member-console/internal/server/member_switch_gate_test.go

// SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Commercial
// SPDX-FileCopyrightText: 2025-2026 Christian Galo

package server

import (
	"context"
	"errors"
	"io"
	"log/slog"
	"testing"

	"git.coopcloud.tech/wiki-cafe/member-console/internal/billing"
)

// Finding 12 of the 2026-09 security audit: checkout refused a product that
// failed the member gate, the switch path did not, so a member who knew a
// draft tier's price id could move onto it. The switch now holds its target
// to the same gate before any subscription is touched. The querier stubs
// only the two reads the gate makes; anything further panics on the nil
// interface, which is the proof that a refusal stops there.
func TestSwitchTargetRefusesAProductOutsideTheMemberGate(t *testing.T) {
	cases := []struct {
		name    string
		product billing.Product
	}{
		{"draft product", billing.Product{ProductID: "prod-draft", LifecycleStatus: "draft", IsActive: true, IsPublic: true}},
		{"retired product", billing.Product{ProductID: "prod-retired", LifecycleStatus: "retired", IsActive: true, IsPublic: true}},
		{"inactive product", billing.Product{ProductID: "prod-inactive", LifecycleStatus: "published", IsActive: false, IsPublic: true}},
		{"non-public product", billing.Product{ProductID: "prod-internal", LifecycleStatus: "published", IsActive: true, IsPublic: false}},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			h := &MemberProductsHandler{
				BillingQ: fakeCheckoutQuerier{
					price:   billing.Price{PriceID: "price-1", ProductID: tc.product.ProductID, IsActive: true},
					product: tc.product,
				},
				Logger: slog.New(slog.NewTextHandler(io.Discard, nil)),
			}
			err := h.switchTargetOpenToMembers(context.Background(), "price-1")
			if !errors.Is(err, errPlanNotOpenToMembers) {
				t.Fatalf("err = %v, want errPlanNotOpenToMembers", err)
			}
		})
	}
}

// The control: a published, active, public target passes, so the gate
// refuses the draft and not every switch.
func TestSwitchTargetAdmitsAPublishedProduct(t *testing.T) {
	h := &MemberProductsHandler{
		BillingQ: fakeCheckoutQuerier{
			price:   billing.Price{PriceID: "price-1", ProductID: "prod-1", IsActive: true},
			product: billing.Product{ProductID: "prod-1", LifecycleStatus: "published", IsActive: true, IsPublic: true},
		},
		Logger: slog.New(slog.NewTextHandler(io.Discard, nil)),
	}
	if err := h.switchTargetOpenToMembers(context.Background(), "price-1"); err != nil {
		t.Fatalf("a published product must pass the gate, got %v", err)
	}
}

// ladderQuerier adds the one read switchTargetAllowed makes beyond the
// member gate: the ladder's tiers.
type ladderQuerier struct {
	fakeCheckoutQuerier
	tiers []billing.ListTiersByLadderWithProductsRow
}

func (q ladderQuerier) ListTiersByLadderWithProducts(_ context.Context, _ string) ([]billing.ListTiersByLadderWithProductsRow, error) {
	return q.tiers, nil
}

// Finding 6 of the 2026-09-21 audit: the switch preview copied only the
// active-price check and so rendered an unpublished product's name and a
// Stripe estimate for any price a member could name. switchTargetAllowed is
// the one gate the switch and the preview now share: the member gate, then
// membership of the named ladder (security-audit-remediation-3 design D6).
func TestSwitchTargetAllowedRequiresTheLadder(t *testing.T) {
	published := billing.Product{ProductID: "prod-1", LifecycleStatus: "published", IsActive: true, IsPublic: true}
	newHandler := func(tiers ...string) *MemberProductsHandler {
		q := ladderQuerier{fakeCheckoutQuerier: fakeCheckoutQuerier{
			price: billing.Price{PriceID: "price-1", ProductID: "prod-1", IsActive: true}, product: published,
		}}
		for _, id := range tiers {
			q.tiers = append(q.tiers, billing.ListTiersByLadderWithProductsRow{ProductID: id})
		}
		return &MemberProductsHandler{BillingQ: q, Logger: slog.New(slog.NewTextHandler(io.Discard, nil))}
	}

	if err := newHandler("prod-0", "prod-1", "prod-2").switchTargetAllowed(context.Background(), "ladder-1", "price-1"); err != nil {
		t.Fatalf("a published tier of the ladder must pass, got %v", err)
	}
	err := newHandler("prod-0", "prod-2").switchTargetAllowed(context.Background(), "ladder-1", "price-1")
	if !errors.Is(err, errPlanOffLadder) {
		t.Fatalf("a product that is not a tier of the ladder must be refused, got %v", err)
	}

	draft := newHandler("prod-1")
	draft.BillingQ = ladderQuerier{fakeCheckoutQuerier: fakeCheckoutQuerier{
		price:   billing.Price{PriceID: "price-1", ProductID: "prod-1", IsActive: true},
		product: billing.Product{ProductID: "prod-1", LifecycleStatus: "draft", IsActive: true, IsPublic: true},
	}, tiers: []billing.ListTiersByLadderWithProductsRow{{ProductID: "prod-1"}}}
	if err := draft.switchTargetAllowed(context.Background(), "ladder-1", "price-1"); !errors.Is(err, errPlanNotOpenToMembers) {
		t.Fatalf("the member gate runs first, got %v", err)
	}
}