200)
     const org = await TestApp.json(response, Orgs.schema.Organization)
     expect(org.name).toBe('Ops')
+    expect(await EnabledBillingSources.listByOrg(db, org.id)).toEqual([])
 
     // Memberless: invisible to sessions until an owner is seated.
     const cookie = await session(app)

package/src/apps/management/routes/orgs.ts

@@ -5,6 +5,7 @@ import * as ApiKeys from '../../../ApiKeys.js'
 import type * as App from '../../../App.js'
 import * as Auth from '../../../internal/Auth.js'
 import * as Db from '../../../db/Db.js'
+import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
 import * as Memberships from '../../../db/tables/memberships.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Organizations from '../../../db/tables/organizations.js'
@@ -189,6 +190,11 @@ export function orgs() {
               ? await Organizations.create(db, { createdBy: 'super_admin', name: body.name })
               : {
                   ...(await Organizations.createOwned(db, {
+                    enabledBillingSources:
+                      principal.email &&
+                      (await EarlyAccess.matches(db, principal.email.trim().toLowerCase()))
+                        ? ['stripe']
+                        : [],
                     name: body.name,
                     userId: principal.id,
                   })),

package/src/apps/management/routes/scopes.test.ts

@@ -21,6 +21,7 @@ describe('scopes', () => {
         "indexer:query",
         "management:read",
         "management:write",
+        "mpp:write",
         "rpc-relay:read",
         "rpc-relay:sponsor",
         "webhooks:read",