+
-
- {{ String(event.series?.position || index + 1).padStart(2, '0') }}
-
-
{{ formatEventDate(event.startDate) }}
-
-
+
+
- {{ event.title }}
-
-
{{ getEventStatus(event) }}
+
+
+
+ {{ formatSeriesType(series.type) }}
+
+
+ {{ series.status }}
+
+
+
+ {{ series.title }}
+
+
+ {{ series.description }}
+
+
+
+
+ {{ series.eventCount }}
+
+
Events
+
+ of {{ series.totalEvents }} planned
+
+
+
+
+
+
+
+
+ {{ event.series?.position || "?" }}
+
+
+
+ {{ event.title }}
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {{ getEventStatus(event) }}
+
+
+ View
+
+
+
+
+
+
+
+
+
+
+
+
+
+ View Series
+
+
-
+
+
-
-
diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md
deleted file mode 100644
index 88acda3..0000000
--- a/docs/BACKLOG.md
+++ /dev/null
@@ -1,122 +0,0 @@
-# Ghost Guild — Open Backlog
-
-_Last consolidated: 2026-04-30. Single source of truth for every open issue across the codebase. Pulls from `LAUNCH_READINESS.md`, `TODO.md`, the post-launch backlog memory, and a fresh sweep of in-code TODO/FIXME comments._
-
-Cutover has not happened yet. Deploy steps live separately in [`LAUNCH_READINESS.md`](./LAUNCH_READINESS.md).
-
----
-
-## Pre-cutover (do once)
-
-Operational steps that have to run during cutover. Full details + env-var list in [`LAUNCH_READINESS.md`](./LAUNCH_READINESS.md).
-
-- [ ] Provision the Dokploy app, set env vars (full list in LAUNCH_READINESS.md), confirm `BASE_URL` exact-matches the public origin and `NODE_ENV=production`.
-- [ ] Add the daily Dokploy Scheduled Task that POSTs to `/api/internal/reconcile-payments` with `X-Reconcile-Token`.
-- [ ] **Run `node scripts/migrate-contribution-amount.cjs --apply` against prod Mongo BEFORE the new code serves traffic.**
-- [ ] Set `NUXT_HELCIM_MONTHLY_PLAN_ID=50302` and `NUXT_HELCIM_ANNUAL_PLAN_ID=50303` in Dokploy.
-- [ ] Set `NUXT_RECONCILE_TOKEN` to a 32+ char random string.
-- [ ] Push local `main` to `origin/main`.
-- [ ] Deploy.
-- [ ] **Run `node scripts/reconcile-helcim-payments.mjs --apply` against prod Mongo AFTER the new code serves traffic.**
-- [ ] Audit prod for pre-fix series-pass bypass registrations (registrations on pass-only series children with `registeredAt < 2026-04-20` from non-pass-holders). Decide per case.
-- [ ] In Helcim dashboard: disable the default payment-confirmation email for plans 50302 + 50303 (we send our own CRA-safe version via Resend).
-- [ ] Run one real test charge and verify (a) Payment doc in Mongo and (b) exactly one CRA-compliant confirmation email.
-- [ ] Rotate `HELCIM_API_TOKEN` in the Helcim merchant portal and update the Dokploy env var.
-- [ ] Trigger the daily reconcile task once manually in Dokploy to confirm it's wired correctly.
-
-## Pilot smoke walks (before first wave)
-
-Once cutover lands, before the first Slack onboarding wave goes out:
-
-- [ ] **Pilot smoke walk for Slack-invited workflow.** One admin manually clicks "Mark as Slack invited" against a real test member in production, confirms the row updates in place, and confirms the dashboard "Slack coming" note disappears for that member. Unit tests cover the pieces; nothing covers the live admin-to-member round-trip.
-
----
-
-## Bylaws-decoupling (waiting on amendment ratification)
-
-Membership status is being decoupled from payment status. Copy + UI gates already align; behavioral changes below remain.
-
-- [ ] **B1.** `server/api/members/cancel-subscription.post.js:31,48` flips status to `pending_payment` on cancel. Under the new bylaws, cancellation should keep status `active` (just zero contribution). Update the `findByIdAndUpdate` payload + response, the comment at line 26, and add coverage in `tests/server/api/cancel-subscription.test.js`.
-- ~~B3 cancelled.~~ `pending_payment` stays.
-- ~~B4 admin "Pending Payment" → "Payment setup incomplete"~~ shipped 2026-04-29 (`59d2be2`).
-
----
-
-## Known gotchas (post-launch)
-
-- **Admin edit does not sync Helcim `recurringAmount`.** `/admin/members/[id]` PUT writes `contributionAmount` direct to Mongo by design. Admins must PATCH Helcim manually. The admin form already shows an `--ember`-bordered notice (commit `e756170`); a real sync flow is a future enhancement.
-- **Cadence switch rejected on active subscriptions.** `server/api/members/update-contribution.post.js:206` refuses cadence changes mid-subscription with a TODO comment pointing here. No UI toggle exists on `/member/account`. Adding cadence switch requires a Helcim subscription replacement flow, not a plain update.
-- **S2 test fixture id/slug mismatch (local dev only).** Seeded S2 series has `id: 'test-s2-drop-in-allowed'` but `slug: 'test-s2-drop-in-allowed-series'`. Doesn't affect prod — fix the seed script if anyone re-runs fixtures.
-- **`/admin/series-management` "Delete" button doesn't actually delete.** Click handler iterates events to PUT-unlink each from the series, never calls `DELETE /api/admin/series/:id`. For an empty series the button is a no-op; for a series with events it just orphans them. Either rename to "Unlink events" or add the actual DELETE call. Surfaced by `e2e/admin-series.spec.js` (delete test skipped). Flagged 2026-04-30.
-- **Past-deadline events and sold-out events render identically.** `EventTicketPurchase.vue` falls through to "Event Sold Out" panel for both `tickets.available.reason === 'Registration deadline has passed'` and zero-stock cases. If "Registration closed" is meant to read differently from "Sold out," add a distinct branch. Flagged 2026-04-30 (no e2e written — gated on this UX decision).
-
----
-
-## Accessibility / a11y
-
-- [ ] **Button minimum target size.** Site-wide `.btn` renders ~35px tall. WCAG AA 2.5.8 (24×24) passes; AAA 2.5.5 (44×44) fails. Bumping padding affects every button — design call, not a drop-in fix. Flagged 2026-04-11.
-- [ ] **`/board` color-contrast violations (WCAG AA).** `.block-label` ("Offering" tag) and `.slack-handle` use `#746a58` on `#e8dfc8` → 4.01:1; AA needs 4.5:1 for small text. Surfaced by `e2e/a11y.spec.js` (the `/board` route fails; test is intentionally left red until fixed). Likely a single CSS variable adjustment. Flagged 2026-04-30.
-
----
-
-## Deferred features (own session each)
-
-- [ ] **Email automation system.** Patterned after Tranzac's implementation (separate project, already built). HTML email bodies with template management and drip sequences. Deferred 2026-04-20 — ruled wasted work given the larger system is designed elsewhere. Current transactional email lives in `server/utils/resend.js` + inline in `server/api/auth/login.post.js`, `server/routes/oidc/interaction/login.post.ts`, `server/api/admin/{members,pre-registrants}/invite.post.js`. Copy dump at `docs/email-copy-dump.md`. See memory: `project_email_automation_future`.
-- [ ] **Receipts for event ticket purchases (Phase 2).** Phase 1 receipts only cover membership payments. Event tickets — especially guest purchases without member accounts — need a receipt flow. Likely an emailed PDF/HTML receipt at purchase time. Build target: June–Oct 2026, live Jan 2027. See memory: `project_receipts`.
-- [ ] **Series/event waitlist.** Admin can configure `tickets.waitlist.enabled` and `maxSize`; `server/utils/tickets.js` returns `waitlistAvailable: true` when full; `app/components/SeriesPassPurchase.vue:341` and `EventTicketPurchase.vue` have stub `handleJoinWaitlist` that toasts "Waitlist Coming Soon." No server endpoint, no confirmation email, no `event_waitlisted` activity hook. Either implement end-to-end or hide the button by removing the `v-if="availability?.waitlistAvailable"` branches in `EventSeriesTicketCard.vue:175` and `EventTicketCard.vue:73`.
-- [ ] **ASVS Phase 4.** File-upload validation pipeline, granular RBAC, credential encryption.
-
----
-
-## Wave-Slack pilot follow-ups
-
-- [ ] **`/api/auth/member` doesn't return `slackInvited`.** Dashboard's Slack-coming note is gated on `memberData.slackInvited`, which is always `undefined` client-side, so the note shows for *every* active member regardless of state. Real bug. Add `slackInvited` (and `slackInvitedAt`) to the auth/member response. Surfaced by wave-slack §7.2 e2e (skipped pending this fix). Flagged 2026-04-30.
-- [ ] **Admin members list row mutation isn't reactive.** `markSlackInvited` in `app/pages/admin/members/index.vue` does `Object.assign(member, res.member)` on a plain object inside a `useFetch` array; Vue doesn't react, so the "Mark as Slack invited" button stays visible until a manual reload. Fix: `members.value[i] = { ...members.value[i], ...res.member }` or `splice`. Detail page uses the right pattern (covered by §6.6). Surfaced by wave-slack §6.2 e2e (skipped pending this fix). Flagged 2026-04-30.
-- [ ] **Deprecated `slackInviteStatus` field still serialized.** Removed from UI but still on `Member` documents and the `/api/admin/members` payload. Project it away in the API response and run a one-shot `$unset` cleanup. Surfaced by wave-slack §6.7 e2e. Flagged 2026-04-30.
-- [ ] **Spec vs shipped-UI mismatch on wave language.** `docs/specs/wave-based-slack-onboarding-tests.md` §7.5 asserts "no wave/cohort/batch language" in the dashboard note, but the shipped welcome-email and dashboard copy say "monthly onboarding waves." Decide which side wins; update the other.
-- [ ] **E2E coverage for `e2e/wave-slack-onboarding.spec.js`.** 9 of 16 scaffolded tests now passing (admin Slack-invited button + non-trivial dashboard cases). 7 remain skipped pending the bugs above (7.2, 6.2), seeding gaps (7.4 — no dev endpoint to mint members of arbitrary status), Open Questions (7.8, 6.9), or spec-vs-UI conflicts (7.5, 6.7).
-- [ ] **Pilot exit decision (~8 weeks post-launch).** Either restore `server/_archive/utils/checkSlackJoins.js` + its plugin if polling is needed, or delete the archive permanently. Driven by whether the manual-invite cadence is sustainable post-pilot.
-- [ ] **`slack_invite_failed` enum slug cleanup.** Detector and alert removed in `d15458b`, but the slug remains in `server/models/adminAlertDismissal.js` enum so historical dismissal rows continue to validate. Full removal needs a one-shot cleanup of stale dismissal rows in the DB. Roll into a future schema-tidy pass.
-
----
-
-## Simplify-pass follow-ups (still open)
-
-Items surfaced during the 2026-04-29 /simplify review. The 2026-04-30 small-wins batch shipped 3 items (STATUS_LABELS dedup, ImageUpload focus, signupBridge rename). Remaining:
-
-- [ ] **Extract `.tint-candle` / `.tint-ember` utility classes.** The `color-mix(in srgb, var(--candle) 15%, transparent)` + matching border pattern is now inlined as `style=""` in ~9 sites across `EventSeriesTicketCard.vue`, `SeriesPassPurchase.vue`, `NaturalDateInput.vue`, `ImageUpload.vue`. Promote to utility classes in `app/assets/css/main.css` so future tints don't keep multiplying inline styles (and so `:hover` / `:focus` variants are reachable).
-- [ ] **Audit `member &&` truthy checks in sibling ticket/subscription routes.** Commit `f66455e` fixed `server/api/events/[id]/tickets/available.get.js:115` to use `hasMemberAccess(member)`. Same anti-pattern likely exists in adjacent routes (`tickets/purchase.post.js`, subscription endpoints). Guests/suspended/cancelled members would currently look like full members for any feature gated on truthiness alone.
-- [ ] **STATUS_LABELS dedup — verify.** The 2026-04-30 small-wins batch claimed STATUS_LABELS dedup, but `e2e/admin-members.spec.js` expansion found an inline copy still at `app/pages/admin/members/index.vue:491` and another at `app/pages/member/account.vue:420`. Either the previous dedup was partial or a new copy was reintroduced — confirm and finish dedup into a shared constants module.
-- [ ] **`app/pages/admin/members/[id].vue` status select still hand-written.** Commit `441a5f5` aligned the index page's status `
` to `STATUS_LABELS`, but the detail page (`[id].vue`) still hand-codes raw status options. Refactor to drive from the same constant.
-
----
-
-## Optional / low-priority
-
-- [ ] **Welcome-email Slack-timing mention.** Currently the welcome email doesn't mention Slack timing — the dashboard carries that note. Could add a one-line "Slack invitation comes in monthly waves — there may be a short wait" if the dashboard turns out not to be enough signal.
-
----
-
-## E2e infrastructure gaps
-
-Surfaced during the 2026-04-30 e2e expansion. None block a green suite, but each blocks specific coverage from being added.
-
-- [ ] **Other email routes still send real emails in dev mode.** The `ALLOW_DEV_TEST_ENDPOINTS` short-circuit was added to `server/api/admin/pre-registrants/invite.post.js` (which calls `new Resend(...)` directly), but the five wrapper functions in `server/utils/resend.js` (event registration, cancellation, waitlist, series pass, welcome) still dispatch live. Either add the same gate to each wrapper, or refactor the wrappers into a single `sendEmail({ from, to, subject, text, html })` helper holding the gate centrally — would also dedupe ~5 near-identical try/catch blocks.
-- [ ] **No dev endpoint to seed members of arbitrary status.** Wave-slack §7.4 (note hidden for suspended/cancelled/guest) is gated on this. `/api/dev/test-login` only mints an `active` admin. A minimal `/api/dev/members.post` accepting `{ email, status, slackInvited, ... }` would unblock many more dashboard-state e2e tests.
-- [ ] **SSR `useFetch` blocks `page.route` mocking.** Page-level fetches in `[slug].vue` files run during SSR and can't be intercepted client-side. Affects: hidden-event 404 e2e, any test that needs a mocked event payload before client hydration. Either expose a client-side fetch alternative, add a server-side test mock layer, or accept that DB seeding is required for these cases.
-- [ ] **Self-cancel block on paid event registrations not e2e-tested.** Requires seeding a logged-in member with a paid registration row. Out of scope for this round.
-- [ ] **Visual snapshot for `join — desktop` is stale.** 12,676px diff (2% of image) from layout drift. Regenerate via `npx playwright test --update-snapshots e2e/visual/pages.spec.js` once a designer eyeballs the diff.
-- [ ] **E2e cross-file races on admin specs.** With `fullyParallel: false` + `workers: 4` + `retries: 1`, ~1 admin CRUD test still fails per full-suite run (rotates between `admin-events` CRUD, `board` page-loads, and wave-slack §6.4). Each passes 100% in isolation. Root cause: tests anchor on "first row" / "any visible button" rather than uniquely-identified data, so they race when other admin specs mutate the shared dev DB. Proper fix is per-test data isolation: each test creates its own scoped record with a `Date.now()` suffix and queries by that exact identifier. Out of scope for the e2e expansion.
-
----
-
-## Deeplink memories
-
-- `project_post_launch_backlog.md` — high-level digest of this file
-- `project_launch_readiness.md` — cutover status (NOT YET happened)
-- `project_launch_flow_map.md` — onboarding flow + Slack wave model
-- `project_pre_registrants.md` — invitation system + pre-reg lifecycle
-- `project_helcim_plan_model.md` — cadence-keyed plan model
-- `project_contribution_amount_redesign.md` — arbitrary $ amount + guidance presets
-- `project_receipts.md` — Phase 1 done, Phase 2 pending
-- `project_email_automation_future.md` — Tranzac reference for full system
diff --git a/docs/LAUNCH_READINESS.md b/docs/LAUNCH_READINESS.md
index 410e4b1..81abbfc 100644
--- a/docs/LAUNCH_READINESS.md
+++ b/docs/LAUNCH_READINESS.md
@@ -1,18 +1,33 @@
# Launch Readiness
-**Status as of 2026-04-30. Cutover has not happened yet.** Code is on local `main`; deploy steps below still need to execute.
+**Status as of 2026-04-20.** Target launch: before 2026-05-01.
-Pre-cutover deploy checklist is the live content on this page. Everything else (post-launch work, bylaws decoupling, deferred features, simplify follow-ups, a11y) lives in [`BACKLOG.md`](./BACKLOG.md). Completed launch-blocker items are archived — see `~/.claude/projects/-Users-jennie-Sites-ghostguild-org/memory/project_launch_readiness_archive.md`.
+Single source of truth for work that must happen before cutover. P0 blocks launch. P1 is strongly preferred but survivable. Completed items have been archived — see `~/.claude/projects/-Users-jennie-Sites-ghostguild-org/memory/project_launch_readiness_archive.md`. Post-launch backlog lives in `docs/TODO.md`.
---
## Current state
-- Vitest snapshot 2026-04-25 ~18:23 local: **703 passing / 8 failing / 2 skipped (713 total)**. The previously-flagged 6 helcim-payment failures are now green. The 8 current failures are in `tests/server/api/auth-verify.test.js` and `tests/server/api/cancel-subscription.smoke.test.js`, both belonging to in-flight Phase 5 fixes (#10 and #9) being landed by parallel impl subagents — they will resolve as those branches merge.
-- All launch code is on local `main`: Helcim plan consolidation, contribution-amount redesign, cadence UX unification, and receipts Phase 1. Not pushed — site is not on Netlify yet.
-- Helcim plan consolidation migration **ran against prod 2026-04-18** (Monthly plan id `50302`, Annual plan id `50303`).
-- Contribution-amount migration has **NOT** yet been run against prod.
-- Receipts Phase 1 code is shipped; remaining work is deploy-time only (see Deploy checklist).
+- Vitest on `main`: **652/658 passing**. 6 pre-existing failures in `tests/server/api/helcim-payment.test.js` — unrelated to launch-blocking work, noted in the deploy checklist for visibility.
+- `main` is now caught up locally (2026-04-20): `feature/helcim-plan-consolidation` (40 commits) and `feature/contribution-amount-redesign` (17 commits) fast-forwarded in. Not pushed — site is not on Netlify yet.
+- Helcim plan consolidation migration ran against prod 2026-04-18 (Monthly plan id `50302`, Annual plan id `50303`). **Contribution-amount migration has NOT yet been run against prod.**
+- Cadence/contribution UX unified across signup + edit surfaces 2026-04-20. Uncommitted in working tree — see "Cadence UX refinements" below.
+- **Charitable receipts Phase 1 built on `feature/receipts-phase-1` (commits `bf5a333..91711aa`, 2026-04-20). Unmerged.** All four spec items shipped: `Payment` model + idempotent `upsertPaymentFromHelcim` helper, synchronous payment logging on both new paid subscriptions and free→paid upgrades, nightly reconciliation script, `/join` charity note, and `taxReceiptPreferences` schema field (no UI — Phase 2). Resend-owned confirmation email (`server/emails/paymentConfirmation.js`) is CRA-safe. Remaining work is deploy-time only (merge branch, disable Helcim default email on plans 50302 + 50303, backfill, real staging charge) — tracked in Deploy checklist.
+
+### Cadence UX refinements (2026-04-20, uncommitted)
+
+Shipped across `accept-invite.vue`, `join.vue`, `member/account.vue`, `welcome.vue`, `member/dashboard.vue`, and a new shared `SignupFlowOverlay.vue`:
+
+- **Shared SignupFlowOverlay component.** Extracted from `/join` progress overlay; now used by both `/join` and `/accept-invite`.
+- **Static "Monthly Contribution" label** on all three contribution inputs (previously dynamic — flipped to "Annual Contribution" when annual cadence was selected, which was misleading because the stored value is always the monthly base).
+- **"Per Year" / "Per Month"** toggle copy (was "Annual" / "Monthly"). On `/accept-invite`, Per Year is now the default; `/join` stays on Per Month by default.
+- **Live billing-summary card** below the contribution input on both signup flows — reads e.g. "You'll be charged $180 today ($15/month × 12). Then $180 every year, until you cancel."
+- **Welcome heading on dashboard** for new signups: `/member/dashboard?welcome=1` renders "Welcome to Ghost Guild, {name}" instead of "Welcome back, {name}". `/welcome` redirect now always carries the param; `/accept-invite` navigates to the dashboard with the param directly.
+- **$0 member polish on `/member/account`**: Payment History section hidden for $0 members with no prior charges (condition now `contributionAmount > 0 || paymentHistory.length > 0` — fixes a regression where paid-then-$0 members lost visibility of their past payments). Solidarity-Fund sentence in the Danger Zone also hidden at $0.
+- **Next charge row above payment history** on `/member/account`: When a member has an upcoming charge, a "Next charge: $X on DATE" row renders above the transaction list (dashed `--candle` border). Separate from the existing compact "Next payment" row in the Membership Card summary.
+- **Fixed `subscription.get.js` Helcim field mapping.** Helcim's GET `/subscriptions/:id` returns `data` as a single object (not array) with the field `dateBilling` (not `nextBillingDate`). The lazy refresh endpoint now handles both shapes — previously it returned empty strings, so neither the Membership-card "Next payment" nor the new "Next charge" row rendered for any member whose cached `nextBillingDate` was missing. Note: `subscription.post.js` and `update-contribution.post.js` still read `subscription.nextBillingDate` from Helcim's CREATE response (same wrong field), which is why the cache was empty to begin with. Left unfixed in this pass — the lazy GET refresh now masks it. Worth cleaning up post-launch.
+- **State-aware contribution-change hint** on `/member/account`: "You'll be charged $X today to start your subscription." ($0 → paid) / "Your paid subscription will be cancelled." (paid → $0) / "Changes apply on your next billing cycle." (paid → paid, different amount).
+- **Server-side invite accept** now creates the Helcim customer and sets the auth cookie before returning, for both free and paid branches.
---
@@ -24,89 +39,137 @@ None outstanding.
## P1 — Strongly preferred before launch
-None outstanding.
+### Charitable receipts — Phase 1 ✅ COMPLETE (`docs/specs/receipts-launch-spec.md`)
+
+Built on `feature/receipts-phase-1`, commits `bf5a333..91711aa` (2026-04-20). **Unmerged.** All four spec items shipped; remaining work is deploy-time only (tracked in Deploy checklist).
+
+Shipped:
+- **Payment logging.** New `Payment` model (`server/models/payment.js`) + idempotent `upsertPaymentFromHelcim` helper keyed on unique `helcimTransactionId` (`server/utils/payments.js`). Synchronous write paths:
+ - New paid subscription → `server/api/helcim/subscription.post.js` fetches the newest paid Helcim tx and upserts a Payment with `paymentType` from cadence + `sendConfirmation: true`. Wrapped in try/catch so a logging failure cannot break subscription creation.
+ - Free → paid upgrade → `server/api/members/update-contribution.post.js` (Case 1 branch) does the same.
+ - Paid → paid amount change (Case 3) is intentionally **not** wired synchronously — no new tx at the moment of change; the next recurring charge is captured by the reconciliation script.
+- **Confirmation email via Resend, not Helcim.** Spec alternative (b) chosen. `server/emails/paymentConfirmation.js` is CRA-safe: charity name "Baby Ghosts Studio Development Fund" + "not an official donation receipt / tax receipts available later in 2026" disclaimer. Triggered only on new Payment inserts; send failures are swallowed. Helcim's default confirmation must be disabled on plans 50302 + 50303 at cutover (Deploy checklist).
+- **Join page copy.** Factual charity note below contribution tiers on `/join` only (`app/pages/join.vue:83`). `/accept-invite` and `/member/account` intentionally untouched per spec §3.
+- **Member schema field.** `taxReceiptPreferences` nested object added to `server/models/member.js` (filesCanadianTaxes, middleInitial, confirmedAddress sub-object, setupCompletedAt). Defaults null/false — existing members read as "not set up." Schema-only; no Zod, no route, no UI. Phase 2 binds to it without migration.
+- **Reconciliation script.** `scripts/reconcile-helcim-payments.mjs` iterates every Member with `helcimCustomerId`, pulls recent Helcim transactions, and upserts via the same helper. Idempotent. Dry-run by default; `--apply` to write. No confirmation emails sent during reconcile. Dual purpose: launch-day backfill for the ~34 pre-existing members, and nightly cron post-launch to catch recurring charges that bypass the synchronous write paths.
+
+Remaining (deploy-time, not code):
+- [ ] Merge `feature/receipts-phase-1` into `main`.
+- Manual Helcim-dashboard step + prod reconcile + staging test charge — see Deploy checklist.
---
## Deploy checklist
-Applies when the app is deployed to **Dokploy on Hetzner**. Build is via the in-repo `Dockerfile` (`node:20-alpine`, runs `node .output/server/index.mjs` on port 3000); Dokploy autodetects it. Traefik (Dokploy's reverse proxy) handles SSL; `oidc-provider.ts:194` and the rate-limit middleware already trust `X-Forwarded-Proto` / `X-Forwarded-For`.
-
-### One-time host setup
-
-- [ ] **Provision the Dokploy app** pointing at this repo. Build context: repo root. Default Dockerfile. Container port: `3000`.
-- [ ] **Set env vars in the Dokploy UI** (full list below). The `validate-env.js` Nitro plugin fails fast at boot if `MONGODB_URI` / `JWT_SECRET` / `RESEND_API_KEY` / `HELCIM_API_TOKEN` are missing — container refuses to start, so misconfig surfaces immediately in logs.
-- [ ] **`BASE_URL` must exactly match the public origin** (e.g. `https://ghostguild.org`, no trailing slash). The `/api/helcim/customer` origin check at `server/api/helcim/customer.post.js:11-15` does exact-match comparison against the `Origin` header — if `BASE_URL` is wrong or unset, signup 403s.
-- [ ] **`NODE_ENV=production`** must be set. Without it: `Secure` cookie flag, HSTS, and CSP all silently no-op.
-- [ ] **Add a Dokploy Scheduled Task** for daily reconciliation. Command:
- ```
- curl -fsS -X POST "$BASE_URL/api/internal/reconcile-payments" -H "X-Reconcile-Token: $NUXT_RECONCILE_TOKEN"
- ```
- Schedule: `0 4 * * *` (or any time of day). The Nitro route does the heavy lifting (Mongo iteration, Helcim API, retries) — the scheduler just wakes it up.
-
-### Cutover
+Applies when the site is connected to Netlify / production hosting. Nothing here is actionable until that connection exists; kept here so nothing gets forgotten at cutover.
- [ ] Push local `main` to `origin/main`.
- [ ] **Run `node scripts/migrate-contribution-amount.cjs --apply` against prod Mongo BEFORE the new code serves traffic.** Idempotent; dry-run on local counted 34 members. Requires `MONGODB_URI` in env. The script writes `contributionAmount` (Number) derived from existing `contributionTier` (String) on every Member doc; the old field is left intact for a window.
-- [ ] Set `NUXT_HELCIM_MONTHLY_PLAN_ID=50302` in Dokploy env.
-- [ ] Set `NUXT_HELCIM_ANNUAL_PLAN_ID=50303` in Dokploy env.
-- [ ] **Set `NUXT_RECONCILE_TOKEN`** to any 32+ char random string. Shared secret between the Dokploy scheduled task and `/api/internal/reconcile-payments`.
-- [ ] Deploy.
-- [ ] **Run `node scripts/reconcile-helcim-payments.mjs --apply` against prod Mongo AFTER the new code serves traffic** to backfill Payment records for pre-existing members. Idempotent (unique `helcimTransactionId`); the daily Dokploy cron picks it up from there.
-- [ ] **Prod audit for pre-fix series-pass bypass registrations.** Fixed in `f34b062` + `4e1888a` (2026-04-20). Before that, child events of pass-only series (`tickets.requiresSeriesTicket=true && tickets.allowIndividualEventTickets=false`) accepted drop-in registrations from non-pass-holders. For every such series, list its child-event `registrations` where the registrant is not in the parent series' pass-holder list, filter to `registeredAt < 2026-04-20`, and decide per-case: grandfather (keep + notify), refund + unregister, or silently unregister. Local Mongo was scrubbed of 2 such rows on 2026-04-20; prod was intentionally untouched.
+- [ ] Set `NUXT_HELCIM_MONTHLY_PLAN_ID=50302` in production env.
+- [ ] Set `NUXT_HELCIM_ANNUAL_PLAN_ID=50303` in production env.
+- [ ] Decide on the 6 failing tests in `tests/server/api/helcim-payment.test.js` — either fix or consciously accept. Not launch-blocking, but pre-existing red tests tend to mask new regressions.
+- [ ] **Run `node scripts/reconcile-helcim-payments.mjs --apply` against prod Mongo AFTER the new code serves traffic** to backfill Payment records for pre-existing members. Idempotent (unique `helcimTransactionId`); safe to re-run as a nightly reconciliation job post-launch.
- [ ] **Helcim dashboard: disable the default payment-confirmation email for plans 50302 + 50303.** We send our own CRA-safe confirmation via Resend (`server/emails/paymentConfirmation.js`) triggered from `upsertPaymentFromHelcim`; leaving Helcim's default on = duplicate emails.
-- [ ] **Run one real test charge against the deployed app** and verify (a) a Payment doc in Mongo with `amount`, `paymentType`, `status: 'success'`, and (b) exactly one CRA-compliant confirmation email (charity name + "not an official donation receipt" disclaimer; no banned assertive phrasing).
-- [ ] **Rotate HELCIM_API_TOKEN** in the Helcim merchant portal and update the Dokploy env var. The token was previously exposed in `window.__NUXT__` payload until commit `208638e`.
-- [ ] **Trigger the daily reconcile task once manually** in Dokploy to confirm scheduled task + token are wired correctly. Expect a `[reconcile] done {...}` log line.
+- [ ] **Run one real test charge on staging** via the cloudflared tunnel and verify (a) a Payment doc in Mongo with `amount`, `paymentType`, `status: 'success'`, and (b) exactly one CRA-compliant confirmation email (charity name + "not an official donation receipt" disclaimer; no banned assertive phrasing).
-**Env vars required in Dokploy (reference):**
-- `NODE_ENV=production`
-- `BASE_URL` (exact public origin, no trailing slash)
+**Env vars required in production (reference):**
- `MONGODB_URI`
- `JWT_SECRET` (or `NUXT_JWT_SECRET` — the `NUXT_` variant wins)
- `RESEND_API_KEY`
- `HELCIM_API_TOKEN`
-- `NUXT_HELCIM_MONTHLY_PLAN_ID=50302`
-- `NUXT_HELCIM_ANNUAL_PLAN_ID=50303`
-- `NUXT_PUBLIC_HELCIM_PORTAL_URL`
-- `NUXT_RECONCILE_TOKEN` (32+ char random string)
+- `NUXT_HELCIM_MONTHLY_PLAN_ID`
+- `NUXT_HELCIM_ANNUAL_PLAN_ID`
- `SLACK_BOT_TOKEN`
+- `BASE_URL`
- `OIDC_COOKIE_SECRET`
-
----
-
-## Fixed 2026-04-25
-
-Day-of-launch security and correctness audit. All commit shas TBD until Phase 5.
