tapimo 0.6.0 → 0.7.0

package/src/apps/management/routes/me.test.ts

@@ -4,8 +4,6 @@ import { exportJWK, generateKeyPair } from 'jose'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as TestApp from '../../../../test/App.js'
-import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
-import * as Users from '../../../db/tables/users.js'
 import * as Me from './me.js'
 
 /** Origin pinned for SIWE domain binding; Hono test requests use this host. */
@@ -20,40 +18,6 @@ function createApp() {
   })
 }
 
-/** App with the early-access gate enabled; allowlist entries seed through `EarlyAccess.add`. */
-function createGatedApp(db = TestApp.database()) {
-  return TestApp.create({
-    auth: { keys: [TestApp.key] },
-    db,
-    session: { wallet: { origin } },
-    tmp_earlyAccess: true,
-  })
-}
-
-/** RequestInit for a JSON mutation carrying the session cookie. */
-function json(method: 'POST', cookie: string, body: unknown) {
-  return {
-    body: JSON.stringify(body),
-    headers: { 'content-type': 'application/json', cookie },
-    method,
-  }
-}
-
-/** Signs in a fresh scripted account; returns its session cookie and user id. */
-async function session(app: TestApp.signIn.App) {
-  const account = privateKeyToAccount(generatePrivateKey())
-  const { cookie } = await TestApp.signIn(app, account)
-  const me = await app.request('/v1/me', { headers: { cookie: cookie! } })
-  const { id } = (await me.json()) as { id: string }
-  return { cookie: cookie!, userId: id }
-}
-
-/** Reads the session's `tmp_earlyAccess` flag from `/v1/me`. TODO: remove after GA. */
-async function tmp_earlyAccess(app: TestApp.signIn.App, cookie: string) {
-  const response = await app.request('/v1/me', { headers: { cookie } })
-  return (await TestApp.json(response, Me.schema.User)).tmp_earlyAccess
-}
-
 describe('GET /me', () => {
   test('returns the signed-in user', async () => {
     const app = createApp()
@@ -219,13 +183,12 @@ describe('sign-in email requirement', () => {
 })
 
 describe('open sign-up', () => {
-  test('allows new users on any domain with the gate on', async () => {
+  test('allows new users on any domain', async () => {
     const oidc = await createIssuer({ email: 'dev@example.com' })
     try {
       const app = TestApp.create({
         auth: { keys: [TestApp.key] },
         session: { wallet: { issuer: oidc.url, origin } },
-        tmp_earlyAccess: true,
       })
       const account = privateKeyToAccount(generatePrivateKey())
       const { cookie, verifyResponse } = await TestApp.signIn(app, account, {
@@ -242,8 +205,8 @@ describe('open sign-up', () => {
     }
   })
 
-  test('allows new users without an identity token with the gate on', async () => {
-    const app = createGatedApp()
+  test('allows new users without an identity token', async () => {
+    const app = createApp()
     const account = privateKeyToAccount(generatePrivateKey())
     const { cookie, verifyResponse } = await TestApp.signIn(app, account)
 
@@ -252,111 +215,6 @@ describe('open sign-up', () => {
   })
 })
 
