feat(entitlements): per-company capability paywall — gate, trial seeding, UI upsells, Stripe checkout (#815)
* feat(entitlements): capability-grant gate substrate (paywall + modularity) Two-axis capability primitive behind the SaaS paywall and the per-tenant modularity/marketplace vision: - migration: capability_grants (entitlement axis, polymorphic company/firm scope), company_capability_config (enablement axis), metered_events (append-only), company_has_capability() RPC reusing the 20260619130100 tenant guard; SELECT-only RLS (writes service-role only, no self-grant). - lib/entitlements: hasCapability/requireCapability gate (mirrors guardSandbox, fail-closed, NEXT_PUBLIC_SELF_HOSTED bypass), capability key namespace, metering helper. - unit (11) + pg-real tests (RPC/RLS/tenant-guard incl. no-self-grant). Gate not yet wired into call sites (follow-up commit). Paid keys: ai, bank_sync, skatteverket, email_send. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(entitlements): enforce capability gate at paid external-service chokepoints Wire the gate into the paid surfaces (keys: ai, email_send, bank_sync, skatteverket): - AI routes (agent invoke/composer/onboarding stream): requireCapability(ai) - Invoice send (web + v1): requireCapability(email_send) - document-extraction event handler: skip Bedrock extract if ai not entitled - enable-banking + skatteverket crons: per-company hasCapability skip in loop - colocated send-route test mocks updated (requireCapability -> null) Free per founder decision: TIC org lookup, VIES VAT validation, FX auto-fetch, cloud backup, BankID login, all internal bookkeeping. DEPLOY ORDER: fail-closed by design — do NOT deploy before trial/comp grant seeding lands, or companies without grants lose these features. Seeding + Stripe checkout/webhook are the next steps. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(entitlements): seed trial + comp capability grants Makes the fail-closed gate safely deployable — nobody is locked out at cutover: - AFTER INSERT trigger on companies grants every NEW company a 30-day trial on the PAID keys (ai, bank_sync, skatteverket, email_send), on ALL creation paths (RPC/MCP/direct) — so a new signup can use onboarding AI immediately. - one-time backfill for EXISTING companies: created <=2026-06-07 -> trial ends 2026-07-07; created later -> created_at + 30 days. - permanent comp grants for Arcim/Mattsson (matched by name, no hardcoded UUIDs). - pg tests: clearGrants() for controlled resolver tests + trigger coverage. Trigger fn is SECURITY DEFINER so it writes grants regardless of caller RLS (table has no INSERT policy for authenticated — no self-grant). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(entitlements): client capability visibility + billing page Non-payers get a clean upsell instead of broken/empty features: - CompanyContext gains capabilities[] + useCapability(key); resolved once server-side in the dashboard layout via getCompanyCapabilities (batched, 2 queries), all three provider branches wired. - /settings/billing upgrade page — the destination upsells point to (Stripe Payment Link via NEXT_PUBLIC_STRIPE_PAYMENT_LINK; degrades to 'coming soon' until automated checkout lands). - ChatEmptyState: non-payer sees an Uppgradera CTA (mirrors the sandbox state). - SendInvoiceDialog: email send disabled + upsell note when email_send missing (extends the existing sandbox-disable pattern). Fast-follow: chat input/FAB + document-inbox empty state + bank/skatteverket/ AI-suggest buttons + a shared capability_blocked->toast backstop. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(entitlements): gate remaining paid UI surfaces with upsell (fast-follow) disable-with-upsell across the rest of the paid surfaces (keys: bank_sync, skatteverket, ai): - BankSyncNowButton: sync/reconnect disabled + note when !bank_sync (CSV/SIE stays free) - AGIPanel: AGI submit-to-Skatteverket disabled + note when !skatteverket - SkatteverketConnectPanel: BankID connect/reconnect disabled + upsell - ApprovalCard: AI re-propose (correction) gated; manual approve/reject stay free - InvoiceInboxWorkspace: upsell when extraction empty AND !ai (deterministic parse + manual entry unaffected) - AgentTrigger FAB: routes to /settings/billing when !ai (no dead chat) - settings nav: 'Abonnemang'/'Subscription' link to /settings/billing (sv/en) TaxPaymentPanel + TransactionInboxCard intentionally untouched — only local/ deterministic actions there, nothing paid+external to gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(entitlements): automated Stripe subscription checkout + webhook Self-serve revenue wired to the same capability-grant primitive: - migration: company_subscriptions (company<->Stripe link/status) + stripe_webhook_events (idempotency) - lib/stripe: getStripe singleton, plan->price mapping, subscription-sync (statusGrantsAccess / subscriptionToState / applySubscriptionState / handleStripeEvent). Active sub -> upsert source='stripe' grants for PAID keys (expiry = period_end + 3d grace); canceled/unpaid -> remove ONLY stripe grants (freeze-and-retain). - routes: POST /api/billing/checkout (hosted subscription Checkout, company_id metadata), POST /api/billing/portal (Customer Portal), POST /api/stripe/webhook (raw-body signature verify, event-id dedup; handles checkout.session.completed + customer.subscription.*) - billing page: real plan-toggle Checkout CTA / manage-subscription portal, gated on isStripeConfigured() - adds stripe@22; unit tests for sync logic Provisioning is webhook-driven (never trusts the success redirect). Needs env: STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_MONTHLY, STRIPE_PRICE_YEARLY. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(entitlements): validate UUIDs in capability filter + log webhook errors Addresses PR review (Superagent Security / PR Agent): - has-capability.ts: validate companyId/teamId as UUIDs before interpolating into the PostgREST .or() filter (fail-closed) — removes the latent injection vector flagged in the entitlement gate. Unit tests updated to use UUIDs. - stripe/webhook: log processing failures with event id + type before the generic 500, so a failing webhook is visible to operators. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(salary): always-free AGI XML download for manual filing; only direct API submit is paid Per founder decision on the swedish-compliance-review finding: AGI is a mandatory statutory filing, so producing/downloading the AGI XML must never be paywalled. Adds a free 'Ladda ner AGI-fil' button (generates + downloads the XML for manual upload to Skatteverket's e-service) on all tiers; the gated 'Skicka in underlag' stays the paid convenience (direct API submission — which also requires the paid BankID connection). Upsell reworded to point to the manual path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(entitlements): harden comp-grant match after prod verification Verified Arcim/Mattsson in prod (pwxtzglxptnnvjrpixpg): the name match was case-sensitive (missed the active 'Arcim technology AB' lowercase variant) and would have granted 3 archived dupes. Now match by org_number (5595386219 / 5595719864) OR case-insensitive name, active companies only — hits exactly the 3 active comp companies, excludes archived dupes and the unrelated 'Amnäs Mattsson, Emil' enskild firma. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
fce6faff2c
commit
4f0a7b1db0
@@ -0,0 +1,214 @@
|
||||
import { describe, it, expect } from 'vitest'
|
||||
import { randomUUID } from 'node:crypto'
|
||||
import { getPool, withUserContext } from '../../../tests/pg/setup'
|
||||
import { seedCompany, insertAuthUser, insertCompany } from '../../../tests/pg/fixtures'
|
||||
|
||||
// pg-real coverage for migrations 20260628140000 (capability_grants /
|
||||
// company_capability_config / metered_events + company_has_capability RPC +
|
||||
// RLS) and 20260629120000 (trial-grant trigger). Required by
|
||||
// .claude/rules/database.md for any RPC/RLS/trigger change.
