Files
accounted/lib/stripe/__tests__/subscription-sync.test.ts
T
Mattsson aabddb592f feat(billing): multi-user paywall: multi_user capability, 20-day grace, owner-only dormancy (#2099)
* feat(billing): multi-user seat gate: multi_user capability, 20-day grace, owner-only dormancy

Multiple people in one company becomes a paid capability (multi_user, the
eighth PAID key). Derived at access time from capability_grants, no status
column, no enforcement cron:

- entitled: active grant (trial/stripe/team/manual/comp), everyone works
- grace: newest grant expired < 20 days ago; countdown banner for everyone
  in companies with > 1 user; invites still allowed
- frozen: only role=owner resolves; other memberships go dormant (rows
  untouched, paying reactivates instantly); invites 403 with paid-plan upsell

Enforcement: new resolve_active_company_gated RPC (zero-arg RPC and RLS twin
untouched: they also run on self-hosts, where the gate never bites), gated
query fallback for service-role/API-key paths, setActiveCompany guard, MCP
company-access check, invite route. Middleware routes all-frozen users to a
new /paused page; the switcher greys locked companies.

Migration 20260901081417 (applied to staging): trial trigger seeds
multi_user, backfills for mid-trial companies, active Stripe subs, team
agreements, and a grandfather grant (expires now, i.e. grace = deploy + 20
days) for existing unpaid multi-member companies. Daily cron mails owners at
grace start and last day. Strings in sv+en; pg-real + unit tests included.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP

* fix(billing): multi-user seat gate hardening from skeptic review

- Stripe cancel now EXPIRES the multi_user stripe grant instead of deleting
  it: the 20-day grace window hangs on an expired row, so a deleted one
  froze churned payers' staff instantly with no banner and no mail. Other
  stripe grants keep the freeze-and-retain delete.
- New SECURITY DEFINER company_multi_user_state() RPC (migration
  20260901083726, applied to staging) and RPC-first getMultiUserState:
  capability_grants RLS hides team-scoped rows from non-team users, so
  user-client reads misread byra-covered companies as frozen (switch
  refusal, wrong switcher locks).
- Byra-kind teams get a standing team-scoped multi_user grant (backfill +
  teams trigger): byra client companies have no company-scoped trial by
  design, so a grantless byra team would freeze every consultant and
  client user.
- Comped/manual companies with active PAID-key grants extend to multi_user
  (a comped company must not read as paying while locking out user two).
- /api/v1 gets the same dormancy gate as MCP (frozen non-owner -> 403).
- PGRST202 on resolution fails OPEN (pre-migration DB has zero multi_user
  rows; the gated fallback would have frozen every non-owner mid-deploy).
- Grace cron: covers team-scoped lapses (byra agreement ending) and skips
  the start mail for the hand-mailed grandfather cohort.
- Tests updated/added across all touched surfaces; pg tests for the new
  RPC and byra trigger; trial-suppression pg test extended to 8 keys.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP

* fix(billing): decouple seat-gate env check and fail open on gate read throws

CI round 1 on #2099:
- isMultiUserEnforced no longer imports has-capability: several route test
  suites partially mock that module and the vitest mock guard threw from
  inside the v1 seat gate, turning expected 4xx responses into 500s.
  multi_user is never a connector capability, so the bypass reduces to the
  same env reads, now inlined.
- getMultiUserState wraps its resolution in a fail-open try/catch: a client
  without .rpc or a thrown network error must never lock users out.
- no-phantom-columns ceiling 391 -> 393 with reasons: the seat gate's .or()
  scope filter (server-resolved UUIDs) and the Stripe cancel expiry update's
  timestamp .or(); all columns in both strings are literals.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP

* fix(billing): membership-guard the multi-user entitlement RPCs (Superagent P3)

company_multi_user_ok and company_multi_user_state are SECURITY DEFINER and
were granted to authenticated with a caller-supplied company UUID: any
logged-in user could probe an arbitrary company's billing state and grace
deadline across tenants. Migration 20260901091752 (applied to staging)
requires an auth.uid() membership in the target company when a JWT is
present, keeps service-role/definer contexts unrestricted, and clamps the
grace window to [0, 20] days. pg tests: stranger gets false/NULL, member
reads normally, oversized p_grace_days cannot widen the probe.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-09-01 11:29:12 +02:00