-describe('tmp_earlyAccess', () => {
-  test('defaults to true while the gate is dormant', async () => {
-    const app = createApp()
-    const { cookie } = await session(app)
-    expect(await tmp_earlyAccess(app, cookie)).toBe(true)
-  })
-
-  test('matches domain entries case-insensitively', async () => {
-    const db = TestApp.database()
-    const app = createGatedApp(db)
-    await EarlyAccess.add(db, { createdBy: 'test', entry: 'Example.ORG' })
-    const user = await session(app)
-    await Users.setEmail(db, user.userId, 'Dev@EXAMPLE.org')
-
-    expect(await tmp_earlyAccess(app, user.cookie)).toBe(true)
-  })
-
-  test('exact-email entries grant only that address', async () => {
-    const db = TestApp.database()
-    const app = createGatedApp(db)
-    await EarlyAccess.add(db, { createdBy: 'test', entry: 'dev@example.org' })
-    const granted = await session(app)
-    await Users.setEmail(db, granted.userId, 'dev@example.org')
-    const denied = await session(app)
-    await Users.setEmail(db, denied.userId, 'other@example.org')
-
-    expect(await tmp_earlyAccess(app, granted.cookie)).toBe(true)
-    expect(await tmp_earlyAccess(app, denied.cookie)).toBe(false)
-  })
-
-  test('stays false without a matching entry', async () => {
-    const db = TestApp.database()
-    const app = createGatedApp(db)
-    const user = await session(app)
-    await Users.setEmail(db, user.userId, 'dev@example.net')
-
-    expect(await tmp_earlyAccess(app, user.cookie)).toBe(false)
-  })
-
-  test('stays false without a verified email', async () => {
-    const app = createGatedApp()
-    const { cookie } = await session(app)
-
-    expect(await tmp_earlyAccess(app, cookie)).toBe(false)
-  })
-
-  test('flips false once the entry is removed', async () => {
-    const db = TestApp.database()
-    const app = createGatedApp(db)
-    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
-    const user = await session(app)
-    await Users.setEmail(db, user.userId, 'dev@example.org')
-    expect(await tmp_earlyAccess(app, user.cookie)).toBe(true)
-
-    await EarlyAccess.remove(db, 'example.org')
-    expect(await tmp_earlyAccess(app, user.cookie)).toBe(false)
-  })
-
-  test('invitations from early-access inviters grant access until revoked', async () => {
-    const db = TestApp.database()
-    const app = createGatedApp(db)
-    await EarlyAccess.add(db, { createdBy: 'test', entry: 'example.org' })
-    const inviter = await session(app)
-    await Users.setEmail(db, inviter.userId, 'owner@example.org')
-    const created = await app.request('/v1/orgs', json('POST', inviter.cookie, { name: 'Acme' }))
-    const org = (await created.json()) as { id: string }
-    const invited = await app.request(
-      `/v1/orgs/${org.id}/invitations`,
-      json('POST', inviter.cookie, { email: 'invitee@example.net', role: 'member' }),
-    )
-    expect(invited.status).toBe(200)
-    const invitation = (await invited.json()) as { id: string }
-
-    const invitee = await session(app)
-    await Users.setEmail(db, invitee.userId, 'invitee@example.net')
-    expect(await tmp_earlyAccess(app, invitee.cookie)).toBe(true)
-
-    // Revoking the invitation withdraws the grant.
-    const revoked = await app.request(`/v1/orgs/${org.id}/invitations/${invitation.id}`, {
-      headers: { cookie: inviter.cookie },
-      method: 'DELETE',
-    })
-    expect(revoked.status).toBe(200)
-    expect(await tmp_earlyAccess(app, invitee.cookie)).toBe(false)
-  })
-
-  test('invitations from non-early-access inviters do not grant access', async () => {
-    const db = TestApp.database()
-    const app = createGatedApp(db)
-    const inviter = await session(app)
-    await Users.setEmail(db, inviter.userId, 'owner@example.net')
-    const created = await app.request('/v1/orgs', json('POST', inviter.cookie, { name: 'Acme' }))
-    const org = (await created.json()) as { id: string }
-    const invited = await app.request(
-      `/v1/orgs/${org.id}/invitations`,
-      json('POST', inviter.cookie, { email: 'friend@example.net', role: 'member' }),
-    )
-    expect(invited.status).toBe(200)
-
-    const invitee = await session(app)
-    await Users.setEmail(db, invitee.userId, 'friend@example.net')
-    expect(await tmp_earlyAccess(app, invitee.cookie)).toBe(false)
-  })
-})
-
 /** Local OIDC issuer standing in for the wallet: the SDK's own provider (discovery, JWKS, token mint). */
 async function createIssuer(options: { email: string }) {
   // Extractable: the provider takes key material as JWK strings.

