Hermes
e8ab0e09a0
[mm-grade=A] (MiniMax-M3 adversarial review, 3 rounds) Codex quota exhausted 2026-08-19 21:26 UTC. Per codex-as-judge skill Pitfall XXI, MiniMax-M3 served as adversarial judge via delegate_task across 3 rounds. Final grade: A. No blocking defects remaining. Round 1 (initial: C — 14 issues): CRITICAL/HIGH fixed: 1. Layer-2 delivery idempotency (different event + same session) 2. Mislabeled idempotency test (#2 was layer-1 not layer-2) 3. CRLF test was vacuous (regex matched space-after-colon) 4. Currency: native symbols for EUR/GBP/JPY/etc, ISO code fallback 5. PDF graceful degradation on poison-pill inputs 6. Retry uses claim.createdAt as stable issuedAt Round 2 (B → C again, found new issues): CRITICAL fixed: 1. amountCents accepted string/NaN/Infinity/negative → rendered $0.00 silently (financial-document bug) 2. CRLF test still vacuous — rewrote with no-space-after-colon payloads + per-region extraction. Mutation-tested: deleting stripControlChars → test FAILS. 3. Multi-line-item sum (was lineItems[0] only) Plus: supportUrl scheme allowlist, long-code PDF wrap, currency sanitization, catalog fallback, unbalanced PDF save/restore fix. Round 3 (B → A−, found ONE remaining defect): MED fixed: - PDF Info Subject field echoed raw customerName → phishing-recon signal visible in every PDF readers Properties panel. Now constant. - PDF body Bill To had raw <script> visible (no XSS but phishing). Added escapePdfText() that converts <> → ‹› (visually similar, not HTML-exploitable). Polish: - Bridge wiring: claim.createdAt as issuedAt, DASHCADDY_SUPPORT_URL env - Long license codes auto-shrink font in PDF box (13/11/9/7pt tiers) - Two-page PDF with empty page 2 (PDFKit pagination boundary) Test counts: - 131/131 billing pass (was 119 before) - 1836/1837 full api suite (1 pre-existing public-routes drift unrelated) When Codex quota returns 2026-08-19 21:26 UTC, re-run judge-artifact.sh for the canonical verdict and supersede [mm-grade=A] if needed.
741 lines
34 KiB
JavaScript
741 lines
34 KiB
JavaScript
/**
|
|
* DC-054 + DC-057 stripe-license-bridge tests.
|
|
*
|
|
* Strategy: no live network, no live Stripe SDK. We use `jest.mock` to
|
|
* substitute license-keygen + nodemailer before the bridge loads, drive
|
|
* handleWebhook() with crafted raw bodies + signatures.
|
|
*
|
|
* Coverage:
|
|
* - Signature validation (pass / missing / wrong / out-of-tolerance)
|
|
* - JSON parse failure
|
|
* - Duplicate event-id → 200 idempotent
|
|
* - Two different events for the SAME session → single license (layer-2 idempotency)
|
|
* - License persisted BEFORE email (crash-safety)
|
|
* - Email failure → markDeliveryFailed → returns 500 → customer can retrieve via lookup
|
|
* - Retry from pending_email delivers the SAME code
|
|
* - Concurrent lease (busy) returns 409
|
|
* - Catalog resolution: missing productId → 400; unknown productId → 400;
|
|
* product-not-configured → 400
|
|
* - Lookup endpoint: not_found, processing, pending_email, delivered, expired TTL
|
|
* - Layer-1 + Layer-2 idempotency under Stripe retry
|
|
*/
|
|
|
|
// jest.mock must be hoisted before any require.
|
|
jest.mock('../../license-keygen', () => {
|
|
const crypto = require('crypto');
|
|
let calls = 0;
|
|
return {
|
|
VALID_DURATIONS: [30, 90, 180, 365],
|
|
loadSecret: () => 'mock-license-secret-' + crypto.randomBytes(8).toString('hex'),
|
|
generateCodes: jest.fn(({ durationDays, count }) => {
|
|
calls++;
|
|
const codes = [];
|
|
for (let i = 0; i < count; i++) {
|
|
codes.push({
|
|
code: `DC-TEST-${durationDays}D-${crypto.randomBytes(4).toString('hex').toUpperCase()}`,
|
|
codeId: `codeid_${Date.now()}_${i}_${calls}`,
|
|
});
|
|
}
|
|
return codes;
|
|
}),
|
|
__resetGenerateCalls() { calls = 0; },
|
|
__getGenerateCalls() { return calls; },
|
|
};
|
|
});
|
|
|
|
jest.mock('nodemailer', () => ({
|
|
createTransport: jest.fn(() => ({
|
|
sendMail: jest.fn(),
|
|
})),
|
|
}));
|
|
|
|
const path = require('path');
|
|
const fs = require('fs');
|
|
const os = require('os');
|
|
const crypto = require('crypto');
|
|
|
|
// Set up isolated tmp dirs BEFORE requiring the bridge (it captures paths at require time).