-
-### CRITICAL (security)
-- **Fix #1** — `HELCIM_API_TOKEN` removed from public runtime config + dead `useHelcim.js` deleted. **Token must be rotated post-deploy** (was previously exposed via `window.__NUXT__`).
-- **Fix #2** — `/api/helcim/customer` gated with origin check + per-IP/email rate limit + magic-link email verification (replaces unauthenticated `setAuthCookie`).
-- **Fix #3** — `/api/events/[id]/payment` deleted (dead code with auth bypass). `processHelcimPayment` stub + `eventPaymentSchema` removed.
-- **Fix #4** — `/api/helcim/initialize-payment` re-derives ticket amount server-side via `calculateTicketPrice`; new `series_ticket` metadata type.
-- **Fix #5** — `/api/helcim/customer` upgrades existing `status:guest` members in place rather than rejecting with 409.
-
-### HIGH (correctness)
-- **Fix #6** — Recurring reconciliation: Netlify scheduled function calls `/api/internal/reconcile-payments` daily. Requires `NUXT_RECONCILE_TOKEN` env var.
-- **Fix #7** — `validateBeforeSave: false` added to event subdoc saves (waitlist endpoints) to dodge legacy location validators.
-- **Fix #8** — Series-pass purchase always creates a guest Member when caller is unauthenticated, mirroring event-ticket flow.
-- **Fix #9** — `cancel-subscription` leaves status `active` (per ratified bylaws); adds `lastCancelledAt` audit field.
-- **Fix #10** — `/api/auth/verify` uses `validateBody` with `.strict()` Zod schema.
-- **Fix #11** — Added 8 vitest cases for `cancel-subscription.post.js` (was uncovered).
-
-### Side-quests
-- Visual audit Phase 4 changes (events/series surface)
-- Per-fix branch verification: see `docs/superpowers/specs/2026-04-25-fix-*.md`
+- `NUXT_PUBLIC_HELCIM_PORTAL_URL`
---
## Manual browser tests still needed
-None outstanding. All launch-blocking flows verified via local dev or cloudflared tunnel with real Helcim test card + real email (see archive for the full log). The one remaining browser verification is the staging test charge bundled into the Deploy checklist above.
+Cannot be verified by Vitest. Both require a real browser + real Helcim test card + real email, via cloudflared tunnel or ngrok HTTPS (Helcim requires HTTPS for the pay.js iframe).
+
+**Shared setup (do once):**
+- `npx nuxi dev --https` in one terminal, `cloudflared tunnel --url https://localhost:3000` (or `ngrok http https://localhost:3000`) in another. Use the tunnel URL as `BASE_URL` in `.env`.
+- Helcim sandbox test card: see `~/.claude/projects/-Users-jennie-Sites-ghostguild-org/memory/reference_helcim_sandbox.md`.
+- Apply the contribution-amount migration against local Mongo first so seeded members match the new schema:
+ ```
+ node scripts/migrate-contribution-amount.cjs # dry-run
+ node scripts/migrate-contribution-amount.cjs --apply # apply
+ ```
+ After applying, confirm in mongosh: `db.members.countDocuments({ contributionAmount: { $exists: true } })` should equal total member count; `db.members.countDocuments({ contributionAmount: { $type: 'string' } })` must be `0`.
---
-## Post-launch & deferred work
+- [x] **Pre-registrant invite → accept flow with a paid contribution amount.** ✅ Passed 2026-04-20 — both Monthly $7 and Annual $15 variants completed end-to-end. DB verified programmatically: `contributionAmount` stored as Number, `billingCadence` correct, `helcimCustomerId` + `helcimSubscriptionId` populated, `status: active`, no `contributionTier` field, preReg transitioned to `accepted` with `memberId` set.
-Bylaws decoupling, post-launch a11y, ASVS Phase 4, deferred features, simplify-pass follow-ups, known gotchas, wave-Slack pilot follow-ups — **everything that isn't a deploy step has moved to [`BACKLOG.md`](./BACKLOG.md).**
+- **Contribution-amount redesign end-to-end.** Covers the full surface of the `contributionTier` → `contributionAmount` rename.
+ - [x] **Signup flows — `/join`:** ✅ Passed 2026-04-20. All 5 variants ran functionally clean (welcome-heading regression was caught, fixed via `?welcome=1` propagation through `/welcome`, not retested — trusted):
+ 1. `$0` Monthly — Member created with no Helcim subscription.
+ 2. `$5` Monthly (preset) — Helcim `recurringAmount: 5`.
+ 3. `$17` Monthly (non-preset) — Helcim `recurringAmount: 17`, `$15` chip label via `findLast`.
+ 4. `$17` Annual — Helcim `recurringAmount: 204`, `billingCadence: 'annual'`, Mongo stores monthly-equivalent `17`.
+ 5. `$50` Annual (top preset) — Helcim `recurringAmount: 600`.
+
+ - [x] **Edit flows — `/member/account` as an active paid member:** ✅ Passed 2026-04-20 against Cleo's Annual subscription (Helcim sub 138682).
+ - Raise $15 → $30 annual: `updateHelcimSubscription` hit with `recurringAmount: 360`, Mongo `contributionAmount: 30` (Number).
+ - Lower $30 → $5 annual: `recurringAmount: 60`, Mongo `contributionAmount: 5` (Number).
+ - ~~Switch cadence (Monthly $17 ↔ Annual $17).~~ **Deferred from launch.** Server (`update-contribution.post.js:184-189`) explicitly rejects cadence changes on existing subscriptions; no UI toggle exists on `/member/account`. Re-scope post-launch if/when we want to support cadence switch (would need Helcim subscription replacement flow, not a plain update).
+
+ - [x] **Admin flow — `/admin/members/[id]` edit:** ✅ Passed 2026-04-20.
+ - Changed Cleo $5 → $15 via admin PUT. Mongo wrote `contributionAmount: 15` (Number). `contributionTier` field absent across all 34 members (`countDocuments({ contributionTier: { $exists: true } }) === 0`).
+ - Known non-blocker: admin edit does not sync the change to Helcim's `recurringAmount`. Admin override is direct Mongo-only by design; had to PATCH Helcim manually to re-sync Cleo post-test. Worth noting in docs or surfacing in admin UI post-launch.
+
+ **Assert across all flows:**
+ - Mongo `contributionAmount` is always `Number`, never `String`.
+ - No `contributionTier` values written anywhere (greppable: `db.members.findOne({}, { contributionTier: 1 })` should return whatever the migration left; no *new* writes to that field).
+ - No "save $X", "2 months free", or discount copy appears in any UI surface. Annual is just `amount × 12` exactly.
+ - Guidance chip labels (`$0`/`$5`/`$15`/`$30`/`$50`) are matched via `findLast`, so $17 lands on the `$15` label, $49 lands on `$30`, $51 lands on `$50`.
+
+ **Key files if debugging:** `app/pages/join.vue`, `app/pages/member/account.vue`, `app/pages/admin/members/[id].vue`, `server/api/helcim/subscription.post.js`, `server/api/members/update-contribution.post.js`, `server/api/admin/members/[id].put.js`, `app/config/contributions.js` + `server/config/contributions.js`.
+
+ **Cosmetic follow-ups noted in Post-launch backlog below** — won't block this test (they're naming, not behavior).
+
+---
+
+## Bylaws decoupling — follow-ups (added 2026-04-18)
+
+Context: bylaws are being amended to remove automatic termination for nonpayment. Membership status will be fully decoupled from payment status; failed payments trigger committee outreach, not status change. Copy + UI access gates already aligned in `useMemberStatus.js` and `account.vue` (2026-04-18). Server-side status gating shipped as B2 (see archive). The behavioral changes below remain.
+
+Not blocking launch — the amendment hasn't passed yet, and the user-visible copy/UI is already consistent. Pick up once the amendment is ratified.
+
+### B1. `cancel-subscription` flips status to `pending_payment`
+- `server/api/members/cancel-subscription.post.js:31,48`
+- When a member cancels their paid subscription, status is set to `pending_payment` and contribution amount to `0`. Under the new model, cancelling a payment plan moves the member to the $0 contribution — status should stay `active`.
+- **Fix:** change `status: 'pending_payment'` → `status: 'active'` in both the `findByIdAndUpdate` payload (line 31) and the response (line 48). Comment at line 26 also needs updating ("(not cancelled) so member can re-subscribe" → reflect new framing).
+- Add coverage in `tests/server/api/cancel-subscription.test.js` if it doesn't already exist.
+
+### B3. Vestigial `pending_payment` status
+- Once payment is fully decoupled, `pending_payment` no longer gates anything and is functionally equivalent to `active`. Consider removing it from the enum (`server/models/member.js:38`, `server/utils/schemas.js:299`) and treating new signups as `active` from the moment of account creation.
+- Touches: signup flow (`helcim/customer.post.js:34`, `invite/accept.post.js:48`), admin filter UI (`app/pages/admin/members/index.vue:45,382,499,1145`, `[id].vue:69,286`), admin alerts (`server/utils/adminAlerts.js:22,100-116`, `server/models/adminAlertDismissal.js:6`), and a data migration to flip existing `pending_payment` rows to `active`.
+- Larger refactor — break out into its own ticket once B1 lands.
+
+### B4. Admin "Pending Payment" filter label (cosmetic)
+- `app/pages/admin/members/index.vue:45,499`, `[id].vue:69` show `pending_payment` as "Pending Payment". If B3 removes the status entirely, this disappears too. If we keep `pending_payment` for now, rename in admin UI to "Payment setup incomplete" so admins also stop conflating it with membership state.
+
+---
+
+## Post-launch backlog
+
+See `docs/TODO.md` for:
+- Button minimum target size (WCAG AAA 2.5.5).
+- `/oidc/interaction/[uid]` routing quirk.
+- Admin layout migration from `guild-*` tokens to zine spec.
+- Admin dashboard quick-action button contrast.
+- Members table NAME column clipping.
+- OWASP ASVS L1 Phase 4 (file-upload validation pipeline, granular RBAC, credential encryption).
+- `tickets/available.get.js:115` `memberSavings` block reports `$0 saved` for inactive members — cosmetic; suppress comparison block when `!hasMemberAccess(member)` if it ever surfaces in UI.
+
+### Contribution-amount redesign — cosmetic cleanup (naming only, not behavior)
+- Rename admin members column header "Tier" → "Contribution" (`app/pages/admin/members/index.vue:265`).
+- Delete dead `app/components/TierPicker.vue`.
+- Update stale tier comment in `app/composables/useMemberPayment.js:59`.
+- Update error log message referencing "tier" in `server/api/members/update-contribution.post.js:221`.
+- Rename `handleUpdateTier` handler in `app/pages/member/account.vue`.
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/about-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/about-desktop-chromium-darwin.png
new file mode 100644
index 0000000..f1a80e7
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/about-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/about-mobile-auth-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/about-mobile-auth-chromium-darwin.png
new file mode 100644
index 0000000..0765129
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/about-mobile-auth-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/about-mobile-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/about-mobile-chromium-darwin.png
new file mode 100644
index 0000000..8c4ad03
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/about-mobile-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/admin-dashboard-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/admin-dashboard-desktop-chromium-darwin.png
new file mode 100644
index 0000000..8aeacc2
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/admin-dashboard-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/admin-events-create-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/admin-events-create-desktop-chromium-darwin.png
new file mode 100644
index 0000000..a1671b1
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/admin-events-create-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/admin-members-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/admin-members-desktop-chromium-darwin.png
new file mode 100644
index 0000000..7838ee3
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/admin-members-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/coming-soon-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/coming-soon-desktop-chromium-darwin.png
new file mode 100644
index 0000000..6e601d3
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/coming-soon-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/coming-soon-mobile-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/coming-soon-mobile-chromium-darwin.png
new file mode 100644
index 0000000..4cc7b93
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/coming-soon-mobile-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/connections-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/connections-desktop-chromium-darwin.png
new file mode 100644
index 0000000..b7875d9
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/connections-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/connections-mobile-auth-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/connections-mobile-auth-chromium-darwin.png
new file mode 100644
index 0000000..4fffa70
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/connections-mobile-auth-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/events-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/events-desktop-chromium-darwin.png
new file mode 100644
index 0000000..40d1ee5
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/events-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/events-mobile-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/events-mobile-chromium-darwin.png
new file mode 100644
index 0000000..2c631f7
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/events-mobile-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/home-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/home-desktop-chromium-darwin.png
new file mode 100644
index 0000000..880a306
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/home-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/home-mobile-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/home-mobile-chromium-darwin.png
new file mode 100644
index 0000000..46c53d7
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/home-mobile-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/join-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/join-desktop-chromium-darwin.png
new file mode 100644
index 0000000..90caa26
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/join-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/join-mobile-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/join-mobile-chromium-darwin.png
new file mode 100644
index 0000000..c7a4e0e
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/join-mobile-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-account-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-account-desktop-chromium-darwin.png
new file mode 100644
index 0000000..8f1a75e
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-account-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-account-mobile-auth-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-account-mobile-auth-chromium-darwin.png
new file mode 100644
index 0000000..5c09985
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-account-mobile-auth-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-activity-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-activity-desktop-chromium-darwin.png
new file mode 100644
index 0000000..c3d2e31
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-activity-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-dashboard-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-dashboard-desktop-chromium-darwin.png
new file mode 100644
index 0000000..280b1f5
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-dashboard-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-dashboard-mobile-auth-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-dashboard-mobile-auth-chromium-darwin.png
new file mode 100644
index 0000000..5af2e0b
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-dashboard-mobile-auth-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-profile-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-profile-desktop-chromium-darwin.png
new file mode 100644
index 0000000..44c77f9
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-profile-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-profile-mobile-auth-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-profile-mobile-auth-chromium-darwin.png
new file mode 100644
index 0000000..b6edc45
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/member-profile-mobile-auth-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/members-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/members-desktop-chromium-darwin.png
new file mode 100644
index 0000000..132c9ea
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/members-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/members-detail-desktop-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/members-detail-desktop-chromium-darwin.png
new file mode 100644
index 0000000..6f05986
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/members-detail-desktop-chromium-darwin.png differ
diff --git a/e2e/__screenshots__/visual/pages.spec.js-snapshots/members-mobile-chromium-darwin.png b/e2e/__screenshots__/visual/pages.spec.js-snapshots/members-mobile-chromium-darwin.png
new file mode 100644
index 0000000..c8f1848
Binary files /dev/null and b/e2e/__screenshots__/visual/pages.spec.js-snapshots/members-mobile-chromium-darwin.png differ
diff --git a/e2e/a11y.spec.js b/e2e/a11y.spec.js
index cbb7caa..a81f901 100644
--- a/e2e/a11y.spec.js
+++ b/e2e/a11y.spec.js
@@ -7,20 +7,16 @@ const publicPages = [
{ name: "Join", path: "/join" },
{ name: "Events", path: "/events" },
{ name: "Coming Soon", path: "/coming-soon" },
- { name: "Accept Invite", path: "/accept-invite" },
];
const memberPages = [
{ name: "Member Dashboard", path: "/member/dashboard" },
{ name: "Member Profile", path: "/member/profile" },
- { name: "Member Account", path: "/member/account" },
- { name: "Board", path: "/board" },
];
const adminPages = [
{ name: "Admin Members", path: "/admin/members" },
{ name: "Admin Events Create", path: "/admin/events/create" },
- { name: "Admin Pre-Registrants", path: "/admin/pre-registrants" },
];
test.describe("accessibility — public pages", () => {
diff --git a/e2e/accept-invite.spec.js b/e2e/accept-invite.spec.js
deleted file mode 100644
index c834a70..0000000
--- a/e2e/accept-invite.spec.js
+++ /dev/null
@@ -1,170 +0,0 @@
-import { test, expect } from '@playwright/test'
-
-const FAKE_TOKEN = 'fake-invite-token-for-e2e'
-const FAKE_PREREG_ID = '000000000000000000000001'
-
-async function mockVerifyOk(page, overrides = {}) {
- await page.route('**/api/invite/verify', async (route) => {
- await route.fulfill({
- status: 200,
- contentType: 'application/json',
- body: JSON.stringify({
- preRegistrationId: FAKE_PREREG_ID,
- name: overrides.name ?? 'Pre Registered User',
- email: overrides.email ?? `prereg-${Date.now()}@example.com`,
- city: overrides.city ?? 'Vancouver, BC',
- }),
- })
- })
-}
-
-async function mockAcceptFree(page) {
- await page.route('**/api/invite/accept', async (route) => {
- await route.fulfill({
- status: 200,
- contentType: 'application/json',
- body: JSON.stringify({
- success: true,
- requiresPayment: false,
- redirectUrl: '/member/dashboard',
- member: {
- id: 'mem-1',
- email: 'prereg@example.com',
- name: 'Pre Registered User',
- circle: 'community',
- contributionAmount: 0,
- status: 'active',
- },
- }),
- })
- })
- await page.route('**/api/auth/status', async (route) => {
- await route.fulfill({
- status: 200,
- contentType: 'application/json',
- body: JSON.stringify({
- authenticated: true,
- member: { id: 'mem-1', name: 'Pre Registered User', status: 'active' },
- status: 'active',
- }),
- })
- })
-}
-
-async function gotoAcceptInvite(page) {
- await page.goto(`/accept-invite#${FAKE_TOKEN}`)
-}
-
-test.describe('Accept Invite — pre-registrant signup', () => {
- test('verifies invitation and shows form fields', async ({ page }) => {
- await mockVerifyOk(page, { name: 'Ada Lovelace', email: 'ada@example.com' })
- await gotoAcceptInvite(page)
-
- await expect(page.locator('#accept-name')).toBeVisible()
- await expect(page.locator('#accept-name')).toHaveValue('Ada Lovelace')
- await expect(page.locator('#accept-email')).toHaveValue('ada@example.com')
- await expect(page.locator('#circle-community')).toBeAttached()
- await expect(page.locator('#circle-founder')).toBeAttached()
- await expect(page.locator('#circle-practitioner')).toBeAttached()
- await expect(page.locator('#accept-cadence-monthly')).toBeAttached()
- await expect(page.locator('#accept-cadence-annual')).toBeAttached()
- await expect(page.locator('#accept-contribution')).toBeVisible()
- await expect(page.locator('.contribution-preset-chip').first()).toBeVisible()
- await expect(page.locator('.form-submit')).toBeVisible()
- })
-
- test('shows error when no token in URL hash', async ({ page }) => {
- await page.goto('/accept-invite')
- await expect(page.getByRole('heading', { name: 'Invitation Error' })).toBeVisible()
- await expect(page.locator('.error-box')).toContainText(/No invitation token/)
- })
-
- test('shows error when token verification fails', async ({ page }) => {
- await page.route('**/api/invite/verify', async (route) => {
- await route.fulfill({
- status: 401,
- contentType: 'application/json',
- body: JSON.stringify({ statusCode: 401, statusMessage: 'Invalid or expired invitation link' }),
- })
- })
- await gotoAcceptInvite(page)
- await expect(page.getByRole('heading', { name: 'Invitation Error' })).toBeVisible()
- await expect(page.locator('.error-box')).toContainText(/Invalid or expired/)
- })
-
- test('submit disabled until name + agreement filled', async ({ page }) => {
- await mockVerifyOk(page, { name: '' })
- await gotoAcceptInvite(page)
-
- await expect(page.locator('#accept-name')).toBeVisible()
- await expect(page.locator('.form-submit')).toBeDisabled()
-
- await page.locator('#accept-name').fill('New Member')
- await expect(page.locator('.form-submit')).toBeDisabled()
-
- await page.getByRole('checkbox', { name: /Community Guidelines/ }).check()
- await expect(page.locator('.form-submit')).toBeEnabled()
- })
-
- test('cadence toggle updates billing summary total', async ({ page }) => {
- await mockVerifyOk(page)
- await gotoAcceptInvite(page)
-
- await expect(page.locator('#accept-contribution')).toBeVisible()
- await page.locator('#accept-contribution').fill('10')
-
- await page.locator('label[for="accept-cadence-monthly"]').click()
- await expect(page.locator('.billing-summary')).toContainText('$10 today')
-
- await page.locator('label[for="accept-cadence-annual"]').click()
- await expect(page.locator('.billing-summary')).toContainText('$120 today')
- await expect(page.locator('.billing-summary')).toContainText('$10/month')
- })
-
- test('preset chip sets contribution amount', async ({ page }) => {
- await mockVerifyOk(page)
- await gotoAcceptInvite(page)
-
- await expect(page.locator('.contribution-preset-chip').first()).toBeVisible()
- const chip = page.locator('.contribution-preset-chip').nth(1)
- const chipText = await chip.textContent()
- const expected = chipText.replace(/[^0-9]/g, '')
-
- await chip.click()
- await expect(page.locator('#accept-contribution')).toHaveValue(expected)
- })
-
- test('free tier happy path shows welcome state', async ({ page }) => {
- await mockVerifyOk(page, { name: 'Free Tester', email: `free-${Date.now()}@example.com` })
- await mockAcceptFree(page)
- await gotoAcceptInvite(page)
-
- await expect(page.locator('#accept-name')).toHaveValue('Free Tester')
- await page.locator('#circle-community').check({ force: true })
- await page.locator('#accept-contribution').fill('0')
- await page.getByRole('checkbox', { name: /Community Guidelines/ }).check()
-
- await expect(page.locator('.form-submit')).toBeEnabled()
- await expect(page.locator('.form-submit')).toContainText(/Accept Invitation/)
-
- await page.locator('.form-submit').click()
-
- await expect(
- page.getByRole('heading', { name: 'Welcome to Ghost Guild!' })
- ).toBeVisible({ timeout: 15000 })
- })
-
- test('paid tier submit button copy switches to Continue to Payment', async ({ page }) => {
- await mockVerifyOk(page)
- await gotoAcceptInvite(page)
-
- await page.locator('#accept-contribution').fill('10')
- await page.getByRole('checkbox', { name: /Community Guidelines/ }).check()
- await expect(page.locator('.form-submit')).toContainText(/Continue to Payment/)
- })
-
- // Skipped: full paid-tier submission requires intercepting HelcimPay.js modal
- // (external script loads an iframe and posts a message back to verifyPayment).
- // Feasible but out of scope for this initial coverage pass.
- test.skip('paid tier full flow with mocked HelcimPay', async () => {})
-})
diff --git a/e2e/admin-board-channels.spec.js b/e2e/admin-board-channels.spec.js
index 91111cf..7a2d1e7 100644
--- a/e2e/admin-board-channels.spec.js
+++ b/e2e/admin-board-channels.spec.js
@@ -11,7 +11,6 @@ test.describe('Admin board channels page', () => {
test('create, edit, and delete a channel', async ({ adminPage }) => {
await adminPage.goto('/admin/board-channels')
- await adminPage.waitForLoadState('networkidle')
await expect(adminPage.getByRole('heading', { name: 'Board Channels' })).toBeVisible({
timeout: 15000,
})
@@ -19,14 +18,14 @@ test.describe('Admin board channels page', () => {
const suffix = Date.now().toString().slice(-6)
const channelName = `e2e-channel-${suffix}`
const editedName = `e2e-channel-${suffix}-edited`
+ const slackId = `C${suffix}XYZ`
// --- Create ---
- // Create flow only takes a name; the Slack channel ID is auto-assigned on
- // creation and only becomes editable in the Edit modal.
await adminPage.getByRole('button', { name: '+ New Channel' }).click()
await expect(adminPage.getByRole('heading', { name: 'New Channel' })).toBeVisible()
- await adminPage.locator('input[placeholder="e.g., coop-formation"]').fill(channelName)
+ await adminPage.locator('input[placeholder="e.g., #coop-formation"]').fill(channelName)
+ await adminPage.locator('input[placeholder="C0123456789"]').fill(slackId)
// Select the first available cooperative tag if any are present
const firstTagCheckbox = adminPage.locator('.tag-select input[type="checkbox"]').first()
@@ -45,7 +44,7 @@ test.describe('Admin board channels page', () => {
await row.getByRole('button', { name: 'Edit' }).click()
await expect(adminPage.getByRole('heading', { name: 'Edit Channel' })).toBeVisible()
- const nameInput = adminPage.locator('input[placeholder="e.g., coop-formation"]')
+ const nameInput = adminPage.locator('input[placeholder="e.g., #coop-formation"]')
await nameInput.fill(editedName)
await adminPage.getByRole('button', { name: 'Save Changes' }).click()
diff --git a/e2e/admin-events.spec.js b/e2e/admin-events.spec.js
index 4acd617..0fba9d0 100644
--- a/e2e/admin-events.spec.js
+++ b/e2e/admin-events.spec.js
@@ -53,116 +53,3 @@ test.describe('Admin events access control', () => {
expect(page.url()).not.toContain('/admin/events')
})
})
-
-test.describe('Admin events CRUD', () => {
- test('create, edit, and delete an event', async ({ adminPage }) => {
- const suffix = Date.now().toString().slice(-6)
- const title = `e2e-event-${suffix}`
- const editedTitle = `e2e-event-${suffix}-edited`
-
- // Re-prime the auth cookie immediately before this multi-step flow.
- // The shared test-admin account's tokenVersion is bumped whenever
- // auth.spec.js's logout test runs in parallel, which would otherwise
- // surface mid-flow as "Session has been revoked" on the first POST.
- const loginRes = await adminPage.context().request.get('/api/dev/test-login', { maxRedirects: 0 })
- if (loginRes.status() !== 302) {
- throw new Error(`Failed to refresh admin session: ${loginRes.status()}`)
- }
-
- // --- Create ---
- await adminPage.goto('/admin/events/create')
- await expect(adminPage.locator('h1')).toContainText('Create Event')
- // Ensure Vue has hydrated (initial $fetch for series/tags has resolved)
- // before interacting — under cross-file load, hydration can lag and a
- // pre-hydration submit will native-POST against an empty form.
- await adminPage.waitForLoadState('networkidle')
-
- await adminPage
- .getByPlaceholder('Enter a clear, descriptive event title')
- .fill(title)
-
- await adminPage
- .getByPlaceholder(
- 'Provide a clear description of what attendees can expect from this event'
- )
- .fill('e2e test event description')
-
- await adminPage
- .getByPlaceholder('e.g., https://zoom.us/j/123... or #channel-name')
- .fill('https://example.com/zoom')
-
- const startInput = adminPage.getByPlaceholder(
- "e.g., 'tomorrow at 3pm', 'next Friday at 9am'"
- )
- await startInput.fill('next Tuesday at 3pm')
- await startInput.blur()
-
- const endInput = adminPage.getByPlaceholder(
- "e.g., 'tomorrow at 5pm', 'next Friday at 11am'"
- )
- await endInput.fill('next Tuesday at 5pm')
- await endInput.blur()
-
- await adminPage.getByRole('button', { name: 'Create Event' }).click()
-
- // The form posts via $fetch and then auto-redirects after a 1.5s setTimeout.
- // Under cross-file load that auto-redirect can race against waitForURL.
- // Wait for the surfaced success/error state, fail fast on error, then
- // navigate explicitly so subsequent assertions are deterministic.
- await expect(
- adminPage.locator('.success-box').or(adminPage.locator('.error-box'))
- ).toBeVisible({ timeout: 15000 })
- await expect(adminPage.locator('.success-box')).toBeVisible()
- await adminPage.goto('/admin/events')
- await adminPage.waitForLoadState('networkidle')
-
- // Filter to just our event — orphan rows from prior failed runs can push
- // the new row off page 1 of the paginated list.
- await adminPage.getByPlaceholder('Search events...').fill(title)
- const row = adminPage.locator('tr', { hasText: title })
- await expect(row).toBeVisible({ timeout: 10000 })
-
- // --- Edit ---
- // Find the event ID from the row's "View" link (href is /events/),
- // and use the row's Edit button. Pair the click with waitForURL so we don't
- // miss the navigation event under load.
- await Promise.all([
- adminPage.waitForURL(/\/admin\/events\/create\?edit=/, { timeout: 15000 }),
- row.getByRole('button', { name: 'Edit' }).click(),
- ])
- await expect(adminPage.locator('h1')).toContainText('Edit Event')
-
- const titleInput = adminPage.getByPlaceholder(
- 'Enter a clear, descriptive event title'
- )
- await titleInput.fill(editedTitle)
-
- await adminPage.getByRole('button', { name: 'Update Event' }).click()
-
- await expect(
- adminPage.locator('.success-box').or(adminPage.locator('.error-box'))
- ).toBeVisible({ timeout: 15000 })
- await expect(adminPage.locator('.success-box')).toBeVisible()
- await adminPage.goto('/admin/events')
- await adminPage.waitForLoadState('networkidle')
-
- // Filter to the edited event's unique title for the same pagination reason.