package/src/apps/management/routes/me.ts

@@ -35,11 +35,6 @@ export namespace schema {
           z.describe('Opaque user id (`usr_…`).'),
           z.meta({ examples: ['usr_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
         ),
-      // TODO: remove after GA.
-      tmp_earlyAccess: z.boolean().check(
-        z.describe('Whether the user has early access; gated features require it while the platform is invite-only.'), // prettier-ignore
-        z.meta({ examples: [true] }),
-      ),
       updatedAt: z
         .string()
         .check(
@@ -99,7 +94,6 @@ export function me() {
             createdAt: user.createdAt,
             ...(user.email ? { email: user.email } : {}),
             id: user.id,
-            tmp_earlyAccess: await Auth.tmp_earlyAccess(c),
             updatedAt: user.updatedAt,
           }),
           200,

package/src/apps/management/routes/orgs.test.ts

@@ -1,8 +1,11 @@
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as TestApp from '../../../../test/App.js'
+import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
+import * as EnabledBillingSources from '../../../db/tables/enabledBillingSources.js'
 import * as Organizations from '../../../db/tables/organizations.js'
 import * as Projects from '../../../db/tables/projects.js'
+import * as Users from '../../../db/tables/users.js'
 import type * as Log from '../../../internal/Log.js'
 import * as Orgs from './orgs.js'
 
@@ -196,7 +199,8 @@ describe('GET /orgs', () => {
 
 describe('POST /orgs', () => {
   test('creates a session-owned organization', async () => {
-    const app = createApp()
+    const db = TestApp.database()
+    const app = createApp(db)
     const cookie = await session(app)
 
     const response = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
@@ -204,10 +208,48 @@ describe('POST /orgs', () => {
     const body = await TestApp.json(response, Orgs.schema.Organization)
     expect(body.id.startsWith('org_')).toBe(true)
     expect(body.name).toBe('Acme')
+    expect(await EnabledBillingSources.listByOrg(db, body.id)).toEqual([])
+  })
+
+  test.each([
+    { email: 'Dev@Example.NET', entry: 'dev@example.net', kind: 'email' },
+    { email: 'Dev@Example.ORG', entry: 'example.org', kind: 'domain' },
+  ])('enables Stripe for a session matching an early-access $kind', async ({ email, entry }) => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    await EarlyAccess.add(db, { createdBy: 'test', entry })
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { cookie } = await TestApp.signIn(app, account)
+    const user = await Users.getByAddress(db, account.address)
+    if (!user) throw new Error('sign-in did not create a user')
+    await Users.setEmail(db, user.id, email)
+
+    const response = await app.request('/v1/orgs', json('POST', cookie!, { name: 'Acme' }))
+    expect(response.status).toBe(200)
+    const org = await TestApp.json(response, Orgs.schema.Organization)
+    const sources = await EnabledBillingSources.listByOrg(db, org.id)
+    expect(sources.map(({ createdBy, source }) => ({ createdBy, source }))).toEqual([
+      { createdBy: user.id, source: 'stripe' },
+    ])
+  })
+
+  test('does not enable Stripe without an early-access grant', async () => {
+    const db = TestApp.database()
+    const app = createApp(db)
+    const account = privateKeyToAccount(generatePrivateKey())
+    const { cookie } = await TestApp.signIn(app, account)
+    const user = await Users.getByAddress(db, account.address)
+    if (!user) throw new Error('sign-in did not create a user')
+    await Users.setEmail(db, user.id, 'dev@example.net')
+
+    const response = await app.request('/v1/orgs', json('POST', cookie!, { name: 'Acme' }))
+    const org = await TestApp.json(response, Orgs.schema.Organization)
+    expect(await EnabledBillingSources.listByOrg(db, org.id)).toEqual([])
   })
 
   test('creates a memberless org as the super admin', async () => {
-    const app = createApp()
+    const db = TestApp.database()
+    const app = createApp(db)
     const response = await app.request('/v1/orgs', {
       body: JSON.stringify({ name: 'Ops' }),
       headers: { 'content-type': 'application/json', 'tempo-api-key': secret },
@@ -216,6 +258,7 @@ describe('POST /orgs', () => {
     expect(response.status).toBe(200)
     const org = await TestApp.json(response, Orgs.schema.Organization)
     expect(org.name).toBe('Ops')
+    expect(await EnabledBillingSources.listByOrg(db, org.id)).toEqual([])
 