|
|
const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'dc057-bridge-'));
|
|
process.env.STRIPE_BRIDGE_STATE_DIR = TMP;
|
|
process.env.STRIPE_BRIDGE_EVENTS_FILE = path.join(TMP, 'stripe-events.json');
|
|
process.env.STRIPE_BRIDGE_FULFILLMENT_STORE_FILE = path.join(TMP, 'stripe-fulfillments.json');
|
|
// Use a unique webhook secret so tests don't pollute each other.
|
|
process.env.STRIPE_WEBHOOK_SECRET = 'whsec_test_' + crypto.randomBytes(8).toString('hex');
|
|
// Configure all Stripe Prices so catalog.getConfiguredProducts() returns them.
|
|
process.env.STRIPE_PRICE_PRO_30D = 'price_30d_test';
|
|
process.env.STRIPE_PRICE_PRO_90D = 'price_90d_test';
|
|
process.env.STRIPE_PRICE_PRO_180D = 'price_180d_test';
|
|
process.env.STRIPE_PRICE_PRO_365D = 'price_365d_test';
|
|
// Disable SMTP so the bridge falls back to dev-console unless a test
|
|
// explicitly injects nodemailer.
|
|
delete process.env.SMTP_HOST;
|
|
delete process.env.SMTP_FROM;
|
|
|
|
const licenseKeygenMock = require('../../license-keygen');
|
|
const nodemailerMock = require('nodemailer');
|
|
const bridge = require('../../scripts/stripe-license-bridge');
|
|
const catalog = require('../../src/billing/catalog');
|
|
const { createFulfillmentStore } = require('../../src/billing/fulfillment-store');
|
|
|
|
afterEach(() => {
|
|
delete process.env.SMTP_HOST;
|
|
delete process.env.SMTP_FROM;
|
|
licenseKeygenMock.__resetGenerateCalls();
|
|
// Reset nodemailer.sendMail mock implementations between tests.
|
|
nodemailerMock.createTransport.mockClear();
|
|
});
|
|
|
|
// Helper: build a signed Stripe webhook payload.
|
|
function buildSignedPayload(body, opts = {}) {
|
|
const secret = opts.secret || process.env.STRIPE_WEBHOOK_SECRET;
|
|
const ts = opts.timestamp || Math.floor(Date.now() / 1000);
|
|
const rawBody = Buffer.from(JSON.stringify(body));
|
|
const sig = crypto.createHmac('sha256', secret).update(`${ts}.${rawBody}`, 'utf8').digest('hex');
|
|
const header = `t=${ts},v1=${sig}`;
|
|
return { rawBody, signatureHeader: header };
|
|
}
|
|
|
|
function buildSessionEvent({ productId = 'pro-30d', sessionId, customerEmail = 'alice@example.com',
|
|
eventId, lineItems, paymentStatus = 'paid' }) {
|
|
const product = catalog.getProduct(productId);
|
|
// For tests of "unknown productId" the catalog.getProduct returns null —
|
|
// we still build a valid event so the bridge can return its own 400.
|
|
const priceId = product ? catalog.getConfiguredPrice(product) : 'price_unconfigured';
|
|
return {
|
|
id: eventId || `evt_${crypto.randomBytes(6).toString('hex')}`,
|
|
type: 'checkout.session.completed',
|
|
data: {
|
|
object: {
|
|
id: sessionId || `cs_test_${crypto.randomBytes(6).toString('hex')}`,
|
|
customer_email: customerEmail,
|
|
customer_details: { email: customerEmail },
|
|
payment_status: paymentStatus,
|
|
amount_total: product ? product.amountCents : 0,
|
|
currency: 'usd',
|
|
metadata: { productId, product: 'dashcaddy-pro' },
|
|
line_items: { data: lineItems || [{ price: { id: priceId } }] },
|
|
},
|
|
},
|
|
};
|
|
}
|
|
|
|
function injectSmtp(impl) {
|
|
nodemailerMock.createTransport.mockImplementation(() => ({
|
|
sendMail: jest.fn().mockImplementation(impl),
|
|
}));
|
|
}
|
|
|
|
describe('stripe-license-bridge signature verification', () => {
|
|
test('rejects missing signature header', async () => {
|
|
const { rawBody } = buildSignedPayload({ id: 'evt_1', type: 'x' });
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader: '' });
|
|
expect(result.status).toBe(400);
|
|
expect(result.body.reason).toBe('signature-missing-signature');
|
|
});
|
|
|
|
test('rejects wrong signature', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-30d' });
|
|
const ts = Math.floor(Date.now() / 1000);
|
|
const rawBody = Buffer.from(JSON.stringify(event));
|
|
const sig = crypto.createHmac('sha256', 'wrong').update(`${ts}.${rawBody}`, 'utf8').digest('hex');
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader: `t=${ts},v1=${sig}` });
|
|
expect(result.status).toBe(400);
|
|
expect(result.body.reason).toMatch(/^signature-/);
|
|
});
|
|
|
|
test('rejects out-of-tolerance timestamp', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-30d' });
|
|
const oldTs = Math.floor(Date.now() / 1000) - 3600; // 1h ago, > 300s tolerance
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event, { timestamp: oldTs });