- await adminPage.getByPlaceholder('Search events...').fill(editedTitle)
- const editedRow = adminPage.locator('tr', { hasText: editedTitle })
- await expect(editedRow).toBeVisible({ timeout: 10000 })
-
- // --- Delete (custom modal, not browser dialog) ---
- await editedRow.getByRole('button', { name: 'Del' }).click()
- await expect(
- adminPage.getByRole('heading', { name: 'Delete Event' })
- ).toBeVisible()
- await adminPage
- .locator('.modal')
- .getByRole('button', { name: 'Delete' })
- .click()
-
- await expect(
- adminPage.locator('tr', { hasText: editedTitle })
- ).toHaveCount(0, { timeout: 10000 })
- })
-})
diff --git a/e2e/admin-members.spec.js b/e2e/admin-members.spec.js
index e7b11d3..88aedce 100644
--- a/e2e/admin-members.spec.js
+++ b/e2e/admin-members.spec.js
@@ -66,68 +66,4 @@ test.describe("Admin members page", () => {
adminPage.getByPlaceholder("email@example.com"),
).toBeVisible();
});
-
- test("create member, status select reflects STATUS_LABELS, change persists, detail page renders", async ({ adminPage }) => {
- const stamp = Date.now();
- const memberName = `E2E Member ${stamp}`;
- const memberEmail = `e2e-member-${stamp}@example.test`;
-
- await adminPage.goto("/admin/members");
- await adminPage.waitForLoadState("networkidle");
- await expect(adminPage.locator("h1")).toHaveText("Members");
-
- await adminPage.getByRole("button", { name: "Add Member" }).click();
- await adminPage.getByPlaceholder("Full name").fill(memberName);
- await adminPage.getByPlaceholder("email@example.com").fill(memberEmail);
- await adminPage.getByRole("button", { name: "Create Member" }).click();
-
- // Verify the new member shows up via search
- const searchInput = adminPage.getByPlaceholder("Search members...");
- await expect(searchInput).toBeVisible({ timeout: 10000 });
- await searchInput.fill(memberEmail);
-
- const memberRow = adminPage.locator("tr", { hasText: memberEmail });
- await expect(memberRow).toBeVisible({ timeout: 10000 });
- await expect(memberRow.getByText(memberName)).toBeVisible();
-
- // Open the edit modal for this member, where the STATUS_LABELS-driven lives
- await memberRow.getByRole("button", { name: "Edit" }).click();
-
- const statusSelect = adminPage.locator(".modal select").filter({ hasText: "Active" });
- await expect(statusSelect).toBeVisible({ timeout: 10000 });
-
- // STATUS_LABELS keys (values) and the rendered labels
- const expectedOptions = [
- { value: "active", label: "Active" },
- { value: "pending_payment", label: "Payment setup incomplete" },
- { value: "suspended", label: "Paused" },
- { value: "cancelled", label: "Closed" },
- ];
- for (const { value, label } of expectedOptions) {
- const opt = statusSelect.locator(`option[value="${value}"]`);
- await expect(opt).toHaveCount(1);
- await expect(opt).toHaveText(label);
- }
-
- // Change status to suspended and save
- await statusSelect.selectOption("suspended");
- await adminPage.getByRole("button", { name: "Save Changes" }).click();
-
- // Modal closes; verify the row badge reflects the new status
- await expect(adminPage.locator(".modal")).toHaveCount(0, { timeout: 10000 });
- await expect(memberRow.getByText("Paused")).toBeVisible({ timeout: 10000 });
-
- // Reload to confirm persistence
- await adminPage.reload();
- await adminPage.waitForLoadState("networkidle");
- await adminPage.getByPlaceholder("Search members...").fill(memberEmail);
- const reloadedRow = adminPage.locator("tr", { hasText: memberEmail });
- await expect(reloadedRow.getByText("Paused")).toBeVisible({ timeout: 10000 });
-
- // Click the member name (link to detail page) and verify URL + heading
- await reloadedRow.getByRole("link", { name: memberName }).click();
- await adminPage.waitForURL(/\/admin\/members\/[a-f0-9]{24}$/, { timeout: 10000 });
- await expect(adminPage.locator("h1")).toHaveText(memberName);
- await expect(adminPage.locator(".member-email")).toHaveText(memberEmail);
- });
});
diff --git a/e2e/admin-pre-registrants.spec.js b/e2e/admin-pre-registrants.spec.js
deleted file mode 100644
index 2c60168..0000000
--- a/e2e/admin-pre-registrants.spec.js
+++ /dev/null
@@ -1,111 +0,0 @@
-import { test, expect } from './helpers/fixtures.js'
-
-test.describe('Admin pre-registrants page', () => {
- test('page loads for admin', async ({ adminPage }) => {
- await adminPage.goto('/admin/pre-registrants')
-
- await expect(adminPage.getByRole('heading', { name: 'Pre-Registrants' })).toBeVisible({
- timeout: 15000,
- })
-
- await expect(
- adminPage.locator('table').or(adminPage.getByText('No pre-registrants found matching your criteria')),
- ).toBeVisible({ timeout: 15000 })
- })
-
- test('header action buttons render', async ({ adminPage }) => {
- await adminPage.goto('/admin/pre-registrants')
- await expect(adminPage.getByRole('heading', { name: 'Pre-Registrants' })).toBeVisible({
- timeout: 15000,
- })
-
- await expect(adminPage.getByRole('button', { name: /^Mark as Selected/ })).toBeVisible()
- await expect(adminPage.getByRole('button', { name: /^Send Invites/ })).toBeVisible()
- })
-
- test('search input filters list without crashing', async ({ adminPage }) => {
- await adminPage.goto('/admin/pre-registrants')
- await adminPage.waitForLoadState('networkidle')
-
- const search = adminPage.getByPlaceholder('Search by name, email, city, role...')
- await expect(search).toBeVisible({ timeout: 15000 })
-
- await search.fill(`nonexistent-prereg-${Date.now()}`)
-
- await expect(
- adminPage.getByText('No pre-registrants found matching your criteria'),
- ).toBeVisible({ timeout: 10000 })
- })
-
- test('status filter changes selection', async ({ adminPage }) => {
- await adminPage.goto('/admin/pre-registrants')
- await adminPage.waitForLoadState('networkidle')
-
- const statusFilter = adminPage.getByLabel('Filter by status')
- await expect(statusFilter).toBeVisible({ timeout: 15000 })
-
- await statusFilter.selectOption('expired')
- await expect(statusFilter).toHaveValue('expired')
-
- await expect(
- adminPage.locator('table').or(adminPage.getByText('No pre-registrants found matching your criteria')),
- ).toBeVisible({ timeout: 10000 })
-
- await statusFilter.selectOption('')
- await expect(statusFilter).toHaveValue('')
- })
-
- test('Send Invites button is disabled with no selection', async ({ adminPage }) => {
- await adminPage.goto('/admin/pre-registrants')
- await expect(adminPage.getByRole('heading', { name: 'Pre-Registrants' })).toBeVisible({
- timeout: 15000,
- })
-
- await expect(adminPage.getByRole('button', { name: 'Send Invites (0)' })).toBeDisabled()
- await expect(adminPage.getByRole('button', { name: 'Mark as Selected (0)' })).toBeDisabled()
- })
-
- test('send invite action', async ({ adminPage }) => {
- await adminPage.goto('/admin/pre-registrants')
- await adminPage.waitForLoadState('networkidle')
- await expect(adminPage.getByRole('heading', { name: 'Pre-Registrants' })).toBeVisible({
- timeout: 15000,
- })
-
- // Filter to invitable statuses; pick the first row if available.
- const statusFilter = adminPage.getByLabel('Filter by status')
- await statusFilter.selectOption('pending')
- await adminPage.waitForLoadState('networkidle')
-
- const firstRow = adminPage.locator('tbody tr').first()
- if (await firstRow.count() === 0) {
- test.skip(true, 'No pending pre-registrants in dev DB to invite')
- return
- }
-
- await firstRow.locator('.col-name').click()
- const sendButton = adminPage.getByRole('button', { name: /^Send Invites \(\d+\)/ })
- await expect(sendButton).toBeEnabled()
- await sendButton.click()
-
- await expect(adminPage.getByRole('heading', { name: 'Send Invitation Emails' })).toBeVisible()
-
- const submitButton = adminPage.getByRole('button', { name: /^Send \d+ invitation/ })
- await submitButton.click()
-
- // ALLOW_DEV_TEST_ENDPOINTS=true short-circuits the Resend call; result still reports sent.
- await expect(adminPage.getByText(/^\d+ sent$/)).toBeVisible({ timeout: 15000 })
- })
-
- test('non-admin redirect', async ({ browser }) => {
- const context = await browser.newContext()
- const page = await context.newPage()
-
- await page.goto('/admin/pre-registrants')
-
- await page.waitForURL((url) => !url.pathname.startsWith('/admin'))
- expect(page.url()).not.toContain('/admin/pre-registrants')
-
- await context.close()
- })
-})
diff --git a/e2e/admin-series.spec.js b/e2e/admin-series.spec.js
deleted file mode 100644
index 897bdb0..0000000
--- a/e2e/admin-series.spec.js
+++ /dev/null
@@ -1,65 +0,0 @@
-import { test, expect } from './helpers/fixtures.js'
-
-test.describe('Admin series management page', () => {
- test('series list loads for admin', async ({ adminPage }) => {
- await adminPage.goto('/admin/series-management')
- await expect(adminPage.getByRole('heading', { name: 'Series', level: 1 })).toBeVisible({
- timeout: 15000,
- })
- await expect(adminPage.getByRole('link', { name: 'Create Series' })).toBeVisible()
- })
-})
-
-test.describe('Admin series access control', () => {
- test('non-admin redirect', async ({ page }) => {
- await page.goto('/admin/series-management')
- await page.waitForURL((url) => !url.pathname.startsWith('/admin'))
- expect(page.url()).not.toContain('/admin/series-management')
- })
-})
-
-test.describe('Admin series CRUD', () => {
- test('create and edit a series', async ({ adminPage }) => {
- const suffix = Date.now().toString().slice(-6)
- const title = `e2e-series-${suffix}`
- const description = 'e2e test series description'
- const editedDescription = 'e2e test series description edited'
-
- // --- Create ---
- await adminPage.goto('/admin/series/create')
- await expect(adminPage.locator('h1')).toContainText('Create New Series')
-
- await adminPage
- .getByPlaceholder('e.g., Cooperative Game Development Fundamentals')
- .fill(title)
-
- await adminPage
- .getByPlaceholder('Describe what the series covers and its goals')
- .fill(description)
-
- await adminPage.getByRole('button', { name: 'Create Series' }).click()
-
- await adminPage.waitForURL('**/admin/series-management', { timeout: 15000 })
-
- const card = adminPage.locator('.series-card', { hasText: title })
- await expect(card).toBeVisible({ timeout: 10000 })
- await expect(card).toContainText(description)
-
- // --- Edit (in-page modal) ---
- await card.getByRole('button', { name: 'Edit' }).click()
- await expect(adminPage.getByRole('heading', { name: 'Edit Series' })).toBeVisible()
-
- const descInput = adminPage.locator('textarea[placeholder="Brief description of this series"]')
- await descInput.fill(editedDescription)
- await adminPage.getByRole('button', { name: 'Save Changes' }).click()
-
- const editedCard = adminPage.locator('.series-card', { hasText: title })
- await expect(editedCard).toContainText(editedDescription, { timeout: 10000 })
- })
-
- // Delete is skipped: the series-management page's "Delete" button only
- // unlinks events from the series via PUT /api/admin/events/:id; it does
- // not call DELETE /api/admin/series/:id, so the series record remains.
- // No UI affordance currently exists to remove an empty series.
- test.skip('delete a series', async () => {})
-})
diff --git a/e2e/admin-site-content.spec.js b/e2e/admin-site-content.spec.js
deleted file mode 100644
index d4962d2..0000000
--- a/e2e/admin-site-content.spec.js
+++ /dev/null
@@ -1,85 +0,0 @@
-import { test, expect } from './helpers/fixtures.js'
-
-const WHITELISTED_KEYS = ['homepage.wiki_feature']
-
-test.describe('Admin site content page', () => {
- test('page loads for admin', async ({ adminPage }) => {
- await adminPage.goto('/admin/site-content')
- await expect(adminPage.getByRole('heading', { name: 'Site Content' })).toBeVisible({
- timeout: 15000,
- })
- })
-
- test('renders one block per whitelisted key', async ({ adminPage }) => {
- await adminPage.goto('/admin/site-content')
- await adminPage.waitForLoadState('networkidle')
- await expect(adminPage.getByRole('heading', { name: 'Site Content' })).toBeVisible({
- timeout: 15000,
- })
-
- const blocks = adminPage.locator('.content-block')
- await expect(blocks).toHaveCount(WHITELISTED_KEYS.length)
-
- for (const key of WHITELISTED_KEYS) {
- await expect(adminPage.locator('.block-key', { hasText: key })).toBeVisible()
- }
- })
-
- test('edit, save, persist, and reflect on public page', async ({ adminPage }) => {
- const key = 'homepage.wiki_feature'
-
- await adminPage.goto('/admin/site-content')
- await adminPage.waitForLoadState('networkidle')
- await expect(adminPage.getByRole('heading', { name: 'Site Content' })).toBeVisible({
- timeout: 15000,
- })
-
- const original = await adminPage.evaluate(
- async (k) => await (await fetch(`/api/site-content/${k}`)).json(),
- key,
- )
- const originalTitle = original.title || ''
- const originalBody = original.body || ''
-
- const stamp = Date.now()
- const newTitle = `e2e title ${stamp}`
- const newBody = `e2e body paragraph ${stamp}`
-
- const block = adminPage.locator('.content-block', {
- has: adminPage.locator('.block-key', { hasText: key }),
- })
- await expect(block).toBeVisible()
-
- const titleInput = block.locator('input[type="text"]')
- const bodyTextarea = block.locator('textarea')
-
- await titleInput.fill(newTitle)
- await bodyTextarea.fill(newBody)
- await block.getByRole('button', { name: 'Save' }).click()
-
- await expect(block.locator('.block-meta')).toContainText('Updated', { timeout: 10000 })
-
- await adminPage.reload()
- await adminPage.waitForLoadState('networkidle')
- const reloadedBlock = adminPage.locator('.content-block', {
- has: adminPage.locator('.block-key', { hasText: key }),
- })
- await expect(reloadedBlock.locator('input[type="text"]')).toHaveValue(newTitle)
- await expect(reloadedBlock.locator('textarea')).toHaveValue(newBody)
-
- await adminPage.goto('/')
- await adminPage.waitForLoadState('networkidle')
- await expect(adminPage.getByText(newBody)).toBeVisible({ timeout: 15000 })
-
- await adminPage.evaluate(
- async ({ k, t, b }) => {
- await fetch(`/api/admin/site-content/${k}`, {
- method: 'PUT',
- headers: { 'Content-Type': 'application/json' },
- body: JSON.stringify({ title: t, body: b }),
- })
- },
- { k: key, t: originalTitle, b: originalBody },
- )
- })
-})
diff --git a/e2e/auth.spec.js b/e2e/auth.spec.js
index f7c60f0..5b0daca 100644
--- a/e2e/auth.spec.js
+++ b/e2e/auth.spec.js
@@ -44,7 +44,6 @@ test.describe('Authentication flows', () => {
test('logout clears auth', async ({ page }) => {
await loginAsAdmin(page)
await page.goto('/admin')
- await page.waitForLoadState('networkidle')
await expect(page.locator('.admin-tag')).toBeVisible({ timeout: 15000 })
// Set up response listener BEFORE clicking to avoid race
diff --git a/e2e/board.spec.js b/e2e/board.spec.js
index 89332b5..6f2fe7e 100644
--- a/e2e/board.spec.js
+++ b/e2e/board.spec.js
@@ -1,78 +1,45 @@
import { test, expect } from './helpers/fixtures.js'
-import { loginAsMember } from './helpers/auth.js'
-
-// The default `memberPage` fixture authenticates as test-admin@ghostguild.dev,
-// the same account auth.spec.js's logout test revokes mid-suite. Bypass the
-// fixture and use a seeded, non-shared member instead so cross-file logout
-// can't strand this file mid-flow.
-const SEEDED_MEMBER_EMAIL = 'riley.johnson@cooperativedev.org'
-
-const newMemberPage = async (browser) => {
- const context = await browser.newContext()
- const page = await context.newPage()
- await loginAsMember(page, SEEDED_MEMBER_EMAIL)
- return { context, page }
-}
test.describe('Board page', () => {
- test('page loads for authenticated member', async ({ browser }) => {
- const { context, page: memberPage } = await newMemberPage(browser)
- try {
- await memberPage.goto('/board')
- await expect(memberPage.getByRole('heading', { name: 'Bulletin Board' })).toBeVisible({ timeout: 15000 })
- await expect(memberPage.getByRole('button', { name: '+ New Post' }).first()).toBeVisible()
- } finally {
- await context.close()
- }
- })
-
- test('clicking New Post reveals the form', async ({ browser }) => {
- const { context, page: memberPage } = await newMemberPage(browser)
- try {
- await memberPage.goto('/board')
- await memberPage.waitForLoadState('networkidle')
- await expect(memberPage.getByRole('button', { name: '+ New Post' }).first()).toBeVisible({
- timeout: 15000,
- })
-
- await memberPage.getByRole('button', { name: '+ New Post' }).first().click()
-
- await expect(memberPage.getByRole('heading', { name: 'New post' })).toBeVisible()
- await expect(memberPage.locator('#post-title')).toBeVisible()
- await expect(memberPage.locator('#post-seeking')).toBeVisible()
- } finally {
- await context.close()
- }
- })
-
- test('tags drawer toggles open and closed', async ({ browser }) => {
- const { context, page: memberPage } = await newMemberPage(browser)
- try {
- await memberPage.goto('/board')
- await expect(memberPage.getByRole('heading', { name: 'Bulletin Board' })).toBeVisible({ timeout: 15000 })
-
- const drawerToggle = memberPage.getByRole('button', { name: /^Tags\.\.\./ })
- // Drawer toggle only appears if cooperative tags exist — skip quietly if not
- if (!(await drawerToggle.isVisible().catch(() => false))) {
- test.skip(true, 'No cooperative tags seeded in this environment')
- return
- }
-
- await drawerToggle.click()
- await expect(memberPage.getByText('Filter:')).toBeVisible()
-
- await drawerToggle.click()
- await expect(memberPage.getByText('Filter:')).not.toBeVisible()
- } finally {
- await context.close()
- }
- })
-
- test('create, edit, and delete own post', async ({ browser }) => {
- const { context, page: memberPage } = await newMemberPage(browser)
- try {
+ test('page loads for authenticated member', async ({ memberPage }) => {
+ await memberPage.goto('/board')
+ await expect(memberPage.getByRole('heading', { name: 'Board' })).toBeVisible({ timeout: 15000 })
+ await expect(memberPage.getByRole('button', { name: '+ New Post' }).first()).toBeVisible()
+ })
+
+ test('clicking New Post reveals the form', async ({ memberPage }) => {
+ await memberPage.goto('/board')
+ await expect(memberPage.getByRole('button', { name: '+ New Post' }).first()).toBeVisible({
+ timeout: 15000,
+ })
+
+ await memberPage.getByRole('button', { name: '+ New Post' }).first().click()
+
+ await expect(memberPage.getByRole('heading', { name: 'New post' })).toBeVisible()
+ await expect(memberPage.locator('#post-title')).toBeVisible()
+ await expect(memberPage.locator('#post-seeking')).toBeVisible()
+ })
+
+ test('tags drawer toggles open and closed', async ({ memberPage }) => {
+ await memberPage.goto('/board')
+ await expect(memberPage.getByRole('heading', { name: 'Board' })).toBeVisible({ timeout: 15000 })
+
+ const drawerToggle = memberPage.getByRole('button', { name: /^Tags\.\.\./ })
+ // Drawer toggle only appears if cooperative tags exist — skip quietly if not
+ if (!(await drawerToggle.isVisible().catch(() => false))) {
+ test.skip(true, 'No cooperative tags seeded in this environment')
+ return
+ }
+
+ await drawerToggle.click()
+ await expect(memberPage.getByText('Filter:')).toBeVisible()
+
+ await drawerToggle.click()
+ await expect(memberPage.getByText('Filter:')).not.toBeVisible()
+ })
+
+ test('create, edit, and delete own post', async ({ memberPage }) => {
await memberPage.goto('/board')
- await memberPage.waitForLoadState('networkidle')
await expect(memberPage.getByRole('button', { name: '+ New Post' }).first()).toBeVisible({
timeout: 15000,
})
@@ -88,7 +55,7 @@ test.describe('Board page', () => {
await memberPage.locator('#post-title').fill(originalTitle)
await memberPage.locator('#post-seeking').fill('Playwright test seeking text')
- await memberPage.getByRole('button', { name: 'Post', exact: true }).click()
+ await memberPage.getByRole('button', { name: 'Post' }).click()
await expect(memberPage.getByRole('heading', { name: originalTitle })).toBeVisible({
timeout: 10000,
@@ -108,16 +75,13 @@ test.describe('Board page', () => {
timeout: 10000,
})
- // --- Delete (in-card two-step confirm; not a native dialog) ---
+ // --- Delete (confirm dialog) ---
+ memberPage.once('dialog', (dialog) => dialog.accept())
const editedCard = memberPage.locator('article.board-post', { hasText: editedTitle })
await editedCard.getByRole('button', { name: 'Delete' }).click()
- await editedCard.getByRole('button', { name: 'Confirm' }).click()
await expect(memberPage.getByRole('heading', { name: editedTitle })).not.toBeVisible({
timeout: 10000,
})
- } finally {
- await context.close()
- }
})
})
diff --git a/e2e/events.spec.js b/e2e/events.spec.js
index 3453fdd..6238998 100644
--- a/e2e/events.spec.js
+++ b/e2e/events.spec.js
@@ -67,128 +67,3 @@ test.describe('Events list page', () => {
await expect(page.locator('h1')).toBeVisible()
})
})
-
-async function navigateToFirstEventDetail(page) {
- await page.goto('/events')
- await page.locator('.past-toggle').click()
- await page.waitForLoadState('networkidle')
- const eventLinks = page.locator('.event-row a')
- const count = await eventLinks.count()
- if (count === 0) return null
- const href = await eventLinks.first().getAttribute('href')
- return href
-}
-
-test.describe('Event detail — ticket gating', () => {
- test('series-pass-required shows pass-required notice instead of buy button', async ({ page }) => {
- const href = await navigateToFirstEventDetail(page)
- test.skip(!href, 'No events in dev DB to navigate against')
-
- await page.route('**/api/events/*/tickets/available**', async (route) => {
- await route.fulfill({
- status: 200,
- contentType: 'application/json',
- body: JSON.stringify({
- available: false,
- reason: 'series_pass_required',
- requiresSeriesPass: true,
- series: { id: 'series-stub', slug: 'series-stub', title: 'Stub Series' }
- })
- })
- })
- await page.route('**/api/events/*/check-series-access**', async (route) => {
- await route.fulfill({
- status: 200,
- contentType: 'application/json',
- body: JSON.stringify({ requiresSeriesPass: false })
- })
- })
-
- await page.locator(`.event-row a[href="${href}"]`).first().click()
- await page.waitForURL(`**${href}`)
-
- const ticketPanel = page.locator('.event-ticket-purchase')
- await expect(ticketPanel.locator('.ticket-status', { hasText: 'Series Pass Required' })).toBeVisible()
- await expect(ticketPanel.locator('button', { hasText: /Pay |Register for this event|Complete Registration/ })).toHaveCount(0)
- await expect(ticketPanel.locator('a[href="/series/series-stub"] button')).toBeVisible()
- })
-
- test('memberSavings line is hidden for anonymous viewers', async ({ page }) => {
- const href = await navigateToFirstEventDetail(page)
- test.skip(!href, 'No events in dev DB to navigate against')
-
- await page.route('**/api/events/*/tickets/available**', async (route) => {
- await route.fulfill({
- status: 200,
- contentType: 'application/json',
- body: JSON.stringify({
- available: true,
- alreadyRegistered: false,
- isFree: false,
- isMember: false,
- name: 'General Admission',
- formattedPrice: '$25.00',
- remaining: 10,
- memberSavings: 0,
- publicTicket: null
- })
- })
- })
-
- await page.locator(`.event-row a[href="${href}"]`).first().click()
- await page.waitForURL(`**${href}`)
-
- const ticketCard = page.locator('.ticket-card')
- await expect(ticketCard).toBeVisible()
- await expect(page.locator('.ticket-savings')).toHaveCount(0)
- await expect(page.locator('text=/save .* as a member/i')).toHaveCount(0)
- })
-
- test('memberSavings line is shown when API reports savings', async ({ page }) => {
- const href = await navigateToFirstEventDetail(page)
- test.skip(!href, 'No events in dev DB to navigate against')
-
- await page.route('**/api/events/*/tickets/available**', async (route) => {
- await route.fulfill({
- status: 200,
- contentType: 'application/json',
- body: JSON.stringify({
- available: true,
- alreadyRegistered: false,
- isFree: false,
- isMember: true,
- name: 'Member Ticket',
- formattedPrice: '$10.00',
- remaining: 10,
- memberSavings: 15,
- publicTicket: { formattedPrice: '$25.00' }
- })
- })
- })
-
- await page.locator(`.event-row a[href="${href}"]`).first().click()
- await page.waitForURL(`**${href}`)
-
- const savings = page.locator('.ticket-savings')
- await expect(savings).toBeVisible()
- await expect(savings).toContainText(/save/i)
- })
-
- test.skip('hidden event returns 404', async () => {
- // Skipped: hidden-event gating happens during SSR useFetch in [slug].vue,
- // which page.route cannot intercept. Verifying this gate requires either
- // seeding a hidden event in the dev DB or a server-side mock layer.
- })
-
- test.skip('past-deadline event shows registration-closed copy', async () => {
- // Skipped: when the available endpoint returns reason
- // "Registration deadline has passed", the current UI surfaces it as the
- // generic "Event Sold Out" panel — there is no distinct "Registration
- // closed" string to assert against without changing the component.
- })
-
- test.skip('member with paid registration cannot self-cancel', async () => {
- // Skipped: requires seeding an authed member with a paid registration in
- // the DB, which is out of scope for API-level mocking.
- })
-})
diff --git a/e2e/helpers/auth.js b/e2e/helpers/auth.js
index d85c110..82f580b 100644
--- a/e2e/helpers/auth.js
+++ b/e2e/helpers/auth.js
@@ -1,32 +1,36 @@
/**
* Login helpers using dev endpoints.
- *
- * Implementation note: hits the dev endpoints via the APIRequestContext
- * (no page navigation). The Set-Cookie response writes auth-token to the
- * BrowserContext's cookie jar, so any subsequent page.goto() is authed.
- * Avoids the Nuxt-dev networkidle race that made page.goto-based login flaky.
+ * These set real httpOnly JWT cookies so all middleware works naturally.
+ */
+
+/**
+ * Login as admin via the dev test-login endpoint.
+ * Creates a test admin user if none exists and sets the auth cookie.
+ * Waits for networkidle so the client-side auth check (admin middleware +
+ * auth-init plugin) completes before the test navigates anywhere.
*/
export async function loginAsAdmin(page) {
- const res = await page.context().request.get('/api/dev/test-login', { maxRedirects: 0 })
- if (res.status() !== 302) {
- throw new Error(`/api/dev/test-login returned ${res.status()}; expected 302`)
- }
- const cookies = await page.context().cookies()
- if (!cookies.find((c) => c.name === 'auth-token')) {
- throw new Error('/api/dev/test-login did not set auth-token cookie')
+ await page.goto('/api/dev/test-login', { waitUntil: 'domcontentloaded' })
+
+ // The endpoint sets the cookie and redirects to /admin.
+ // waitForURL fires as soon as the URL changes — not when JS finishes.
+ // waitForLoadState('networkidle') ensures the auth-init plugin and admin
+ // middleware have both completed their checkMemberStatus() calls before
+ // the test proceeds.
+ try {
+ await page.waitForURL(/\/admin/, { timeout: 15000 })
+ await page.waitForLoadState('networkidle')
+ } catch {
+ // Cookie should be set even if redirect failed — navigate manually
+ await page.goto('/admin', { waitUntil: 'networkidle' })
+ await page.waitForURL(/\/admin/)
}
}
+/**
+ * Login as a specific member by email via the dev member-login endpoint.
+ */
export async function loginAsMember(page, email) {
- const res = await page.context().request.get(
- `/api/dev/member-login?email=${encodeURIComponent(email)}`,
- { maxRedirects: 0 }
- )
- if (res.status() !== 302) {
- throw new Error(`/api/dev/member-login returned ${res.status()}; expected 302`)
- }
- const cookies = await page.context().cookies()
- if (!cookies.find((c) => c.name === 'auth-token')) {
- throw new Error('/api/dev/member-login did not set auth-token cookie')
- }
+ await page.goto(`/api/dev/member-login?email=${encodeURIComponent(email)}`, { waitUntil: 'domcontentloaded' })
+ await page.waitForURL(/\/member\//)
}
diff --git a/e2e/join-flow.spec.js b/e2e/join-flow.spec.js
index 6369d1a..919e9ec 100644
--- a/e2e/join-flow.spec.js
+++ b/e2e/join-flow.spec.js
@@ -68,12 +68,8 @@ test.describe('Join page — member signup flow', () => {
await page.locator('#join-name').fill('Test User')
await expect(page.locator('.form-submit')).toBeDisabled()
- // Fill email — agreement still unchecked, so still disabled
+ // Fill email too — now all fields are populated and button should be enabled
await page.locator('#join-email').fill('incomplete-test@example.com')
- await expect(page.locator('.form-submit')).toBeDisabled()
-
- // Check the Community Guidelines agreement — now all required fields satisfied
- await page.getByRole('checkbox', { name: /Community Guidelines/ }).check()
await expect(page.locator('.form-submit')).toBeEnabled()
})
@@ -87,9 +83,8 @@ test.describe('Join page — member signup flow', () => {
await page.locator('#join-name').fill('E2E Test User')
await page.locator('#join-email').fill(uniqueEmail)
await page.locator('#circle-community').check({ force: true })
- // Contribution is now a numeric input with preset chips, not a select
- await page.locator('#join-contribution').fill('0')
- await page.getByRole('checkbox', { name: /Community Guidelines/ }).check()
+ await page.locator('#join-contribution').click()
+ await page.getByRole('option', { name: '$0/mo' }).click()
await expect(page.locator('.form-submit')).toBeEnabled()
@@ -98,108 +93,8 @@ test.describe('Join page — member signup flow', () => {
await page.locator('.form-submit').click()
- // Free tier flips the SignupFlowOverlay into its success state
- await expect(
- page.getByRole('heading', { name: 'Welcome to Ghost Guild!' })
- ).toBeVisible({ timeout: 15000 })
- })
-
- test('cadence toggle updates billing summary to annual ×12', async ({ page }) => {
- await page.goto('/join')
- await page.waitForLoadState('networkidle')
-
- await page.locator('#join-contribution').fill('10')
- await page.locator('label[for="cadence-annual"]').click()
-
- const summary = page.locator('.billing-summary')
- await expect(summary).toBeVisible()
- await expect(summary).toContainText('$120 today')
- await expect(summary).toContainText('$10/month × 12')
- await expect(summary).toContainText('$120 every year')
-
- await page.locator('label[for="cadence-monthly"]').click()
- await expect(summary).toContainText('$10 today')
- await expect(summary).toContainText('$10 every month')
- })
-
- test('contribution guidance label changes with amount tier', async ({ page }) => {
- await page.goto('/join')
- await page.waitForLoadState('networkidle')
-
- const guidance = page.locator('.contribution-guidance')
-
- await page.locator('#join-contribution').fill('5')
- await expect(guidance).toHaveText(/I can contribute/)
-
- await page.locator('#join-contribution').fill('30')
- await expect(guidance).toHaveText(/I can support others too/)
- })
-
- test('paid tier flow reaches success state with HelcimPay stubbed', async ({ page }) => {
- const uniqueEmail = `test-e2e-paid-${Date.now()}@example.com`
-
- // Stub HelcimPay window globals before the page loads so the composable's
- // script-load path is bypassed and we resolve verifyPayment synchronously.