|
||||
//
|
||||
// NOTE: as of 20260629120000 an AFTER INSERT trigger auto-seeds a trial grant
|
||||
// on the PAID keys for every new company. The resolver tests therefore call
|
||||
// clearGrants() first to assert against a controlled grant state.
|
||||
|
||||
const future = () => new Date(Date.now() + 86_400_000).toISOString()
|
||||
const past = () => new Date(Date.now() - 86_400_000).toISOString()
|
||||
|
||||
async function insertGrant(p: {
|
||||
companyId?: string | null
|
||||
teamId?: string | null
|
||||
key: string
|
||||
source?: string
|
||||
expiresAt?: string | null
|
||||
}): Promise<void> {
|
||||
await getPool().query(
|
||||
`INSERT INTO public.capability_grants (company_id, team_id, capability_key, source, expires_at)
|
||||
VALUES ($1, $2, $3, $4, $5)`,
|
||||
[p.companyId ?? null, p.teamId ?? null, p.key, p.source ?? 'manual', p.expiresAt ?? null],
|
||||
)
|
||||
}
|
||||
|
||||
// Remove the trigger-seeded trial grants so a test can assert a controlled state.
|
||||
async function clearGrants(companyId: string): Promise<void> {
|
||||
await getPool().query(`DELETE FROM public.capability_grants WHERE company_id = $1`, [companyId])
|
||||
}
|
||||
|
||||
async function rpc(companyId: string, key: string): Promise<boolean> {
|
||||
const { rows } = await getPool().query<{ ok: boolean }>(
|
||||
`SELECT public.company_has_capability($1, $2) AS ok`,
|
||||
[companyId, key],
|
||||
)
|
||||
return rows[0].ok
|
||||
}
|
||||
|
||||
describe('company_has_capability (entitlement axis)', () => {
|
||||
it('is false when no grant exists (fail-closed)', async () => {
|
||||
const { companyId } = await seedCompany()
|
||||
await clearGrants(companyId)
|
||||
expect(await rpc(companyId, 'ai')).toBe(false)
|
||||
})
|
||||
|
||||
it('is true for an unexpired company-scoped grant', async () => {
|
||||
const { companyId } = await seedCompany()
|
||||
await clearGrants(companyId)
|
||||
await insertGrant({ companyId, key: 'ai', expiresAt: future() })
|
||||
expect(await rpc(companyId, 'ai')).toBe(true)
|
||||
})
|
||||
|
||||
it('treats a null expiry as never-expiring', async () => {
|
||||
const { companyId } = await seedCompany()
|
||||
await clearGrants(companyId)
|
||||
await insertGrant({ companyId, key: 'ai', source: 'comp', expiresAt: null })
|
||||
expect(await rpc(companyId, 'ai')).toBe(true)
|
||||
})
|
||||
|
||||
it('is false once the grant has expired', async () => {
|
||||
const { companyId } = await seedCompany()
|
||||
await clearGrants(companyId)
|
||||
await insertGrant({ companyId, key: 'ai', source: 'trial', expiresAt: past() })
|
||||
expect(await rpc(companyId, 'ai')).toBe(false)
|
||||
})
|
||||
|
||||
it('cascades a firm/team-scoped grant to the client company', async () => {
|
||||
const { userId, companyId } = await seedCompany()
|
||||
await clearGrants(companyId)
|
||||
const teamId = randomUUID()
|
||||
await getPool().query(
|
||||
`INSERT INTO public.teams (id, name, created_by) VALUES ($1, 'Firm', $2)`,
|
||||
[teamId, userId],
|
||||
)
|
||||
await getPool().query(`UPDATE public.companies SET team_id = $1 WHERE id = $2`, [
|
||||
teamId,
|
||||
companyId,
|
||||
])
|
||||
await insertGrant({ teamId, key: 'skatteverket', expiresAt: future() })
|
||||
expect(await rpc(companyId, 'skatteverket')).toBe(true)
|
||||
})
|
||||
})
|
||||
|
||||
describe('company_has_capability (enablement axis)', () => {
|
||||
it('is false when entitled but explicitly disabled', async () => {
|
||||
const { companyId } = await seedCompany()
|
||||
await clearGrants(companyId)
|
||||
await insertGrant({ companyId, key: 'ai', expiresAt: null })
|
||||
await getPool().query(
|
||||
`INSERT INTO public.company_capability_config (company_id, capability_key, enabled)
|
||||
VALUES ($1, 'ai', false)`,
|
||||
[companyId],
|
||||
)
|
||||
expect(await rpc(companyId, 'ai')).toBe(false)
|
||||
})
|
||||
})
|
||||
|
||||
describe('company_has_capability tenant guard', () => {
|
||||
it('raises 42501 when a non-member asks about a company (authenticated ctx)', async () => {
|
||||
const { companyId } = await seedCompany()
|
||||
const outsider = await insertAuthUser()
|
||||
await expect(
|
||||
withUserContext(outsider, async (client) => {
|
||||
await client.query(`SELECT public.company_has_capability($1, 'ai')`, [companyId])
|
||||
}),
|
||||
).rejects.toThrow(/unauthorized/)
|
||||
})
|
||||
|
||||
it('lets a member resolve their own company under authenticated ctx', async () => {
|
||||
const { userId, companyId } = await seedCompany()
|
||||
const ok = await withUserContext(userId, async (client) => {
|
||||
const r = await client.query<{ ok: boolean }>(
|
||||
`SELECT public.company_has_capability($1, 'ai') AS ok`,
|
||||
[companyId],
|
||||
)
|
||||
return r.rows[0].ok
|
||||
})
|
||||
// entitled via the auto-seeded trial grant
|
||||
expect(ok).toBe(true)
|
||||
})
|
||||
})
|
||||
|
||||
describe('capability_grants RLS', () => {
|
||||
it('lets a member read their own grants but hides them from non-members', async () => {
|
||||
const { userId, companyId } = await seedCompany()
|
||||
await clearGrants(companyId)
|
||||
await insertGrant({ companyId, key: 'ai', expiresAt: null })
|
||||
|
||||
const memberCount = await withUserContext(userId, async (client) => {
|
||||
const r = await client.query(
|
||||
`SELECT id FROM public.capability_grants WHERE company_id = $1`,
|
||||
[companyId],
|
||||
)
|
||||
return r.rowCount
|
||||
})
|
||||
expect(memberCount).toBe(1)
|
||||
|
||||
const outsider = await insertAuthUser()
|
||||
const outsiderCount = await withUserContext(outsider, async (client) => {