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(400);
|
|
expect(result.body.reason).toBe('signature-timestamp-out-of-tolerance');
|
|
});
|
|
});
|
|
|
|
describe('stripe-license-bridge event parsing', () => {
|
|
test('rejects invalid JSON', async () => {
|
|
const rawBody = Buffer.from('not json');
|
|
const ts = Math.floor(Date.now() / 1000);
|
|
const sig = crypto.createHmac('sha256', process.env.STRIPE_WEBHOOK_SECRET).update(`${ts}.${rawBody}`, 'utf8').digest('hex');
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader: `t=${ts},v1=${sig}` });
|
|
expect(result.status).toBe(400);
|
|
expect(result.body.reason).toBe('invalid-json');
|
|
});
|
|
|
|
test('rejects event without id', async () => {
|
|
const event = { type: 'checkout.session.completed', data: { object: {} } };
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(400);
|
|
expect(result.body.reason).toBe('invalid-event');
|
|
});
|
|
|
|
test('acks unknown event types with 200 (so Stripe stops retrying)', async () => {
|
|
const event = { id: 'evt_unknown', type: 'customer.created', data: { object: {} } };
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
expect(result.body.reason).toBe('ignored-event-type');
|
|
});
|
|
});
|
|
|
|
describe('stripe-license-bridge catalog resolution', () => {
|
|
test('rejects session without productId metadata', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-30d' });
|
|
delete event.data.object.metadata.productId;
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(400);
|
|
expect(result.body.reason).toBe('missing-productId');
|
|
});
|
|
|
|
test('rejects unknown productId', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-1000d' });
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(400);
|
|
expect(result.body.reason).toBe('unknown-productId');
|
|
});
|
|
|
|
test('rejects when product Stripe Price is unconfigured', async () => {
|
|
const productId = 'pro-30d';
|
|
const saved = process.env.STRIPE_PRICE_PRO_30D;
|
|
delete process.env.STRIPE_PRICE_PRO_30D;
|
|
try {
|
|
const event = buildSessionEvent({ productId });
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(400);
|
|
expect(result.body.reason).toBe('product-not-configured');
|
|
} finally {
|
|
process.env.STRIPE_PRICE_PRO_30D = saved;
|
|
}
|
|
});
|
|
|
|
test('rejects when customer email is missing', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-30d', customerEmail: '' });
|
|
delete event.data.object.customer_email;
|
|
delete event.data.object.customer_details.email;
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(400);
|
|
expect(result.body.reason).toBe('missing-customer-email');
|
|
});
|
|
|
|
test('accepts sessions without expanded line_items (Stripe webhook default)', async () => {
|
|
// DC-057 acceptance: Stripe does NOT expand line_items in webhooks by
|
|
// default — the bridge must accept the canonical metadata.productId
|
|
// even when line_items is absent. (Price verification, when added,
|
|
// should be an optional belt-and-suspenders via a separate API call,
|
|
// not a hard requirement.)
|
|
const event = buildSessionEvent({ productId: 'pro-30d' });
|
|
delete event.data.object.line_items;
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
expect(result.body.delivered).toBe(true);
|
|
expect(result.body.productId).toBe('pro-30d');
|
|
expect(result.body.durationDays).toBe(30);
|
|
});
|
|
|
|
test('rejects unpaid sessions (no license until payment clears)', async () => {
|
|
// DC-057: a checkout.session.completed event with payment_status='unpaid'
|
|
// arrives when the customer closes the browser mid-checkout or for
|
|
// delayed-payment methods (ACH/SEPA) before they clear. The bridge
|
|
// MUST ack 200 (so Stripe stops retrying) but MUST NOT generate a
|
|
// license. The async_payment_succeeded event will fire later.
|
|
const event = buildSessionEvent({ productId: 'pro-30d', paymentStatus: 'unpaid' });
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
expect(result.body.delivered).toBe(false);
|
|
expect(result.body.reason).toBe('payment-not-unpaid');
|
|
expect(licenseKeygenMock.__getGenerateCalls()).toBe(0);
|
|
});
|
|
|
|
test('rejects no_payment_required sessions (DashCaddy does not sell free products)', async () => {
|
|
// 'no_payment_required' is a Stripe-internal edge case for free
|
|
// sessions. DashCaddy has no $0 product, so reject explicitly.
