feat(billing): multi-user paywall: multi_user capability, 20-day grace, owner-only dormancy (#2099)
* feat(billing): multi-user seat gate: multi_user capability, 20-day grace, owner-only dormancy Multiple people in one company becomes a paid capability (multi_user, the eighth PAID key). Derived at access time from capability_grants, no status column, no enforcement cron: - entitled: active grant (trial/stripe/team/manual/comp), everyone works - grace: newest grant expired < 20 days ago; countdown banner for everyone in companies with > 1 user; invites still allowed - frozen: only role=owner resolves; other memberships go dormant (rows untouched, paying reactivates instantly); invites 403 with paid-plan upsell Enforcement: new resolve_active_company_gated RPC (zero-arg RPC and RLS twin untouched: they also run on self-hosts, where the gate never bites), gated query fallback for service-role/API-key paths, setActiveCompany guard, MCP company-access check, invite route. Middleware routes all-frozen users to a new /paused page; the switcher greys locked companies. Migration 20260901081417 (applied to staging): trial trigger seeds multi_user, backfills for mid-trial companies, active Stripe subs, team agreements, and a grandfather grant (expires now, i.e. grace = deploy + 20 days) for existing unpaid multi-member companies. Daily cron mails owners at grace start and last day. Strings in sv+en; pg-real + unit tests included. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP * fix(billing): multi-user seat gate hardening from skeptic review - Stripe cancel now EXPIRES the multi_user stripe grant instead of deleting it: the 20-day grace window hangs on an expired row, so a deleted one froze churned payers' staff instantly with no banner and no mail. Other stripe grants keep the freeze-and-retain delete. - New SECURITY DEFINER company_multi_user_state() RPC (migration 20260901083726, applied to staging) and RPC-first getMultiUserState: capability_grants RLS hides team-scoped rows from non-team users, so user-client reads misread byra-covered companies as frozen (switch refusal, wrong switcher locks). - Byra-kind teams get a standing team-scoped multi_user grant (backfill + teams trigger): byra client companies have no company-scoped trial by design, so a grantless byra team would freeze every consultant and client user. - Comped/manual companies with active PAID-key grants extend to multi_user (a comped company must not read as paying while locking out user two). - /api/v1 gets the same dormancy gate as MCP (frozen non-owner -> 403). - PGRST202 on resolution fails OPEN (pre-migration DB has zero multi_user rows; the gated fallback would have frozen every non-owner mid-deploy). - Grace cron: covers team-scoped lapses (byra agreement ending) and skips the start mail for the hand-mailed grandfather cohort. - Tests updated/added across all touched surfaces; pg tests for the new RPC and byra trigger; trial-suppression pg test extended to 8 keys. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP * fix(billing): decouple seat-gate env check and fail open on gate read throws CI round 1 on #2099: - isMultiUserEnforced no longer imports has-capability: several route test suites partially mock that module and the vitest mock guard threw from inside the v1 seat gate, turning expected 4xx responses into 500s. multi_user is never a connector capability, so the bypass reduces to the same env reads, now inlined. - getMultiUserState wraps its resolution in a fail-open try/catch: a client without .rpc or a thrown network error must never lock users out. - no-phantom-columns ceiling 391 -> 393 with reasons: the seat gate's .or() scope filter (server-resolved UUIDs) and the Stripe cancel expiry update's timestamp .or(); all columns in both strings are literals. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP * fix(billing): membership-guard the multi-user entitlement RPCs (Superagent P3) company_multi_user_ok and company_multi_user_state are SECURITY DEFINER and were granted to authenticated with a caller-supplied company UUID: any logged-in user could probe an arbitrary company's billing state and grace deadline across tenants. Migration 20260901091752 (applied to staging) requires an auth.uid() membership in the target company when a JWT is present, keeps service-role/definer contexts unrestricted, and clamps the grace window to [0, 20] days. pg tests: stranger gets false/NULL, member reads normally, oversized p_grace_days cannot widen the probe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Fable 5
Claude Fable 5
parent
ca12b1855e
commit
aabddb592f
@@ -1,4 +1,4 @@
|
||||
import { describe, expect, it, vi } from 'vitest'
|
||||
import { beforeEach, describe, expect, it, vi } from 'vitest'
|
||||
import {
|
||||
addCompanyToNextHint,
|
||||
addCompanyToTopLevelNext,
|
||||
@@ -12,6 +12,25 @@ import {
|
||||
const DEFAULT_COMPANY_ID = '11111111-1111-4111-8111-111111111111'
|
||||
const OTHER_COMPANY_ID = '22222222-2222-4222-8222-222222222222'
|
||||
|
||||
// Multi-user seat gate: mocked (real logic covered in
|
||||
// lib/entitlements/__tests__/multi-user.test.ts) so the membership chain mock
|
||||
// below stays single-purpose. Default entitled; individual tests flip it.