- await page.addInitScript(() => {
- window.appendHelcimPayIframe = (checkoutToken) => {
- const eventName = 'helcim-pay-js-' + checkoutToken
- setTimeout(() => {
- window.postMessage({
- eventName,
- eventStatus: 'SUCCESS',
- eventMessage: JSON.stringify({
- data: {
- data: {
- transactionId: 'stub-txn-1',
- cardToken: 'stub-card-token-1',
- cardNumber: '4111111111111234',
- cardType: 'visa'
- }
- }
- })
- }, '*')
- }, 50)
- }
- window.removeHelcimPayIframe = () => {}
- })
-
- await page.goto('/join')
- await page.waitForLoadState('networkidle')
-
- await mockHelcimAPIs(page)
-
- await page.route('**/api/helcim/initialize-payment', async (route) => {
- return route.fulfill({
- status: 200,
- contentType: 'application/json',
- body: JSON.stringify({
- success: true,
- checkoutToken: 'stub-checkout-token',
- secretToken: 'stub-secret-token'
- })
- })
- })
-
- await page.route('**/api/helcim/verify-payment', async (route) => {
- return route.fulfill({
- status: 200,
- contentType: 'application/json',
- body: JSON.stringify({ success: true })
- })
- })
-
- await page.locator('#join-name').fill('Paid E2E User')
- await page.locator('#join-email').fill(uniqueEmail)
- await page.locator('#circle-community').check({ force: true })
- await page.locator('#join-contribution').fill('15')
- await page.getByRole('checkbox', { name: /Community Guidelines/ }).check()
-
- await expect(page.locator('.form-submit')).toBeEnabled()
- await page.locator('.form-submit').click()
-
- await expect(
- page.getByRole('heading', { name: 'Welcome to Ghost Guild!' })
- ).toBeVisible({ timeout: 15000 })
+ // Free tier creates subscription then shows confirmation (step 3)
+ await expect(page.locator('.success-box')).toBeVisible({ timeout: 15000 })
})
test('duplicate email shows error', async ({ page }) => {
@@ -214,13 +109,12 @@ test.describe('Join page — member signup flow', () => {
await page.locator('#join-name').fill('Dup Test User')
await page.locator('#join-email').fill(duplicateEmail)
await page.locator('#circle-community').check({ force: true })
- await page.locator('#join-contribution').fill('0')
- await page.getByRole('checkbox', { name: /Community Guidelines/ }).check()
+ await page.locator('#join-contribution').click()
+ await page.getByRole('option', { name: '$0/mo' }).click()
await page.locator('.form-submit').click()
- // Helcim 409 puts SignupFlowOverlay into its error state
- const overlayError = page.locator('.signup-flow-overlay .error-box')
- await expect(overlayError).toBeVisible({ timeout: 10000 })
- await expect(overlayError).toContainText(/already/i)
+ // Should show an error about the email already existing
+ await expect(page.locator('.error-box')).toBeVisible({ timeout: 10000 })
+ await expect(page.locator('.error-box')).toContainText(/already/i)
})
})
diff --git a/e2e/member-profile.spec.js b/e2e/member-profile.spec.js
index 22af212..0fa51c8 100644
--- a/e2e/member-profile.spec.js
+++ b/e2e/member-profile.spec.js
@@ -3,11 +3,9 @@ import { test, expect } from './helpers/fixtures.js'
test.describe('Member profile page', () => {
test('profile page loads', async ({ adminPage }) => {
await adminPage.goto('/member/profile')
- await adminPage.waitForLoadState('networkidle')
// Auth is checked client-side in onMounted — wait for profile form to render
await expect(adminPage.getByText('Edit Profile')).toBeVisible({ timeout: 15000 })
- // Verify a stable structural section label, not transient marketing copy
- await expect(adminPage.getByText('Show in Member Directory')).toBeVisible()
+ await expect(adminPage.getByText('How you appear to other members')).toBeVisible()
})
test('form fields are present', async ({ adminPage }) => {
@@ -26,7 +24,6 @@ test.describe('Member profile page', () => {
test('bio field accepts input', async ({ adminPage }) => {
await adminPage.goto('/member/profile')
- await adminPage.waitForLoadState('networkidle')
await expect(adminPage.getByText('Edit Profile')).toBeVisible({ timeout: 15000 })
const bio = adminPage.locator('textarea[placeholder*="Share your background"]')
diff --git a/e2e/visual/pages.spec.js b/e2e/visual/pages.spec.js
new file mode 100644
index 0000000..24062e7
--- /dev/null
+++ b/e2e/visual/pages.spec.js
@@ -0,0 +1,180 @@
+import { test, expect } from '@playwright/test'
+import { loginAsAdmin } from '../helpers/auth.js'
+import path from 'path'
+import fs from 'fs'
+
+const viewports = {
+ desktop: { width: 1280, height: 720 },
+ mobile: { width: 375, height: 667 },
+}
+
+const publicPages = [
+ { name: 'home', path: '/' },
+ { name: 'join', path: '/join' },
+ { name: 'events', path: '/events' },
+ { name: 'coming-soon', path: '/coming-soon' },
+ // about and members have no auth middleware — accessible publicly
+ { name: 'about', path: '/about' },
+ { name: 'members', path: '/members' },
+]
+
+const authenticatedPages = [
+ { name: 'member-dashboard', path: '/member/dashboard' },
+ { name: 'member-profile', path: '/member/profile' },
+ { name: 'admin-members', path: '/admin/members' },
+ { name: 'admin-events-create', path: '/admin/events/create' },
+ // New authenticated pages
+ { name: 'member-account', path: '/member/account' },
+ { name: 'connections', path: '/connections' },
+ { name: 'admin-dashboard', path: '/admin' },
+]
+
+// Pages that need mobile coverage captured while authenticated.
+// These cover column-collapse breakpoints critical for the page-shell refactor.
+// Snapshots use the -mobile-auth suffix to distinguish from the public mobile loop
+// (which also captures about-mobile unauthenticated, so names must not collide).
+const authenticatedMobilePages = [
+ { name: 'about', path: '/about' },
+ { name: 'member-dashboard', path: '/member/dashboard' },
+ { name: 'member-profile', path: '/member/profile' },
+ { name: 'member-account', path: '/member/account' },
+ { name: 'connections', path: '/connections' },
+]
+
+// Path where the saved admin auth state (cookies) will be stored within a run.
+const authStatePath = path.resolve('e2e/.auth/admin.json')
+
+// Wait for fonts and images to load before taking screenshots
+async function waitForStable(page) {
+ await page.waitForLoadState('networkidle')
+ // Wait for web fonts to load
+ await page.evaluate(() => document.fonts.ready)
+}
+
+// Common mask selectors for dynamic content
+function commonMasks(page) {
+ return [
+ // Dates and times throughout the app
+ page.locator('.event-date'),
+ page.locator('.event-count'),
+ page.locator('time'),
+ page.locator('.member-since'),
+ // Activity log timestamps
+ page.locator('.tl-time'),
+ // Admin dashboard stat values (member counts, revenue, etc.)
+ page.locator('.stat-val'),
+ // Recent member join dates in admin dashboard
+ page.locator('.item-date'),
+ // Member avatars (ghost images may not load deterministically)
+ page.locator('.mc-avatar'),
+ page.locator('.cc-avatar'),
+ page.locator('.profile-avatar'),
+ // Member count text in members page filter bar
+ page.locator('.filter-count'),
+ // Connections page: filter bar and suggestions vary based on tag/topic
+ // state and async fetch ordering. Mask them to keep the structural
+ // (PageShell + page-level) regression coverage stable.
+ page.locator('.filter-bar'),
+ page.locator('.skills-bar'),
+ page.locator('.connections-section'),
+ page.locator('.loading-state'),
+ ]
+}
+
+// All visual tests run serially in a single top-level describe block.
+//
+// Auth is handled with a beforeAll that saves the cookie to disk once. All
+// authenticated sub-describes load from that saved state, avoiding repeated
+// /api/dev/test-login calls that exhaust the dev server's MongoDB connections.
+test.describe('visual regression', () => {
+ test.describe.configure({ mode: 'serial' })
+
+ // Log in once before all tests and save the auth cookie.
+ // serial mode guarantees this runs before any test in this describe tree.
+ test.beforeAll(async ({ browser }) => {
+ fs.mkdirSync(path.dirname(authStatePath), { recursive: true })
+ const page = await browser.newPage()
+ await loginAsAdmin(page)
+ await page.context().storageState({ path: authStatePath })
+ await page.close()
+ })
+
+ // ── Public pages (desktop + mobile) ──────────────────────────────────────
+ test.describe('public pages', () => {
+ for (const { name, path } of publicPages) {
+ for (const [viewportName, viewport] of Object.entries(viewports)) {
+ test(`${name} — ${viewportName}`, async ({ page }) => {
+ await page.setViewportSize(viewport)
+ await page.goto(path)
+ await waitForStable(page)
+
+ await expect(page).toHaveScreenshot(`${name}-${viewportName}.png`, {
+ maxDiffPixelRatio: 0.01,
+ mask: commonMasks(page),
+ })
+ })
+ }
+ }
+ })
+
+ // ── Authenticated pages (desktop) ─────────────────────────────────────────
+ // Loads saved auth cookie — no repeated /api/dev/test-login calls.
+ test.describe('authenticated pages', () => {
+ test.use({ storageState: authStatePath })
+
+ for (const { name, path } of authenticatedPages) {
+ test(`${name} — desktop`, async ({ page }) => {
+ await page.setViewportSize(viewports.desktop)
+ await page.goto(path)
+ await waitForStable(page)
+
+ await expect(page).toHaveScreenshot(`${name}-desktop.png`, {
+ maxDiffPixelRatio: 0.01,
+ mask: commonMasks(page),
+ })
+ })
+ }
+
+ // members-detail: navigate to the test admin's own profile page.
+ // The test admin is created by /api/dev/test-login (email: test-admin@ghostguild.dev,
+ // status: active). We fetch their _id from /api/auth/member using the saved cookie.
+ // Even if showInDirectory is false, the page renders a stable error or profile shell.
+ test('members-detail — desktop', async ({ page }) => {
+ await page.setViewportSize(viewports.desktop)
+ const response = await page.request.get('/api/auth/member')
+ // /api/auth/member returns the member object directly (not nested under a 'member' key)
+ const authData = response.ok() ? await response.json() : null
+ const memberId = authData?._id || authData?.id
+ if (!memberId) {
+ // Skip gracefully if we can't retrieve the member ID
+ test.skip(true, 'Could not retrieve test admin member ID from /api/auth/member')
+ return
+ }
+ await page.goto(`/members/${memberId}`)
+ await waitForStable(page)
+ await expect(page).toHaveScreenshot('members-detail-desktop.png', {
+ maxDiffPixelRatio: 0.01,
+ mask: commonMasks(page),
+ })
+ })
+ })
+
+ // ── Authenticated pages (mobile — column-collapse coverage) ───────────────
+ // Loads saved auth cookie — no repeated /api/dev/test-login calls.
+ test.describe('authenticated pages (mobile)', () => {
+ test.use({ storageState: authStatePath })
+
+ for (const { name, path } of authenticatedMobilePages) {
+ test(`${name} — mobile`, async ({ page }) => {
+ await page.setViewportSize(viewports.mobile)
+ await page.goto(path)
+ await waitForStable(page)
+
+ await expect(page).toHaveScreenshot(`${name}-mobile-auth.png`, {
+ maxDiffPixelRatio: 0.01,
+ mask: commonMasks(page),
+ })
+ })
+ }
+ })
+})
diff --git a/e2e/wave-slack-onboarding.spec.js b/e2e/wave-slack-onboarding.spec.js
deleted file mode 100644
index e68a3b3..0000000
--- a/e2e/wave-slack-onboarding.spec.js
+++ /dev/null
@@ -1,222 +0,0 @@
-// Spec: docs/specs/wave-based-slack-onboarding.md
-// Test plan: docs/specs/wave-based-slack-onboarding-tests.md §6 + §7
-
-import { test, expect } from './helpers/fixtures.js'
-import { loginAsMember } from './helpers/auth.js'
-
-const SLACK_NOTE_RE = /Slack workspace access is part of your membership/i
-
-test.describe('Member dashboard — Slack-coming note (§7)', () => {
- test('shows note for active member without Slack (7.1)', async ({ browser }) => {
- const context = await browser.newContext()
- const page = await context.newPage()
- await loginAsMember(page, 'riley.johnson@cooperativedev.org')
- await page.goto('/member/dashboard')
- await expect(page.getByRole('heading', { name: /Welcome.*Riley/i })).toBeVisible({ timeout: 15000 })
- await expect(page.getByText(SLACK_NOTE_RE)).toBeVisible()
- await context.close()
- })
-
- test.skip('hides note once slackInvited:true (7.2)', async () => {
- // BUG: /api/auth/member does not return slackInvited, so memberData.slackInvited
- // is always undefined on the client. The dashboard condition
- // (status==="active" && !slackInvited) currently shows the note for ALL
- // active members regardless of slackInvited. Fix the API to expose the
- // field before unskipping.
- })
-
- test('hides note for pending_payment member (7.3)', async ({ browser }) => {
- const context = await browser.newContext()
- const page = await context.newPage()
- await loginAsMember(page, 'pending-payment-test@example.test')
- await page.goto('/member/dashboard')
- await expect(page.getByRole('heading', { name: /Welcome.*Pending Payment Tester/i })).toBeVisible({ timeout: 15000 })
- await expect(page.getByText(SLACK_NOTE_RE)).toHaveCount(0)
- await context.close()
- })
-
- test.skip('hides note for suspended/cancelled/guest (7.4)', async () => {
- // No suspended/cancelled/guest members exist in the dev DB and there is
- // no dev endpoint to seed members with arbitrary status. Implementing
- // this would require a new server-side helper (out of scope).
- })
-
- test.skip('copy contains no wave/cohort/batch language (7.5)', async () => {
- // The shipped UI uses the phrase "monthly onboarding waves" — this test's
- // \bwave\b assertion contradicts the current copy. Resolve the spec/UI
- // divergence before unskipping.
- })
-
- test('renders as plain text — no banner / modal / callout styling (7.6)', async ({ browser }) => {
- const context = await browser.newContext()
- const page = await context.newPage()
- await loginAsMember(page, 'riley.johnson@cooperativedev.org')
- await page.goto('/member/dashboard')
- await expect(page.getByRole('heading', { name: /Welcome.*Riley/i })).toBeVisible({ timeout: 15000 })
- const note = page.getByText(SLACK_NOTE_RE)
- await expect(note).toBeVisible()
- const tag = await note.evaluate((el) => el.tagName.toLowerCase())
- expect(tag).toBe('p')
- const inDialog = await note.evaluate((el) => !!el.closest('[role="dialog"]'))
- expect(inDialog).toBe(false)
- const inAlert = await note.evaluate((el) => !!el.closest('[role="alert"], .alert'))
- expect(inAlert).toBe(false)
- await context.close()
- })
-
- test('SSR renders without auth — note absent (7.7)', async ({ browser }) => {
- const context = await browser.newContext()
- const page = await context.newPage()
- const response = await page.goto('/member/dashboard')
- const ssrHtml = await response.text()
- expect(ssrHtml).not.toMatch(SLACK_NOTE_RE)
- await context.close()
- })
-
- test.skip('copy matches approved wording (7.8)', async () => {
- // Awaiting resolution of the Open Question on the final approved string.
- })
-})
-
-test.describe('Admin members — Slack-invited control (§6)', () => {
- test('shows "Mark as Slack invited" for slackInvited:false (6.1)', async ({ adminPage }) => {
- await adminPage.goto('/admin/members')
- await expect(adminPage.getByRole('heading', { name: 'Members' })).toBeVisible()
- await expect(
- adminPage.getByRole('button', { name: /Mark as Slack invited/i }).first()
- ).toBeVisible()
- })
-
- test.skip('replaces button with "Invited " once flipped (6.2)', async () => {
- // BUG: in admin/members/index.vue, markSlackInvited does
- // Object.assign(member, res.member) on a plain object inside the
- // useFetch array — Vue does not pick up the per-item mutation, so the
- // row UI does not refresh until the page reloads. The same control on
- // the detail page (which reassigns member.value) does work — see 6.6.
- })
-
- test('click triggers single PATCH and updates row in place (6.4)', async ({ adminPage }) => {
- // Re-prime the auth cookie. The shared test-admin account's tokenVersion
- // is bumped whenever auth.spec.js's logout test runs in parallel, which
- // would otherwise surface mid-flow as a silent 401 on the create POST.
- const loginRes = await adminPage.context().request.get('/api/dev/test-login', { maxRedirects: 0 })
- if (loginRes.status() !== 302) {
- throw new Error(`Failed to refresh admin session: ${loginRes.status()}`)
- }
-
- // Create a dedicated test member so the row we operate on is uniquely
- // identifiable by email and can't be displaced by parallel test mutations.
- // We use the admin UI flow (vs API) because the POST endpoint is
- // CSRF-protected and the modal is the documented happy path.
- const stamp = Date.now()
- const memberEmail = `e2e-slack-6-4-${stamp}@example.test`
- const memberName = `E2E Slack 6.4 ${stamp}`
-
- await adminPage.goto('/admin/members')
- await expect(adminPage.getByRole('heading', { name: 'Members' })).toBeVisible()
- await adminPage.waitForLoadState('networkidle')
- await adminPage.getByRole('button', { name: 'Add Member' }).click()
- await adminPage.getByPlaceholder('Full name').fill(memberName)
- await adminPage.getByPlaceholder('email@example.com').fill(memberEmail)
- await adminPage.getByRole('button', { name: 'Create Member' }).click()
- // Modal closes after successful create
- await expect(adminPage.getByPlaceholder('Full name')).toHaveCount(0, { timeout: 10000 })
-
- const patchRequests = []
- await adminPage.route('**/api/admin/members/*/slack-status', async (route) => {
- const req = route.request()
- patchRequests.push({ method: req.method(), url: req.url() })
- await route.fulfill({
- status: 200,
- contentType: 'application/json',
- body: JSON.stringify({
- success: true,
- member: {
- slackInvited: true,
- slackInvitedAt: new Date().toISOString(),
- },
- }),
- })
- })
- await adminPage.goto('/admin/members')
- await expect(adminPage.getByRole('heading', { name: 'Members' })).toBeVisible()
- // Wait for hydration so v-model bindings on the search input are wired up
- // and the click on the row's button reaches the Vue handler.
- await adminPage.waitForLoadState('networkidle')
-
- // Filter the list down to our specific member so the row anchor is unambiguous.
- const searchInput = adminPage.getByPlaceholder('Search members...')
- await expect(searchInput).toBeVisible({ timeout: 10000 })
- await searchInput.fill(memberEmail)
-
- const targetRow = adminPage.locator('tbody tr', { hasText: memberEmail })
- await expect(targetRow).toBeVisible({ timeout: 10000 })
- // Wait until the table has filtered down to only our row — confirms the
- // search v-model has been processed.
- await expect(adminPage.locator('tbody tr')).toHaveCount(1, { timeout: 10000 })
- await targetRow.getByRole('button', { name: /Mark as Slack invited/i }).click()
- await expect.poll(() => patchRequests.length, { timeout: 5000 }).toBe(1)
-
- expect(patchRequests[0].method).toBe('PATCH')
- expect(patchRequests[0].url).toMatch(/\/api\/admin\/members\/[^/]+\/slack-status$/)
-
- await adminPage.waitForTimeout(500)
- expect(patchRequests).toHaveLength(1)
- })
-
- test('status labels read "Not yet invited" / "Invited" — not "Pending" (6.5)', async ({ adminPage }) => {
- await adminPage.goto('/admin/members')
- await expect(adminPage.getByRole('heading', { name: 'Members' })).toBeVisible()
- await expect(adminPage.getByText('Not yet invited').first()).toBeVisible()
- const html = await adminPage.content()
- expect(html).not.toMatch(/Slack:\s*Pending/i)
- })
-
- test('member detail page mirrors list controls (6.6)', async ({ adminPage }) => {
- await adminPage.goto('/admin/members')
- await expect(adminPage.getByRole('heading', { name: 'Members' })).toBeVisible()
- const row = adminPage.locator('tr', {
- has: adminPage.getByRole('button', { name: /Mark as Slack invited/i }),
- }).first()
- const href = await row.locator('a.member-name-link').getAttribute('href')
- expect(href).toMatch(/\/admin\/members\/[a-f0-9]+/)
-
- await adminPage.goto(href)
- await expect(adminPage.getByText('Slack invite', { exact: true })).toBeVisible()
- await expect(adminPage.getByText('Not yet invited').first()).toBeVisible()
- await expect(adminPage.getByRole('button', { name: /Mark as Slack invited/i })).toBeVisible()
- })
-
- test.skip('no UI references slackInviteStatus (6.7)', async () => {
- // The deprecated slackInviteStatus field still lives on Member documents
- // and is serialized into the /api/admin/members payload (visible in the
- // SSR Nuxt state). The admin UI itself does not reference the field, but
- // a content() check against the rendered HTML matches the JSON payload.
- // Cleaning up the DB field is out of scope for this test pass.
- })
-
- test('UI rolls back on PATCH error — no false "Invited" badge (6.8)', async ({ adminPage }) => {
- await adminPage.route('**/api/admin/members/*/slack-status', async (route) => {
- await route.fulfill({
- status: 500,
- contentType: 'application/json',
- body: JSON.stringify({ statusMessage: 'Server error' }),
- })
- })
- await adminPage.goto('/admin/members')
- await expect(adminPage.getByRole('heading', { name: 'Members' })).toBeVisible()
-
- const row = adminPage.locator('tr', {
- has: adminPage.getByRole('button', { name: /Mark as Slack invited/i }),
- }).first()
- await row.getByRole('button', { name: /Mark as Slack invited/i }).click()
-
- await expect(row.getByText('Not yet invited')).toBeVisible()
- await expect(row.getByText(/^Invited\s+\d/)).toHaveCount(0)
- await expect(row.getByRole('button', { name: /Mark as Slack invited/i })).toBeVisible()
- })
-
- test.skip('proposed: sortable on slackInvitedAt + filter "no Slack yet" (6.9)', async () => {
- // Dependent on Open Question — wire up if implemented.
- })
-})
diff --git a/nuxt.config.ts b/nuxt.config.ts
index ab9ad7d..d04c3f7 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -7,9 +7,6 @@ export default defineNuxtConfig({
providers: {
google: false,
fontsource: false,
- bunny: false,
- adobe: false,
- googleicons: false,
},
},
colorMode: {
@@ -94,10 +91,11 @@ export default defineNuxtConfig({
},
runtimeConfig: {
// Private keys (server-side only)
- mongodbUri: process.env.MONGODB_URI || "",
+ mongodbUri:
+ process.env.MONGODB_URI || "mongodb://localhost:27017/ghostguild",
jwtSecret: process.env.JWT_SECRET || "",
resendApiKey: process.env.RESEND_API_KEY || "",
- helcimApiToken: process.env.HELCIM_API_TOKEN || "",
+ helcimApiToken: process.env.HELCIM_API_TOKEN || "", // also exposed to client via public.helcimToken
slackBotToken: process.env.SLACK_BOT_TOKEN || "",
slackAdminBotToken: process.env.SLACK_ADMIN_BOT_TOKEN || "",
slackSigningSecret: process.env.SLACK_SIGNING_SECRET || "",
@@ -108,10 +106,10 @@ export default defineNuxtConfig({
outlineApiKey: process.env.OUTLINE_API_KEY || "",
helcimMonthlyPlanId: process.env.NUXT_HELCIM_MONTHLY_PLAN_ID || "",
helcimAnnualPlanId: process.env.NUXT_HELCIM_ANNUAL_PLAN_ID || "",
- reconcileToken: process.env.NUXT_RECONCILE_TOKEN || "",
// Public keys (available on client-side)
public: {
+ helcimToken: process.env.HELCIM_API_TOKEN || "",
helcimAccountId: process.env.NUXT_PUBLIC_HELCIM_ACCOUNT_ID || "",
cloudinaryCloudName:
process.env.NUXT_PUBLIC_CLOUDINARY_CLOUD_NAME || "divzuumlr",
diff --git a/playwright.config.js b/playwright.config.js
index 70569f9..9cc1897 100644
--- a/playwright.config.js
+++ b/playwright.config.js
@@ -6,10 +6,11 @@ const BASE_URL = `http://localhost:${PORT}`;
export default defineConfig({
testDir: "./e2e",
outputDir: "e2e/test-results",
- fullyParallel: false,
+ snapshotDir: "e2e/__screenshots__",
+ fullyParallel: true,
forbidOnly: !!process.env.CI,
- retries: process.env.CI ? 1 : 1,
- workers: process.env.CI ? 1 : 4,
+ retries: process.env.CI ? 1 : 0,
+ workers: process.env.CI ? 1 : undefined,
reporter: "html",
timeout: 60000,
use: {
@@ -26,7 +27,7 @@ export default defineConfig({
webServer: {
command: `PORT=${PORT} npm run build && PORT=${PORT} NODE_ENV=development npm run preview`,
url: BASE_URL,
- reuseExistingServer: true,
+ reuseExistingServer: !process.env.CI,
env: {
NUXT_PUBLIC_COMING_SOON: "false",
NODE_ENV: "development",
diff --git a/scripts/seed-members.js b/scripts/seed-members.js
index 3611f12..52f87a9 100644
--- a/scripts/seed-members.js
+++ b/scripts/seed-members.js
@@ -274,18 +274,6 @@ const sampleMembers = [
createdAt: new Date('2025-06-01'),
lastLogin: new Date('2026-04-04'),
},
- {
- email: 'pending-payment-test@example.test',
- name: 'Pending Payment Tester',
- circle: 'community',
- contributionAmount: 5,
- status: 'pending_payment',
- slackInvited: false,
- craftTags: [],
- board: {},
- createdAt: new Date('2026-04-25'),
- lastLogin: new Date('2026-04-29'),
- },
]
const TEST_ADMIN_BOARD = {
diff --git a/scripts/seed-pre-registrants.js b/scripts/seed-pre-registrants.js
deleted file mode 100644
index b24872d..0000000
--- a/scripts/seed-pre-registrants.js
+++ /dev/null
@@ -1,72 +0,0 @@
-import mongoose from 'mongoose'
-import PreRegistration from '../server/models/preRegistration.js'
-import { connectDB } from '../server/utils/mongoose.js'
-import dotenv from 'dotenv'
-
-dotenv.config()
-
-// 30 mock pre-registrants with realistic game dev / co-op roles and cities
-const samplePreRegistrants = [
- { email: 'lina.okoro@gmail.com', name: 'Lina Okoro', city: 'Lagos, Nigeria', role: 'Game designer', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-11-02') },
- { email: 'marco.bianchi@proton.me', name: 'Marco Bianchi', city: 'Milan, Italy', role: 'Narrative designer', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-11-05') },
- { email: 'priya.nair@outlook.com', name: 'Priya Nair', city: 'Bangalore, India', role: 'Unity developer', status: 'pending', newsletterOptIn: false, createdAt: new Date('2025-11-08') },
- { email: 'elke.hoffmann@posteo.de', name: 'Elke Hoffmann', city: 'Berlin, Germany', role: 'Producer', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-11-12') },
- { email: 'tomoko.sato@icloud.com', name: 'Tomoko Sato', city: 'Tokyo, Japan', role: 'Pixel artist', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-11-15') },
- { email: 'jamie.callahan@fastmail.com', name: 'Jamie Callahan', city: 'Vancouver, BC', role: 'Co-op founder', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-11-18') },
- { email: 'yusuf.demir@gmail.com', name: 'Yusuf Demir', city: 'Istanbul, Turkey', role: 'Sound designer', status: 'pending', newsletterOptIn: false, createdAt: new Date('2025-11-20') },
- { email: 'saoirse.murphy@proton.me', name: 'Saoirse Murphy', city: 'Dublin, Ireland', role: 'QA lead', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-11-22') },
- { email: 'ren.watanabe@gmail.com', name: 'Ren Watanabe', city: 'Osaka, Japan', role: 'Godot developer', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-11-25') },
- { email: 'astrid.lindgren@tuta.io', name: 'Astrid Lindgren', city: 'Stockholm, Sweden', role: '3D artist', status: 'pending', newsletterOptIn: false, createdAt: new Date('2025-12-01') },
- { email: 'carlos.reyes@gmail.com', name: 'Carlos Reyes', city: 'Mexico City, Mexico', role: 'Programmer', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-12-04') },
- { email: 'noor.hassan@outlook.com', name: 'Noor Hassan', city: 'Amman, Jordan', role: 'UX researcher', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-12-07') },
- { email: 'freya.johansson@pm.me', name: 'Freya Johansson', city: 'Copenhagen, Denmark', role: 'Studio co-founder', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-12-10') },
- { email: 'kwame.asante@gmail.com', name: 'Kwame Asante', city: 'Accra, Ghana', role: 'Game developer', status: 'pending', newsletterOptIn: false, createdAt: new Date('2025-12-13') },
- { email: 'mila.petrov@proton.me', name: 'Mila Petrov', city: 'Belgrade, Serbia', role: 'Animator', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-12-16') },
- { email: 'odin.haugen@fastmail.com', name: 'Odin Haugen', city: 'Oslo, Norway', role: 'Cooperative advisor', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-12-19') },
- { email: 'chen.wei@icloud.com', name: 'Chen Wei', city: 'Taipei, Taiwan', role: 'Indie developer', status: 'pending', newsletterOptIn: true, createdAt: new Date('2025-12-22') },
- { email: 'lucia.romano@gmail.com', name: 'Lucia Romano', city: 'Buenos Aires, Argentina', role: 'Level designer', status: 'pending', newsletterOptIn: false, createdAt: new Date('2025-12-28') },
- { email: 'imani.williams@proton.me', name: 'Imani Williams', city: 'Toronto, ON', role: 'Community manager', status: 'pending', newsletterOptIn: true, createdAt: new Date('2026-01-03') },
- { email: 'felix.dubois@pm.me', name: 'Felix Dubois', city: 'Montreal, QC', role: 'Technical artist', status: 'pending', newsletterOptIn: true, createdAt: new Date('2026-01-06') },
- { email: 'anika.schuster@posteo.de', name: 'Anika Schuster', city: 'Vienna, Austria', role: 'Writer', status: 'pending', newsletterOptIn: true, createdAt: new Date('2026-01-10') },
- { email: 'rohan.kapoor@gmail.com', name: 'Rohan Kapoor', city: 'Mumbai, India', role: 'Studio founder', status: 'pending', newsletterOptIn: false, createdAt: new Date('2026-01-14') },
- { email: 'emeka.obi@outlook.com', name: 'Emeka Obi', city: 'Nairobi, Kenya', role: 'Mobile game dev', status: 'pending', newsletterOptIn: true, createdAt: new Date('2026-01-18') },
- { email: 'sofie.bakker@tuta.io', name: 'Sofie Bakker', city: 'Amsterdam, Netherlands', role: 'Cooperative organizer', status: 'pending', newsletterOptIn: true, createdAt: new Date('2026-01-22') },
- { email: 'mateo.silva@gmail.com', name: 'Mateo Silva', city: 'Bogota, Colombia', role: 'Concept artist', status: 'pending', newsletterOptIn: true, createdAt: new Date('2026-01-26') },
- { email: 'hana.kim@proton.me', name: 'Hana Kim', city: 'Seoul, South Korea', role: 'Unreal developer', status: 'pending', newsletterOptIn: false, createdAt: new Date('2026-02-01') },
- { email: 'zara.thompson@fastmail.com', name: 'Zara Thompson', city: 'London, UK', role: 'Producer', status: 'pending', newsletterOptIn: true, createdAt: new Date('2026-02-05') },
- { email: 'leo.moreau@pm.me', name: 'Leo Moreau', city: 'Lyon, France', role: 'Gameplay programmer', status: 'pending', newsletterOptIn: true, createdAt: new Date('2026-02-10') },
- { email: 'cleo.nguyen@gmail.com', name: 'Cleo Nguyen', city: 'Ho Chi Minh City, Vietnam', role: 'Environment artist', status: 'pending', newsletterOptIn: true, createdAt: new Date('2026-02-15') },
- { email: 'kai.eriksson@icloud.com', name: 'Kai Eriksson', city: 'Helsinki, Finland', role: 'Cooperative consultant', status: 'pending', newsletterOptIn: false, createdAt: new Date('2026-02-20') },
-]
-
-async function seedPreRegistrants() {
- try {
- await connectDB()
-
- await PreRegistration.deleteMany({})
- console.log('Cleared existing pre-registrants')
-
- await PreRegistration.insertMany(samplePreRegistrants)
- console.log(`Added ${samplePreRegistrants.length} sample pre-registrants`)
-
- const count = await PreRegistration.countDocuments()
- console.log(`Total pre-registrants in database: ${count}`)
-
- const statusBreakdown = await PreRegistration.aggregate([
- { $group: { _id: '$status', count: { $sum: 1 } } },
- { $sort: { _id: 1 } }
- ])
-
- console.log('\nBreakdown by status:')
- statusBreakdown.forEach(s => {
- console.log(` ${s._id}: ${s.count}`)
- })
-
- process.exit(0)
- } catch (error) {
- console.error('Error seeding pre-registrants:', error)
- process.exit(1)
- }
-}
-
-seedPreRegistrants()
diff --git a/server/api/admin/board-channels.post.js b/server/api/admin/board-channels.post.js
index bc4a9f8..eea3efd 100644
--- a/server/api/admin/board-channels.post.js
+++ b/server/api/admin/board-channels.post.js
@@ -24,29 +24,22 @@ export default defineEventHandler(async (event) => {
let channelName = body.name
if (!slackChannelId) {
- if (process.env.ALLOW_DEV_TEST_ENDPOINTS === 'true') {
- // Match the Slack channel ID format (^[A-Z0-9]+$) so the value
- // round-trips through boardChannelUpdateSchema on subsequent edits.