|
|
const event = buildSessionEvent({ productId: 'pro-30d', paymentStatus: 'no_payment_required' });
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
expect(result.body.delivered).toBe(false);
|
|
expect(result.body.reason).toBe('payment-not-no_payment_required');
|
|
expect(licenseKeygenMock.__getGenerateCalls()).toBe(0);
|
|
});
|
|
|
|
test('rejects sessions with missing payment_status', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-30d', paymentStatus: '' });
|
|
delete event.data.object.payment_status;
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
expect(result.body.delivered).toBe(false);
|
|
expect(result.body.reason).toBe('payment-not-confirmed');
|
|
expect(licenseKeygenMock.__getGenerateCalls()).toBe(0);
|
|
});
|
|
|
|
test('fulfills async_payment_succeeded events for delayed-payment methods', async () => {
|
|
// ACH/SEPA: Stripe first sends checkout.session.completed (unpaid),
|
|
// then async_payment_succeeded (paid) when the bank clears. The
|
|
// bridge generates the license on the second event.
|
|
const sessionId = `cs_test_ach_${crypto.randomBytes(4).toString('hex')}`;
|
|
const event = {
|
|
id: `evt_ach_${crypto.randomBytes(6).toString('hex')}`,
|
|
type: 'checkout.session.async_payment_succeeded',
|
|
data: {
|
|
object: {
|
|
id: sessionId,
|
|
customer_email: 'alice@example.com',
|
|
customer_details: { email: 'alice@example.com' },
|
|
payment_status: 'paid',
|
|
amount_total: 5000,
|
|
currency: 'usd',
|
|
metadata: { productId: 'pro-90d', product: 'dashcaddy-pro' },
|
|
},
|
|
},
|
|
};
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
expect(result.body.delivered).toBe(true);
|
|
expect(result.body.productId).toBe('pro-90d');
|
|
expect(result.body.durationDays).toBe(90);
|
|
});
|
|
|
|
test('acks async_payment_failed events without generating a license', async () => {
|
|
const event = {
|
|
id: `evt_ach_fail_${crypto.randomBytes(6).toString('hex')}`,
|
|
type: 'checkout.session.async_payment_failed',
|
|
data: {
|
|
object: {
|
|
id: `cs_test_fail_${crypto.randomBytes(6).toString('hex')}`,
|
|
payment_status: 'unpaid',
|
|
},
|
|
},
|
|
};
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
expect(result.body.delivered).toBe(false);
|
|
expect(result.body.reason).toBe('async-payment-failed');
|
|
expect(licenseKeygenMock.__getGenerateCalls()).toBe(0);
|
|
});
|
|
});
|
|
|
|
describe('stripe-license-bridge happy path', () => {
|
|
test('generates + persists + delivers license (dev-console SMTP fallback)', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-90d' });
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
|
|
expect(result.status).toBe(200);
|
|
expect(result.body.delivered).toBe(true);
|
|
expect(result.body.productId).toBe('pro-90d');
|
|
expect(result.body.durationDays).toBe(90);
|
|
expect(result.body.codeId).toBeTruthy();
|
|
expect(licenseKeygenMock.__getGenerateCalls()).toBe(1);
|
|
|
|
// Fulfillment record exists.
|
|
const record = createFulfillmentStore({ filePath: process.env.STRIPE_BRIDGE_FULFILLMENT_STORE_FILE })
|
|
.readBySession(event.data.object.id);
|
|
expect(record.status).toBe('delivered');
|
|
expect(record.code).toBeTruthy();
|
|
expect(record.codeId).toBe(result.body.codeId);
|
|
expect(record.deliveredVia).toBe('dev-console');
|
|
});
|
|
});
|
|
|
|
describe('stripe-license-bridge idempotency', () => {
|
|
test('duplicate eventId (Stripe retry) returns 200 without regenerating', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-30d' });
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
|
|
const first = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(first.status).toBe(200);
|
|
expect(first.body.delivered).toBe(true);
|
|
|
|
const second = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(second.status).toBe(200);
|
|
expect(second.body.deduplicated).toBe(true);
|
|
// generateCodes called exactly once across both deliveries.
|
|
expect(licenseKeygenMock.__getGenerateCalls()).toBe(1);
|
|
});
|
|
|
|
test('two events for the same session reuse the same license (layer-2 idempotency)', async () => {
|
|
const sessionId = `cs_test_shared_${crypto.randomBytes(4).toString('hex')}`;
|
|
const eventA = buildSessionEvent({ productId: 'pro-30d', sessionId });
|
|
const eventB = buildSessionEvent({ productId: 'pro-30d', sessionId });
|
|
|
|
const payloadA = buildSignedPayload(eventA);
|
|
const payloadB = buildSignedPayload(eventB);
|
|
|
|
const rA = await bridge.handleWebhook({ rawBody: payloadA.rawBody, signatureHeader: payloadA.signatureHeader });
|
|
const rB = await bridge.handleWebhook({ rawBody: payloadB.rawBody, signatureHeader: payloadB.signatureHeader });
|
|
|
|
expect(rA.status).toBe(200);
|
|
expect(rA.body.delivered).toBe(true);
|
|
// Second event hits layer-1 idempotency by eventId — different eventId,
|
|
// so falls through to layer-2 by sessionId; sees existing delivered record.