|
||||
const r = await client.query(
|
||||
`SELECT id FROM public.capability_grants WHERE company_id = $1`,
|
||||
[companyId],
|
||||
)
|
||||
return r.rowCount
|
||||
})
|
||||
expect(outsiderCount).toBe(0)
|
||||
})
|
||||
|
||||
it('forbids a member from self-granting an entitlement (no INSERT policy)', async () => {
|
||||
const { userId, companyId } = await seedCompany()
|
||||
await expect(
|
||||
withUserContext(userId, async (client) => {
|
||||
await client.query(
|
||||
`INSERT INTO public.capability_grants (company_id, capability_key, source)
|
||||
VALUES ($1, 'ai', 'manual')`,
|
||||
[companyId],
|
||||
)
|
||||
}),
|
||||
).rejects.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('capability_grants scope constraint', () => {
|
||||
it('rejects a grant with neither company_id nor team_id', async () => {
|
||||
await expect(
|
||||
getPool().query(
|
||||
`INSERT INTO public.capability_grants (capability_key, source) VALUES ('ai', 'manual')`,
|
||||
),
|
||||
).rejects.toThrow()
|
||||
})
|
||||
|
||||
it('rejects a grant with both company_id and team_id', async () => {
|
||||
const { userId, companyId } = await seedCompany()
|
||||
const teamId = randomUUID()
|
||||
await getPool().query(
|
||||
`INSERT INTO public.teams (id, name, created_by) VALUES ($1, 'Firm', $2)`,
|
||||
[teamId, userId],
|
||||
)
|
||||
await expect(insertGrant({ companyId, teamId, key: 'ai' })).rejects.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('trial grant seeding trigger (20260629120000)', () => {
|
||||
it('grants a new company a 30-day trial on the PAID keys at creation', async () => {
|
||||
const userId = await insertAuthUser()
|
||||
const companyId = await insertCompany({ createdBy: userId })
|
||||
const { rows } = await getPool().query<{
|
||||
capability_key: string
|
||||
source: string
|
||||
expires_at: string | null
|
||||
}>(
|
||||
`SELECT capability_key, source, expires_at FROM public.capability_grants
|
||||
WHERE company_id = $1 ORDER BY capability_key`,
|
||||
[companyId],
|
||||
)
|
||||
expect(rows.map((r) => r.capability_key)).toEqual(['ai', 'bank_sync', 'email_send', 'skatteverket'])
|
||||
expect(rows.every((r) => r.source === 'trial')).toBe(true)
|
||||
expect(rows.every((r) => r.expires_at !== null)).toBe(true)
|
||||
expect(await rpc(companyId, 'ai')).toBe(true)
|
||||
})
|
||||
|
||||
it('does not seed free keys (only the PAID set is granted)', async () => {
|
||||
const userId = await insertAuthUser()
|
||||
const companyId = await insertCompany({ createdBy: userId })
|
||||
expect(await rpc(companyId, 'cloud_backup')).toBe(false)
|
||||
expect(await rpc(companyId, 'org_lookup')).toBe(false)
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,146 @@
|
||||
import { describe, it, expect, afterEach, vi } from 'vitest'
|
||||
import type { SupabaseClient } from '@supabase/supabase-js'
|
||||
import {
|
||||
hasCapability,
|
||||
requireCapability,
|
||||
capabilityBlockedResponse,
|
||||
} from '../has-capability'
|
||||
import { CAPABILITY } from '../keys'
|
||||
|
||||
/**
|
||||
* Per-table mock: each table resolves to its own configured result, so a
|
||||
* function that queries several tables in one call (companies → capability_grants
|
||||
* → company_capability_config) gets the right answer per table. Any chained
|
||||
* method returns the chain; awaiting it (or .maybeSingle()/.or()) resolves to
|
||||
* the table's result.
|
||||
*/
|
||||
type TableResult = { data: unknown; error?: unknown }
|
||||
function makeSupabase(byTable: Record<string, TableResult>): SupabaseClient {
|
||||
const chainFor = (table: string) => {
|
||||
const result = byTable[table] ?? { data: null, error: null }
|
||||
const chain: unknown = new Proxy(
|
||||
{},
|
||||
{
|
||||
get(_t, prop) {
|
||||
if (prop === 'then') {
|
||||
return (resolve: (v: unknown) => void) =>
|
||||
resolve({ data: result.data ?? null, error: result.error ?? null })
|
||||
}
|
||||
return () => chain
|
||||
},
|
||||
},
|
||||
)
|
||||
return chain
|
||||
}
|
||||
return { from: (t: string) => chainFor(t) } as unknown as SupabaseClient
|
||||
}
|
||||
|
||||
const iso = (offsetMs: number) => new Date(Date.now() + offsetMs).toISOString()
|
||||
|
||||
afterEach(() => {
|
||||
vi.unstubAllEnvs()
|
||||
})
|
||||
|
||||
describe('hasCapability', () => {
|
||||
it('returns true on self-hosted without touching the DB', async () => {
|
||||
vi.stubEnv('NEXT_PUBLIC_SELF_HOSTED', 'true')
|
||||
const supabase = makeSupabase({}) // would resolve to null/false if queried
|
||||
expect(await hasCapability(supabase, '11111111-1111-4111-8111-111111111111', CAPABILITY.ai)).toBe(true)
|
||||
})
|
||||
|
||||
it('returns true for an unexpired company-scoped grant', async () => {
|
||||
const supabase = makeSupabase({
|
||||
companies: { data: { team_id: null } },
|
||||
capability_grants: { data: [{ expires_at: iso(60_000) }] },
|
||||
company_capability_config: { data: null },
|
||||
})
|
||||
expect(await hasCapability(supabase, '11111111-1111-4111-8111-111111111111', CAPABILITY.ai)).toBe(true)
|
||||
})
|
||||
|
||||
it('treats a null expiry as never-expiring (true)', async () => {
|
||||
const supabase = makeSupabase({
|
||||
companies: { data: { team_id: null } },
|
||||
capability_grants: { data: [{ expires_at: null }] },
|
||||
company_capability_config: { data: null },
|
||||
})
|
||||
expect(await hasCapability(supabase, '11111111-1111-4111-8111-111111111111', CAPABILITY.bank_sync)).toBe(true)
|
||||
})
|
||||
|
||||
it('fails closed when there is no grant', async () => {
|
||||
