veza/veza-backend-api/internal/core/subscription/gate_test.go
senke 9a8d2a4e73 chore(release): v1.0.6.2 — subscription payment-gate bypass hotfix
Closes a bypass surfaced by the 2026-04 audit probe (axis-1 Q2): any
authenticated user could POST /api/v1/subscriptions/subscribe on a paid
plan and receive 201 active without the payment provider ever being
invoked. The resulting row satisfied `checkEligibility()` in the
distribution service via `can_sell_on_marketplace=true` on the Creator
plan — effectively free access to /api/v1/distribution/submit, which
dispatches to external partners.

Fix is centralised in `GetUserSubscription` so there is no code path
that can grant subscription-gated access without routing through the
payment check. Effective-payment = free plan OR unexpired trial OR
invoice with non-empty hyperswitch_payment_id. Migration 980 sweeps
pre-existing fantôme rows into `expired`, preserving the tuple in a
dated audit table for support outreach.

Subscribe and subscribeToFreePlan treat the new ErrSubscriptionNoPayment
as equivalent to ErrNoActiveSubscription so re-subscription works
cleanly post-cleanup. GET /me/subscription surfaces needs_payment=true
with a support-contact message rather than a misleading "you're on
free" or an opaque 500. TODO(v1.0.7-item-G) annotation marks where the
`if s.paymentProvider != nil` short-circuit needs to become a mandatory
pending_payment state.

Probe script `scripts/probes/subscription-unpaid-activation.sh` kept as
a versioned regression test — dry-run by default, --destructive logs in
and attempts the exploit against a live backend with automatic cleanup.
8-case unit test matrix covers the full hasEffectivePayment predicate.

Smoke validated end-to-end against local v1.0.6.2: POST /subscribe
returns 201 (by design — item G closes the creation path), but
GET /me/subscription returns subscription=null + needs_payment=true,
distribution eligibility returns false.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-17 12:21:53 +02:00