|
|
expect(rB.status).toBe(200);
|
|
expect(rB.body.delivered).toBe(true);
|
|
expect(rB.body.codeId).toBe(rA.body.codeId); // SAME license code
|
|
expect(licenseKeygenMock.__getGenerateCalls()).toBe(1); // only one code generated
|
|
});
|
|
});
|
|
|
|
describe('stripe-license-bridge SMTP failure recovery (DC-057 acceptance)', () => {
|
|
beforeEach(() => {
|
|
// Inject SMTP BEFORE each test so SMTP_HOST is set when deliverCode runs.
|
|
injectSmtp(async () => { throw new Error('smtp-down'); });
|
|
process.env.SMTP_HOST = 'smtp.example.com';
|
|
process.env.SMTP_FROM = 'noreply@example.com';
|
|
});
|
|
|
|
test('SMTP failure persists license, returns 500, but customer can retrieve via lookup', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-180d' });
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(500);
|
|
expect(result.body.reason).toBe('email-failed');
|
|
|
|
// License IS persisted (the documented SMTP-failure recovery path).
|
|
const store = createFulfillmentStore({ filePath: process.env.STRIPE_BRIDGE_FULFILLMENT_STORE_FILE });
|
|
const record = store.readBySession(event.data.object.id);
|
|
expect(record.code).toBeTruthy();
|
|
expect(record.status).toBe('pending_email');
|
|
expect(record.lastError).toMatch(/smtp-down/);
|
|
|
|
// The lookup endpoint serves the persisted code ANYWAY.
|
|
const lookup = bridge.lookupSession(event.data.object.id);
|
|
expect(lookup.status).toBe('pending_email');
|
|
expect(lookup.code).toBe(record.code);
|
|
expect(lookup.durationDays).toBe(180);
|
|
expect(lookup.productId).toBe('pro-180d');
|
|
});
|
|
|
|
test('Stripe retry after SMTP failure keeps retrying (customer recovers via lookup)', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-365d' });
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
|
|
const first = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(first.status).toBe(500);
|
|
|
|
// Stripe retries with the SAME eventId. SMTP is still down → bridge
|
|
// keeps retrying (returns 500) until either SMTP recovers or Stripe
|
|
// gives up. The customer recovery path is via the lookup endpoint —
|
|
// the license IS persisted in the fulfillment store regardless.
|
|
const retry = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(retry.status).toBe(500);
|
|
|
|
const store = createFulfillmentStore({ filePath: process.env.STRIPE_BRIDGE_FULFILLMENT_STORE_FILE });
|
|
const record = store.readBySession(event.data.object.id);
|
|
expect(record.code).toBeTruthy();
|
|
expect(record.status).toBe('pending_email');
|
|
|
|
// Lookup serves the persisted code.
|
|
const lookup = bridge.lookupSession(event.data.object.id);
|
|
expect(lookup.code).toBe(record.code);
|
|
|
|
// Only one license generated across the retries (layer-2 idempotency).
|
|
expect(licenseKeygenMock.__getGenerateCalls()).toBe(1);
|
|
});
|
|
|
|
test('SMTP recovers on a subsequent attempt (different eventId, same session) — still reuses the persisted code', async () => {
|
|
let smtpCalls = 0;
|
|
injectSmtp(async () => {
|
|
smtpCalls++;
|
|
if (smtpCalls === 1) throw new Error('smtp-temp-down');
|
|
return { messageId: 'msg-ok' };
|
|
});
|
|
|
|
const sessionId = `cs_test_recover_${crypto.randomBytes(4).toString('hex')}`;
|
|
const eventA = buildSessionEvent({ productId: 'pro-30d', sessionId });
|
|
const eventB = buildSessionEvent({ productId: 'pro-30d', sessionId });
|
|
|
|
const payloadA = buildSignedPayload(eventA);
|
|
const payloadB = buildSignedPayload(eventB);
|
|
|
|
const rA = await bridge.handleWebhook({ rawBody: payloadA.rawBody, signatureHeader: payloadA.signatureHeader });
|
|
expect(rA.status).toBe(500); // first attempt: SMTP down
|
|
expect(licenseKeygenMock.__getGenerateCalls()).toBe(1);
|
|
|
|
// Read the persisted code from the store (rA.body doesn't include it on
|
|
// failure — by design, we don't leak license material in error responses).
|
|
const store = createFulfillmentStore({ filePath: process.env.STRIPE_BRIDGE_FULFILLMENT_STORE_FILE });
|
|
const persistedCode = store.readBySession(sessionId).code;
|
|
expect(persistedCode).toBeTruthy();
|
|
|
|
const rB = await bridge.handleWebhook({ rawBody: payloadB.rawBody, signatureHeader: payloadB.signatureHeader });
|
|
expect(rB.status).toBe(200); // second event, same session: reuses persisted code, delivery succeeds
|
|
expect(rB.body.delivered).toBe(true);
|
|
// Same code reused, NOT a fresh generation.