163 lines
6.3 KiB
TypeScript

import { describe, it, expect, afterEach, vi } from 'vitest'
import type { SupabaseClient } from '@supabase/supabase-js'
import type Stripe from 'stripe'
import {
statusGrantsAccess,
subscriptionToState,
applySubscriptionState,
} from '../subscription-sync'
afterEach(() => vi.unstubAllEnvs())
// Recording mock: captures the from()/upsert()/delete()/eq() operations so we
// can assert what applySubscriptionState wrote, without a real DB.
interface RecordedOp {
table: string
op: 'upsert' | 'delete' | 'update' | null
payload: unknown
conflict: string | undefined
filters: Array<[string, unknown]>
}
function recordingSupabase() {
const calls: RecordedOp[] = []
const supabase = {
from(table: string) {
const ctx: RecordedOp = { table, op: null, payload: null, conflict: undefined, filters: [] }
const chain = {
upsert(payload: unknown, opts?: { onConflict?: string }) {
ctx.op = 'upsert'
ctx.payload = payload
ctx.conflict = opts?.onConflict
calls.push(ctx)
return chain
},
delete() {
ctx.op = 'delete'
calls.push(ctx)
return chain
},
update(payload: unknown) {
ctx.op = 'update'
ctx.payload = payload
calls.push(ctx)
return chain
},
eq(col: string, val: unknown) {
ctx.filters.push([col, val])
return chain
},
neq(col: string, val: unknown) {
ctx.filters.push([`neq:${col}`, val])
return chain
},
or(filter: string) {
ctx.filters.push(['or', filter])
return chain
},
then(resolve: (v: { data: null; error: null }) => void) {
resolve({ data: null, error: null })
},
}
return chain
},
}
return { supabase: supabase as unknown as SupabaseClient, calls }
}
function fakeSub(over: Partial<{ status: string; priceId: string; interval: string; periodEnd: number; customer: string }> = {}): Stripe.Subscription {
return {
id: 'sub_123',
customer: over.customer ?? 'cus_123',
status: over.status ?? 'active',
metadata: {},
items: {
data: [
{
price: { id: over.priceId ?? 'price_x', recurring: { interval: over.interval ?? 'month' } },
current_period_end: over.periodEnd ?? Math.floor(Date.now() / 1000) + 30 * 86400,
},
],
},
} as unknown as Stripe.Subscription
}
describe('statusGrantsAccess', () => {
it('grants for active/trialing/past_due, denies otherwise', () => {
expect(statusGrantsAccess('active')).toBe(true)
expect(statusGrantsAccess('trialing')).toBe(true)
expect(statusGrantsAccess('past_due')).toBe(true)
expect(statusGrantsAccess('canceled')).toBe(false)
expect(statusGrantsAccess('unpaid')).toBe(false)
expect(statusGrantsAccess(null)).toBe(false)
})
})
describe('subscriptionToState', () => {
it('maps status, customer, id, and period end', () => {
const end = Math.floor(Date.now() / 1000) + 1000
const state = subscriptionToState(fakeSub({ status: 'active', periodEnd: end }), 'co_1')
expect(state.companyId).toBe('co_1')
expect(state.stripeCustomerId).toBe('cus_123')
expect(state.stripeSubscriptionId).toBe('sub_123')
expect(state.status).toBe('active')
expect(state.currentPeriodEnd).toBe(new Date(end * 1000).toISOString())
})
it('derives plan from the env price id, falling back to interval', () => {
vi.stubEnv('STRIPE_PRICE_YEARLY', 'price_year')
vi.stubEnv('STRIPE_PRICE_MONTHLY', 'price_month')
expect(subscriptionToState(fakeSub({ priceId: 'price_year' }), 'co').plan).toBe('yearly')
expect(subscriptionToState(fakeSub({ priceId: 'price_month' }), 'co').plan).toBe('monthly')
// unknown price id -> interval fallback
expect(subscriptionToState(fakeSub({ priceId: 'price_other', interval: 'year' }), 'co').plan).toBe('yearly')
})
})
describe('applySubscriptionState', () => {
it('grants the PAID keys when the subscription is active', async () => {
const { supabase, calls } = recordingSupabase()
await applySubscriptionState(supabase, {
companyId: 'co_1',
stripeCustomerId: 'cus_1',
stripeSubscriptionId: 'sub_1',
status: 'active',
plan: 'yearly',
currentPeriodEnd: new Date().toISOString(),
})
const subUpsert = calls.find((c) => c.table === 'company_subscriptions')
expect(subUpsert?.op).toBe('upsert')
const grantUpsert = calls.find((c) => c.table === 'capability_grants')
expect(grantUpsert?.op).toBe('upsert')
const rows = grantUpsert?.payload as Array<{ capability_key: string; source: string }>
expect(rows.map((r) => r.capability_key).sort()).toEqual(['ai', 'bank_sync', 'email_send', 'multi_user', 'shopify_sync', 'skatteverket', 'stripe_payments', 'woocommerce_sync'])
expect(rows.every((r) => r.source === 'stripe')).toBe(true)
})
it('removes the stripe grants when canceled but EXPIRES multi_user (grace anchor)', async () => {
const { supabase, calls } = recordingSupabase()
await applySubscriptionState(supabase, {
companyId: 'co_1',
stripeCustomerId: 'cus_1',
stripeSubscriptionId: 'sub_1',
status: 'canceled',
plan: null,
currentPeriodEnd: null,
})
const grantOps = calls.filter((c) => c.table === 'capability_grants')
// Freeze-and-retain deletes every external-service grant, except
// multi_user, whose 20-day grace window hangs on an EXPIRED row: a
// deleted row would freeze the churned payer's staff instantly.
const deleteOp = grantOps.find((c) => c.op === 'delete')
expect(deleteOp?.filters).toContainEqual(['company_id', 'co_1'])
expect(deleteOp?.filters).toContainEqual(['source', 'stripe'])
expect(deleteOp?.filters).toContainEqual(['neq:capability_key', 'multi_user'])
const updateOp = grantOps.find((c) => c.op === 'update')
expect(updateOp?.filters).toContainEqual(['capability_key', 'multi_user'])
const payload = updateOp?.payload as { expires_at: string }
expect(new Date(payload.expires_at).getTime()).toBeLessThanOrEqual(Date.now())
// Only a still-active row is expired: a re-delivered cancel event must
// not slide the grace anchor forward (the .or filter scopes the update).
expect(updateOp?.filters.some(([col]) => col === 'or')).toBe(true)
})
})