- slackChannelId = `CDEV${Date.now().toString(36).toUpperCase()}`
- console.log('[slack] DEV MODE — skipping createChannel', { name: body.name, slackChannelId })
- } else {
- const slack = getSlackAdminService()
- if (!slack) {
- throw createError({
- statusCode: 500,
- statusMessage: 'Slack integration not configured',
- })
- }
- try {
- const created = await slack.createChannel(body.name)
- slackChannelId = created.id
- channelName = created.name
- } catch (err) {
- throw createError({
- statusCode: 502,
- statusMessage: `Failed to create Slack channel: ${err.data?.error || err.message}`,
- })
- }
+ const slack = getSlackAdminService()
+ if (!slack) {
+ throw createError({
+ statusCode: 500,
+ statusMessage: 'Slack integration not configured',
+ })
+ }
+ try {
+ const created = await slack.createChannel(body.name)
+ slackChannelId = created.id
+ channelName = created.name
+ } catch (err) {
+ throw createError({
+ statusCode: 502,
+ statusMessage: `Failed to create Slack channel: ${err.data?.error || err.message}`,
+ })
}
}
diff --git a/server/api/admin/members.get.js b/server/api/admin/members.get.js
index 5118bb9..3ababb7 100644
--- a/server/api/admin/members.get.js
+++ b/server/api/admin/members.get.js
@@ -7,9 +7,7 @@ export default defineEventHandler(async (event) => {
await requireAdmin(event)
await connectDB()
- const projection = Object.keys(Member.schema.paths).join(' ')
const members = await Member.find()
- .select(projection)
.sort({ createdAt: -1 })
.lean()
diff --git a/server/api/admin/members/[id].get.js b/server/api/admin/members/[id].get.js
index 3c63157..12fd54d 100644
--- a/server/api/admin/members/[id].get.js
+++ b/server/api/admin/members/[id].get.js
@@ -8,8 +8,7 @@ export default defineEventHandler(async (event) => {
await connectDB()
- const projection = Object.keys(Member.schema.paths).join(' ')
- const member = await Member.findById(memberId).select(projection).lean()
+ const member = await Member.findById(memberId).lean()
if (!member) {
throw createError({ statusCode: 404, statusMessage: 'Member not found' })
}
diff --git a/server/api/admin/members/[id]/slack-status.patch.js b/server/api/admin/members/[id]/slack-status.patch.js
deleted file mode 100644
index 6c2ca6c..0000000
--- a/server/api/admin/members/[id]/slack-status.patch.js
+++ /dev/null
@@ -1,35 +0,0 @@
-import Member from '../../../../models/member.js'
-import { connectDB } from '../../../../utils/mongoose.js'
-import { validateBody } from '../../../../utils/validateBody.js'
-import { adminSlackStatusSchema } from '../../../../utils/schemas.js'
-
-export default defineEventHandler(async (event) => {
- const admin = await requireAdmin(event)
- await validateBody(event, adminSlackStatusSchema)
- await connectDB()
-
- const memberId = getRouterParam(event, 'id')
-
- const existing = await Member.findById(memberId)
- if (!existing) {
- throw createError({
- statusCode: 404,
- statusMessage: 'Member not found.'
- })
- }
-
- // Idempotent: if already invited, no-op (preserve original slackInvitedAt, no log).
- if (existing.slackInvited === true) {
- return { success: true, member: existing }
- }
-
- const member = await Member.findByIdAndUpdate(
- memberId,
- { slackInvited: true, slackInvitedAt: new Date() },
- { new: true, runValidators: false }
- )
-
- logActivity(memberId, 'slack_invited_manually', {}, { performedBy: admin._id })
-
- return { success: true, member }
-})
diff --git a/server/api/admin/members/invite.post.js b/server/api/admin/members/invite.post.js
index 710f4e1..ebd866c 100644
--- a/server/api/admin/members/invite.post.js
+++ b/server/api/admin/members/invite.post.js
@@ -4,7 +4,7 @@ import { Resend } from 'resend'
import Member from '../../../models/member.js'
import { connectDB } from '../../../utils/mongoose.js'
-const resend = new Resend(useRuntimeConfig().resendApiKey)
+const resend = new Resend(process.env.RESEND_API_KEY)
export default defineEventHandler(async (event) => {
await requireAdmin(event)
diff --git a/server/api/admin/pre-registrants/invite.post.js b/server/api/admin/pre-registrants/invite.post.js
index 9256499..3d16b88 100644
--- a/server/api/admin/pre-registrants/invite.post.js
+++ b/server/api/admin/pre-registrants/invite.post.js
@@ -4,7 +4,7 @@ import { Resend } from 'resend'
import PreRegistration from '../../../models/preRegistration.js'
import { connectDB } from '../../../utils/mongoose.js'
-const resend = new Resend(useRuntimeConfig().resendApiKey)
+const resend = new Resend(process.env.RESEND_API_KEY)
export default defineEventHandler(async (event) => {
await requireAdmin(event)
@@ -63,23 +63,17 @@ export default defineEventHandler(async (event) => {
.replace(/\n/g, '',
+ to: [preReg.email],
+ subject: "You're invited to Ghost Guild! 👻",
+ text: emailText,
+ html: emailHtml,
+ })
- if (process.env.ALLOW_DEV_TEST_ENDPOINTS === 'true') {
- console.log('[resend] DEV MODE — skipping invite send', { to: preReg.email, subject })
- } else {
- const { error: emailError } = await resend.emails.send({
- from: 'Ghost Guild ',
- to: [preReg.email],
- subject,
- text: emailText,
- html: emailHtml,
- })
-
- if (emailError) {
- results.push({ preRegistrantId: preReg._id, email: preReg.email, success: false, error: emailError.message })
- continue
- }
+ if (emailError) {
+ results.push({ preRegistrantId: preReg._id, email: preReg.email, success: false, error: emailError.message })
+ continue
}
await PreRegistration.findByIdAndUpdate(preReg._id, {
diff --git a/server/api/auth/login.post.js b/server/api/auth/login.post.js
index 2ca99c6..d710d28 100644
--- a/server/api/auth/login.post.js
+++ b/server/api/auth/login.post.js
@@ -1,32 +1,74 @@
// server/api/auth/login.post.js
-import { getRequestIP } from "h3";
+import jwt from "jsonwebtoken";
+import { randomUUID } from "crypto";
+import { Resend } from "resend";
+import Member from "../../models/member.js";
import { connectDB } from "../../utils/mongoose.js";
import { validateBody } from "../../utils/validateBody.js";
import { emailSchema } from "../../utils/schemas.js";
-import { sendMagicLink } from "../../utils/magicLink.js";
-import { rateLimit } from "../../utils/rateLimit.js";
+
+const resend = new Resend(process.env.RESEND_API_KEY);
export default defineEventHandler(async (event) => {
- const ip = getRequestIP(event, { xForwardedFor: true }) || "unknown";
- if (!rateLimit(`auth:login:ip:${ip}`, { max: 5, windowMs: 3600_000 })) {
- throw createError({ statusCode: 429, statusMessage: "Too many login attempts" });
- }
-
await connectDB();
- const body = await validateBody(event, emailSchema);
-
- if (!rateLimit(`auth:login:email:${body.email}`, { max: 3, windowMs: 3600_000 })) {
+ const baseUrl = process.env.BASE_URL;
+ if (!baseUrl) {
throw createError({
- statusCode: 429,
- statusMessage: "Too many login attempts for this email",
+ statusCode: 500,
+ statusMessage: "BASE_URL environment variable is not set",
});
}
+ const { email } = await validateBody(event, emailSchema);
+
const GENERIC_MESSAGE = "If this email is registered, we've sent a login link.";
+ const member = await Member.findOne({ email });
+
+ if (!member) {
+ return {
+ success: true,
+ message: GENERIC_MESSAGE,
+ };
+ }
+
+ const config = useRuntimeConfig(event);
+ const jti = randomUUID();
+
+ const token = jwt.sign(
+ { memberId: member._id, jti },
+ config.jwtSecret,
+ { expiresIn: "15m" },
+ );
+
+ // Store jti so we can burn it on first use
+ await Member.findByIdAndUpdate(
+ member._id,
+ { $set: { magicLinkJti: jti, magicLinkJtiUsed: false } },
+ { runValidators: false }
+ );
+
+ // Token goes in the fragment — never sent to server, never logged
+ const magicLink = `${baseUrl}/verify#${token}`;
+
+ const emailSubject = "Your Ghost Guild login link";
+ const emailBody = `Hi,\n\nSign in to Ghost Guild:\n${magicLink}\n\nThis link expires in 15 minutes. If you didn't request it, ignore this email.`;
+
try {
- await sendMagicLink(body.email);
+ await resend.emails.send({
+ from: "Ghost Guild ",
+ to: email,
+ subject: emailSubject,
+ text: emailBody,
+ });
+
+ logActivity(member._id, 'email_sent', {
+ emailType: 'magic_link',
+ subject: emailSubject,
+ body: emailBody
+ })
+
return {
success: true,
message: GENERIC_MESSAGE,
diff --git a/server/api/auth/member.get.js b/server/api/auth/member.get.js
index 1a4e88b..02316c0 100644
--- a/server/api/auth/member.get.js
+++ b/server/api/auth/member.get.js
@@ -14,11 +14,8 @@ export default defineEventHandler(async (event) => {
contributionAmount: member.contributionAmount,
billingCadence: member.billingCadence,
helcimCustomerId: member.helcimCustomerId,
- helcimCustomerCode: member.helcimCustomerCode,
nextBillingDate: member.nextBillingDate,
membershipLevel: `${member.circle}-${member.contributionAmount}`,
- slackInvited: member.slackInvited,
- slackInvitedAt: member.slackInvitedAt,
// Profile fields
pronouns: member.pronouns,
timeZone: member.timeZone,
diff --git a/server/api/auth/verify.post.js b/server/api/auth/verify.post.js
index 173acb6..3cc4b65 100644
--- a/server/api/auth/verify.post.js
+++ b/server/api/auth/verify.post.js
@@ -1,19 +1,17 @@
// server/api/auth/verify.post.js
-import { getRequestIP } from 'h3'
import jwt from 'jsonwebtoken'
import Member from '../../models/member.js'
-import { validateBody } from '../../utils/validateBody.js'
-import { verifyMagicLinkSchema } from '../../utils/schemas.js'
-import { setAuthCookie } from '../../utils/auth.js'
-import { rateLimit } from '../../utils/rateLimit.js'
export default defineEventHandler(async (event) => {
- const ip = getRequestIP(event, { xForwardedFor: true }) || 'unknown'
- if (!rateLimit(`auth:verify:ip:${ip}`, { max: 5, windowMs: 3600_000 })) {
- throw createError({ statusCode: 429, statusMessage: 'Too many verification attempts' })
- }
+ const body = await readBody(event)
+ const token = body?.token
- const { token } = await validateBody(event, verifyMagicLinkSchema)
+ if (!token) {
+ throw createError({
+ statusCode: 400,
+ statusMessage: 'Token is required',
+ })
+ }
const config = useRuntimeConfig(event)
@@ -65,7 +63,20 @@ export default defineEventHandler(async (event) => {
{ runValidators: false }
)
- setAuthCookie(event, member)
+ // Issue session token with tokenVersion claim for revocation support
+ const sessionToken = jwt.sign(
+ { memberId: member._id, email: member.email, tv: member.tokenVersion },
+ config.jwtSecret,
+ { expiresIn: '7d' },
+ )
+
+ setCookie(event, 'auth-token', sessionToken, {
+ httpOnly: true,
+ secure: process.env.NODE_ENV === 'production',
+ sameSite: 'lax',
+ path: '/',
+ maxAge: 60 * 60 * 24 * 7, // 7 days
+ })
const redirectUrl = member.role === 'admin' ? '/admin' : '/member/dashboard'
return { success: true, redirectUrl }
diff --git a/server/api/events/[id]/cancel-registration.post.js b/server/api/events/[id]/cancel-registration.post.js
index 87a9276..4138f0f 100644
--- a/server/api/events/[id]/cancel-registration.post.js
+++ b/server/api/events/[id]/cancel-registration.post.js
@@ -42,23 +42,6 @@ export default defineEventHandler(async (event) => {
});
}
- const existingRegistration = eventDoc.registrations[registrationIndex];
- const ticketType = existingRegistration.ticketType;
- const amountPaid = existingRegistration.amountPaid || 0;
- // member tickets can be free (default) or paid via circle overrides — gate on amountPaid
- const isPaidRegistration =
- ticketType === "public" ||
- ticketType === "series_pass" ||
- (ticketType === "member" && amountPaid > 0);
-
- if (isPaidRegistration) {
- throw createError({
- statusCode: 403,
- statusMessage:
- "Paid registrations can't be self-cancelled. Email us for a refund — see /policies/refunds.",
- });
- }
-
// Store registration data before removing (convert to plain object)
const registration = {
name: eventDoc.registrations[registrationIndex].name,
diff --git a/server/api/events/[id]/payment.post.js b/server/api/events/[id]/payment.post.js
new file mode 100644
index 0000000..26b0d7f
--- /dev/null
+++ b/server/api/events/[id]/payment.post.js
@@ -0,0 +1,128 @@
+import Event from '../../../models/event.js'
+import Member from '../../../models/member.js'
+import { connectDB } from '../../../utils/mongoose.js'
+import { processHelcimPayment } from '../../../utils/helcim.js'
+import mongoose from 'mongoose'
+
+export default defineEventHandler(async (event) => {
+ try {
+ await connectDB()
+ const identifier = getRouterParam(event, 'id')
+ const body = await validateBody(event, eventPaymentSchema)
+
+ if (!identifier) {
+ throw createError({
+ statusCode: 400,
+ statusMessage: 'Event identifier is required'
+ })
+ }
+
+ // Fetch the event
+ let eventData
+ if (mongoose.Types.ObjectId.isValid(identifier)) {
+ eventData = await Event.findById(identifier)
+ }
+ if (!eventData) {
+ eventData = await Event.findOne({ slug: identifier })
+ }
+
+ if (!eventData) {
+ throw createError({
+ statusCode: 404,
+ statusMessage: 'Event not found'
+ })
+ }
+
+ // Check if event requires payment
+ if (eventData.pricing.isFree || !eventData.pricing.paymentRequired) {
+ throw createError({
+ statusCode: 400,
+ statusMessage: 'This event does not require payment'
+ })
+ }
+
+ // Check if user is already registered
+ const existingRegistration = eventData.registrations.find(
+ reg => reg.email.toLowerCase() === body.email.toLowerCase()
+ )
+
+ if (existingRegistration) {
+ throw createError({
+ statusCode: 400,
+ statusMessage: 'You are already registered for this event'
+ })
+ }
+
+ // Check if user is a member (members get free access)
+ const member = await Member.findOne({ email: body.email.toLowerCase() })
+
+ if (member) {
+ // Members get free access - register directly without payment
+ eventData.registrations.push({
+ name: body.name,
+ email: body.email.toLowerCase(),
+ membershipLevel: `${member.circle}-${member.contributionAmount}`,
+ isMember: true,
+ paymentStatus: 'not_required',
+ amountPaid: 0
+ })
+
+ await eventData.save()
+
+ return {
+ success: true,
+ message: 'Successfully registered as a member (no payment required)',
+ registration: eventData.registrations[eventData.registrations.length - 1]
+ }
+ }
+
+ // Process payment for non-members
+ const paymentResult = await processHelcimPayment({
+ amount: eventData.pricing.publicPrice,
+ paymentToken: body.paymentToken,
+ customerData: {
+ name: body.name,
+ email: body.email
+ }
+ })
+
+ if (!paymentResult.success) {
+ throw createError({
+ statusCode: 400,
+ statusMessage: paymentResult.message || 'Payment failed'
+ })
+ }
+
+ // Add registration with successful payment
+ eventData.registrations.push({
+ name: body.name,
+ email: body.email.toLowerCase(),
+ membershipLevel: 'non-member',
+ isMember: false,
+ paymentStatus: 'completed',
+ paymentId: paymentResult.transactionId,
+ amountPaid: eventData.pricing.publicPrice
+ })
+
+ await eventData.save()
+
+ return {
+ success: true,
+ message: 'Payment successful and registered for event',
+ paymentId: paymentResult.transactionId,
+ registration: eventData.registrations[eventData.registrations.length - 1]
+ }
+
+ } catch (error) {
+ console.error('Error processing event payment:', error)
+
+ if (error.statusCode) {
+ throw error
+ }
+
+ throw createError({
+ statusCode: 500,
+ statusMessage: 'Failed to process payment and registration'
+ })
+ }
+})
\ No newline at end of file
diff --git a/server/api/events/[id]/tickets/available.get.js b/server/api/events/[id]/tickets/available.get.js
index 12d64e2..4107c0a 100644
--- a/server/api/events/[id]/tickets/available.get.js
+++ b/server/api/events/[id]/tickets/available.get.js
@@ -1,12 +1,9 @@
import Member from "../../../../models/member.js";
-import Series from "../../../../models/series.js";
import { loadPublicEvent } from "../../../../utils/loadEvent.js";
import {
calculateTicketPrice,
checkTicketAvailability,
- checkUserSeriesPass,
formatPrice,
- hasMemberAccess,
} from "../../../../utils/tickets.js";
/**
@@ -37,36 +34,6 @@ export default defineEventHandler(async (event) => {
return { available: false, reason: "Registration deadline has passed" };
}
- // Series-pass gate: when an event is linked to a series that requires a
- // pass and doesn't allow drop-ins, surface a structured response so the UI
- // can route to the series page instead of rendering a generic "Sold Out"
- // block. The register/purchase handlers enforce this gate independently.
- if (
- eventData.tickets?.requiresSeriesTicket &&
- eventData.tickets?.seriesTicketReference
- ) {
- const series = await Series.findById(
- eventData.tickets.seriesTicketReference,
- );
- if (series && !series.tickets?.allowIndividualEventTickets) {
- const hasPass = userEmail
- ? checkUserSeriesPass(series, userEmail).hasPass
- : false;
- if (!hasPass) {
- return {
- available: false,
- reason: "series_pass_required",
- requiresSeriesPass: true,
- series: {
- id: series.id,
- title: series.title,
- slug: series.slug,
- },
- };
- }
- }
- }
-
let member = null;
if (userEmail) {
member = await Member.findOne({ email: userEmail.toLowerCase() });
@@ -112,7 +79,7 @@ export default defineEventHandler(async (event) => {
);
}
- if (hasMemberAccess(member) && eventData.tickets?.public?.available) {
+ if (member && eventData.tickets?.public?.available) {
response.publicTicket = {
price: eventData.tickets.public.price,
formattedPrice: formatPrice(
diff --git a/server/api/events/[id]/waitlist.delete.js b/server/api/events/[id]/waitlist.delete.js
index 2bfa90d..9e7c9d2 100644
--- a/server/api/events/[id]/waitlist.delete.js
+++ b/server/api/events/[id]/waitlist.delete.js
@@ -32,8 +32,7 @@ export default defineEventHandler(async (event) => {
}
eventData.tickets.waitlist.entries.splice(waitlistIndex, 1);
- // Skip validators to avoid tripping on legacy location data unrelated to this write.
- await eventData.save({ validateBeforeSave: false });
+ await eventData.save();
return {
success: true,
diff --git a/server/api/events/[id]/waitlist.post.js b/server/api/events/[id]/waitlist.post.js
index f6ddffa..8cfd984 100644
--- a/server/api/events/[id]/waitlist.post.js
+++ b/server/api/events/[id]/waitlist.post.js
@@ -87,8 +87,7 @@ export default defineEventHandler(async (event) => {
notified: false,
});
- // Skip validators to avoid tripping on legacy location data unrelated to this write.
- await eventData.save({ validateBeforeSave: false });
+ await eventData.save();
// Get position in waitlist
const position = eventData.tickets.waitlist.entries.length;
diff --git a/server/api/helcim/customer.post.js b/server/api/helcim/customer.post.js
index 28ceda3..4bbcc80 100644
--- a/server/api/helcim/customer.post.js
+++ b/server/api/helcim/customer.post.js
@@ -1,134 +1,49 @@
-import { getRequestHeader, getRequestIP } from 'h3'
+// Create a Helcim customer
import Member from '../../models/member.js'
import { connectDB } from '../../utils/mongoose.js'
import { createHelcimCustomer } from '../../utils/helcim.js'
-import PreRegistration from '../../models/preRegistration.js'
-import { sendMagicLink } from '../../utils/magicLink.js'
-import { setSignupBridgeCookie } from '../../utils/auth.js'
-import { rateLimit } from '../../utils/rateLimit.js'
export default defineEventHandler(async (event) => {
try {
- const origin = getRequestHeader(event, 'origin')
- const allowed = process.env.BASE_URL
- if (!origin || (allowed && origin !== allowed)) {
- throw createError({ statusCode: 403, statusMessage: 'Invalid origin' })
- }
-
- const ip = getRequestIP(event, { xForwardedFor: true }) || 'unknown'
- if (!rateLimit(`signup:ip:${ip}`, { max: 5, windowMs: 3600_000 })) {
- throw createError({ statusCode: 429, statusMessage: 'Too many signup attempts' })
- }
-
await connectDB()
const body = await validateBody(event, helcimCustomerSchema)
- if (!rateLimit(`signup:email:${body.email}`, { max: 3, windowMs: 3600_000 })) {
- throw createError({
- statusCode: 429,
- statusMessage: 'Too many signup attempts for this email'
- })
- }
-
- // Check if member already exists. Lowercase the lookup so guest docs
- // created via the public ticket-purchase path (which lowercases on insert)
- // are actually found by mixed-case submissions.
- const normalizedEmail = body.email.toLowerCase()
- const existingMember = await Member.findOne({ email: normalizedEmail })
- if (existingMember && existingMember.status !== 'guest') {
+ // Check if member already exists
+ const existingMember = await Member.findOne({ email: body.email })
+ if (existingMember) {
throw createError({
statusCode: 409,
statusMessage: 'A member with this email already exists'
})
}
- // Create customer in Helcim (guest docs have no helcimCustomerId yet).
+ // Create customer in Helcim
const customerData = await createHelcimCustomer({
customerType: 'PERSON',
contactName: body.name,
email: body.email
})
- // If the lookup matched a guest doc, upgrade in place to preserve _id,
- // memberNumber (if any), emailHistory, and the event-registration
- // references that point at this _id. Use findByIdAndUpdate with
- // runValidators:false per the project's member-save-risks pattern.
- let member
- if (existingMember) {
- member = await Member.findByIdAndUpdate(
- existingMember._id,
- {
- $set: {
- name: body.name,
- circle: body.circle,
- contributionAmount: body.contributionAmount,
- helcimCustomerId: customerData.id,
- helcimCustomerCode: customerData.customerCode,
- status: 'pending_payment',
- 'agreement.acceptedAt': new Date()
- }
- },
- { new: true, runValidators: false }
- )
- } else {
- member = await Member.create({
- email: normalizedEmail,
- name: body.name,
- circle: body.circle,
- contributionAmount: body.contributionAmount,
- helcimCustomerId: customerData.id,
- helcimCustomerCode: customerData.customerCode,
- status: 'pending_payment',
- agreement: { acceptedAt: new Date() }
- })
- }
-
- // If this email matches a pending pre-registrant, mark the PreRegistration
- // as accepted and link it to the new Member. Silent — keeps /join and
- // /admin/pre-registrants from showing the same person twice.
- try {
- const preReg = await PreRegistration.findOne({ email: normalizedEmail })
- if (
- preReg &&
- !preReg.memberId &&
- ['pending', 'selected', 'invited'].includes(preReg.status)
- ) {
- await PreRegistration.findByIdAndUpdate(
- preReg._id,
- {
- $set: {
- status: 'accepted',
- acceptedAt: new Date(),
- memberId: member._id,
- },
- },
- { runValidators: false }
- )
- }
- } catch (linkError) {
- console.error('Failed to link PreRegistration to new member:', linkError)
- }
-
- await sendMagicLink(normalizedEmail, {
- subject: 'Verify your Ghost Guild signup',
- intro: 'Verify your email to finish your Ghost Guild signup:',
- member
+ // Create member in database
+ const member = await Member.create({
+ email: body.email,
+ name: body.name,
+ circle: body.circle,
+ contributionAmount: body.contributionAmount,
+ helcimCustomerId: customerData.id,
+ status: 'pending_payment',
+ agreement: { acceptedAt: new Date() }
})
- // Signup completes (paid checkout or free activation) before the magic
- // link is clicked, so issue a short-lived signup-bridge cookie that lets
- // /api/helcim/initialize-payment and /api/helcim/subscription identify
- // the member without a verified auth session.
- setSignupBridgeCookie(event, member)
+ setAuthCookie(event, member)
return {
success: true,
customerId: customerData.id,
customerCode: customerData.customerCode,
- verificationEmailSent: true,
member: {
id: member._id,
- email: normalizedEmail,
+ email: member.email,
name: member.name,
circle: member.circle,
contributionAmount: member.contributionAmount,
diff --git a/server/api/helcim/existing-card.get.js b/server/api/helcim/existing-card.get.js
deleted file mode 100644
index 6ec83a6..0000000
--- a/server/api/helcim/existing-card.get.js
+++ /dev/null
@@ -1,22 +0,0 @@
-// Returns the saved cardToken so callers can skip HelcimPay re-entry.
-import { requireAuth } from '../../utils/auth.js'
-import { listHelcimCustomerCards } from '../../utils/helcim.js'
-
-export default defineEventHandler(async (event) => {
- const member = await requireAuth(event)
-
- if (!member.helcimCustomerId) {
- return { cardToken: null }
- }
-
- const cards = await listHelcimCustomerCards(member.helcimCustomerId)
-
- if (!cards.length) {
- return { cardToken: null }
- }
-
- const defaultCard =
- cards.find((c) => c?.default === true || c?.isDefault === true) || cards[0]
-
- return { cardToken: defaultCard?.cardToken || null }
-})
diff --git a/server/api/helcim/get-or-create-customer.post.js b/server/api/helcim/get-or-create-customer.post.js
index 5a60897..a23ac35 100644
--- a/server/api/helcim/get-or-create-customer.post.js
+++ b/server/api/helcim/get-or-create-customer.post.js
@@ -18,13 +18,6 @@ export default defineEventHandler(async (event) => {
try {
const customer = await getHelcimCustomer(member.helcimCustomerId)
if (customer?.id) {
- if (!member.helcimCustomerCode && customer.customerCode) {
- await Member.findByIdAndUpdate(
- member._id,
- { $set: { helcimCustomerCode: customer.customerCode } },
- { runValidators: false }
- )
- }
return {
success: true,
customerId: customer.id,
@@ -56,13 +49,10 @@ export default defineEventHandler(async (event) => {
}
if (existingCustomer) {
- if (!member.helcimCustomerId || !member.helcimCustomerCode) {
+ if (!member.helcimCustomerId) {
await Member.findByIdAndUpdate(
member._id,
- { $set: {
- helcimCustomerId: existingCustomer.id,
- helcimCustomerCode: existingCustomer.customerCode
- } },
+ { $set: { helcimCustomerId: existingCustomer.id } },
{ runValidators: false }
)
}
@@ -83,10 +73,7 @@ export default defineEventHandler(async (event) => {
await Member.findByIdAndUpdate(
member._id,
- { $set: {
- helcimCustomerId: customerData.id,
- helcimCustomerCode: customerData.customerCode
- } },
+ { $set: { helcimCustomerId: customerData.id } },
{ runValidators: false }
)
diff --git a/server/api/helcim/initialize-payment.post.js b/server/api/helcim/initialize-payment.post.js
index 3826b08..26f9e94 100644
--- a/server/api/helcim/initialize-payment.post.js
+++ b/server/api/helcim/initialize-payment.post.js
@@ -1,73 +1,23 @@
-import Member from '../../models/member.js'
-import { loadPublicEvent } from '../../utils/loadEvent.js'
-import { loadPublicSeries } from '../../utils/loadSeries.js'
-import { calculateTicketPrice, calculateSeriesTicketPrice, hasMemberAccess } from '../../utils/tickets.js'
-import { requireAuth, getOptionalMember, getSignupBridgeMember } from '../../utils/auth.js'
+// Initialize HelcimPay.js session
+import { requireAuth } from '../../utils/auth.js'
import { initializeHelcimPaySession } from '../../utils/helcim.js'
export default defineEventHandler(async (event) => {
try {
const body = await validateBody(event, helcimInitializePaymentSchema)
- const metaType = body.metadata?.type
- const isEventTicket = metaType === PAYMENT_METADATA_TYPES.EVENT_TICKET
- const isSeriesTicket = metaType === PAYMENT_METADATA_TYPES.SERIES_TICKET
- const isTicket = isEventTicket || isSeriesTicket
- const isMembershipSignup = metaType === PAYMENT_METADATA_TYPES.MEMBERSHIP_SIGNUP
-
- if (!isTicket) {
- if (isMembershipSignup) {
- const bridgeMember = await getSignupBridgeMember(event)
- if (!bridgeMember) {
- await requireAuth(event)
- }
- } else {
- await requireAuth(event)
- }
+ // Event ticket purchases can be made without authentication
+ const isEventTicket = body.metadata?.type === 'event_ticket'
+ if (!isEventTicket) {
+ await requireAuth(event)
}
- let amount = 0
- let description = body.metadata?.eventTitle
+ const amount = body.amount || 0
- if (isTicket) {
- // Re-derive price server-side; never trust body.amount for ticket flows.