|
|
expect(rB.body.codeId).toBeTruthy();
|
|
|
|
// The store's codeId matches rB.body.codeId (proves reuse, not regeneration).
|
|
expect(rB.body.codeId).toBe(store.readBySession(sessionId).codeId);
|
|
|
|
// No new license generated.
|
|
expect(licenseKeygenMock.__getGenerateCalls()).toBe(1);
|
|
expect(smtpCalls).toBe(2);
|
|
});
|
|
});
|
|
|
|
describe('stripe-license-bridge lookupSession', () => {
|
|
test('returns not_found for unknown sessionId', () => {
|
|
expect(bridge.lookupSession('cs_unknown')).toEqual({ status: 'not_found' });
|
|
});
|
|
|
|
test('returns expired for record past TTL', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-30d' });
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
|
|
// Far-future "now" past the 24h TTL.
|
|
const future = Date.now() + 25 * 60 * 60 * 1000;
|
|
const lookup = bridge.lookupSession(event.data.object.id, { nowMs: future });
|
|
expect(lookup.status).toBe('expired');
|
|
});
|
|
|
|
test('returns processing state for fresh claim without code', async () => {
|
|
const store = createFulfillmentStore({ filePath: process.env.STRIPE_BRIDGE_FULFILLMENT_STORE_FILE });
|
|
const sessionId = `cs_test_processing_${crypto.randomBytes(4).toString('hex')}`;
|
|
await store.claim({ eventId: 'evt_pend', sessionId, productId: 'pro-30d', durationDays: 30, email: 'a@b.c' });
|
|
const lookup = bridge.lookupSession(sessionId);
|
|
expect(lookup.status).toBe('processing');
|
|
expect(lookup.durationDays).toBe(30);
|
|
expect(lookup.productId).toBe('pro-30d');
|
|
});
|
|
});
|
|
|
|
describe('stripe-license-bridge constants', () => {
|
|
test('LOOKUP_TTL_MS defaults to 24h', () => {
|
|
expect(bridge.LOOKUP_TTL_MS).toBe(24 * 60 * 60 * 1000);
|
|
});
|
|
|
|
test('DELIVERY_LEASE_MS is exported', () => {
|
|
expect(bridge.DELIVERY_LEASE_MS).toBeGreaterThan(0);
|
|
});
|
|
});
|
|
|
|
describe('stripe-license-bridge invoice + email rendering (DC-058)', () => {
|
|
// These tests verify the bridge actually invokes the invoice renderer
|
|
// with the right inputs and that the SMTP send receives a multipart
|
|
// body + a PDF attachment. Pairs with invoice.test.js (which tests the
|
|
// rendering primitives in isolation).
|
|
|
|
test('passes customerName, sessionId, and amount through to the renderer', async () => {
|
|
const sendMailMock = jest.fn().mockResolvedValue({ messageId: 'test' });
|
|
injectSmtp(sendMailMock);
|
|
process.env.SMTP_HOST = 'smtp.test';
|
|
process.env.SMTP_FROM = 'billing@dashcaddy.test';
|
|
|
|
const event = buildSessionEvent({
|
|
productId: 'pro-90d',
|
|
customerEmail: 'alice@example.com',
|
|
});
|
|
// Add customer_details.name + amount_total in line_items[0] (like real Stripe).
|
|
event.data.object.customer_details.name = 'Alice Johnson';
|
|
event.data.object.line_items = {
|
|
data: [{ amount_total: 5000, price: { id: 'price_90d_test', unit_amount: 5000 }, currency: 'usd' }],
|
|
};
|
|
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
expect(result.body.delivered).toBe(true);
|
|
expect(result.body.deliveredVia).toBe('smtp');
|
|
|
|
// Verify the SMTP send was called with branded email + PDF attachment.
|
|
expect(sendMailMock).toHaveBeenCalledTimes(1);
|
|
const mailArgs = sendMailMock.mock.calls[0][0];
|
|
expect(mailArgs.from).toBe('billing@dashcaddy.test');
|
|
expect(mailArgs.to).toBe('alice@example.com');
|
|
// Subject contains duration and "invoice".
|
|
expect(mailArgs.subject).toContain('DashCaddy Pro');
|
|
expect(mailArgs.subject).toContain('invoice');
|
|
// HTML + text both present (multipart/alternative).
|
|
expect(mailArgs.text).toBeDefined();
|
|
expect(mailArgs.html).toBeDefined();
|
|
expect(mailArgs.html).toContain('Hi Alice'); // first name from customer_details.name
|
|
expect(mailArgs.html).toContain('INV-'); // invoice number
|
|
expect(mailArgs.html).toContain('$50.00'); // 90d tier price
|
|
// PDF attachment present.
