Files
accounted/tests/pg/trial-suppression-byra.pg.test.ts
T
MattssonandClaude Fable 5 aabddb592f feat(billing): multi-user paywall: multi_user capability, 20-day grace, owner-only dormancy (#2099)
* feat(billing): multi-user seat gate: multi_user capability, 20-day grace, owner-only dormancy

Multiple people in one company becomes a paid capability (multi_user, the
eighth PAID key). Derived at access time from capability_grants, no status
column, no enforcement cron:

- entitled: active grant (trial/stripe/team/manual/comp), everyone works
- grace: newest grant expired < 20 days ago; countdown banner for everyone
  in companies with > 1 user; invites still allowed
- frozen: only role=owner resolves; other memberships go dormant (rows
  untouched, paying reactivates instantly); invites 403 with paid-plan upsell

Enforcement: new resolve_active_company_gated RPC (zero-arg RPC and RLS twin
untouched: they also run on self-hosts, where the gate never bites), gated
query fallback for service-role/API-key paths, setActiveCompany guard, MCP
company-access check, invite route. Middleware routes all-frozen users to a
new /paused page; the switcher greys locked companies.

Migration 20260901081417 (applied to staging): trial trigger seeds
multi_user, backfills for mid-trial companies, active Stripe subs, team
agreements, and a grandfather grant (expires now, i.e. grace = deploy + 20
days) for existing unpaid multi-member companies. Daily cron mails owners at
grace start and last day. Strings in sv+en; pg-real + unit tests included.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP

* fix(billing): multi-user seat gate hardening from skeptic review

- Stripe cancel now EXPIRES the multi_user stripe grant instead of deleting
  it: the 20-day grace window hangs on an expired row, so a deleted one
  froze churned payers' staff instantly with no banner and no mail. Other
  stripe grants keep the freeze-and-retain delete.
- New SECURITY DEFINER company_multi_user_state() RPC (migration
  20260901083726, applied to staging) and RPC-first getMultiUserState:
  capability_grants RLS hides team-scoped rows from non-team users, so
  user-client reads misread byra-covered companies as frozen (switch
  refusal, wrong switcher locks).
- Byra-kind teams get a standing team-scoped multi_user grant (backfill +
  teams trigger): byra client companies have no company-scoped trial by
  design, so a grantless byra team would freeze every consultant and
  client user.
- Comped/manual companies with active PAID-key grants extend to multi_user
  (a comped company must not read as paying while locking out user two).
- /api/v1 gets the same dormancy gate as MCP (frozen non-owner -> 403).
- PGRST202 on resolution fails OPEN (pre-migration DB has zero multi_user
  rows; the gated fallback would have frozen every non-owner mid-deploy).
- Grace cron: covers team-scoped lapses (byra agreement ending) and skips
  the start mail for the hand-mailed grandfather cohort.
- Tests updated/added across all touched surfaces; pg tests for the new
  RPC and byra trigger; trial-suppression pg test extended to 8 keys.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP

* fix(billing): decouple seat-gate env check and fail open on gate read throws

CI round 1 on #2099:
- isMultiUserEnforced no longer imports has-capability: several route test
  suites partially mock that module and the vitest mock guard threw from
  inside the v1 seat gate, turning expected 4xx responses into 500s.
  multi_user is never a connector capability, so the bypass reduces to the
  same env reads, now inlined.
- getMultiUserState wraps its resolution in a fail-open try/catch: a client
  without .rpc or a thrown network error must never lock users out.
- no-phantom-columns ceiling 391 -> 393 with reasons: the seat gate's .or()
  scope filter (server-resolved UUIDs) and the Stripe cancel expiry update's
  timestamp .or(); all columns in both strings are literals.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP

* fix(billing): membership-guard the multi-user entitlement RPCs (Superagent P3)

company_multi_user_ok and company_multi_user_state are SECURITY DEFINER and
were granted to authenticated with a caller-supplied company UUID: any
logged-in user could probe an arbitrary company's billing state and grace
deadline across tenants. Migration 20260901091752 (applied to staging)
requires an auth.uid() membership in the target company when a JWT is
present, keeps service-role/definer contexts unrestricted, and clamps the
grace window to [0, 20] days. pg tests: stranger gets false/NULL, member
reads normally, oversized p_grace_days cannot widen the probe.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-09-01 11:29:12 +02:00