- const caller = await getOptionalMember(event).catch(() => null)
- const lookupEmail = body.metadata?.email?.toLowerCase()
- const member = caller || (lookupEmail
- ? await Member.findOne({ email: lookupEmail })
- : null)
- const accessMember = hasMemberAccess(member) ? member : null
+ // For event tickets with amount > 0, we do a purchase
+ // For subscriptions or card verification, we do verify
+ const paymentType = isEventTicket && amount > 0 ? 'purchase' : 'verify'
- if (isEventTicket) {
- const eventId = body.metadata?.eventId
- if (!eventId) {
- throw createError({ statusCode: 400, statusMessage: 'metadata.eventId is required for event_ticket' })
- }
- const eventDoc = await loadPublicEvent(event, eventId)
- const ticketInfo = calculateTicketPrice(eventDoc, accessMember)
- if (!ticketInfo) {
- throw createError({ statusCode: 403, statusMessage: 'No tickets available for your membership status' })
- }
- amount = ticketInfo.price
- description = description || eventDoc.title
- } else {
- const seriesId = body.metadata?.seriesId
- if (!seriesId) {
- throw createError({ statusCode: 400, statusMessage: 'metadata.seriesId is required for series_ticket' })
- }
- const series = await loadPublicSeries(event, seriesId)
- const ticketInfo = calculateSeriesTicketPrice(series, accessMember)
- if (!ticketInfo) {
- throw createError({ statusCode: 403, statusMessage: 'No series passes available for your membership status' })
- }
- amount = ticketInfo.price
- description = description || series.title
- }
- } else {
- amount = body.amount || 0
- }
-
- const paymentType = isTicket && amount > 0 ? 'purchase' : 'verify'
const requestBody = {
paymentType,
amount: paymentType === 'purchase' ? amount : 0,
@@ -75,15 +25,20 @@ export default defineEventHandler(async (event) => {
paymentMethod: 'cc'
}
+ // For subscription setup (verify mode), include customer code if provided
+ // For one-time purchases (event tickets), don't include customer code
+ // as the customer may not exist in Helcim yet
if (body.customerCode && paymentType === 'verify') {
requestBody.customerCode = body.customerCode
}
- if (description) {
- requestBody.description = description
- requestBody.notes = description
- const orderId = body.metadata?.eventId || body.metadata?.seriesId
- if (orderId) requestBody.orderNumber = `${orderId}`
+ // Add product/event information for better display in Helcim modal
+ if (body.metadata?.eventTitle) {
+ // Some Helcim accounts don't support invoice numbers in initialization
+ // Try multiple fields that might display in the modal
+ requestBody.description = body.metadata.eventTitle
+ requestBody.notes = body.metadata.eventTitle
+ requestBody.orderNumber = `${body.metadata.eventId}`
}
const paymentData = await initializeHelcimPaySession(requestBody)
@@ -91,9 +46,7 @@ export default defineEventHandler(async (event) => {
return {
success: true,
checkoutToken: paymentData.checkoutToken,
- secretToken: paymentData.secretToken,
- // Echo derived amount so the client can sanity-check before opening modal.
- amount
+ secretToken: paymentData.secretToken
}
} catch (error) {
if (error.statusCode) throw error
diff --git a/server/api/helcim/subscription.post.js b/server/api/helcim/subscription.post.js
index d02846f..8afd7be 100644
--- a/server/api/helcim/subscription.post.js
+++ b/server/api/helcim/subscription.post.js
@@ -3,56 +3,112 @@ import { getHelcimPlanId, requiresPayment } from '../../config/contributions.js'
import Member from '../../models/member.js'
import { connectDB } from '../../utils/mongoose.js'
import { getSlackService } from '../../utils/slack.ts'
-import { requireAuth, getSignupBridgeMember } from '../../utils/auth.js'
+import { requireAuth } from '../../utils/auth.js'
import { createHelcimSubscription, generateIdempotencyKey, listHelcimCustomerTransactions } from '../../utils/helcim.js'
import { sendWelcomeEmail } from '../../utils/resend.js'
import { upsertPaymentFromHelcim } from '../../utils/payments.js'
+// Function to invite member to Slack
+async function inviteToSlack(member) {
+ try {
+ const slackService = getSlackService()
+ if (!slackService) {
+ console.warn('Slack service not configured, skipping invitation')
+ return
+ }
+
+ console.log(`Processing Slack invitation for ${member.email}...`)
+
+ const inviteResult = await slackService.inviteUserToSlack(
+ member.email,
+ member.name
+ )
+
+ if (inviteResult.success) {
+ const update = {}
+ if (inviteResult.status === 'existing_user_added_to_channel' ||
+ inviteResult.status === 'user_already_in_channel' ||
+ inviteResult.status === 'new_user_invited_to_workspace') {
+ update.slackInviteStatus = 'sent'
+ update.slackUserId = inviteResult.userId
+ update.slackInvited = true
+ } else {
+ update.slackInviteStatus = 'pending'
+ update.slackInvited = false
+ }
+ await Member.findByIdAndUpdate(
+ member._id,
+ { $set: update },
+ { runValidators: false }
+ )
+
+ // Send notification to vetting channel
+ await slackService.notifyNewMember(
+ member.name,
+ member.email,
+ member.circle,
+ member.contributionAmount,
+ inviteResult.status
+ )
+
+ console.log(`Successfully processed Slack invitation for ${member.email}: ${inviteResult.status}`)
+ } else {
+ await Member.findByIdAndUpdate(
+ member._id,
+ { $set: { slackInviteStatus: 'failed' } },
+ { runValidators: false }
+ )
+
+ console.error(`Failed to process Slack invitation for ${member.email}: ${inviteResult.error}`)
+ // Don't throw error - subscription creation should still succeed
+ }
+ } catch (error) {
+ console.error('Error during Slack invitation process:', error)
+
+ try {
+ await Member.findByIdAndUpdate(
+ member._id,
+ { $set: { slackInviteStatus: 'failed' } },
+ { runValidators: false }
+ )
+ } catch (saveError) {
+ console.error('Failed to update member Slack status:', saveError)
+ }
+
+ // Don't throw error - subscription creation should still succeed
+ }
+}
+
export default defineEventHandler(async (event) => {
try {
- // Membership signup completes subscription before email verify; allow the
- // signup-bridge cookie set by /api/helcim/customer to satisfy auth here.
- const bridgeMember = await getSignupBridgeMember(event)
- if (!bridgeMember) {
- await requireAuth(event)
- }
+ await requireAuth(event)
await connectDB()
const body = await validateBody(event, helcimSubscriptionSchema)
+ // Only send welcome email when a member transitions from pending_payment
+ // to active for the first time — not on tier upgrades (active → active).
+ const priorMember = await Member.findOne(
+ { helcimCustomerId: body.customerId },
+ { status: 1 }
+ )
+ const isFirstActivation = priorMember?.status === 'pending_payment'
+
// Check if payment is required
if (!requiresPayment(body.contributionAmount)) {
- // For free tier, atomically capture pre-update status alongside the write.
- // Welcome email only fires on pending_payment → active transitions, not
- // on tier upgrades (active → active).
- const preMember = await Member.findOneAndUpdate(
+ // For free tier, just update member status
+ const member = await Member.findOneAndUpdate(
{ helcimCustomerId: body.customerId },
{
status: 'active',
contributionAmount: body.contributionAmount,
subscriptionStartDate: new Date()
},
- { new: false, projection: { status: 1 } }
+ { new: true }
)
- const isFirstActivation = preMember?.status === 'pending_payment'
- const member = await Member.findById(preMember._id)
logActivity(member._id, 'subscription_created', { amount: body.contributionAmount })
- await autoFlagPreExistingSlackAccess(member)
- try {
- const slackService = getSlackService()
- if (slackService) {
- await slackService.notifyNewMember(
- member.name,
- member.email,
- member.circle,
- member.contributionAmount,
- 'manual_invitation_required'
- )
- }
- } catch (err) {
- console.error('[slack] notifyNewMember failed:', err)
- }
+ await inviteToSlack(member)
if (isFirstActivation) await sendWelcomeEmail(member)
return {
@@ -110,13 +166,12 @@ export default defineEventHandler(async (event) => {
throw createError({ statusCode: 500, statusMessage: 'Subscription creation failed' })
}
- const rawNextBilling = subscription.dateBilling || subscription.nextBillingDate || null
- const nextBillingDate = rawNextBilling ? new Date(rawNextBilling) : null
+ const nextBillingDate = subscription.nextBillingDate
+ ? new Date(subscription.nextBillingDate)
+ : null
- // Atomically capture pre-update status alongside the write so we can
- // detect the pending_payment → active transition without a separate read
- // (which would race with concurrent webhooks/double-clicks).
- const preMember = await Member.findOneAndUpdate(
+ // Update member in database
+ const member = await Member.findOneAndUpdate(
{ helcimCustomerId: body.customerId },
{ $set: {
contributionAmount: body.contributionAmount,
@@ -130,10 +185,8 @@ export default defineEventHandler(async (event) => {
? { nextBillingDate }
: {}),
} },
- { new: false, runValidators: false, projection: { status: 1 } }
+ { new: true, runValidators: false }
)
- const isFirstActivation = preMember?.status === 'pending_payment'
- const member = await Member.findById(preMember._id)
logActivity(member._id, 'subscription_created', { amount: body.contributionAmount })
@@ -150,21 +203,7 @@ export default defineEventHandler(async (event) => {
console.error('[payments] initial charge log failed, will be picked up by reconciliation:', err?.message || err)
}
- await autoFlagPreExistingSlackAccess(member)
- try {
- const slackService = getSlackService()
- if (slackService) {
- await slackService.notifyNewMember(
- member.name,
- member.email,
- member.circle,
- member.contributionAmount,
- 'manual_invitation_required'
- )
- }
- } catch (err) {
- console.error('[slack] notifyNewMember failed:', err)
- }
+ await inviteToSlack(member)
if (isFirstActivation) await sendWelcomeEmail(member)
return {
@@ -172,7 +211,7 @@ export default defineEventHandler(async (event) => {
subscription: {
subscriptionId: subscription.id,
status: subscription.status,
- nextBillingDate: rawNextBilling
+ nextBillingDate: subscription.nextBillingDate
},
member: {
id: member._id,
diff --git a/server/api/helcim/update-card.post.js b/server/api/helcim/update-card.post.js
index 1ccd17a..b3dd2d9 100644
--- a/server/api/helcim/update-card.post.js
+++ b/server/api/helcim/update-card.post.js
@@ -45,7 +45,10 @@ export default defineEventHandler(async (event) => {
const { cardToken } = body
// Step 3: verify the submitted token is attached to this member's customer
- const cards = await listHelcimCustomerCards(member.helcimCustomerId)
+ const cardsResponse = await listHelcimCustomerCards(member.helcimCustomerId)
+ const cards = Array.isArray(cardsResponse)
+ ? cardsResponse
+ : (cardsResponse?.cards || cardsResponse?.data || [])
const matchingCard = cards.find((c) => c?.cardToken === cardToken)
if (!matchingCard) {
diff --git a/server/api/helcim/verify-payment.post.js b/server/api/helcim/verify-payment.post.js
index e00d28d..5f3238a 100644
--- a/server/api/helcim/verify-payment.post.js
+++ b/server/api/helcim/verify-payment.post.js
@@ -13,7 +13,7 @@ export default defineEventHandler(async (event) => {
const cards = await listHelcimCustomerCards(body.customerId)
// Verify the card token exists for this customer
- const cardExists = cards.some(card =>
+ const cardExists = Array.isArray(cards) && cards.some(card =>
card.cardToken === body.cardToken
)
diff --git a/server/api/internal/reconcile-payments.post.js b/server/api/internal/reconcile-payments.post.js
deleted file mode 100644
index 869f6f1..0000000
--- a/server/api/internal/reconcile-payments.post.js
+++ /dev/null
@@ -1,158 +0,0 @@
-/**
- * Reconciliation cron route — invoked by `netlify/functions/reconcile-payments.mjs`.
- *
- * Auth: shared-secret header `X-Reconcile-Token` matched against
- * `runtimeConfig.reconcileToken` (env: NUXT_RECONCILE_TOKEN). Machine-to-machine
- * only — never passes `sendConfirmation: true` so back-fills don't re-send
- * confirmation emails.
- */
-import Member from '../../models/member.js'
-import Payment from '../../models/payment.js'
-import { getHelcimCustomer, listHelcimCustomerTransactions } from '../../utils/helcim.js'
-import { connectDB } from '../../utils/mongoose.js'
-import { upsertPaymentFromHelcim } from '../../utils/payments.js'
-
-// Same filter upsertPaymentFromHelcim applies — keep dry-run summary in sync.
-const RECONCILABLE_STATUSES = new Set(['paid', 'refunded', 'failed'])
-
-const RETRY_ATTEMPTS = 3
-const BASE_DELAY_MS = 250
-
-function sleep(ms) {
- return new Promise((resolve) => setTimeout(resolve, ms))
-}
-
-async function listTransactionsWithRetry(customerCode) {
- let lastErr
- for (let attempt = 1; attempt <= RETRY_ATTEMPTS; attempt++) {
- try {
- return await listHelcimCustomerTransactions(customerCode)
- } catch (err) {
- // Permanent failures (auth, missing) — don't burn retries on broken config.
- if (err?.statusCode === 401 || err?.statusCode === 403 || err?.statusCode === 404) {
- throw err
- }
- lastErr = err
- // Backoff after attempts 1 and 2: 250ms, then 500ms (no sleep after attempt 3).
- if (attempt < RETRY_ATTEMPTS) {
- await sleep(BASE_DELAY_MS * 2 ** (attempt - 1))
- }
- }
- }
- throw lastErr
-}
-
-export default defineEventHandler(async (event) => {
- const config = useRuntimeConfig()
- const expected = config.reconcileToken
- const provided = getHeader(event, 'x-reconcile-token')
- if (!expected || provided !== expected) {
- throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
- }
-
- const apply = getQuery(event).apply !== 'false'
-
- await connectDB()
-
- const members = await Member.find(
- { helcimCustomerId: { $exists: true, $ne: null } },
- { _id: 1, email: 1, name: 1, helcimCustomerId: 1, helcimCustomerCode: 1, helcimSubscriptionId: 1, billingCadence: 1 }
- ).lean()
-
- let txExamined = 0
- let created = 0
- let existed = 0
- let skipped = 0
- let memberErrors = 0
-
- async function processMember(member) {
- // Opportunistic backfill: members predating the helcimCustomerCode field
- // get it filled in here so the daily cron acts as the migration. Only on
- // the missing path — no overwrite, no extra API call once populated.
- let customerCode = member.helcimCustomerCode
- if (!customerCode) {
- try {
- const customer = await getHelcimCustomer(member.helcimCustomerId)
- if (customer?.customerCode) {
- customerCode = customer.customerCode
- await Member.findByIdAndUpdate(
- member._id,
- { $set: { helcimCustomerCode: customer.customerCode } },
- { runValidators: false }
- )
- }
- } catch (err) {
- // Backfill is best-effort — never fail the reconcile run on it.
- console.warn(`[reconcile] customerCode backfill failed for member=${member._id}: ${err?.message || err}`)
- }
- }
-
- if (!customerCode) {
- console.warn(`[reconcile] no customerCode for member=${member._id}; skipping`)
- return { error: false, txExamined: 0, created: 0, existed: 0, skipped: 0 }
- }
-
- let txs
- try {
- txs = await listTransactionsWithRetry(customerCode)
- } catch (err) {
- console.error(`[reconcile] member=${member._id}: ${err?.message || err}`)
- return { error: true }
- }
-
- const result = { error: false, txExamined: 0, created: 0, existed: 0, skipped: 0 }
-
- for (const tx of txs) {
- result.txExamined++
- if (!RECONCILABLE_STATUSES.has(tx?.status)) {
- result.skipped++
- continue
- }
-
- if (!apply) {
- const existing = await Payment.findOne({ helcimTransactionId: tx.id })
- if (existing) result.existed++
- else result.created++
- continue
- }
-
- // Note: deliberately NOT passing sendConfirmation — cron back-fills must
- // not re-send confirmation emails for transactions the member has already
- // been notified about (or that pre-date Mongo Payment tracking entirely).
- const upsertResult = await upsertPaymentFromHelcim(member, tx)
- if (upsertResult.created) result.created++
- else if (upsertResult.payment) result.existed++
- else result.skipped++
- }
-
- return result
- }
-
- const CHUNK_SIZE = 8
- for (let i = 0; i < members.length; i += CHUNK_SIZE) {
- const chunk = members.slice(i, i + CHUNK_SIZE)
- const results = await Promise.all(chunk.map((m) => processMember(m)))
- for (const r of results) {
- if (r.error) {
- memberErrors++
- continue
- }
- txExamined += r.txExamined
- created += r.created
- existed += r.existed
- skipped += r.skipped
- }
- }
-
- const summary = {
- membersScanned: members.length,
- txExamined,
- created,
- existed,
- skipped,
- memberErrors,
- apply
- }
- console.log('[reconcile] done', summary)
- return summary
-})
diff --git a/server/api/invite/accept.post.js b/server/api/invite/accept.post.js
index 27e5109..93b46e6 100644
--- a/server/api/invite/accept.post.js
+++ b/server/api/invite/accept.post.js
@@ -5,7 +5,6 @@ import { connectDB } from '../../utils/mongoose.js'
import { setAuthCookie } from '../../utils/auth.js'
import { assignMemberNumber } from '../../utils/memberNumber.js'
import { createHelcimCustomer } from '../../utils/helcim.js'
-import { sendWelcomeEmail } from '../../utils/resend.js'
export default defineEventHandler(async (event) => {
const body = await validateBody(event, inviteAcceptSchema)
@@ -62,7 +61,6 @@ export default defineEventHandler(async (event) => {
bio: body.motivation || undefined,
status: body.contributionAmount === 0 ? 'active' : 'pending_payment',
helcimCustomerId: helcimCustomer?.id,
- helcimCustomerCode: helcimCustomer?.customerCode,
agreement: { acceptedAt: new Date() },
})
@@ -88,16 +86,6 @@ export default defineEventHandler(async (event) => {
// For free tier, redirect to welcome
if (body.contributionAmount === 0) {
- await autoFlagPreExistingSlackAccess(member)
- try {
- await sendWelcomeEmail(member)
- logActivity(member._id, 'email_sent', {
- emailType: 'welcome',
- subject: 'Welcome to Ghost Guild'
- })
- } catch (emailError) {
- console.error('Failed to send welcome email:', emailError)
- }
return {
success: true,
requiresPayment: false,
diff --git a/server/api/members/cancel-subscription.post.js b/server/api/members/cancel-subscription.post.js
index 83fccba..4e311a9 100644
--- a/server/api/members/cancel-subscription.post.js
+++ b/server/api/members/cancel-subscription.post.js
@@ -23,17 +23,16 @@ export default defineEventHandler(async (event) => {
// Continue anyway - we'll update the member record
}
- // Update member: drop to free tier (status stays 'active' — they're still a member)
+ // Update member status — pending_payment (not cancelled) so member can re-subscribe
await Member.findByIdAndUpdate(
member._id,
{
$set: {
- status: 'active',
+ status: 'pending_payment',
contributionAmount: 0,
helcimSubscriptionId: null,
paymentMethod: 'none',
subscriptionEndDate: new Date(),
- lastCancelledAt: new Date(),
},
$unset: { nextBillingDate: 1 },
},
@@ -47,7 +46,7 @@ export default defineEventHandler(async (event) => {
return {
success: true,
message: "Subscription cancelled successfully",
- status: 'active',
+ status: 'pending_payment',
contributionAmount: 0,
};
} catch (error) {
diff --git a/server/api/members/create.post.js b/server/api/members/create.post.js
index 9b78831..53827b0 100644
--- a/server/api/members/create.post.js
+++ b/server/api/members/create.post.js
@@ -7,6 +7,80 @@ import { memberCreateSchema } from '../../utils/schemas.js'
import { sendWelcomeEmail } from '../../utils/resend.js'
import { assignMemberNumber } from '../../utils/memberNumber.js'
+// Function to invite member to Slack
+async function inviteToSlack(member) {
+ try {
+ const slackService = getSlackService()
+ if (!slackService) {
+ console.warn('Slack service not configured, skipping invitation')
+ return
+ }
+
+ console.warn(`Processing Slack invitation for member`)
+
+ const inviteResult = await slackService.inviteUserToSlack(
+ member.email,
+ member.name
+ )
+
+ if (inviteResult.success) {
+ // Update member record based on the actual result
+ if (inviteResult.status === 'existing_user_added_to_channel' ||
+ inviteResult.status === 'user_already_in_channel' ||
+ inviteResult.status === 'new_user_invited_to_workspace') {
+ await Member.findByIdAndUpdate(
+ member._id,
+ { $set: { slackInviteStatus: 'sent', slackUserId: inviteResult.userId, slackInvited: true } },
+ { runValidators: false }
+ )
+ } else {
+ // Manual invitation required
+ await Member.findByIdAndUpdate(
+ member._id,
+ { $set: { slackInviteStatus: 'pending', slackInvited: false } },
+ { runValidators: false }
+ )
+ }
+
+ // Send notification to vetting channel
+ await slackService.notifyNewMember(
+ member.name,
+ member.email,
+ member.circle,
+ member.contributionAmount,
+ inviteResult.status
+ )
+
+ console.warn(`Slack invitation processed: ${inviteResult.status}`)
+ } else {
+ // Update member record to reflect failed invitation
+ await Member.findByIdAndUpdate(
+ member._id,
+ { $set: { slackInviteStatus: 'failed' } },
+ { runValidators: false }
+ )
+
+ console.error(`Failed to process Slack invitation: ${inviteResult.error}`)
+ // Don't throw error - member creation should still succeed
+ }
+ } catch (error) {
+ console.error('Error during Slack invitation process:', error)
+
+ // Update member record to reflect failed invitation
+ try {
+ await Member.findByIdAndUpdate(
+ member._id,
+ { $set: { slackInviteStatus: 'failed' } },
+ { runValidators: false }
+ )
+ } catch (saveError) {
+ console.error('Failed to update member Slack status:', saveError)
+ }
+
+ // Don't throw error - member creation should still succeed
+ }
+}
+
export default defineEventHandler(async (event) => {
// Ensure database is connected
await connectDB()
@@ -33,22 +107,8 @@ export default defineEventHandler(async (event) => {
circle: member.circle
}, { timestamp: member.createdAt })
- // Auto-flag pre-existing Slack workspace members; admin manually invites the rest.
- await autoFlagPreExistingSlackAccess(member)
- try {
- const slackService = getSlackService()
- if (slackService) {
- await slackService.notifyNewMember(
- member.name,
- member.email,
- member.circle,
- member.contributionAmount,
- 'manual_invitation_required'
- )
- }
- } catch (err) {
- console.error('[slack] notifyNewMember failed:', err)
- }
+ // Send Slack invitation for new members
+ await inviteToSlack(member)
// Send welcome email (non-blocking)
try {
diff --git a/server/api/members/update-contribution.post.js b/server/api/members/update-contribution.post.js
index 3e2c071..695e7c9 100644
--- a/server/api/members/update-contribution.post.js
+++ b/server/api/members/update-contribution.post.js
@@ -100,8 +100,9 @@ export default defineEventHandler(async (event) => {
throw new Error("No subscription returned in response");
}
- const rawNextBilling = subscription.dateBilling || subscription.nextBillingDate || null;
- const nextBillingDate = rawNextBilling ? new Date(rawNextBilling) : null;
+ const nextBillingDate = subscription.nextBillingDate
+ ? new Date(subscription.nextBillingDate)
+ : null;
// Update member record
await Member.findByIdAndUpdate(
@@ -148,7 +149,7 @@ export default defineEventHandler(async (event) => {
subscription: {
subscriptionId: subscription.id,
status: subscription.status,
- nextBillingDate: rawNextBilling,
+ nextBillingDate: subscription.nextBillingDate,
},
};
} catch (error) {
@@ -203,10 +204,6 @@ export default defineEventHandler(async (event) => {
}
const memberCadence = member.billingCadence || 'monthly';
- // TODO: Cadence-switch UI on /member/account. Plain Helcim subscription
- // updates can't change billing period — would need a sub-replacement flow
- // (cancel current, create new at desired cadence). See
- // docs/LAUNCH_READINESS.md "Known gotchas" → "Cadence switch rejected".
if (body.cadence && body.cadence !== memberCadence) {
throw createError({
statusCode: 400,
@@ -254,7 +251,7 @@ export default defineEventHandler(async (event) => {
};
} catch (error) {
if (error.statusCode) throw error;
- console.error("Error updating contribution amount:", error);
+ console.error("Error updating contribution tier:", error);
throw createError({
statusCode: 500,
statusMessage: "An unexpected error occurred",
diff --git a/server/api/series/[id].get.js b/server/api/series/[id].get.js
index 000f9b1..be18bdc 100644
--- a/server/api/series/[id].get.js
+++ b/server/api/series/[id].get.js
@@ -1,5 +1,5 @@
import Event from "../../models/event.js";
-import { loadPublicSeries } from "../../utils/loadSeries.js";
+import Series from "../../models/series.js";
import { connectDB } from "../../utils/mongoose.js";
export default defineEventHandler(async (event) => {
@@ -15,14 +15,16 @@ export default defineEventHandler(async (event) => {
});
}
- // Try to fetch the Series model first for full ticketing info.
- // Legacy series may exist only as event metadata (no Series doc), so we
- // fall through to the events-based path below when no Series doc matches.
- const seriesModel = await loadPublicSeries(event, id, {
- select: "-registrations", // Don't expose registration details
- lean: true,
- allowMissing: true,
- });
+ // Try to fetch the Series model first for full ticketing info
+ // Build query conditions based on whether id looks like ObjectId or string
+ const isObjectId = /^[0-9a-fA-F]{24}$/.test(id);
+ const seriesQuery = isObjectId
+ ? { $or: [{ _id: id }, { id: id }, { slug: id }] }
+ : { $or: [{ id: id }, { slug: id }] };
+
+ const seriesModel = await Series.findOne(seriesQuery)
+ .select("-registrations") // Don't expose registration details
+ .lean();
// Fetch all events in this series
const events = await Event.find({
diff --git a/server/api/series/[id]/tickets/available.get.js b/server/api/series/[id]/tickets/available.get.js
index f7f0b0b..cf438ad 100644
--- a/server/api/series/[id]/tickets/available.get.js
+++ b/server/api/series/[id]/tickets/available.get.js
@@ -1,5 +1,5 @@
+import Series from "../../../../models/series.js";
import Member from "../../../../models/member.js";
-import { loadPublicSeries } from "../../../../utils/loadSeries.js";
import {
calculateSeriesTicketPrice,
checkSeriesTicketAvailability,
@@ -13,7 +13,20 @@ export default defineEventHandler(async (event) => {
const email = query.email;
// Fetch series
- const series = await loadPublicSeries(event, seriesId);
+ // Build query conditions based on whether seriesId looks like ObjectId or string
+ const isObjectId = /^[0-9a-fA-F]{24}$/.test(seriesId);
+ const seriesQuery = isObjectId
+ ? { $or: [{ _id: seriesId }, { id: seriesId }, { slug: seriesId }] }
+ : { $or: [{ id: seriesId }, { slug: seriesId }] };
+
+ const series = await Series.findOne(seriesQuery);
+
+ if (!series) {
+ throw createError({
+ statusCode: 404,
+ statusMessage: "Series not found",
+ });
+ }
// Check if tickets are enabled
if (!series.tickets?.enabled) {
diff --git a/server/api/series/[id]/tickets/purchase.post.js b/server/api/series/[id]/tickets/purchase.post.js
index c21d1a9..71f3fda 100644
--- a/server/api/series/[id]/tickets/purchase.post.js
+++ b/server/api/series/[id]/tickets/purchase.post.js
@@ -1,6 +1,6 @@
+import Series from "../../../../models/series.js";
import Event from "../../../../models/event.js";
import Member from "../../../../models/member.js";
-import { loadPublicSeries } from "../../../../utils/loadSeries.js";
import {
validateSeriesTicketPurchase,
calculateSeriesTicketPrice,
@@ -19,13 +19,25 @@ export default defineEventHandler(async (event) => {
const { name, email, paymentId } = body;
// Fetch series
- const series = await loadPublicSeries(event, seriesId);
+ // Build query conditions based on whether seriesId looks like ObjectId or string
+ const isObjectId = /^[0-9a-fA-F]{24}$/.test(seriesId);
+ const seriesQuery = isObjectId
+ ? { $or: [{ _id: seriesId }, { id: seriesId }, { slug: seriesId }] }
+ : { $or: [{ id: seriesId }, { slug: seriesId }] };
+
+ const series = await Series.findOne(seriesQuery);
+
+ if (!series) {
+ throw createError({
+ statusCode: 404,
+ statusMessage: "Series not found",
+ });
+ }
// Check membership — prefer JWT auth for accurate member pricing.