|
|
expect(Array.isArray(mailArgs.attachments)).toBe(true);
|
|
expect(mailArgs.attachments).toHaveLength(1);
|
|
expect(mailArgs.attachments[0].filename).toMatch(/^DashCaddy-Pro-Invoice-INV-.+\.pdf$/);
|
|
expect(mailArgs.attachments[0].contentType).toBe('application/pdf');
|
|
expect(mailArgs.attachments[0].encoding).toBe('base64');
|
|
expect(mailArgs.attachments[0].content.length).toBeGreaterThan(1000); // real PDF
|
|
// PDF magic bytes.
|
|
expect(mailArgs.attachments[0].content.slice(0, 4).toString('ascii')).toBe('%PDF');
|
|
});
|
|
|
|
test('falls back to catalog amount when line_items are missing', async () => {
|
|
const sendMailMock = jest.fn().mockResolvedValue({ messageId: 'test' });
|
|
injectSmtp(sendMailMock);
|
|
process.env.SMTP_HOST = 'smtp.test';
|
|
process.env.SMTP_FROM = 'billing@dashcaddy.test';
|
|
|
|
const event = buildSessionEvent({ productId: 'pro-365d' });
|
|
// Strip line_items entirely (simulates a webhook without expansion).
|
|
delete event.data.object.line_items;
|
|
delete event.data.object.amount_total;
|
|
// Strip customer_details.name to verify "Hi there," fallback.
|
|
delete event.data.object.customer_details.name;
|
|
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
|
|
const mailArgs = sendMailMock.mock.calls[0][0];
|
|
// Falls back to catalog: pro-365d is $99.00.
|
|
expect(mailArgs.html).toContain('$99.00');
|
|
expect(mailArgs.html).toContain('Hi there,');
|
|
});
|
|
|
|
test('dev-console fallback logs invoice number + PDF size', async () => {
|
|
const event = buildSessionEvent({ productId: 'pro-30d' });
|
|
event.data.object.customer_details.name = 'Bob';
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
expect(result.body.deliveredVia).toBe('dev-console');
|
|
// We can't easily assert on log output from here, but the status proves
|
|
// the dev-console path was taken. The log line includes pdfBytes —
|
|
// covered indirectly by invoice.test.js verifying the PDF size.
|
|
});
|
|
|
|
test('uses claim createdAt as issuedAt (not now) for stable retry semantics', async () => {
|
|
const sendMailMock = jest.fn().mockResolvedValue({ messageId: 'test' });
|
|
injectSmtp(sendMailMock);
|
|
process.env.SMTP_HOST = 'smtp.test';
|
|
process.env.SMTP_FROM = 'billing@dashcaddy.test';
|
|
|
|
const event = buildSessionEvent({ productId: 'pro-30d' });
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
|
|
const mailArgs = sendMailMock.mock.calls[0][0];
|
|
// The "Issued" line must reflect the claim's createdAt (which is when
|
|
// the customer paid), not the moment we sent the email.
|
|
expect(mailArgs.html).toMatch(/Issued[\s\S]*?\d{4}-\d{2}-\d{2} \d{2}:\d{2} UTC/);
|
|
});
|
|
|
|
test('gracefully degrades to text-only email when PDF render fails', async () => {
|
|
const sendMailMock = jest.fn().mockResolvedValue({ messageId: 'test' });
|
|
injectSmtp(sendMailMock);
|
|
process.env.SMTP_HOST = 'smtp.test';
|
|
process.env.SMTP_FROM = 'billing@dashcaddy.test';
|
|
|
|
// Force PDF render to throw by passing an invalid issuedAt — this
|
|
// exercises the try/catch around renderInvoicePdf and verifies the
|
|
// bridge still sends a text+HTML email without the attachment.
|
|
// (PDFKit auto-escapes most non-ASCII; lone surrogates no longer
|
|
// throw on this PDFKit version. Bad dates remain a real crash path.)
|
|
const event = buildSessionEvent({ productId: 'pro-30d' });
|
|
// Override issuedAt to an invalid date via the bridge's deliverCode arg.
|
|
// The bridge forwards this from the invoice module, which we can stub
|
|
// at module level for this test.
|
|
const invoiceMod = require('../../src/billing/invoice');
|
|
const originalRender = invoiceMod.renderInvoicePdf;
|
|
invoiceMod.renderInvoicePdf = jest.fn().mockRejectedValue(new Error('simulated PDF render failure'));
|
|
try {
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const result = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(result.status).toBe(200);
|
|
expect(result.body.delivered).toBe(true);
|
|
expect(sendMailMock).toHaveBeenCalledTimes(1);
|
|
const mailArgs = sendMailMock.mock.calls[0][0];
|
|
// No PDF attachment when render failed.
|
|
expect(mailArgs.attachments).toBeUndefined();
|
|
// Text + HTML still sent (keygen mock uses DC-TEST-... in this suite).