     // Memberless: invisible to sessions until an owner is seated.
     const cookie = await session(app)

package/src/apps/management/routes/orgs.ts

@@ -5,6 +5,7 @@ import * as ApiKeys from '../../../ApiKeys.js'
 import type * as App from '../../../App.js'
 import * as Auth from '../../../internal/Auth.js'
 import * as Db from '../../../db/Db.js'
+import * as EarlyAccess from '../../../db/tables/earlyAccess.js'
 import * as Memberships from '../../../db/tables/memberships.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Organizations from '../../../db/tables/organizations.js'
@@ -189,6 +190,11 @@ export function orgs() {
               ? await Organizations.create(db, { createdBy: 'super_admin', name: body.name })
               : {
                   ...(await Organizations.createOwned(db, {
+                    enabledBillingSources:
+                      principal.email &&
+                      (await EarlyAccess.matches(db, principal.email.trim().toLowerCase()))
+                        ? ['stripe']
+                        : [],
                     name: body.name,
                     userId: principal.id,
                   })),

package/src/apps/management/routes/scopes.test.ts

@@ -21,6 +21,7 @@ describe('scopes', () => {
         "indexer:query",
         "management:read",
         "management:write",
+        "mpp:write",
         "rpc-relay:read",
         "rpc-relay:sponsor",
         "webhooks:read",

package/src/apps/mpp/App.ts

@@ -0,0 +1,86 @@
+import { Hono } from 'hono'
+import type * as z from 'zod/mini'
+
+import type * as App from '../../App.js'
+import * as Auth from '../../internal/Auth.js'
+import * as OpenApi from '../../internal/OpenApi.js'
+import * as Metadata from '../metadata.js'
+import * as Mpp from './Mpp.js'
+
+/** Mounts MPP credential verification and broadcast routes. */
+export function mpp() {
+  const app = new Hono<App.Environment>()
+    .post(
+      '/v1/mpp/verify',
+      Auth.policy({ apiKey: { scopes: ['mpp:write'] }, mpp: false, public: false }),
+      OpenApi.validate('json', Mpp.schema.RelayInput, bodyValidation),
+      OpenApi.describeRoute({
+        operationId: 'verifyMppCredential',
+        responses: responses({
+          description: 'The MPP credential validation result.',
+          schema: Mpp.schema.VerifyResponse,
+        }),
+        summary: 'Verify MPP credential',
+        tags: ['MPP Relay'],
+      }),
+      (c) => {
+        if (Auth.narrowAccess) return Auth.accessError(c)
+        if (OpenApi.narrowValidation) return OpenApi.validationError(c, bodyValidation)
+        return Mpp.unavailable<Mpp.VerifyResponse>(c)
+      },
+    )
+    .post(
+      '/v1/mpp/broadcast',
+      Auth.policy({ apiKey: { scopes: ['mpp:write'] }, mpp: false, public: false }),
+      OpenApi.validate('json', Mpp.schema.RelayInput, bodyValidation),
+      OpenApi.describeRoute({
+        operationId: 'broadcastMppCredential',
+        responses: responses({
+          description: 'The MPP credential broadcast result.',
+          schema: Mpp.schema.BroadcastResponse,
+        }),
+        summary: 'Broadcast MPP credential',
+        tags: ['MPP Relay'],
+      }),
+      (c) => {
+        if (Auth.narrowAccess) return Auth.accessError(c)
+        if (OpenApi.narrowValidation) return OpenApi.validationError(c, bodyValidation)
+        return Mpp.unavailable<Mpp.BroadcastResponse>(c)
+      },
+    )
+  return Metadata.attach(app, openapi)
+}
+
+const bodyValidation = {
+  code: 'body_invalid',
+  message: 'Check the MPP credential and challenge, then try again.',
+} as const
+
+function responses<schema extends z.ZodMiniType>(options: { description: string; schema: schema }) {
+  return {
+    ...OpenApi.responses({
+      errors: { 403: 'The API key does not grant MPP relay access.' },
+      success: options,
+    }),
+    503: {
+      content: { 'application/json': { schema: OpenApi.resolver(Mpp.schema.Unavailable) } },
+      description: 'MPP relay settlement is temporarily unavailable.',
+      headers: {
+        'Retry-After': {
+          description: 'How many seconds to wait before retrying the relay.',
+          schema: { type: 'integer' as const },
+        },
+      },
+    },
+  }
+}
+
+const openapi = {
+  tags: [
+    {
+      name: 'MPP Relay',
+      description: 'Validate and broadcast MPP payment credentials through Tempo.',
+    },
+  ],
+  'x-tagGroups': [{ name: 'Payments', tags: ['MPP Relay'] }],
+} satisfies App.create.Metadata