169 lines
5.4 KiB
Go

package subscription
import (
"context"
"errors"
"testing"
"time"
"github.com/google/uuid"
"github.com/stretchr/testify/require"
"go.uber.org/zap"
"gorm.io/driver/sqlite"
"gorm.io/gorm"
)
// TestGetUserSubscription_PaymentGate exercises the v1.0.6.2 hotfix: a row in
// active/trialing state that lacks an effective payment linkage must not be
// returned as a valid subscription. A single test covers the full branch
// matrix of hasEffectivePayment so a regression in any clause is caught.
func TestGetUserSubscription_PaymentGate(t *testing.T) {
ctx := context.Background()
db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
require.NoError(t, err)
require.NoError(t, db.AutoMigrate(&Plan{}, &UserSubscription{}, &Invoice{}))
svc := NewService(db, zap.NewNop())
freePlan := Plan{ID: uuid.New(), Name: PlanFree, DisplayName: "Free", PriceMonthly: 0, IsActive: true}
paidPlan := Plan{ID: uuid.New(), Name: PlanCreator, DisplayName: "Creator", PriceMonthly: 999, IsActive: true}
require.NoError(t, db.Create(&freePlan).Error)
require.NoError(t, db.Create(&paidPlan).Error)
now := time.Now()
future := now.Add(24 * time.Hour)
past := now.Add(-24 * time.Hour)
tests := []struct {
name string
prepare func(t *testing.T, userID uuid.UUID) // sets up the row(s) for this user
expectErr error
}{
{
name: "no subscription row returns ErrNoActiveSubscription",
prepare: func(t *testing.T, userID uuid.UUID) {
// no-op
},
expectErr: ErrNoActiveSubscription,
},
{
name: "free plan active always passes",
prepare: func(t *testing.T, userID uuid.UUID) {
sub := UserSubscription{
UserID: userID, PlanID: freePlan.ID, Status: StatusActive,
BillingCycle: BillingMonthly,
CurrentPeriodStart: now, CurrentPeriodEnd: future,
}
require.NoError(t, db.Create(&sub).Error)
},
expectErr: nil,
},
{
name: "paid plan active with PSP payment intent on invoice passes",
prepare: func(t *testing.T, userID uuid.UUID) {
sub := UserSubscription{
UserID: userID, PlanID: paidPlan.ID, Status: StatusActive,
BillingCycle: BillingMonthly,
CurrentPeriodStart: now, CurrentPeriodEnd: future,
}
require.NoError(t, db.Create(&sub).Error)
inv := Invoice{
SubscriptionID: sub.ID, UserID: userID, AmountCents: 999,
Currency: "USD", Status: InvoicePending,
BillingPeriodStart: now, BillingPeriodEnd: future,
HyperswitchPaymentID: "pay_12345",
}
require.NoError(t, db.Create(&inv).Error)
},
expectErr: nil,
},
{
name: "paid plan active with invoice but empty hs_payment_id returns ErrSubscriptionNoPayment",
prepare: func(t *testing.T, userID uuid.UUID) {
sub := UserSubscription{
UserID: userID, PlanID: paidPlan.ID, Status: StatusActive,
BillingCycle: BillingMonthly,
CurrentPeriodStart: now, CurrentPeriodEnd: future,
}
require.NoError(t, db.Create(&sub).Error)
inv := Invoice{
SubscriptionID: sub.ID, UserID: userID, AmountCents: 999,
Currency: "USD", Status: InvoicePending,
BillingPeriodStart: now, BillingPeriodEnd: future,
HyperswitchPaymentID: "",
}
require.NoError(t, db.Create(&inv).Error)
},
expectErr: ErrSubscriptionNoPayment,
},
{
name: "paid plan active with no invoice at all returns ErrSubscriptionNoPayment",
prepare: func(t *testing.T, userID uuid.UUID) {
sub := UserSubscription{
UserID: userID, PlanID: paidPlan.ID, Status: StatusActive,
BillingCycle: BillingMonthly,
CurrentPeriodStart: now, CurrentPeriodEnd: future,
}
require.NoError(t, db.Create(&sub).Error)
},
expectErr: ErrSubscriptionNoPayment,
},
{
name: "paid plan trialing with future trial_end passes",
prepare: func(t *testing.T, userID uuid.UUID) {
sub := UserSubscription{
UserID: userID, PlanID: paidPlan.ID, Status: StatusTrialing,
BillingCycle: BillingMonthly,
CurrentPeriodStart: now, CurrentPeriodEnd: future,
TrialStart: &now, TrialEnd: &future,
}
require.NoError(t, db.Create(&sub).Error)
},
expectErr: nil,
},
{
name: "paid plan trialing with past trial_end and no payment returns ErrSubscriptionNoPayment",
prepare: func(t *testing.T, userID uuid.UUID) {
sub := UserSubscription{
UserID: userID, PlanID: paidPlan.ID, Status: StatusTrialing,
BillingCycle: BillingMonthly,
CurrentPeriodStart: now, CurrentPeriodEnd: future,
TrialStart: &past, TrialEnd: &past,
}
require.NoError(t, db.Create(&sub).Error)
},
expectErr: ErrSubscriptionNoPayment,
},
{
name: "paid plan trialing with nil trial_end and no payment returns ErrSubscriptionNoPayment",
prepare: func(t *testing.T, userID uuid.UUID) {
sub := UserSubscription{
UserID: userID, PlanID: paidPlan.ID, Status: StatusTrialing,
BillingCycle: BillingMonthly,
CurrentPeriodStart: now, CurrentPeriodEnd: future,
}
require.NoError(t, db.Create(&sub).Error)
},
expectErr: ErrSubscriptionNoPayment,
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
userID := uuid.New()
tc.prepare(t, userID)
sub, err := svc.GetUserSubscription(ctx, userID)
if tc.expectErr == nil {
require.NoError(t, err)
require.NotNil(t, sub)
require.Equal(t, userID, sub.UserID)
return
}
require.Error(t, err)
require.True(t, errors.Is(err, tc.expectErr),
"expected error %v, got %v", tc.expectErr, err)
})
}
}