|
|
expect(mailArgs.text).toMatch(/DC-(PRO|TEST)-/);
|
|
expect(mailArgs.html).toContain('DashCaddy');
|
|
} finally {
|
|
invoiceMod.renderInvoicePdf = originalRender;
|
|
}
|
|
});
|
|
|
|
test('replay (layer-1 event-id idempotency) does NOT re-render the invoice', async () => {
|
|
const sendMailMock = jest.fn().mockResolvedValue({ messageId: 'test' });
|
|
injectSmtp(sendMailMock);
|
|
process.env.SMTP_HOST = 'smtp.test';
|
|
process.env.SMTP_FROM = 'billing@dashcaddy.test';
|
|
|
|
const event = buildSessionEvent({ productId: 'pro-30d' });
|
|
const { rawBody, signatureHeader } = buildSignedPayload(event);
|
|
const sessionId = event.data.object.id;
|
|
|
|
// First delivery — generates a new license + invoice.
|
|
const first = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(first.body.delivered).toBe(true);
|
|
expect(first.body.codeId).toBeDefined();
|
|
const firstCodeId = first.body.codeId;
|
|
expect(sendMailMock).toHaveBeenCalledTimes(1);
|
|
|
|
// Second delivery of the SAME event — should be deduplicated by event id
|
|
// at the layer-1 check (bridge.checkEventIdempotency). SMTP must NOT be
|
|
// called again because Stripe retrying the same event ID should never
|
|
// re-send the invoice.
|
|
const second = await bridge.handleWebhook({ rawBody, signatureHeader });
|
|
expect(second.body.delivered).toBe(true);
|
|
expect(second.body.deduplicated).toBe(true);
|
|
expect(sendMailMock).toHaveBeenCalledTimes(1);
|
|
});
|
|
|
|
test('layer-2 (different event, same session) does NOT re-send the invoice', async () => {
|
|
// Stripe can send BOTH `checkout.session.completed` AND
|
|
// `checkout.session.async_payment_succeeded` for the same Checkout Session
|
|
// (delayed-payment methods). Layer-1 dedup doesn't catch this because
|
|
// the event IDs differ — only the session ID is the same. The bridge
|
|
// MUST recognize that delivery already happened via the OTHER event and
|
|
// ack 200 without re-sending.
|
|
const sendMailMock = jest.fn().mockResolvedValue({ messageId: 'test' });
|
|
injectSmtp(sendMailMock);
|
|
process.env.SMTP_HOST = 'smtp.test';
|
|
process.env.SMTP_FROM = 'billing@dashcaddy.test';
|
|
|
|
const sessionId = `cs_test_layer2_${crypto.randomBytes(4).toString('hex')}`;
|
|
const eventA = buildSessionEvent({
|
|
productId: 'pro-30d',
|
|
sessionId,
|
|
eventId: `evt_A_${crypto.randomBytes(4).toString('hex')}`,
|
|
});
|
|
eventA.type = 'checkout.session.completed';
|
|
|
|
const eventB = buildSessionEvent({
|
|
productId: 'pro-30d',
|
|
sessionId,
|
|
eventId: `evt_B_${crypto.randomBytes(4).toString('hex')}`,
|
|
});
|
|
eventB.type = 'checkout.session.async_payment_succeeded';
|
|
|
|
// First event: completes the payment, sends the invoice.
|
|
const sigA = buildSignedPayload(eventA);
|
|
const resultA = await bridge.handleWebhook({ rawBody: sigA.rawBody, signatureHeader: sigA.signatureHeader });
|
|
expect(resultA.status).toBe(200);
|
|
expect(resultA.body.delivered).toBe(true);
|
|
expect(resultA.body.deduplicated).toBeUndefined();
|
|
expect(sendMailMock).toHaveBeenCalledTimes(1);
|
|
const firstInvoice = sendMailMock.mock.calls[0][0].attachments[0].filename;
|
|
|
|
// Second event for the SAME session: must NOT re-send (different event
|
|
// id, so layer-1 dedup doesn't catch it; layer-2 must).
|
|
const sigB = buildSignedPayload(eventB);
|
|
const resultB = await bridge.handleWebhook({ rawBody: sigB.rawBody, signatureHeader: sigB.signatureHeader });
|
|
expect(resultB.status).toBe(200);
|
|
expect(resultB.body.delivered).toBe(true);
|
|
expect(resultB.body.deduplicated).toBe(true);
|
|
// CRITICAL: only ONE SMTP call. Two invoice emails with different invoice
|
|
// numbers for one charge is a financial-document bug.
|
|
expect(sendMailMock).toHaveBeenCalledTimes(1);
|
|
const secondInvoice = sendMailMock.mock.calls[0][0].attachments[0].filename;
|
|
expect(secondInvoice).toBe(firstInvoice); // same invoice number
|
|
});
|
|
});
|