|
||||
const getMultiUserStateMock = vi.hoisted(() => vi.fn())
|
||||
vi.mock('@/lib/entitlements/multi-user', async () => {
|
||||
const actual = await vi.importActual<typeof import('@/lib/entitlements/multi-user')>(
|
||||
'@/lib/entitlements/multi-user',
|
||||
)
|
||||
return {
|
||||
...actual,
|
||||
getMultiUserState: (...args: unknown[]) => getMultiUserStateMock(...args),
|
||||
}
|
||||
})
|
||||
|
||||
beforeEach(() => {
|
||||
getMultiUserStateMock.mockReset()
|
||||
getMultiUserStateMock.mockResolvedValue({ state: 'entitled', graceEndsAt: null })
|
||||
})
|
||||
|
||||
function membershipClient(result: { data: unknown; error: unknown }) {
|
||||
const chain: Record<string, ReturnType<typeof vi.fn>> = {
|
||||
select: vi.fn(() => chain),
|
||||
@@ -133,6 +152,60 @@ describe('MCP company routing', () => {
|
||||
expect(chain.maybeSingle).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('refuses a NON-OWNER membership in a frozen company (multi-user seat gate)', async () => {
|
||||
getMultiUserStateMock.mockResolvedValue({ state: 'frozen', graceEndsAt: null })
|
||||
const { client } = membershipClient({
|
||||
data: { company_id: OTHER_COMPANY_ID, role: 'admin' },
|
||||
error: null,
|
||||
})
|
||||
|
||||
await expect(
|
||||
resolveMcpCompanyContext({
|
||||
supabase: client as never,
|
||||
userId: 'user-1',
|
||||
defaultCompanyId: DEFAULT_COMPANY_ID,
|
||||
requestedCompanyId: OTHER_COMPANY_ID,
|
||||
})
|
||||
).rejects.toMatchObject({ code: 'FORBIDDEN' })
|
||||
})
|
||||
|
||||
it('lets an OWNER through without consulting the seat gate', async () => {
|
||||
getMultiUserStateMock.mockResolvedValue({ state: 'frozen', graceEndsAt: null })
|
||||
const { client } = membershipClient({
|
||||
data: { company_id: DEFAULT_COMPANY_ID, role: 'owner' },
|
||||
error: null,
|
||||
})
|
||||
|
||||
await expect(
|
||||
resolveMcpCompanyContext({
|
||||
supabase: client as never,
|
||||
userId: 'user-1',
|
||||
defaultCompanyId: DEFAULT_COMPANY_ID,
|
||||
})
|
||||
).resolves.toMatchObject({ role: 'owner' })
|
||||
expect(getMultiUserStateMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('lets a non-owner through while the company is in its grace window', async () => {
|
||||
getMultiUserStateMock.mockResolvedValue({
|
||||
state: 'grace',
|
||||
graceEndsAt: new Date(Date.now() + 5 * 86_400_000).toISOString(),
|
||||
})
|
||||
const { client } = membershipClient({
|
||||
data: { company_id: OTHER_COMPANY_ID, role: 'member' },
|
||||
error: null,
|
||||
})
|
||||
|
||||
await expect(
|
||||
resolveMcpCompanyContext({
|
||||
supabase: client as never,
|
||||
userId: 'user-1',
|
||||
defaultCompanyId: DEFAULT_COMPANY_ID,
|
||||
requestedCompanyId: OTHER_COMPANY_ID,
|
||||
})
|
||||
).resolves.toMatchObject({ role: 'member' })
|
||||
})
|
||||
|
||||
it('rejects companies without a current non-archived membership', async () => {
|
||||
const { client } = membershipClient({ data: null, error: null })
|
||||
|
||||
|
||||
@@ -56,6 +56,18 @@ vi.mock('@/lib/entitlements/has-capability', async (importOriginal) => {
|
||||
return { ...actual, hasCapability: mocks.hasCapability }
|
||||
})
|
||||
|
||||
// Multi-user seat gate: entitled here, so the strict company_members-only
|
||||
// table mock above stays valid for non-owner roles (the gate would otherwise
|
||||
// read companies + capability_grants). Gate behavior is covered in
|
||||
// company-routing.test.ts and lib/entitlements/__tests__/multi-user.test.ts.
|
||||
vi.mock('@/lib/entitlements/multi-user', async (importOriginal) => {
|
||||
const actual = await importOriginal<typeof import('@/lib/entitlements/multi-user')>()
|
||||
return {
|
||||
...actual,
|
||||
getMultiUserState: vi.fn().mockResolvedValue({ state: 'entitled', graceEndsAt: null }),
|
||||
}
|
||||
})
|
||||
|
||||
import { handleMcpRequest } from '../server'
|
||||
|
||||
function toolCall(args: Record<string, unknown>): Request {
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
import type { SupabaseClient } from '@supabase/supabase-js'
|
||||
import type { ApiKeyScope } from '@/lib/auth/api-keys'
|
||||
import { getMultiUserState, isMembershipDormant } from '@/lib/entitlements/multi-user'
|
||||
import type { CompanyRole } from '@/types'
|
||||
|
||||
const UUID_PATTERN =
|
||||
@@ -144,6 +145,20 @@ export async function resolveMcpCompanyContext(args: {
|
||||
throw codedError('FORBIDDEN', 'Company membership has an unsupported role')
|
||||
}
|
||||
|
||||
// Multi-user seat gate: the MCP surface is a chokepoint like the HTTP
|
||||
// routes, so a non-owner membership in a frozen company (multi_user lapsed
|
||||
// past its 20-day grace) is refused here, before any tool touches tenant
|
||||
// data. Owners always pass; self-hosted/dev return 'entitled' outright.
|
||||
if (membership.role !== 'owner') {
|
||||
const access = await getMultiUserState(args.supabase, companyId)
|
||||
if (isMembershipDormant(membership.role, access.state)) {
|
||||
throw codedError(
|
||||
'FORBIDDEN',
|
||||
'This company is paused for your account: multiple users require a paid plan. Ask the company owner to upgrade.'
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
companyId,
|
||||
role: membership.role,
|
||||
|
||||
Reference in New Issue
Block a user