// Only members with access (active or pending_payment) get member-tier
// pricing; guest, suspended, and cancelled are treated as non-members.
let member = null;
- let accountCreated = false;
try {
member = await requireAuth(event);
} catch {
@@ -71,29 +83,6 @@ export default defineEventHandler(async (event) => {
});
}
- // If no Member yet, atomically create a guest Member. Series passes grant
- // access to a bundle of events over time — a buyer without an account
- // can't view their registrations or be recognized by per-event pages,
- // so we always create the guest (unlike single-event tickets which are
- // opt-in). findOneAndUpdate with $setOnInsert handles concurrent
- // registrations on the same email (email has a unique index).
- if (!member) {
- member = await Member.findOneAndUpdate(
- { email: canonicalEmail },
- {
- $setOnInsert: {
- email: canonicalEmail,
- name,
- circle: "community",
- contributionAmount: 0,
- status: "guest",
- },
- },
- { upsert: true, new: true, setDefaultsOnInsert: true }
- );
- accountCreated = true;
- }
-
// Create series registration
const registration = {
memberId: member?._id,
@@ -113,17 +102,6 @@ export default defineEventHandler(async (event) => {
series.registrations.push(registration);
await completeSeriesTicketPurchase(series, ticketInfo.ticketType);
- // Decide on auto-login: safe for new accounts and existing guests, not for
- // real members (stranger could hijack by typing email into a public form).
- let signedIn = false;
- let requiresSignIn = false;
- if (member && (accountCreated || member.status === "guest")) {
- setAuthCookie(event, member);
- signedIn = true;
- } else if (member) {
- requiresSignIn = true;
- }
-
// Get the newly created registration
const newRegistration =
series.registrations[series.registrations.length - 1];
@@ -194,9 +172,6 @@ export default defineEventHandler(async (event) => {
success: r.success,
reason: r.reason,
})),
- accountCreated,
- signedIn,
- requiresSignIn,
};
} catch (error) {
console.error("Error purchasing series pass:", error);
diff --git a/server/middleware/01.csrf.js b/server/middleware/01.csrf.js
index b479c6e..3f3e841 100644
--- a/server/middleware/01.csrf.js
+++ b/server/middleware/01.csrf.js
@@ -2,13 +2,11 @@ import crypto from 'crypto'
const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])
-// Routes exempt from CSRF (external webhooks, magic link verify, machine-to-
-// machine internal endpoints with their own shared-secret auth)
+// Routes exempt from CSRF (external webhooks, magic link verify)
const EXEMPT_PREFIXES = [
'/api/helcim/webhook',
'/api/slack/webhook',
'/api/auth/verify',
- '/api/internal/',
'/oidc/',
]
diff --git a/server/middleware/02.security-headers.js b/server/middleware/02.security-headers.js
index 867ee0f..7129372 100644
--- a/server/middleware/02.security-headers.js
+++ b/server/middleware/02.security-headers.js
@@ -17,12 +17,12 @@ export default defineEventHandler((event) => {
if (!path.startsWith('/oidc/')) {
headers['Content-Security-Policy'] = [
"default-src 'self'",
- "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://myposjs.helcim.com https://secure.helcim.app https://plausible.io",
+ "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://myposjs.helcim.com https://plausible.io",
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
"img-src 'self' data: https://res.cloudinary.com https://*.cloudinary.com",
"font-src 'self' https://fonts.gstatic.com",
- "connect-src 'self' https://api.helcim.com https://myposjs.helcim.com https://secure.helcim.app https://plausible.io",
- "frame-src 'self' https://myposjs.helcim.com https://secure.helcim.app",
+ "connect-src 'self' https://api.helcim.com https://myposjs.helcim.com https://plausible.io",
+ "frame-src 'self' https://myposjs.helcim.com https://secure.helcim.com",
"base-uri 'self'",
"form-action 'self'",
].join('; ')
diff --git a/server/middleware/03.rate-limit.js b/server/middleware/03.rate-limit.js
index 9ad88f4..ac87ef7 100644
--- a/server/middleware/03.rate-limit.js
+++ b/server/middleware/03.rate-limit.js
@@ -1,5 +1,12 @@
import { RateLimiterMemory } from 'rate-limiter-flexible'
+// Strict rate limit for auth endpoints
+const authLimiter = new RateLimiterMemory({
+ points: 5, // 5 requests
+ duration: 300, // per 5 minutes
+ keyPrefix: 'rl_auth'
+})
+
// Moderate rate limit for payment endpoints
const paymentLimiter = new RateLimiterMemory({
points: 10,
@@ -28,6 +35,7 @@ function getClientIp(event) {
|| 'unknown'
}
+const AUTH_PATHS = new Set(['/api/auth/login', '/api/auth/verify'])
const PAYMENT_PREFIXES = ['/api/helcim/']
const UPLOAD_PATHS = new Set(['/api/upload/image'])
@@ -35,15 +43,12 @@ export default defineEventHandler(async (event) => {
const path = getRequestURL(event).pathname
if (!path.startsWith('/api/')) return
- // Bypass rate limiting in test/dev opt-in mode so parallel E2E runs from a
- // single IP (127.0.0.1) do not exhaust the per-IP budget. Mirrors the gate
- // used by /api/dev/* endpoints — only set in development and by Playwright.
- if (process.env.ALLOW_DEV_TEST_ENDPOINTS === 'true') return
-
const ip = getClientIp(event)
try {
- if (PAYMENT_PREFIXES.some(p => path.startsWith(p))) {
+ if (AUTH_PATHS.has(path)) {
+ await authLimiter.consume(ip)
+ } else if (PAYMENT_PREFIXES.some(p => path.startsWith(p))) {
await paymentLimiter.consume(ip)
} else if (UPLOAD_PATHS.has(path)) {
await uploadLimiter.consume(ip)
diff --git a/server/models/member.js b/server/models/member.js
index 0aa2b3d..65949a4 100644
--- a/server/models/member.js
+++ b/server/models/member.js
@@ -42,7 +42,6 @@ const memberSchema = new mongoose.Schema({
default: "pending_payment",
},
helcimCustomerId: String,
- helcimCustomerCode: String,
helcimSubscriptionId: String,
billingCadence: {
type: String,
@@ -57,9 +56,12 @@ const memberSchema = new mongoose.Schema({
subscriptionStartDate: Date,
subscriptionEndDate: Date,
nextBillingDate: Date,
- lastCancelledAt: Date,
slackInvited: { type: Boolean, default: false },
- slackInvitedAt: { type: Date },
+ slackInviteStatus: {
+ type: String,
+ enum: ["pending", "sent", "failed", "accepted", "joined"],
+ default: "pending",
+ },
slackUserId: String,
// Profile fields
diff --git a/server/plugins/check-slack-joins.js b/server/plugins/check-slack-joins.js
new file mode 100644
index 0000000..9f53ff9
--- /dev/null
+++ b/server/plugins/check-slack-joins.js
@@ -0,0 +1,29 @@
+// server/plugins/check-slack-joins.js
+import { checkSlackJoins } from '../utils/checkSlackJoins.js'
+
+const INTERVAL_MS = 3600000 // 1 hour
+
+export default defineNitroPlugin(() => {
+ // Don't run in test environment
+ if (process.env.NODE_ENV === 'test') return
+
+ const config = useRuntimeConfig()
+ const token = config.slackBotToken
+
+ if (!token) {
+ console.warn('[check-slack-joins] No Slack bot token configured, skipping background job')
+ return
+ }
+
+ async function run() {
+ try {
+ await checkSlackJoins(token)
+ } catch (err) {
+ console.error('[check-slack-joins] Unhandled error:', err.message || err)
+ }
+ }
+
+ // Run immediately on server start, then every hour
+ run()
+ setInterval(run, INTERVAL_MS)
+})
diff --git a/server/plugins/validate-env.js b/server/plugins/validate-env.js
index cb1c6ff..c190c4b 100644
--- a/server/plugins/validate-env.js
+++ b/server/plugins/validate-env.js
@@ -1,17 +1,23 @@
export default defineNitroPlugin(() => {
- const config = useRuntimeConfig()
- const checks = {
- MONGODB_URI: config.mongodbUri,
- JWT_SECRET: config.jwtSecret,
- RESEND_API_KEY: config.resendApiKey,
- HELCIM_API_TOKEN: config.helcimApiToken,
- }
+ const required = [
+ 'MONGODB_URI',
+ 'JWT_SECRET',
+ 'RESEND_API_KEY',
+ 'HELCIM_API_TOKEN',
+ ]
- const missing = Object.entries(checks).filter(([, value]) => !value).map(([key]) => key)
+ const missing = required.filter((key) => {
+ // Check both process.env and runtime config where applicable
+ if (key === 'JWT_SECRET') {
+ const config = useRuntimeConfig()
+ return !config.jwtSecret
+ }
+ return !process.env[key]
+ })
if (missing.length > 0) {
console.error(`FATAL: Missing required environment variables: ${missing.join(', ')}`)
- console.error('Set these (or their NUXT_-prefixed equivalents) in your .env file or environment variables.')
+ console.error('Set these in your .env file or environment variables.')
process.exit(1)
}
})
diff --git a/server/routes/oidc/interaction/login.post.ts b/server/routes/oidc/interaction/login.post.ts
index a19af7b..0799a27 100644
--- a/server/routes/oidc/interaction/login.post.ts
+++ b/server/routes/oidc/interaction/login.post.ts
@@ -12,7 +12,7 @@ import { Resend } from "resend";
import Member from "../../../models/member.js";
import { connectDB } from "../../../utils/mongoose.js";
-const resend = new Resend(useRuntimeConfig().resendApiKey);
+const resend = new Resend(process.env.RESEND_API_KEY);
export default defineEventHandler(async (event) => {
await connectDB();
diff --git a/server/utils/adminAlerts.js b/server/utils/adminAlerts.js
index 60dd9af..c8de63f 100644
--- a/server/utils/adminAlerts.js
+++ b/server/utils/adminAlerts.js
@@ -17,6 +17,7 @@ export const ALERT_THRESHOLDS = {
// Single source of truth for alert presentation. Used by detectors AND the
// dismissed-list endpoint (which has no access to a detector run's output).
export const ALERT_METADATA = {
+ slack_invite_failed: { title: 'Slack invites failed', severity: 'critical' },
no_slack_handle_week: { title: 'Active members without a Slack handle', severity: 'attention' },
stuck_pending_payment: { title: 'Members stuck in pending payment', severity: 'attention' },
member_suspended: { title: 'Suspended members', severity: 'attention' },
@@ -61,6 +62,18 @@ function memberItem(member, sublabel) {
}
}
+export async function detectSlackInviteFailed() {
+ await connectDB()
+ const members = await Member
+ .find({ slackInviteStatus: 'failed' })
+ .select('name email')
+ .lean()
+ return {
+ ...alertShell('slack_invite_failed'),
+ items: members.map((m) => memberItem(m))
+ }
+}
+
export async function detectNoSlackHandleAfterWeek() {
await connectDB()
const cutoff = daysAgo(ALERT_THRESHOLDS.NO_SLACK_DAYS)
@@ -244,6 +257,7 @@ export async function detectPendingTagSuggestions() {
}
const DETECTORS = [
+ detectSlackInviteFailed,
detectNoSlackHandleAfterWeek,
detectStuckPendingPayment,
detectSuspendedMembers,
diff --git a/server/utils/auth.js b/server/utils/auth.js
index 6603d6d..1856152 100644
--- a/server/utils/auth.js
+++ b/server/utils/auth.js
@@ -22,60 +22,6 @@ export function setAuthCookie(event, member) {
})
}
-/**
- * Issue a 30-minute signup-bridge cookie scoped to membership-signup flow.
- *
- * The signup flow (POST /api/helcim/customer) defers the full session cookie
- * to email-verify (magic link). The bridge cookie lets the in-progress signup
- * complete its activation step (free or paid) before that magic link is
- * clicked: /api/helcim/subscription accepts it for $0 activation, and
- * /api/helcim/initialize-payment accepts it for paid Helcim checkout.
- * The cookie is NOT honored by requireAuth and grants nothing else.
- */
-export function setSignupBridgeCookie(event, member) {
- const token = jwt.sign(
- {
- memberId: member._id.toString(),
- email: member.email,
- scope: 'signup_bridge'
- },
- useRuntimeConfig(event).jwtSecret,
- { expiresIn: '30m' }
- )
-
- setCookie(event, 'signup-bridge', token, {
- httpOnly: true,
- secure: process.env.NODE_ENV === 'production',
- sameSite: 'lax',
- path: '/',
- maxAge: 60 * 30
- })
-}
-
-/**
- * Verify a signup-bridge cookie and return the associated Member, or null.
- * Used by /api/helcim/subscription and /api/helcim/initialize-payment to
- * let the in-progress signup complete activation before email verification.
- */
-export async function getSignupBridgeMember(event) {
- const token = getCookie(event, 'signup-bridge')
- if (!token) return null
-
- let decoded
- try {
- decoded = jwt.verify(token, useRuntimeConfig(event).jwtSecret)
- } catch {
- return null
- }
-
- if (decoded.scope !== 'signup_bridge') return null
-
- await connectDB()
- const member = await Member.findById(decoded.memberId)
- if (!member) return null
- return member
-}
-
/**
* Verify JWT from cookie and return the decoded member.
* Throws 401 if token is missing or invalid.
diff --git a/server/_archive/utils/checkSlackJoins.js b/server/utils/checkSlackJoins.js
similarity index 100%
rename from server/_archive/utils/checkSlackJoins.js
rename to server/utils/checkSlackJoins.js
diff --git a/server/utils/helcim.js b/server/utils/helcim.js
index a96f630..c62c628 100644
--- a/server/utils/helcim.js
+++ b/server/utils/helcim.js
@@ -86,10 +86,8 @@ export const createHelcimCustomer = (payload) =>
export const updateHelcimCustomer = (id, payload) =>
helcimFetch(`/customers/${id}`, { method: 'PATCH', body: payload, errorMessage: 'Billing update failed' })
-export const listHelcimCustomerCards = async (id) => {
- const raw = await helcimFetch(`/customers/${id}/cards`, { errorMessage: 'Card lookup failed' })
- return Array.isArray(raw) ? raw : (raw?.cards || raw?.data || [])
-}
+export const listHelcimCustomerCards = (id) =>
+ helcimFetch(`/customers/${id}/cards`, { errorMessage: 'Card lookup failed' })
/**
* Set a customer's default payment method by card token.
@@ -264,3 +262,15 @@ export function generateIdempotencyKey() {
}
return key
}
+
+/**
+ * Legacy stub — kept alive ONLY so `server/api/events/[id]/payment.post.js`
+ * still imports cleanly. The direct purchase API was never implemented.
+ * Always returns `{ success: false }`; callers surface the message to the user.
+ */
+export async function processHelcimPayment(_paymentData) {
+ return {
+ success: false,
+ message: 'Direct purchase API not implemented; use HelcimPay.js flow'
+ }
+}
diff --git a/server/utils/loadSeries.js b/server/utils/loadSeries.js
deleted file mode 100644
index 33d9018..0000000
--- a/server/utils/loadSeries.js
+++ /dev/null
@@ -1,47 +0,0 @@
-import Series from '../models/series.js'
-import { connectDB } from './mongoose.js'
-
-/**
- * Load a series by ObjectId, string id, or slug for public endpoints.
- * Series has three identifier fields (`_id`, `id`, `slug`); this helper
- * builds the same conditional `$or` query the call sites would otherwise
- * inline. No isVisible gate today (parity with existing call-site behavior).
- *
- * @param {Object} reqEvent - h3 event (reserved for future auth/cookie access)
- * @param {String} identifier - ObjectId string, string id, or slug
- * @param {Object} [options]
- * @param {Boolean} [options.lean] - apply .lean() to the query
- * @param {String} [options.select] - apply .select() to the query
- * @param {Boolean} [options.allowMissing] - return null instead of throwing 404 on miss
- * @returns {Promise} the series document, or null if allowMissing and not found
- */
-export async function loadPublicSeries(reqEvent, identifier, options = {}) {
- if (!identifier) {
- throw createError({
- statusCode: 400,
- statusMessage: 'Series identifier is required'
- })
- }
-
- await connectDB()
-
- const { lean = false, select = null, allowMissing = false } = options
-
- const isObjectId = /^[0-9a-fA-F]{24}$/.test(identifier)
- const seriesQuery = isObjectId
- ? { $or: [{ _id: identifier }, { id: identifier }, { slug: identifier }] }
- : { $or: [{ id: identifier }, { slug: identifier }] }
-
- let query = Series.findOne(seriesQuery)
- if (select) query = query.select(select)
- if (lean) query = query.lean()
-
- const series = await query
-
- if (!series) {
- if (allowMissing) return null
- throw createError({ statusCode: 404, statusMessage: 'Series not found' })
- }
-
- return series
-}
diff --git a/server/utils/magicLink.js b/server/utils/magicLink.js
deleted file mode 100644
index 928c7f0..0000000
--- a/server/utils/magicLink.js
+++ /dev/null
@@ -1,68 +0,0 @@
-// Send a magic-link verification email. Mirrors the token/email logic in
-// server/api/auth/login.post.js so callers (signup, login, etc.) can request
-// a verification link with their own subject/intro copy.
-import jwt from 'jsonwebtoken'
-import { randomUUID } from 'crypto'
-import { Resend } from 'resend'
-import Member from '../models/member.js'
-
-const resend = new Resend(useRuntimeConfig().resendApiKey)
-
-/**
- * Issue a 15-minute magic-link JWT for `email` and email it.
- *
- * @param {string} email
- * @param {object} [options]
- * @param {string} [options.subject] - Email subject (default: "Your Ghost Guild login link")
- * @param {string} [options.intro] - Optional one-line intro before the link.
- * @param {object} [options.member] - Pre-loaded Member doc; skips the findOne lookup.
- * @returns {Promise<{ sent: boolean }>} - sent=false when no member exists for the email
- * (caller can decide whether to surface that; the auth/login endpoint hides it for
- * anti-enumeration, signup knows the member was just created).
- */
-export async function sendMagicLink(email, options = {}) {
- const baseUrl = process.env.BASE_URL
- if (!baseUrl) {
- throw createError({
- statusCode: 500,
- statusMessage: 'BASE_URL environment variable is not set'
- })
- }
-
- email = email.toLowerCase()
- const member = options.member || await Member.findOne({ email })
- if (!member) return { sent: false }
-
- const jti = randomUUID()
- const token = jwt.sign(
- { memberId: member._id, jti },
- useRuntimeConfig().jwtSecret,
- { expiresIn: '15m' }
- )
-
- await Member.findByIdAndUpdate(
- member._id,
- { $set: { magicLinkJti: jti, magicLinkJtiUsed: false } },
- { runValidators: false }
- )
-
- const magicLink = `${baseUrl}/verify#${token}`
- const subject = options.subject || 'Your Ghost Guild login link'
- const intro = options.intro || 'Sign in to Ghost Guild:'
- const text = `Hi,\n\n${intro}\n${magicLink}\n\nThis link expires in 15 minutes. If you didn't request it, ignore this email.`
-
- await resend.emails.send({
- from: 'Ghost Guild ',
- to: email,
- subject,
- text
- })
-
- logActivity(member._id, 'email_sent', {
- emailType: 'magic_link',
- subject,
- body: text
- })
-
- return { sent: true }
-}
diff --git a/server/utils/mongoose.js b/server/utils/mongoose.js
index 1e06946..6456191 100644
--- a/server/utils/mongoose.js
+++ b/server/utils/mongoose.js
@@ -7,10 +7,7 @@ export const connectDB = async () => {
return;
}
- const MONGODB_URI =
- typeof useRuntimeConfig === 'function'
- ? useRuntimeConfig().mongodbUri
- : process.env.NUXT_MONGODB_URI || process.env.MONGODB_URI;
+ const MONGODB_URI = process.env.NUXT_MONGODB_URI || process.env.MONGODB_URI || 'mongodb://localhost:27017/ghostguild';
try {
await mongoose.connect(MONGODB_URI, {
diff --git a/server/utils/oidc-provider.ts b/server/utils/oidc-provider.ts
index 187f8a8..dfc7042 100644
--- a/server/utils/oidc-provider.ts
+++ b/server/utils/oidc-provider.ts
@@ -86,7 +86,9 @@ export async function getOidcProvider() {
},
features: {
- devInteractions: { enabled: false },
+ devInteractions: {
+ enabled: process.env.NODE_ENV !== "production",
+ },
revocation: { enabled: true },
rpInitiatedLogout: {
enabled: true,
diff --git a/server/utils/paymentTypes.js b/server/utils/paymentTypes.js
deleted file mode 100644
index 3c833a8..0000000
--- a/server/utils/paymentTypes.js
+++ /dev/null
@@ -1,15 +0,0 @@
-// Metadata.type values accepted by /api/helcim/initialize-payment.
-// Shared by the Zod schema (PAYMENT_METADATA_TYPE_VALUES in z.enum) and the
-// route handler so server-side wire validation stays single-sourced. The client
-// composable intentionally uses inline string literals — server-side z.enum
-// rejects any drift as a 400.
-
-export const PAYMENT_METADATA_TYPES = {
- EVENT_TICKET: 'event_ticket',
- SERIES_TICKET: 'series_ticket',
- SUBSCRIPTION: 'subscription',
- CARD_VERIFY: 'card_verify',
- MEMBERSHIP_SIGNUP: 'membership_signup'
-}
-
-export const PAYMENT_METADATA_TYPE_VALUES = Object.values(PAYMENT_METADATA_TYPES)
diff --git a/server/utils/payments.js b/server/utils/payments.js
index 9e529f2..bd0e984 100644
--- a/server/utils/payments.js
+++ b/server/utils/payments.js
@@ -2,7 +2,7 @@ import { Resend } from 'resend'
import Payment from '../models/payment.js'
import { paymentConfirmationEmail } from '../emails/paymentConfirmation.js'
-const resend = new Resend(useRuntimeConfig().resendApiKey)
+const resend = new Resend(process.env.RESEND_API_KEY)
function mapStatus(helcimStatus) {
if (helcimStatus === 'paid') return 'success'
diff --git a/server/utils/rateLimit.js b/server/utils/rateLimit.js
deleted file mode 100644
index 4057174..0000000
--- a/server/utils/rateLimit.js
+++ /dev/null
@@ -1,36 +0,0 @@
-// Tiny in-memory sliding-window rate limiter.
-// Acceptable for single-instance Nitro on Netlify; swap to Mongo/Upstash if
-// we move to multi-instance.
-const buckets = new Map()
-
-export function rateLimit(key, { max, windowMs }) {
- // Bypass in test/dev opt-in mode so parallel E2E runs from a single IP
- // (127.0.0.1) don't exhaust per-IP/email budgets. Mirrors the gate used by
- // /api/dev/* endpoints and server/middleware/03.rate-limit.js.
- if (process.env.ALLOW_DEV_TEST_ENDPOINTS === 'true') return true
-
- const now = Date.now()
-
- // Probabilistic sweep: ~1% of calls evict keys whose newest entry has fully
- // aged out, so the Map doesn't grow unbounded under random-key spraying.
- if (Math.random() < 0.01) {
- for (const [k, arr] of buckets) {
- const last = arr[arr.length - 1]
- if (last === undefined || now - last >= windowMs) buckets.delete(k)
- }
- }
-
- const arr = (buckets.get(key) || []).filter((t) => now - t < windowMs)
- if (arr.length >= max) {
- buckets.set(key, arr)
- return false
- }
- arr.push(now)
- buckets.set(key, arr)
- return true
-}
-
-// Test helper — clears all buckets so each test starts clean.
-export function resetRateLimit() {
- buckets.clear()
-}
diff --git a/server/utils/resend.js b/server/utils/resend.js
index ce79e94..24b2356 100644
--- a/server/utils/resend.js
+++ b/server/utils/resend.js
@@ -1,6 +1,6 @@
import { Resend } from "resend";
-const resend = new Resend(useRuntimeConfig().resendApiKey);
+const resend = new Resend(process.env.RESEND_API_KEY);
/**
* Send event registration confirmation email
@@ -282,7 +282,7 @@ Welcome to Ghost Guild! You're now part of the ${member.circle} circle.
Sign in to your dashboard to get started:
${baseUrl}/member/dashboard
-If you have questions, just reply to this email.`,
+If you have questions, reach out to jennie + eileen on Slack or reply to this email.`,
});
if (error) {
diff --git a/server/utils/schemas.js b/server/utils/schemas.js
index 7345224..464f77c 100644
--- a/server/utils/schemas.js
+++ b/server/utils/schemas.js
@@ -1,15 +1,10 @@
import * as z from 'zod'
import { ADMIN_ALERT_TYPES } from '../models/adminAlertDismissal.js'
-import { PAYMENT_METADATA_TYPE_VALUES } from './paymentTypes.js'
export const emailSchema = z.object({
email: z.string().trim().toLowerCase().email()
})
-export const verifyMagicLinkSchema = z.object({
- token: z.string().min(1).max(2000)
-}).strict()
-
export const memberCreateSchema = z.object({
email: z.string().trim().toLowerCase().email(),
name: z.string().min(1).max(200),
@@ -67,16 +62,12 @@ export const helcimCustomerSchema = z.object({
})
export const helcimInitializePaymentSchema = z.object({
- // amount is accepted but IGNORED for ticket types (server re-derives).
- // Kept for verify-mode (subscription card-on-file) where 0 is sent.
amount: z.number().min(0).optional(),
customerCode: z.string().max(200).optional(),
metadata: z.object({
- type: z.enum(PAYMENT_METADATA_TYPE_VALUES).optional(),
+ type: z.string().max(100).optional(),
eventTitle: z.string().max(500).optional(),
- eventId: z.string().max(200).optional(),
- seriesId: z.string().max(200).optional(),
- email: z.string().trim().toLowerCase().email().optional()
+ eventId: z.string().max(200).optional()
}).optional()
})
@@ -140,6 +131,12 @@ export const checkRegistrationSchema = z.object({
email: z.string().trim().toLowerCase().email()
})
+export const eventPaymentSchema = z.object({
+ name: z.string().min(1).max(200),
+ email: z.string().trim().toLowerCase().email(),
+ paymentToken: z.string().min(1).max(500)
+})
+
// --- Member schemas ---
export const updateContributionSchema = z.object({
@@ -166,17 +163,15 @@ export const seriesTicketEligibilitySchema = z.object({
// --- Admin schemas ---
-const emptyStringToUndefined = (v) => (v === '' ? undefined : v)
-
export const adminEventCreateSchema = z.object({
title: z.string().min(1).max(500),
description: z.string().min(1).max(50000),
startDate: z.string().min(1),
endDate: z.string().min(1),
location: z.string().max(500).optional(),
- maxAttendees: z.preprocess(emptyStringToUndefined, z.number().int().positive().optional().nullable()),
+ maxAttendees: z.number().int().positive().optional(),
membersOnly: z.boolean().optional(),
- registrationDeadline: z.preprocess(emptyStringToUndefined, z.string().optional().nullable()),
+ registrationDeadline: z.string().optional(),
pricing: z.object({
paymentRequired: z.boolean().optional(),
isFree: z.boolean().optional()
@@ -188,16 +183,16 @@ export const adminEventCreateSchema = z.object({
name: z.string().max(200).optional(),
description: z.string().max(2000).optional(),
price: z.number().min(0).optional(),
- quantity: z.preprocess(emptyStringToUndefined, z.number().int().positive().optional().nullable()),
- earlyBirdPrice: z.preprocess(emptyStringToUndefined, z.number().min(0).optional().nullable()),
- earlyBirdDeadline: z.preprocess(emptyStringToUndefined, z.string().optional().nullable())
+ quantity: z.number().int().positive().optional(),
+ earlyBirdPrice: z.number().min(0).optional(),
+ earlyBirdDeadline: z.string().optional()
}).optional()
}).optional(),
- image: z.string().url().optional().nullable(),
+ image: z.string().url().optional(),
category: z.string().max(100).optional(),
tags: z.array(z.string().max(100)).max(20).optional(),
- series: z.any().optional()
-}).passthrough()
+ series: z.string().optional()
+})
export const adminEventUpdateSchema = z.object({
title: z.string().min(1).max(500),
@@ -205,9 +200,9 @@ export const adminEventUpdateSchema = z.object({
startDate: z.string().min(1),
endDate: z.string().min(1),
location: z.string().max(500).optional(),
- maxAttendees: z.preprocess(emptyStringToUndefined, z.number().int().positive().optional().nullable()),
+ maxAttendees: z.number().int().positive().optional().nullable(),
membersOnly: z.boolean().optional(),
- registrationDeadline: z.preprocess(emptyStringToUndefined, z.string().optional().nullable()),
+ registrationDeadline: z.string().optional().nullable(),
pricing: z.object({
paymentRequired: z.boolean().optional(),
isFree: z.boolean().optional(),
@@ -220,10 +215,10 @@ export const adminEventUpdateSchema = z.object({
name: z.string().max(200).optional(),
description: z.string().max(2000).optional(),
price: z.number().min(0).optional(),
- quantity: z.preprocess(emptyStringToUndefined, z.number().int().positive().optional().nullable()),
+ quantity: z.number().int().positive().optional().nullable(),
sold: z.number().int().min(0).optional(),
- earlyBirdPrice: z.preprocess(emptyStringToUndefined, z.number().min(0).optional().nullable()),
- earlyBirdDeadline: z.preprocess(emptyStringToUndefined, z.string().optional().nullable())
+ earlyBirdPrice: z.number().min(0).optional().nullable(),
+ earlyBirdDeadline: z.string().optional().nullable()
}).optional()
}).optional(),
image: z.string().url().optional().nullable(),
@@ -314,10 +309,6 @@ export const adminRoleUpdateSchema = z.object({
role: z.enum(['admin', 'member'])
})
-export const adminSlackStatusSchema = z.object({
- slackInvited: z.literal(true)
-}).strict()
-
export const bulkMemberImportSchema = z.object({
members: z.array(z.object({
name: z.string().min(1).max(200),
diff --git a/server/utils/slack.ts b/server/utils/slack.ts
index 2216e21..f1fd674 100644
--- a/server/utils/slack.ts
+++ b/server/utils/slack.ts
@@ -9,10 +9,102 @@ export class SlackService {
this.vettingChannelId = vettingChannelId;
}
+ /**
+ * Invite user to workspace and channel (using proper admin and conversation scopes)
+ */
+ async inviteUserToSlack(
+ email: string,
+ realName: string,
+ ): Promise<{
+ success: boolean;
+ userId?: string;
+ status?: string;
+ error?: string;
+ }> {
+ try {
+ // First, check if user already exists in workspace
+ const existingUser = await this.findUserByEmail(email);
+
+ if (existingUser) {
+ // User exists, invite them to the vetting channel
+ try {
+ await this.client.conversations.invite({
+ channel: this.vettingChannelId,
+ users: existingUser,
+ });
+
+ console.log(
+ `Successfully invited existing user ${email} to vetting channel`,
+ );
+ return {
+ success: true,
+ userId: existingUser,
+ status: "existing_user_added_to_channel",
+ };
+ } catch (error: any) {
+ if (error.data?.error === "already_in_channel") {
+ return {
+ success: true,
+ userId: existingUser,
+ status: "user_already_in_channel",
+ };
+ }
+ throw error;
+ }
+ }
+
+ // User doesn't exist, try to invite to workspace using admin API
+ try {
+ const inviteResponse = await this.client.admin.users.invite({
+ email: email,
+ real_name: realName,
+ channel_ids: [this.vettingChannelId],
+ is_restricted: true, // Single-channel guest
+ is_ultra_restricted: false,
+ });
+
+ if (inviteResponse.ok && inviteResponse.user) {
+ console.log(
+ `Successfully invited ${email} to workspace as single-channel guest`,
+ );
+ return {
+ success: true,
+ userId: inviteResponse.user.id,
+ status: "new_user_invited_to_workspace",
+ };
+ } else {
+ throw new Error(`Admin invite failed: ${inviteResponse.error}`);
+ }
+ } catch (adminError: any) {
+ console.log(
+ `Admin API not available or failed: ${
+ adminError.data?.error || adminError.message
+ }`,
+ );
+
+ // Fall back to manual process
+ return {
+ success: true,
+ status: "manual_invitation_required",
+ error: `Admin API unavailable: ${
+ adminError.data?.error || adminError.message
+ }`,
+ };
+ }
+ } catch (error: any) {
+ console.error(`Failed to process invitation for ${email}:`, error);
+
+ return {
+ success: false,
+ error: error.data?.error || error.message || "Unknown error occurred",
+ };
+ }
+ }
+
/**
* Find user in workspace by email
*/
- async findUserByEmail(email: string): Promise {
+ private async findUserByEmail(email: string): Promise {
try {
const response = await this.client.users.lookupByEmail({ email });
return response.user?.id || null;
diff --git a/server/utils/slackAccess.js b/server/utils/slackAccess.js
deleted file mode 100644
index 885ae12..0000000
--- a/server/utils/slackAccess.js
+++ /dev/null
@@ -1,61 +0,0 @@
-// Spec: docs/specs/wave-based-slack-onboarding.md
-//
-// Auto-detect existing Slack workspace membership for a Ghost Guild member
-// and flag them as `slackInvited` without sending a duplicate invite.