const supabase = makeSupabase({
|
||||
companies: { data: { team_id: null } },
|
||||
capability_grants: { data: [] },
|
||||
})
|
||||
expect(await hasCapability(supabase, '11111111-1111-4111-8111-111111111111', CAPABILITY.ai)).toBe(false)
|
||||
})
|
||||
|
||||
it('fails closed when the only grant is expired', async () => {
|
||||
const supabase = makeSupabase({
|
||||
companies: { data: { team_id: null } },
|
||||
capability_grants: { data: [{ expires_at: iso(-60_000) }] },
|
||||
})
|
||||
expect(await hasCapability(supabase, '11111111-1111-4111-8111-111111111111', CAPABILITY.ai)).toBe(false)
|
||||
})
|
||||
|
||||
it('honours a firm/team-scoped grant (cascades to the client company)', async () => {
|
||||
const supabase = makeSupabase({
|
||||
companies: { data: { team_id: '22222222-2222-4222-8222-222222222222' } },
|
||||
capability_grants: { data: [{ expires_at: iso(60_000) }] }, // grant lives on the team
|
||||
company_capability_config: { data: null },
|
||||
})
|
||||
expect(await hasCapability(supabase, '11111111-1111-4111-8111-111111111111', CAPABILITY.skatteverket)).toBe(true)
|
||||
})
|
||||
|
||||
it('returns false when entitled but explicitly disabled (enablement axis)', async () => {
|
||||
const supabase = makeSupabase({
|
||||
companies: { data: { team_id: null } },
|
||||
capability_grants: { data: [{ expires_at: null }] },
|
||||
company_capability_config: { data: { enabled: false } },
|
||||
})
|
||||
expect(await hasCapability(supabase, '11111111-1111-4111-8111-111111111111', CAPABILITY.ai)).toBe(false)
|
||||
})
|
||||
|
||||
it('fails closed when the grants query errors', async () => {
|
||||
const supabase = makeSupabase({
|
||||
companies: { data: { team_id: null } },
|
||||
capability_grants: { data: null, error: { message: 'boom' } },
|
||||
})
|
||||
expect(await hasCapability(supabase, '11111111-1111-4111-8111-111111111111', CAPABILITY.ai)).toBe(false)
|
||||
})
|
||||
})
|
||||
|
||||
describe('requireCapability', () => {
|
||||
it('returns null (proceed) when the company has the capability', async () => {
|
||||
const supabase = makeSupabase({
|
||||
companies: { data: { team_id: null } },
|
||||
capability_grants: { data: [{ expires_at: null }] },
|
||||
company_capability_config: { data: null },
|
||||
})
|
||||
expect(await requireCapability(supabase, '11111111-1111-4111-8111-111111111111', CAPABILITY.ai)).toBeNull()
|
||||
})
|
||||
|
||||
it('returns a 403 capability_blocked response when missing', async () => {
|
||||
const supabase = makeSupabase({
|
||||
companies: { data: { team_id: null } },
|
||||
capability_grants: { data: [] },
|
||||
})
|
||||
const res = await requireCapability(supabase, '11111111-1111-4111-8111-111111111111', CAPABILITY.ai)
|
||||
expect(res).not.toBeNull()
|
||||
expect(res!.status).toBe(403)
|
||||
const body = await res!.json()
|
||||
expect(body.capability_blocked).toBe(true)
|
||||
expect(body.capability).toBe(CAPABILITY.ai)
|
||||
})
|
||||
})
|
||||
|
||||
describe('capabilityBlockedResponse', () => {
|
||||
it('returns a bilingual 403 carrying the capability key', async () => {
|
||||
const res = capabilityBlockedResponse(CAPABILITY.bank_sync)
|
||||
expect(res.status).toBe(403)
|
||||
const body = await res.json()
|
||||
expect(body.error).toBeTruthy()
|
||||
expect(body.error_en).toBeTruthy()
|
||||
expect(body.capability_blocked).toBe(true)
|
||||
expect(body.capability).toBe(CAPABILITY.bank_sync)
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,168 @@
|
||||
import type { SupabaseClient } from '@supabase/supabase-js'
|
||||
import { NextResponse } from 'next/server'
|
||||
import { PAID_CAPABILITIES, type CapabilityKey } from './keys'
|
||||
|
||||
/**
|
||||
* Entitlement gate — the single primitive behind the paywall ("non-payer loses
|
||||
* functionality") AND the vision's modularity-out ("hide a module this company
|
||||
* doesn't need"). Both are the same question: does this company hold the
|
||||
* capability, fail-closed, resolved server-side?
|
||||
*
|
||||
* Two orthogonal axes, AND-ed together (see migration
|
||||
* 20260628140000_capability_grants_and_metered_events):
|
||||
* ENTITLEMENT — an unexpired capability_grant on the company OR its firm/team.
|
||||
* ENABLEMENT — not explicitly disabled in company_capability_config (absent == enabled).
|
||||
*
|
||||
* Mirrors the shape of lib/sandbox/guard.ts so it drops in at the same call
|
||||
* sites. The company is resolved by the CALLER (requireCompanyId for web, the
|
||||
* validated API key for MCP) — never taken from untrusted input here.
|
||||
*/
|
||||
|
||||
/** Self-hosted deployments are all-on — the gate never withholds anything. */
|
||||
function isSelfHosted(): boolean {
|
||||
return process.env.NEXT_PUBLIC_SELF_HOSTED === 'true'
|
||||
}
|
||||
|
||||
const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
|
||||
/**
|
||||
* Only server-resolved UUIDs may be interpolated into the PostgREST `.or()`
|
||||
* filter below — commas/dots/parens are filter syntax. companyId/teamId always
|
||||
* come from the DB, but we validate at this boundary as defense in depth.
|
||||
*/
|
||||
function isUuid(v: string): boolean {
|
||||
return UUID_RE.test(v)
|
||||
}
|
||||
|
||||
export async function hasCapability(
|
||||
supabase: SupabaseClient,
|
||||
companyId: string,
|
||||
key: CapabilityKey,
|
||||
): Promise<boolean> {
|
||||
if (isSelfHosted()) return true
|
||||
if (!isUuid(companyId)) return false // fail-closed: never interpolate a non-UUID
|
||||
|
||||
// Resolve the company's firm/team (firm-scoped grants cascade to clients).