142 lines
5.0 KiB
TypeScript

import { randomUUID } from 'node:crypto'
import { describe, expect, it } from 'vitest'
import { getPool } from '@/tests/pg/setup'
import { insertAuthUser } from '@/tests/pg/fixtures'
import { PAID_CAPABILITIES } from '@/lib/entitlements/keys'
// Tests for 20260826130300_suppress_trial_for_byra_companies.sql (WL-10):
// the company-creation trial trigger (trg_seed_trial_capability_grants /
// seed_trial_capability_grants) must skip companies attached to a byrå team
// (already entitled via the team-scoped partner grant) while personal-team
// and teamless companies keep the 30-day trial exactly as before.
//
// The trigger is AFTER INSERT ON companies and reads NEW.team_id, so plain
// inserts through the pool exercise it on every creation path.
// Full PAID set (20260818170000); must stay in step with
// lib/entitlements/keys.ts PAID_CAPABILITIES. Sorted: trialGrantKeys()
// orders by capability_key.
const TRIAL_KEYS = [...PAID_CAPABILITIES].sort()
async function insertTeam(params: {
createdBy: string
kind: 'personal' | 'byra'
name?: string
}): Promise<string> {
const id = randomUUID()
await getPool().query(
`INSERT INTO public.teams (id, name, created_by, kind)
VALUES ($1, $2, $3, $4)`,
[id, params.name ?? 'Trial Test Team', params.createdBy, params.kind],
)
await getPool().query(
`INSERT INTO public.team_members (team_id, user_id, role)
VALUES ($1, $2, 'owner')`,
[id, params.createdBy],
)
return id
}
async function insertCompanyOnTeam(params: {
createdBy: string
teamId: string | null
}): Promise<string> {
const id = randomUUID()
await getPool().query(
`INSERT INTO public.companies (id, name, entity_type, created_by, team_id)
VALUES ($1, 'Trial Test AB', 'aktiebolag', $2, $3)`,
[id, params.createdBy, params.teamId],
)
return id
}
async function trialGrantKeys(companyId: string): Promise<string[]> {
const { rows } = await getPool().query<{ capability_key: string }>(
`SELECT capability_key FROM public.capability_grants
WHERE company_id = $1 AND source = 'trial'
ORDER BY capability_key`,
[companyId],
)
return rows.map((r) => r.capability_key)
}
describe('trial suppression for byrå-team companies', () => {
it('the trial seed covers the full eight-key PAID set', () => {
// Guard against the seed list drifting from lib/entitlements/keys.ts:
// if PAID_CAPABILITIES grows, the migration VALUES list (and this test)
// must grow with it. multi_user joined at 20260901081417.
expect(TRIAL_KEYS).toEqual(
[
'ai',
'bank_sync',
'email_send',
'multi_user',
'shopify_sync',
'skatteverket',
'stripe_payments',
'woocommerce_sync',
],
)
})
it('a company created under a byrå team gets NO trial grants', async () => {
const byraOwner = await insertAuthUser()
const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
const companyId = await insertCompanyOnTeam({ createdBy: byraOwner, teamId: byraTeam })
expect(await trialGrantKeys(companyId)).toEqual([])
})
it('a company created under a personal team still gets the full trial', async () => {
const user = await insertAuthUser()
const personalTeam = await insertTeam({ createdBy: user, kind: 'personal' })
const companyId = await insertCompanyOnTeam({ createdBy: user, teamId: personalTeam })
expect(await trialGrantKeys(companyId)).toEqual(TRIAL_KEYS)
})
it('a teamless company still gets the full trial', async () => {
const user = await insertAuthUser()
const companyId = await insertCompanyOnTeam({ createdBy: user, teamId: null })
expect(await trialGrantKeys(companyId)).toEqual(TRIAL_KEYS)
})
it('personal-team trial expiry stays created_at + 30 days', async () => {
const user = await insertAuthUser()
const personalTeam = await insertTeam({ createdBy: user, kind: 'personal' })
const companyId = await insertCompanyOnTeam({ createdBy: user, teamId: personalTeam })
const { rows } = await getPool().query<{ ok: boolean }>(
`SELECT bool_and(g.expires_at = c.created_at + interval '30 days') AS ok
FROM public.capability_grants g
JOIN public.companies c ON c.id = g.company_id
WHERE g.company_id = $1 AND g.source = 'trial'`,
[companyId],
)
expect(rows[0]!.ok).toBe(true)
})
it('byrå suppression does not block non-trial grants on the same company', async () => {
const byraOwner = await insertAuthUser()
const byraTeam = await insertTeam({ createdBy: byraOwner, kind: 'byra' })
const companyId = await insertCompanyOnTeam({ createdBy: byraOwner, teamId: byraTeam })
// The team-scoped partner grant (WL-10 v1 mechanics) is unaffected.
await getPool().query(
`INSERT INTO public.capability_grants (team_id, capability_key, source, expires_at)
VALUES ($1, 'ai', 'manual', NULL)`,
[byraTeam],
)
const { rows } = await getPool().query<{ ok: boolean }>(
`SELECT public.company_has_capability($1, 'ai') AS ok`,
[companyId],
)
expect(rows[0]!.ok).toBe(true)
})
})