package/src/apps/mpp/Mpp.test.ts

@@ -0,0 +1,193 @@
+import * as TestApp from '../../../test/App.js'
+import * as Mpp from './Mpp.js'
+
+const key = {
+  id: 'key_mpp',
+  orgId: 'org_test',
+  scopes: ['mpp:write'],
+  token: 'secret_mpp',
+} satisfies TestApp.kvStore.Key
+
+const input = {
+  challenge: {
+    description: 'Tempo API payment',
+    id: 'ch_01j3j1k2l3m4n5p6q7r8s9t0u',
+    intent: 'charge',
+    method: 'tempo',
+    opaque: 'eyJhbGciOiJIUzI1NiJ9',
+    realm: 'merchant.example',
+    request: { amount: '1', currency: 'USD' },
+  },
+  payload: { signature: `0x${'aa'.repeat(65)}`, type: 'transaction' },
+} satisfies Mpp.RelayInput
+
+const errorCodes = [
+  'unsupported',
+  'policy_denied',
+  'invalid_payment',
+  'insufficient_funds',
+  'expired',
+  'already_used',
+  'screen_rejected',
+  'simulation_failed',
+  'broadcast_failed',
+  'temporarily_unavailable',
+  'unknown',
+] as const
+
+const errorDescriptions = [
+  'Method, intent, network, or asset is unsupported.',
+  'Payment violates relay or account policy.',
+  'Payload, signature, parties, or payment requirements are invalid.',
+  'Sender lacks funds.',
+  'Challenge or payment authorization expired.',
+  'Credential or transaction already used.',
+  'Originator or recipient failed screening.',
+  'Transaction simulation failed before broadcast.',
+  'Transaction broadcast or confirmation failed.',
+  'Retry may succeed.',
+  'Unexpected relay failure.',
+] as const
+
+describe('MPP relay', () => {
+  test.each(['/v1/mpp/verify', '/v1/mpp/broadcast'])('%s requires the MPP scope', async (path) => {
+    const app = TestApp.create({ auth: { keys: [key] } })
+    const response = await app.fetch(
+      new Request(`http://tempo-api.test${path}`, {
+        body: JSON.stringify(input),
+        headers: { 'content-type': 'application/json', authorization: 'Bearer secret_mpp' },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(503)
+    expect(response.headers.get('retry-after')).toBe('60')
+    expect(await response.json()).toMatchInlineSnapshot(`
+      {
+        "error": {
+          "code": "temporarily_unavailable",
+          "message": "MPP relay is not enabled yet.",
+        },
+        "success": false,
+      }
+    `)
+  })
+
+  test('rejects unscoped API keys', async () => {
+    const app = TestApp.create({ auth: { keys: [key, TestApp.key] } })
+    const response = await app.fetch(
+      new Request('http://tempo-api.test/v1/mpp/verify', {
+        body: JSON.stringify(input),
+        headers: {
+          'content-type': 'application/json',
+          authorization: `Bearer ${TestApp.key.token}`,
+        },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ error: { code: 'api_key_forbidden' } })
+  })
+
+  test('requires API-key authentication', async () => {
+    const app = TestApp.create()
+    const response = await app.fetch(
+      new Request('http://tempo-api.test/v1/mpp/verify', {
+        body: JSON.stringify(input),
+        headers: { 'content-type': 'application/json' },
+        method: 'POST',
+      }),
+    )
+
+    expect(response.status).toBe(401)
+    expect(await response.json()).toMatchObject({ error: { code: 'api_key_missing' } })