|
||||
const { data: company } = await supabase
|
||||
.from('companies')
|
||||
.select('team_id')
|
||||
.eq('id', companyId)
|
||||
.maybeSingle()
|
||||
const rawTeamId = (company as { team_id: string | null } | null)?.team_id ?? null
|
||||
const teamId = rawTeamId && isUuid(rawTeamId) ? rawTeamId : null
|
||||
|
||||
// ENTITLEMENT axis: any unexpired grant on the company or its team.
|
||||
const scopeFilter = teamId
|
||||
? `company_id.eq.${companyId},team_id.eq.${teamId}`
|
||||
: `company_id.eq.${companyId}`
|
||||
const { data: grants, error: grantsError } = await supabase
|
||||
.from('capability_grants')
|
||||
.select('expires_at')
|
||||
.eq('capability_key', key)
|
||||
.or(scopeFilter)
|
||||
|
||||
if (grantsError) return false // fail-closed on any read error
|
||||
const now = Date.now()
|
||||
const entitled = (grants ?? []).some((g) => {
|
||||
const exp = (g as { expires_at: string | null }).expires_at
|
||||
return exp === null || new Date(exp).getTime() > now
|
||||
})
|
||||
if (!entitled) return false
|
||||
|
||||
// ENABLEMENT axis: explicitly turned off for this company? (absence == enabled)
|
||||
const { data: config } = await supabase
|
||||
.from('company_capability_config')
|
||||
.select('enabled')
|
||||
.eq('company_id', companyId)
|
||||
.eq('capability_key', key)
|
||||
.maybeSingle()
|
||||
if ((config as { enabled: boolean } | null)?.enabled === false) return false
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
/**
|
||||
* Standard bilingual 403 for a capability-blocked endpoint. Matches the
|
||||
* sandbox/guard envelope so the UI surfaces the upsell consistently.
|
||||
*/
|
||||
export function capabilityBlockedResponse(key: CapabilityKey): NextResponse {
|
||||
return NextResponse.json(
|
||||
{
|
||||
error:
|
||||
'Den här funktionen kräver en betald prenumeration. Uppgradera för att fortsätta använda externa tjänster.',
|
||||
error_en:
|
||||
'This feature requires a paid subscription. Upgrade to keep using external services.',
|
||||
capability_blocked: true,
|
||||
capability: key,
|
||||
},
|
||||
{ status: 403 },
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Convenience wrapper: check + return the 403 in one call. Returns the
|
||||
* NextResponse to return from the route, or null when the company has the
|
||||
* capability and the route should proceed.
|
||||
*
|
||||
* const blocked = await requireCapability(supabase, companyId, CAPABILITY.ai)
|
||||
* if (blocked) return blocked
|
||||
*/
|
||||
export async function requireCapability(
|
||||
supabase: SupabaseClient,
|
||||
companyId: string,
|
||||
key: CapabilityKey,
|
||||
): Promise<NextResponse | null> {
|
||||
if (await hasCapability(supabase, companyId, key)) return null
|
||||
return capabilityBlockedResponse(key)
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve which PAID capabilities a company currently holds (entitled AND
|
||||
* enabled), in two queries. Used to seed the client CompanyContext so the UI
|
||||
* can hide/disable/upsell gated features. Self-hosted holds everything.
|
||||
*/
|
||||
export async function getCompanyCapabilities(
|
||||
supabase: SupabaseClient,
|
||||
companyId: string,
|
||||
): Promise<CapabilityKey[]> {
|
||||
if (isSelfHosted()) return [...PAID_CAPABILITIES]
|
||||
if (!isUuid(companyId)) return [] // fail-closed: never interpolate a non-UUID
|
||||
|
||||
const { data: company } = await supabase
|
||||
.from('companies')
|
||||
.select('team_id')
|
||||
.eq('id', companyId)
|
||||
.maybeSingle()
|
||||
const rawTeamId = (company as { team_id: string | null } | null)?.team_id ?? null
|
||||
const teamId = rawTeamId && isUuid(rawTeamId) ? rawTeamId : null
|
||||
|
||||
const scopeFilter = teamId
|
||||
? `company_id.eq.${companyId},team_id.eq.${teamId}`
|
||||
: `company_id.eq.${companyId}`
|
||||
const { data: grants } = await supabase
|
||||
.from('capability_grants')
|
||||
.select('capability_key, expires_at')
|
||||
.in('capability_key', PAID_CAPABILITIES as unknown as string[])
|
||||
.or(scopeFilter)
|
||||
|
||||
const now = Date.now()
|
||||
const entitled = new Set<string>()
|
||||
for (const g of grants ?? []) {
|
||||
const row = g as { capability_key: string; expires_at: string | null }
|
||||
if (row.expires_at === null || new Date(row.expires_at).getTime() > now) {
|
||||
entitled.add(row.capability_key)
|
||||
}
|
||||
}
|
||||
if (entitled.size === 0) return []
|
||||
|
||||
// Subtract any explicitly-disabled (enablement axis).
|
||||
const { data: configs } = await supabase
|
||||
.from('company_capability_config')
|
||||
.select('capability_key, enabled')
|
||||
.eq('company_id', companyId)
|
||||
.eq('enabled', false)
|
||||
for (const c of configs ?? []) {
|
||||
entitled.delete((c as { capability_key: string }).capability_key)
|
||||
}
|
||||
|
||||
return PAID_CAPABILITIES.filter((k) => entitled.has(k))
|
||||
}
|
||||
@@ -0,0 +1,55 @@
|
||||
/**
|
||||
* Capability keys — the single namespace behind the SaaS paywall AND the
|
||||
* per-tenant modularity / marketplace vision. Each key names one gateable
|
||||
* feature; a company "has" it when an unexpired capability_grant exists
|
||||
* (entitlement) and it isn't explicitly disabled (enablement).
|
||||
*
|
||||
* These keys are a STABLE CONTRACT: grant rows, the future marketplace catalog,
|
||||
* and per-tenant module toggles all reference them. Add keys; never rename one.
|
||||
*/
|
||||
export const CAPABILITY = {
|
||||
/** AI assistant chat, onboarding composer, and document field extraction (Anthropic/Bedrock). */
|
||||
ai: 'ai',
|
||||
/** Bank sync / PSD2 (Enable Banking). Freeze-and-retain: tokens are NOT revoked on downgrade. */
|
||||
bank_sync: 'bank_sync',
|
||||
/** Skatteverket filing/sync — VAT, AGI, skattekonto — via BankID. */
|
||||
skatteverket: 'skatteverket',
|
||||
/** Outbound transactional email: invoices, reminders, payslips (Resend). Auth/account email is never gated. */
|
||||
email_send: 'email_send',
|
||||
/** Org-number lookup / enrichment (TIC). NOT gated — identity/lookup is always free. */
|
||||
org_lookup: 'org_lookup',
|
||||
/** EU VAT-number validation (VIES). NOT gated — identity/lookup is always free. */
|
||||
vat_validation: 'vat_validation',
|
||||
/** Riksbanken FX auto-fetch. NOT gated at launch (kept free); manual rate entry is always allowed. */
|
||||
currency_rates: 'currency_rates',
|
||||
/** Cloud backup to Google Drive. NOT gated at launch (kept free — never hold a customer's data hostage). */
|
||||
cloud_backup: 'cloud_backup',
|
||||
/** Migration import from other systems (Fortnox/Visma/Bokio/BL/Briox). Kept open so new payers can migrate IN. */
|
||||
migration: 'migration',
|
||||
/** Bolagsverket iXBRL årsredovisning filing. Reserved (extension not yet enabled). */
|
||||
bolagsverket: 'bolagsverket',
|
||||
} as const
|
||||
|
||||
export type CapabilityKey = (typeof CAPABILITY)[keyof typeof CAPABILITY]
|
||||
|
||||
/**
|
||||
* The set actually withheld from non-payers (manual tier) at the 2026-07-07
|
||||
* cutover. Founder decision (2026-06-28): gate the high-value recurring external
|
||||
* services only.
|
||||
*
|
||||
* KEPT FREE on purpose:
|
||||
* - identity & lookup: TIC org_lookup, VIES vat_validation, BankID login —
|
||||
* they aid onboarding/data quality; gating them is friction in the wrong place.
|
||||
* - currency_rates (FX auto-fetch) and cloud_backup.
|
||||
* Internal bookkeeping is always fully usable on the manual tier.
|
||||
*
|
||||
* NOTE: bank_sync and skatteverket stay PAID even though their flows use BankID
|
||||
* as an auth step — what's charged for is the bank data sync and the VAT/AGI
|
||||
* filing service, not the identity check.
|
||||
*/
|
||||
export const PAID_CAPABILITIES: readonly CapabilityKey[] = [
|
||||
CAPABILITY.ai,
|
||||
CAPABILITY.bank_sync,
|
||||
CAPABILITY.skatteverket,
|
||||
CAPABILITY.email_send,
|
||||
] as const
|
||||
@@ -0,0 +1,33 @@
|
||||
import type { SupabaseClient } from '@supabase/supabase-js'
|
||||
import type { CapabilityKey } from './keys'
|
||||
|
||||
/**
|
||||
* Append a usage event to metered_events. Best-effort and non-blocking:
|
||||
* metering must never break the feature it measures, so failures are swallowed.
|
||||
*
|
||||
* Usage cannot be backfilled, so we capture it from day one even though no
|
||||
* usage-based pricing exists yet — it is the raw material for future firm-level
|
||||
* "active company" / consumption billing.
|
||||
*/
|
||||
export async function recordMeteredEvent(
|
||||
supabase: SupabaseClient,
|
||||
params: {
|
||||
companyId: string
|
||||
teamId?: string | null
|
||||
key: CapabilityKey
|
||||
eventType: string
|
||||
attribution?: Record<string, unknown>
|
||||
},
|
||||
): Promise<void> {
|
||||
try {
|
||||
await supabase.from('metered_events').insert({
|
||||
company_id: params.companyId,
|
||||
team_id: params.teamId ?? null,
|
||||
capability_key: params.key,
|
||||
event_type: params.eventType,
|
||||
attribution: params.attribution ?? {},
|
||||
})
|
||||
} catch {
|
||||
// best-effort; never block the metered operation
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,137 @@
|
||||
import { describe, it, expect, afterEach, vi } from 'vitest'
|
||||
import type { SupabaseClient } from '@supabase/supabase-js'
|
||||
import type Stripe from 'stripe'
|
||||
import {
|
||||
statusGrantsAccess,
|
||||
subscriptionToState,
|
||||
applySubscriptionState,
|
||||
} from '../subscription-sync'
|
||||
|
||||
afterEach(() => vi.unstubAllEnvs())
|
||||
|
||||
// Recording mock: captures the from()/upsert()/delete()/eq() operations so we
|
||||
// can assert what applySubscriptionState wrote, without a real DB.
|
||||
interface RecordedOp {
|
||||
table: string
|
||||
op: 'upsert' | 'delete' | null
|
||||
payload: unknown
|
||||
conflict: string | undefined
|
||||
filters: Array<[string, unknown]>
|
||||
}
|
||||
function recordingSupabase() {
|
||||
const calls: RecordedOp[] = []
|
||||
const supabase = {
|
||||
from(table: string) {
|
||||
const ctx: RecordedOp = { table, op: null, payload: null, conflict: undefined, filters: [] }
|
||||
const chain = {
|
||||
upsert(payload: unknown, opts?: { onConflict?: string }) {
|
||||
ctx.op = 'upsert'
|
||||
ctx.payload = payload
|
||||
ctx.conflict = opts?.onConflict
|
||||
calls.push(ctx)
|
||||
return chain
|
||||
},
|
||||
delete() {
|
||||
ctx.op = 'delete'
|
||||
calls.push(ctx)
|
||||
return chain
|
||||
},
|
||||
eq(col: string, val: unknown) {
|
||||
ctx.filters.push([col, val])
|
||||
return chain
|
||||
},
|
||||
then(resolve: (v: { data: null; error: null }) => void) {
|
||||
resolve({ data: null, error: null })
|
||||
},
|
||||
}
|
||||
return chain
|
||||
},
|
||||
}
|
||||
return { supabase: supabase as unknown as SupabaseClient, calls }
|
||||
}
|
||||
|
||||
function fakeSub(over: Partial<{ status: string; priceId: string; interval: string; periodEnd: number; customer: string }> = {}): Stripe.Subscription {
|
||||
return {
|
||||
id: 'sub_123',
|
||||
customer: over.customer ?? 'cus_123',
|
||||
status: over.status ?? 'active',
|
||||
metadata: {},
|
||||
items: {
|
||||
data: [