+  })
+
+  test.each(['/v1/mpp/verify', '/v1/mpp/broadcast'])(
+    '%s rejects malformed credential input before the disabled handler',
+    async (path) => {
+      const app = TestApp.create({ auth: { keys: [key] } })
+      const response = await app.fetch(
+        new Request(`http://tempo-api.test${path}`, {
+          body: JSON.stringify({}),
+          headers: { 'content-type': 'application/json', authorization: 'Bearer secret_mpp' },
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(400)
+      expect(await response.json()).toMatchObject({ error: { code: 'body_invalid' } })
+    },
+  )
+
+  test.each(['/v1/mpp/verify', '/v1/mpp/broadcast'])(
+    '%s requires a credential payload',
+    async (path) => {
+      const app = TestApp.create({ auth: { keys: [key] } })
+      const response = await app.fetch(
+        new Request(`http://tempo-api.test${path}`, {
+          body: JSON.stringify({ challenge: input.challenge }),
+          headers: { 'content-type': 'application/json', authorization: 'Bearer secret_mpp' },
+          method: 'POST',
+        }),
+      )
+
+      expect(response.status).toBe(400)
+      expect(await response.json()).toMatchObject({ error: { code: 'body_invalid' } })
+    },
+  )
+
+  test('publishes the MPP endpoints', async () => {
+    const app = TestApp.create()
+    const spec = (await (await app.request('/openapi.json')).json()) as {
+      paths: Record<string, { post?: { responses?: Record<string, unknown> } }>
+    }
+
+    for (const path of ['/v1/mpp/verify', '/v1/mpp/broadcast']) {
+      expect(spec.paths[path]?.post?.responses?.['200']).toBeDefined()
+      expect(spec.paths[path]?.post?.responses?.['503']).toBeDefined()
+    }
+
+    const response = JSON.stringify(spec.paths['/v1/mpp/verify']?.post?.responses?.['200'])
+    for (const description of errorDescriptions) expect(response).toContain(description)
+  })
+})
+
+describe('MPP relay schemas', () => {
+  test('parses public relay contracts', () => {
+    expect(Mpp.schema.RelayInput.parse(input)).toEqual(input)
+    expect(Mpp.schema.VerifyResponse.parse({ success: true })).toEqual({ success: true })
+    expect(
+      Mpp.schema.BroadcastResponse.parse({
+        receipt: {
+          method: 'tempo',
+          reference: `0x${'22'.repeat(32)}`,
+          timestamp: '2026-07-20T18:30:00.000Z',
+        },
+        success: true,
+      }),
+    ).toMatchInlineSnapshot(`
+      {
+        "receipt": {
+          "method": "tempo",
+          "reference": "0x2222222222222222222222222222222222222222222222222222222222222222",
+          "timestamp": "2026-07-20T18:30:00.000Z",
+        },
+        "success": true,
+      }
+    `)
+  })
+
+  test.each(errorCodes)('accepts the %s error code', (code) => {
+    expect(Mpp.schema.RelayError.parse({ code })).toEqual({ code })
+  })
+
+  test('publishes the relay error code type', () => {
+    expectTypeOf<Mpp.RelayErrorCode>().toEqualTypeOf<(typeof errorCodes)[number]>()
+  })
+
+  test('rejects an unknown error code', () => {
+    expect(Mpp.schema.RelayError.safeParse({ code: 'unexpected' }).success).toBe(false)
+  })
+})