|
||||
{
|
||||
price: { id: over.priceId ?? 'price_x', recurring: { interval: over.interval ?? 'month' } },
|
||||
current_period_end: over.periodEnd ?? Math.floor(Date.now() / 1000) + 30 * 86400,
|
||||
},
|
||||
],
|
||||
},
|
||||
} as unknown as Stripe.Subscription
|
||||
}
|
||||
|
||||
describe('statusGrantsAccess', () => {
|
||||
it('grants for active/trialing/past_due, denies otherwise', () => {
|
||||
expect(statusGrantsAccess('active')).toBe(true)
|
||||
expect(statusGrantsAccess('trialing')).toBe(true)
|
||||
expect(statusGrantsAccess('past_due')).toBe(true)
|
||||
expect(statusGrantsAccess('canceled')).toBe(false)
|
||||
expect(statusGrantsAccess('unpaid')).toBe(false)
|
||||
expect(statusGrantsAccess(null)).toBe(false)
|
||||
})
|
||||
})
|
||||
|
||||
describe('subscriptionToState', () => {
|
||||
it('maps status, customer, id, and period end', () => {
|
||||
const end = Math.floor(Date.now() / 1000) + 1000
|
||||
const state = subscriptionToState(fakeSub({ status: 'active', periodEnd: end }), 'co_1')
|
||||
expect(state.companyId).toBe('co_1')
|
||||
expect(state.stripeCustomerId).toBe('cus_123')
|
||||
expect(state.stripeSubscriptionId).toBe('sub_123')
|
||||
expect(state.status).toBe('active')
|
||||
expect(state.currentPeriodEnd).toBe(new Date(end * 1000).toISOString())
|
||||
})
|
||||
|
||||
it('derives plan from the env price id, falling back to interval', () => {
|
||||
vi.stubEnv('STRIPE_PRICE_YEARLY', 'price_year')
|
||||
vi.stubEnv('STRIPE_PRICE_MONTHLY', 'price_month')
|
||||
expect(subscriptionToState(fakeSub({ priceId: 'price_year' }), 'co').plan).toBe('yearly')
|
||||
expect(subscriptionToState(fakeSub({ priceId: 'price_month' }), 'co').plan).toBe('monthly')
|
||||
// unknown price id -> interval fallback
|
||||
expect(subscriptionToState(fakeSub({ priceId: 'price_other', interval: 'year' }), 'co').plan).toBe('yearly')
|
||||
})
|
||||
})
|
||||
|
||||
describe('applySubscriptionState', () => {
|
||||
it('grants the PAID keys when the subscription is active', async () => {
|
||||
const { supabase, calls } = recordingSupabase()
|
||||
await applySubscriptionState(supabase, {
|
||||
companyId: 'co_1',
|
||||
stripeCustomerId: 'cus_1',
|
||||
stripeSubscriptionId: 'sub_1',
|
||||
status: 'active',
|
||||
plan: 'yearly',
|
||||
currentPeriodEnd: new Date().toISOString(),
|
||||
})
|
||||
const subUpsert = calls.find((c) => c.table === 'company_subscriptions')
|
||||
expect(subUpsert?.op).toBe('upsert')
|
||||
const grantUpsert = calls.find((c) => c.table === 'capability_grants')
|
||||
expect(grantUpsert?.op).toBe('upsert')
|
||||
const rows = grantUpsert?.payload as Array<{ capability_key: string; source: string }>
|
||||
expect(rows.map((r) => r.capability_key).sort()).toEqual(['ai', 'bank_sync', 'email_send', 'skatteverket'])
|
||||
expect(rows.every((r) => r.source === 'stripe')).toBe(true)
|
||||
})
|
||||
|
||||
it('removes only the stripe grants when canceled (freeze-and-retain)', async () => {
|
||||
const { supabase, calls } = recordingSupabase()
|
||||
await applySubscriptionState(supabase, {
|
||||
companyId: 'co_1',
|
||||
stripeCustomerId: 'cus_1',
|
||||
stripeSubscriptionId: 'sub_1',
|
||||
status: 'canceled',
|
||||
plan: null,
|
||||
currentPeriodEnd: null,
|
||||
})
|
||||
const grantOp = calls.find((c) => c.table === 'capability_grants')
|
||||
expect(grantOp?.op).toBe('delete')
|
||||
expect(grantOp?.filters).toContainEqual(['company_id', 'co_1'])
|
||||
expect(grantOp?.filters).toContainEqual(['source', 'stripe'])
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,31 @@
|
||||
import Stripe from 'stripe'
|
||||
|
||||
let cached: Stripe | null = null
|
||||
|
||||
/**
|
||||
* Singleton Stripe client. Throws if STRIPE_SECRET_KEY is unset so misconfig
|
||||
* fails loudly at call time rather than silently no-opping. The API version is
|
||||
* pinned by the installed SDK (stripe@22), which is the recommended stable
|
||||
* default — do not hardcode a version string that can drift from the SDK types.
|
||||
*/
|
||||
export function getStripe(): Stripe {
|
||||
if (cached) return cached
|
||||
const key = process.env.STRIPE_SECRET_KEY
|
||||
if (!key) throw new Error('STRIPE_SECRET_KEY is not configured')
|
||||
cached = new Stripe(key)
|
||||
return cached
|
||||
}
|
||||
|
||||
export type BillingPlan = 'monthly' | 'yearly'
|
||||
|
||||
/** Stripe Price id for a plan, from env. Returns undefined if not configured. */
|
||||
export function priceIdForPlan(plan: BillingPlan): string | undefined {
|
||||
return plan === 'yearly'
|
||||
? process.env.STRIPE_PRICE_YEARLY
|
||||
: process.env.STRIPE_PRICE_MONTHLY
|
||||
}
|
||||
|
||||
/** Whether Stripe checkout is configured (used to gate the upgrade CTA). */
|
||||
export function isStripeConfigured(): boolean {
|
||||
return Boolean(process.env.STRIPE_SECRET_KEY && process.env.STRIPE_PRICE_MONTHLY)
|
||||
}
|
||||
@@ -0,0 +1,164 @@
|
||||
import type { SupabaseClient } from '@supabase/supabase-js'
|
||||
import type Stripe from 'stripe'
|
||||
import { PAID_CAPABILITIES } from '@/lib/entitlements/keys'
|
||||
import type { BillingPlan } from './client'
|
||||
|
||||
/**
|
||||
* Stripe → DB reconciliation for subscriptions. The single source of truth for
|
||||
* paid access is capability_grants(source='stripe'); this module writes those
|
||||
* grants from subscription state and removes them on cancellation
|
||||
* (freeze-and-retain — only the stripe grants are touched, never bank tokens or
|
||||
* AI data).
|
||||
*/
|
||||
|
||||
// Statuses that should keep paid access on. past_due stays on as a grace window
|
||||
// (Stripe's dunning retries the charge); access is revoked only once the
|
||||
// subscription is genuinely canceled/unpaid.
|
||||
const ACCESS_STATUSES = new Set(['active', 'trialing', 'past_due'])
|
||||
|
||||
export function statusGrantsAccess(status: string | null | undefined): boolean {
|
||||
return !!status && ACCESS_STATUSES.has(status)
|
||||
}
|
||||
|
||||
export interface SubscriptionState {
|
||||
companyId: string
|
||||
stripeCustomerId: string | null
|
||||
stripeSubscriptionId: string | null
|
||||
status: string | null
|
||||
plan: BillingPlan | null
|
||||
currentPeriodEnd: string | null // ISO
|
||||
}
|
||||
|
||||
function planFromSubscription(sub: Stripe.Subscription): BillingPlan | null {
|
||||
const price = sub.items.data[0]?.price
|
||||
const priceId = price?.id
|
||||
if (priceId && priceId === process.env.STRIPE_PRICE_YEARLY) return 'yearly'
|
||||
if (priceId && priceId === process.env.STRIPE_PRICE_MONTHLY) return 'monthly'
|
||||
// Fallback by recurring interval if env price ids aren't wired up.
|
||||
const interval = price?.recurring?.interval
|
||||
if (interval === 'year') return 'yearly'
|
||||
if (interval === 'month') return 'monthly'
|
||||
return null
|
||||
}
|
||||
|
||||
// current_period_end lives on the Subscription in older API versions and on the
|
||||
// subscription item in newer ones — read defensively so SDK/API drift can't
|
||||
// break the build or the expiry calc.
|
||||
function periodEndIso(sub: Stripe.Subscription): string | null {
|
||||
const s = sub as unknown as {
|
||||
current_period_end?: number
|
||||
items?: { data?: Array<{ current_period_end?: number }> }
|
||||
}
|
||||
const unix = s.current_period_end ?? s.items?.data?.[0]?.current_period_end ?? null
|
||||
return unix ? new Date(unix * 1000).toISOString() : null
|
||||
}
|
||||
|
||||
export function subscriptionToState(sub: Stripe.Subscription, companyId: string): SubscriptionState {
|
||||
return {
|
||||
companyId,
|
||||
stripeCustomerId: typeof sub.customer === 'string' ? sub.customer : (sub.customer?.id ?? null),
|
||||
stripeSubscriptionId: sub.id,
|
||||
status: sub.status,
|
||||
plan: planFromSubscription(sub),
|
||||
currentPeriodEnd: periodEndIso(sub),
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Reconcile a company's subscription state into the DB: upsert
|
||||
* company_subscriptions, then either grant or remove the stripe capability
|
||||
* grants. Idempotent — safe to run on duplicate/retried events.
|
||||
*/
|
||||
export async function applySubscriptionState(
|
||||
supabase: SupabaseClient,
|
||||
state: SubscriptionState,
|
||||
): Promise<void> {
|
||||
await supabase.from('company_subscriptions').upsert(
|
||||
{
|
||||
company_id: state.companyId,
|
||||
stripe_customer_id: state.stripeCustomerId,
|
||||
stripe_subscription_id: state.stripeSubscriptionId,
|
||||
status: state.status,
|
||||
plan: state.plan,
|
||||
current_period_end: state.currentPeriodEnd,
|
||||
updated_at: new Date().toISOString(),
|
||||
},
|
||||
{ onConflict: 'company_id' },
|
||||
)
|
||||
|
||||
if (statusGrantsAccess(state.status)) {
|
||||
// Grant a few days past the period end so a brief renewal-webhook delay
|
||||
// never flips a paying customer to blocked.
|
||||
const expiresAt = state.currentPeriodEnd
|
||||
? new Date(new Date(state.currentPeriodEnd).getTime() + 3 * 24 * 3600 * 1000).toISOString()
|
||||
: null
|
||||
const rows = PAID_CAPABILITIES.map((key) => ({
|
||||
company_id: state.companyId,
|
||||
capability_key: key,
|
||||
source: 'stripe',
|
||||
expires_at: expiresAt,
|
||||
}))
|
||||
await supabase
|
||||
.from('capability_grants')
|
||||
.upsert(rows, { onConflict: 'company_id,team_id,capability_key,source' })
|
||||
} else {
|
||||
// Freeze-and-retain: drop only the stripe grants. Trial/comp grants (if any)
|
||||
// are untouched; data and tokens are never deleted.
|
||||
await supabase
|
||||
.from('capability_grants')
|
||||
.delete()
|
||||
.eq('company_id', state.companyId)
|
||||
.eq('source', 'stripe')
|
||||
}
|
||||
}
|
||||
|
||||
async function companyIdForCustomer(
|
||||
supabase: SupabaseClient,
|
||||
customerId: string,
|
||||
): Promise<string | null> {
|
||||
const { data } = await supabase
|
||||
.from('company_subscriptions')
|
||||
.select('company_id')
|
||||
.eq('stripe_customer_id', customerId)
|
||||
.maybeSingle()
|
||||
return (data as { company_id: string } | null)?.company_id ?? null
|
||||
}
|
||||
|
||||
/**
|
||||
* Route a verified Stripe event to a state reconciliation. Only subscription
|
||||
* lifecycle events matter; everything else is a no-op (already ack'd 200).
|
||||
*/
|
||||
export async function handleStripeEvent(
|
||||
supabase: SupabaseClient,
|
||||
stripe: Stripe,
|
||||
event: Stripe.Event,
|
||||
): Promise<void> {
|
||||
switch (event.type) {
|
||||
case 'checkout.session.completed': {
|
||||
const session = event.data.object as Stripe.Checkout.Session
|
||||
if (session.mode !== 'subscription' || !session.subscription) return
|
||||
const sub = await stripe.subscriptions.retrieve(session.subscription as string)
|
||||
const companyId =
|
||||
session.metadata?.company_id ??
|
||||
session.client_reference_id ??
|
||||
sub.metadata?.company_id ??
|
||||
null
|
||||
if (companyId) await applySubscriptionState(supabase, subscriptionToState(sub, companyId))
|
||||
return
|
||||
}
|
||||
case 'customer.subscription.created':
|
||||
case 'customer.subscription.updated':
|
||||
case 'customer.subscription.deleted': {
|
||||
const sub = event.data.object as Stripe.Subscription
|
||||
const companyId =
|
||||
sub.metadata?.company_id ??
|
||||
(await companyIdForCustomer(supabase, typeof sub.customer === 'string' ? sub.customer : sub.customer.id))
|
||||
if (companyId) await applySubscriptionState(supabase, subscriptionToState(sub, companyId))
|
||||
return
|
||||
}
|
||||
default:
|
||||
// invoice.payment_failed etc. — Stripe also emits subscription.updated
|
||||
// (-> past_due / canceled), which the cases above handle. No-op here.
|
||||
return
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user