-//
-// Contract:
-// - Caller awaits this helper, but it never throws — all errors swallowed.
-// - Internal lookup races against a 3s timeout (resolves null on hang).
-// - No-op if Slack service isn't configured, lookup misses, or member is
-// already flagged.
-
-import Member from '../models/member.js'
-import { getSlackService } from './slack.ts'
-
-const LOOKUP_TIMEOUT_MS = 3000
-
-export async function autoFlagPreExistingSlackAccess(member) {
- try {
- if (!member || !member._id || !member.email) return
- if (member.slackInvited === true) return
-
- const slackService = getSlackService()
- if (!slackService) return
-
- const timeoutPromise = new Promise((resolve) => {
- setTimeout(() => resolve(null), LOOKUP_TIMEOUT_MS)
- })
-
- let userId = null
- try {
- userId = await Promise.race([
- slackService.findUserByEmail(member.email),
- timeoutPromise
- ])
- } catch (err) {
- console.error('[slackAccess] findUserByEmail failed:', err)
- return
- }
-
- if (!userId) return
-
- await Member.findByIdAndUpdate(
- member._id,
- {
- slackInvited: true,
- slackInvitedAt: new Date(),
- slackUserId: userId
- },
- { runValidators: false }
- )
-
- await logActivity(
- member._id,
- 'slack_access_auto_detected',
- { slackUserId: userId },
- { visibility: 'member' }
- )
- } catch (err) {
- console.error('[slackAccess] autoFlagPreExistingSlackAccess error:', err)
- }
-}
diff --git a/server/utils/tickets.js b/server/utils/tickets.js
index 799989e..4790ab5 100644
--- a/server/utils/tickets.js
+++ b/server/utils/tickets.js
@@ -19,14 +19,6 @@ export const calculateTicketPrice = (event, member = null) => {
// Members without access (guest/suspended/cancelled) get public pricing only.
const accessMember = hasMemberAccess(member) ? member : null;
- // Members-only gate applies to both legacy and ticketed paths. Without this,
- // a legacy event (tickets.enabled=false) with membersOnly=true returns a
- // free guest ticket and the availability endpoint shows a registration form
- // that the server then 403s on submit.
- if (event.membersOnly && !accessMember) {
- return null;
- }
-
if (!event.tickets?.enabled) {
// Legacy pricing model
if (event.pricing?.paymentRequired && !event.pricing?.isFree) {
diff --git a/tests/client/composables/useMemberPayment.test.js b/tests/client/composables/useMemberPayment.test.js
deleted file mode 100644
index 2a5e1dd..0000000
--- a/tests/client/composables/useMemberPayment.test.js
+++ /dev/null
@@ -1,145 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-import { ref } from 'vue'
-import { useMemberPayment } from '../../../app/composables/useMemberPayment.js'
-
-// Stub Vue's ref/readonly as Nuxt auto-imports
-vi.stubGlobal('ref', ref)
-vi.stubGlobal('readonly', (v) => v)
-
-const memberData = ref(null)
-const checkMemberStatus = vi.fn()
-vi.stubGlobal('useAuth', () => ({ memberData, checkMemberStatus }))
-
-const initializeHelcimPay = vi.fn()
-const verifyPayment = vi.fn()
-const cleanupHelcimPay = vi.fn()
-vi.stubGlobal('useHelcimPay', () => ({
- initializeHelcimPay,
- verifyPayment,
- cleanup: cleanupHelcimPay,
-}))
-
-const $fetch = vi.fn()
-vi.stubGlobal('$fetch', $fetch)
-
-describe('useMemberPayment.initiatePaymentSetup — shortcut path', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- memberData.value = null
- $fetch.mockReset()
- })
-
- it('skips getOrCreateCustomer when both helcim ids are cached AND a card is on file', async () => {
- memberData.value = {
- helcimCustomerId: 'cust-123',
- helcimCustomerCode: 'CST-ABC',
- contributionAmount: 15,
- }
-
- $fetch.mockImplementation((path) => {
- if (path === '/api/helcim/existing-card') {
- return Promise.resolve({ cardToken: 'tok-xyz' })
- }
- if (path === '/api/helcim/subscription') {
- return Promise.resolve({ success: true })
- }
- return Promise.reject(new Error(`Unexpected $fetch call: ${path}`))
- })
-
- const { initiatePaymentSetup } = useMemberPayment()
- const result = await initiatePaymentSetup()
-
- expect(result.success).toBe(true)
-
- // The whole point: get-or-create-customer was NOT called.
- const calledPaths = $fetch.mock.calls.map((c) => c[0])
- expect(calledPaths).not.toContain('/api/helcim/get-or-create-customer')
- expect(calledPaths).not.toContain('/api/helcim/customer-code')
-
- // We did call existing-card (once) and subscription (once).
- expect(calledPaths.filter((p) => p === '/api/helcim/existing-card')).toHaveLength(1)
- expect(calledPaths.filter((p) => p === '/api/helcim/subscription')).toHaveLength(1)
-
- // HelcimPay modal not opened — card was already on file.
- expect(initializeHelcimPay).not.toHaveBeenCalled()
- expect(verifyPayment).not.toHaveBeenCalled()
-
- // Subscription called with the cached id/code from memberData.
- const subscriptionCall = $fetch.mock.calls.find((c) => c[0] === '/api/helcim/subscription')
- expect(subscriptionCall[1].body).toMatchObject({
- customerId: 'cust-123',
- customerCode: 'CST-ABC',
- cardToken: 'tok-xyz',
- contributionAmount: 15,
- })
- })
-
- it('falls through to get-or-create-customer when helcimCustomerCode is missing', async () => {
- memberData.value = {
- helcimCustomerId: 'cust-123',
- // helcimCustomerCode missing — must NOT take shortcut
- contributionAmount: 15,
- }
-
- $fetch.mockImplementation((path) => {
- if (path === '/api/helcim/customer-code') {
- return Promise.resolve({ customerId: 'cust-123', customerCode: 'CST-FRESH' })
- }
- if (path === '/api/helcim/existing-card') {
- return Promise.resolve({ cardToken: 'tok-xyz' })
- }
- if (path === '/api/helcim/subscription') {
- return Promise.resolve({ success: true })
- }
- return Promise.reject(new Error(`Unexpected $fetch call: ${path}`))
- })
-
- const { initiatePaymentSetup } = useMemberPayment()
- await initiatePaymentSetup()
-
- const calledPaths = $fetch.mock.calls.map((c) => c[0])
- // Existing helcimCustomerId path -> /api/helcim/customer-code is called.
- expect(calledPaths).toContain('/api/helcim/customer-code')
- })
-
- it('falls through to get-or-create-customer when no card is on file', async () => {
- memberData.value = {
- helcimCustomerId: 'cust-123',
- helcimCustomerCode: 'CST-ABC',
- contributionAmount: 15,
- }
-
- initializeHelcimPay.mockResolvedValue(undefined)
- verifyPayment.mockResolvedValue({ success: true, cardToken: 'tok-new' })
-
- let existingCardCalls = 0
- $fetch.mockImplementation((path) => {
- if (path === '/api/helcim/existing-card') {
- existingCardCalls++
- return Promise.resolve(null) // no card on file
- }
- if (path === '/api/helcim/customer-code') {
- return Promise.resolve({ customerId: 'cust-123', customerCode: 'CST-ABC' })
- }
- if (path === '/api/helcim/verify-payment') {
- return Promise.resolve({ success: true })
- }
- if (path === '/api/helcim/subscription') {
- return Promise.resolve({ success: true })
- }
- return Promise.reject(new Error(`Unexpected $fetch call: ${path}`))
- })
-
- const { initiatePaymentSetup } = useMemberPayment()
- await initiatePaymentSetup()
-
- // Falls into the full flow — modal opens, verify runs.
- expect(initializeHelcimPay).toHaveBeenCalled()
- expect(verifyPayment).toHaveBeenCalled()
-
- const calledPaths = $fetch.mock.calls.map((c) => c[0])
- expect(calledPaths).toContain('/api/helcim/customer-code')
- // existing-card was reused from the shortcut probe — should not refetch.
- expect(existingCardCalls).toBe(1)
- })
-})
diff --git a/tests/server/api/activation-auto-flag.test.js b/tests/server/api/activation-auto-flag.test.js
deleted file mode 100644
index 2895506..0000000
--- a/tests/server/api/activation-auto-flag.test.js
+++ /dev/null
@@ -1,211 +0,0 @@
-// Spec: docs/specs/wave-based-slack-onboarding.md
-// Test plan: docs/specs/wave-based-slack-onboarding-tests.md §3 + §4
-//
-// Verifies that the three self-serve activation paths invoke
-// `autoFlagPreExistingSlackAccess`, while the two admin-create paths do not.
-//
-// `autoFlagPreExistingSlackAccess` is auto-imported by Nitro at runtime; in
-// tests it's stubbed as a global in tests/server/setup.js. Tests grab the stub
-// off `globalThis` and reset it per-case.
-
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-
-import Member from '../../../server/models/member.js'
-import { requireAuth } from '../../../server/utils/auth.js'
-import { requiresPayment } from '../../../server/config/contributions.js'
-import { sendWelcomeEmail } from '../../../server/utils/resend.js'
-import { validateBody } from '../../../server/utils/validateBody.js'
-// jwt and the auto-flag helper are mocked via globals/vi.mock
-import PreRegistration from '../../../server/models/preRegistration.js'
-import { createHelcimCustomer } from '../../../server/utils/helcim.js'
-import subscriptionHandler from '../../../server/api/helcim/subscription.post.js'
-import membersCreateHandler from '../../../server/api/members/create.post.js'
-import inviteAcceptHandler from '../../../server/api/invite/accept.post.js'
-import { createMockEvent } from '../helpers/createMockEvent.js'
-
-vi.mock('../../../server/models/member.js', () => {
- const mockSave = vi.fn().mockResolvedValue(undefined)
- function MockMember(data) {
- Object.assign(this, data)
- this._id = 'new-member-123'
- this.status = data.status || 'pending_payment'
- this.save = mockSave
- }
- MockMember.findOne = vi.fn()
- MockMember.findOneAndUpdate = vi.fn()
- MockMember.findById = vi.fn()
- MockMember.findByIdAndUpdate = vi.fn()
- MockMember.create = vi.fn()
- MockMember._mockSave = mockSave
- return { default: MockMember }
-})
-vi.mock('../../../server/models/preRegistration.js', () => ({
- default: { findById: vi.fn(), findByIdAndUpdate: vi.fn() }
-}))
-vi.mock('../../../server/utils/mongoose.js', () => ({ connectDB: vi.fn() }))
-vi.mock('../../../server/utils/auth.js', () => ({
- requireAuth: vi.fn(),
- getSignupBridgeMember: vi.fn().mockResolvedValue(null),
- setAuthCookie: vi.fn()
-}))
-vi.mock('../../../server/utils/slack.ts', () => ({
- getSlackService: vi.fn().mockReturnValue(null)
-}))
-vi.mock('../../../server/config/contributions.js', () => ({
- requiresPayment: vi.fn(),
- getHelcimPlanId: vi.fn()
-}))
-vi.mock('../../../server/utils/resend.js', () => ({
- sendWelcomeEmail: vi.fn().mockResolvedValue({ success: true })
-}))
-vi.mock('../../../server/utils/helcim.js', () => ({
- createHelcimSubscription: vi.fn(),
- generateIdempotencyKey: vi.fn().mockReturnValue('idem-key-1'),
- listHelcimCustomerTransactions: vi.fn().mockResolvedValue([]),
- createHelcimCustomer: vi.fn()
-}))
-vi.mock('../../../server/utils/payments.js', () => ({
- upsertPaymentFromHelcim: vi.fn().mockResolvedValue({ created: true, payment: { _id: 'p1' } })
-}))
-vi.mock('../../../server/utils/validateBody.js', () => ({ validateBody: vi.fn() }))
-vi.mock('../../../server/utils/schemas.js', () => ({ memberCreateSchema: {} }))
-vi.mock('../../../server/utils/memberNumber.js', () => ({
- assignMemberNumber: vi.fn().mockResolvedValue(1)
-}))
-vi.mock('jsonwebtoken', () => {
- const verify = vi.fn(() => ({ type: 'prereg-invite', preRegistrationId: 'prereg-1' }))
- return {
- default: { verify },
- verify
- }
-})
-
-vi.stubGlobal('helcimSubscriptionSchema', {})
-vi.stubGlobal('inviteAcceptSchema', {})
-
-const autoFlagStub = globalThis.autoFlagPreExistingSlackAccess
-
-// ---------------------------------------------------------------------------
-// 3.1 — Helcim subscription success calls helper
-// ---------------------------------------------------------------------------
-describe('POST /api/helcim/subscription — auto-flag wiring (3.1)', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- autoFlagStub.mockClear()
- requireAuth.mockResolvedValue(undefined)
- requiresPayment.mockReturnValue(false)
- })
-
- it('calls autoFlagPreExistingSlackAccess after successful free-tier activation', async () => {
- const mockMember = {
- _id: 'member-1',
- email: 'free@example.com',
- name: 'Free Tier',
- circle: 'community',
- contributionAmount: 0,
- status: 'active'
- }
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-1', status: 'pending_payment' })
- Member.findById.mockResolvedValue(mockMember)
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/helcim/subscription',
- body: { customerId: 'cust-1', contributionAmount: 0, customerCode: 'code-1' }
- })
-
- await subscriptionHandler(event)
-
- expect(autoFlagStub).toHaveBeenCalledTimes(1)
- expect(autoFlagStub).toHaveBeenCalledWith(
- expect.objectContaining({ _id: 'member-1', email: 'free@example.com' })
- )
- })
-})
-
-// ---------------------------------------------------------------------------
-// 3.2 — Free-tier /api/invite/accept calls helper
-// ---------------------------------------------------------------------------
-describe('POST /api/invite/accept (free tier) — auto-flag wiring (3.2)', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- autoFlagStub.mockClear()
- PreRegistration.findById.mockResolvedValue({
- _id: 'prereg-1',
- email: 'invitee@example.com',
- status: 'pending'
- })
- PreRegistration.findByIdAndUpdate.mockResolvedValue(undefined)
- Member.findOne.mockResolvedValue(null)
- Member.create.mockImplementation(async (data) => ({
- _id: 'new-member-via-invite',
- ...data
- }))
- // Handler uses Nitro auto-imported validateBody (global), not the explicit import
- globalThis.validateBody.mockResolvedValue({
- token: 'tok',
- preRegistrationId: 'prereg-1',
- name: 'New Invitee',
- circle: 'community',
- contributionAmount: 0
- })
- })
-
- it('calls helper after Member.create on the free-tier branch', async () => {
- const event = createMockEvent({ method: 'POST', path: '/api/invite/accept' })
-
- await inviteAcceptHandler(event)
-
- expect(autoFlagStub).toHaveBeenCalledTimes(1)
- expect(autoFlagStub).toHaveBeenCalledWith(
- expect.objectContaining({ _id: 'new-member-via-invite', email: 'invitee@example.com' })
- )
- })
-
- it('paid-tier branch does NOT call helper (3.3)', async () => {
- globalThis.validateBody.mockResolvedValue({
- token: 'tok',
- preRegistrationId: 'prereg-1',
- name: 'Paid Invitee',
- circle: 'community',
- contributionAmount: 25
- })
- createHelcimCustomer.mockResolvedValue({ id: 'cust-2', customerCode: 'code-2' })
-
- const event = createMockEvent({ method: 'POST', path: '/api/invite/accept' })
-
- await inviteAcceptHandler(event)
-
- expect(autoFlagStub).not.toHaveBeenCalled()
- })
-})
-
-// ---------------------------------------------------------------------------
-// 3.8 — members/create.post.js calls helper instead of legacy inviteToSlack
-// ---------------------------------------------------------------------------
-describe('POST /api/members/create — auto-flag wiring (3.8)', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- autoFlagStub.mockClear()
- Member.findOne.mockResolvedValue(null)
- Member._mockSave.mockResolvedValue(undefined)
- sendWelcomeEmail.mockResolvedValue({ success: true })
- validateBody.mockResolvedValue({
- email: 'mc@example.com',
- name: 'MC Member',
- circle: 'community',
- contributionAmount: 0
- })
- })
-
- it('calls helper instead of legacy inviteToSlack', async () => {
- const event = createMockEvent({ method: 'POST', path: '/api/members/create' })
-
- await membersCreateHandler(event)
-
- expect(autoFlagStub).toHaveBeenCalledTimes(1)
- expect(autoFlagStub).toHaveBeenCalledWith(
- expect.objectContaining({ email: 'mc@example.com' })
- )
- })
-})
diff --git a/tests/server/api/admin-members-slack-status.test.js b/tests/server/api/admin-members-slack-status.test.js
deleted file mode 100644
index 7f06c1f..0000000
--- a/tests/server/api/admin-members-slack-status.test.js
+++ /dev/null
@@ -1,186 +0,0 @@
-// Spec: docs/specs/wave-based-slack-onboarding.md
-// Test plan: docs/specs/wave-based-slack-onboarding-tests.md §5
-//
-// SCAFFOLD: `describe.skip` until the route at
-// server/api/admin/members/[id]/slack-status.patch.js
-// exists. Unskip during implementation (TDD).
-
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-
-vi.mock('../../../server/models/member.js', () => ({
- default: {
- findById: vi.fn(),
- findByIdAndUpdate: vi.fn()
- }
-}))
-
-vi.mock('../../../server/utils/mongoose.js', () => ({
- connectDB: vi.fn()
-}))
-
-vi.mock('../../../server/utils/validateBody.js', () => ({
- validateBody: vi.fn()
-}))
-
-vi.mock('../../../server/utils/schemas.js', () => ({
- adminSlackStatusSchema: {}
-}))
-
-// Slack service must NOT be invoked from this endpoint.
-vi.mock('../../../server/utils/slack.ts', () => ({
- getSlackService: vi.fn().mockReturnValue({
- findUserByEmail: vi.fn()
- })
-}))
-
-describe('PATCH /api/admin/members/[id]/slack-status', () => {
- let handler
- let Member
- let validateBody
- let getSlackService
-
- beforeEach(async () => {
- vi.clearAllMocks()
-
- Member = (await import('../../../server/models/member.js')).default
- validateBody = (await import('../../../server/utils/validateBody.js')).validateBody
- getSlackService = (await import('../../../server/utils/slack.ts')).getSlackService
-
- handler = (
- await import('../../../server/api/admin/members/[id]/slack-status.patch.js')
- ).default
-
- globalThis.requireAdmin.mockResolvedValue({
- _id: { toString: () => 'admin-1' }
- })
- validateBody.mockResolvedValue({ slackInvited: true })
- vi.stubGlobal('getRouterParam', vi.fn().mockReturnValue('member-1'))
- globalThis.logActivity.mockClear?.()
- })
-
- function makeEvent() {
- return { node: { req: {}, res: {} } } // handler reads via auto-imports + stubs
- }
-
- describe('auth (5.4 / 5.5)', () => {
- it('rejects unauthenticated requests with 401', async () => {
- globalThis.requireAdmin.mockRejectedValue(
- createError({ statusCode: 401, statusMessage: 'Unauthorized' })
- )
- await expect(handler(makeEvent())).rejects.toMatchObject({ statusCode: 401 })
- })
-
- it('rejects non-admin members with 403', async () => {
- globalThis.requireAdmin.mockRejectedValue(
- createError({ statusCode: 403, statusMessage: 'Forbidden' })
- )
- await expect(handler(makeEvent())).rejects.toMatchObject({ statusCode: 403 })
- })
- })
-
- describe('validation (5.6)', () => {
- it('rejects invalid body via validateBody (zod)', async () => {
- validateBody.mockRejectedValue(
- createError({ statusCode: 400, statusMessage: 'Invalid body' })
- )
- await expect(handler(makeEvent())).rejects.toMatchObject({ statusCode: 400 })
- })
- })
-
- describe('member lookup (5.7)', () => {
- it('returns 404 when member does not exist', async () => {
- Member.findById.mockResolvedValue(null)
- await expect(handler(makeEvent())).rejects.toMatchObject({ statusCode: 404 })
- })
- })
-
- describe('happy path: false → true transition (5.1)', () => {
- it('marks member invited, stamps date, logs activity', async () => {
- Member.findById.mockResolvedValue({
- _id: 'member-1',
- slackInvited: false,
- slackInvitedAt: undefined
- })
- const updated = {
- _id: 'member-1',
- slackInvited: true,
- slackInvitedAt: new Date('2026-04-29T00:00:00Z')
- }
- Member.findByIdAndUpdate.mockResolvedValue(updated)
-
- const result = await handler(makeEvent())
-
- expect(Member.findByIdAndUpdate).toHaveBeenCalledWith(
- 'member-1',
- expect.objectContaining({
- slackInvited: true,
- slackInvitedAt: expect.any(Date)
- }),
- expect.objectContaining({ runValidators: false, new: true })
- )
- expect(globalThis.logActivity).toHaveBeenCalledWith(
- 'member-1',
- 'slack_invited_manually',
- expect.any(Object),
- expect.objectContaining({ performedBy: expect.anything() })
- )
- expect(result).toMatchObject({ success: true })
- expect(result.member).toMatchObject({
- slackInvited: true,
- slackInvitedAt: expect.any(Date)
- })
- })
-
- it('uses findByIdAndUpdate with runValidators:false (5.9)', async () => {
- Member.findById.mockResolvedValue({ _id: 'member-1', slackInvited: false })
- Member.findByIdAndUpdate.mockResolvedValue({ _id: 'member-1', slackInvited: true })
-
- await handler(makeEvent())
-
- const opts = Member.findByIdAndUpdate.mock.calls.at(-1)?.[2]
- expect(opts).toMatchObject({ runValidators: false })
- })
- })
-
- describe('idempotency: true → true (5.2)', () => {
- it('preserves original slackInvitedAt and writes no new activity-log entry', async () => {
- const original = new Date('2026-01-15T00:00:00Z')
- Member.findById.mockResolvedValue({
- _id: 'member-1',
- slackInvited: true,
- slackInvitedAt: original
- })
-
- await handler(makeEvent())
-
- // Either the endpoint short-circuits with no write, OR the update payload
- // carefully omits slackInvitedAt. Both are acceptable; assert outcome:
- const updateCall = Member.findByIdAndUpdate.mock.calls.at(-1)
- if (updateCall) {
- expect(updateCall[1]).not.toHaveProperty('slackInvitedAt')
- }
- expect(globalThis.logActivity).not.toHaveBeenCalled()
- })
- })
-
- describe('no Slack API call (5.3)', () => {
- it('does not invoke any Slack write API on success', async () => {
- Member.findById.mockResolvedValue({ _id: 'member-1', slackInvited: false })
- Member.findByIdAndUpdate.mockResolvedValue({ _id: 'member-1', slackInvited: true })
-
- await handler(makeEvent())
-
- const slack = getSlackService()
- expect(slack.findUserByEmail).not.toHaveBeenCalled()
- })
- })
-
- describe('source inspection (handler shape)', () => {
- // Mirrors the pattern in admin-role-patch.test.js — verifies route
- // construction order without booting the handler.
- it.todo('calls requireAdmin before validateBody')
- it.todo('does not import getSlackService')
- })
-
- it.todo('PATCH { slackInvited: false } behavior — decided in spec gap #2 (5.11)')
-})
diff --git a/tests/server/api/auth-login.test.js b/tests/server/api/auth-login.test.js
index 8c692e7..9e98c4b 100644
--- a/tests/server/api/auth-login.test.js
+++ b/tests/server/api/auth-login.test.js
@@ -1,10 +1,5 @@
import { describe, it, expect, vi, beforeEach } from 'vitest'
-import Member from '../../../server/models/member.js'
-import loginHandler from '../../../server/api/auth/login.post.js'
-import { resetRateLimit } from '../../../server/utils/rateLimit.js'
-import { createMockEvent } from '../helpers/createMockEvent.js'
-
vi.mock('../../../server/models/member.js', () => ({
default: { findOne: vi.fn(), findByIdAndUpdate: vi.fn() }
}))
@@ -25,10 +20,13 @@ vi.mock('resend', () => ({
}
}))
+import Member from '../../../server/models/member.js'
+import loginHandler from '../../../server/api/auth/login.post.js'
+import { createMockEvent } from '../helpers/createMockEvent.js'
+
describe('auth login endpoint', () => {
beforeEach(() => {
vi.clearAllMocks()
- resetRateLimit()
})
it('returns generic success message for existing member', async () => {
@@ -112,92 +110,4 @@ describe('auth login endpoint', () => {
statusMessage: 'Validation failed'
})
})
-
- describe('rate limiting', () => {
- it('allows up to 5 login attempts from a single IP', async () => {
- Member.findOne.mockResolvedValue({ _id: 'member-123', email: 'ok@example.com' })
-
- // 5 calls succeed (each with a unique email so we don't hit email limit)
- for (let i = 0; i < 5; i++) {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/login',
- body: { email: `u${i}@example.com` },
- headers: { host: 'localhost:3000' },
- remoteAddress: '10.0.0.1'
- })
- const result = await loginHandler(event)
- expect(result.success).toBe(true)
- }
- })
-
- it('rate-limits a single IP after 5 login attempts', async () => {
- Member.findOne.mockResolvedValue({ _id: 'member-123', email: 'ok@example.com' })
-
- for (let i = 0; i < 5; i++) {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/login',
- body: { email: `u${i}@example.com` },
- headers: { host: 'localhost:3000' },
- remoteAddress: '10.0.0.1'
- })
- await loginHandler(event)
- }
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/login',
- body: { email: 'u6@example.com' },
- headers: { host: 'localhost:3000' },
- remoteAddress: '10.0.0.1'
- })
- await expect(loginHandler(event)).rejects.toMatchObject({
- statusCode: 429
- })
- })
-
- it('allows up to 3 login attempts for a single email', async () => {
- Member.findOne.mockResolvedValue({ _id: 'member-123', email: 'shared@example.com' })
-
- // 3 calls from different IPs succeed
- for (let i = 0; i < 3; i++) {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/login',
- body: { email: 'shared@example.com' },
- headers: { host: 'localhost:3000' },
- remoteAddress: `10.0.0.${i + 10}`
- })
- const result = await loginHandler(event)
- expect(result.success).toBe(true)
- }
- })
-
- it('rate-limits a single email after 3 login attempts (different IPs)', async () => {
- Member.findOne.mockResolvedValue({ _id: 'member-123', email: 'shared@example.com' })
-
- for (let i = 0; i < 3; i++) {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/login',
- body: { email: 'shared@example.com' },
- headers: { host: 'localhost:3000' },
- remoteAddress: `10.0.0.${i + 10}`
- })
- await loginHandler(event)
- }
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/login',
- body: { email: 'shared@example.com' },
- headers: { host: 'localhost:3000' },
- remoteAddress: '10.0.0.99'
- })
- await expect(loginHandler(event)).rejects.toMatchObject({
- statusCode: 429
- })
- })
- })
})
diff --git a/tests/server/api/auth-verify.test.js b/tests/server/api/auth-verify.test.js
index 4cdfdec..a16234d 100644
--- a/tests/server/api/auth-verify.test.js
+++ b/tests/server/api/auth-verify.test.js
@@ -1,11 +1,5 @@
import { describe, it, expect, vi, beforeEach } from 'vitest'
-import jwt from 'jsonwebtoken'
-import Member from '../../../server/models/member.js'
-import verifyHandler from '../../../server/api/auth/verify.post.js'
-import { resetRateLimit } from '../../../server/utils/rateLimit.js'
-import { createMockEvent } from '../helpers/createMockEvent.js'
-
vi.mock('../../../server/models/member.js', () => ({
default: { findById: vi.fn(), findByIdAndUpdate: vi.fn() }
}))
@@ -21,6 +15,11 @@ vi.mock('jsonwebtoken', () => ({
}
}))
+import jwt from 'jsonwebtoken'
+import Member from '../../../server/models/member.js'
+import verifyHandler from '../../../server/api/auth/verify.post.js'
+import { createMockEvent } from '../helpers/createMockEvent.js'
+
const baseMember = {
_id: 'member-123',
email: 'test@example.com',
@@ -34,7 +33,6 @@ const baseMember = {
describe('auth verify endpoint', () => {
beforeEach(() => {
vi.clearAllMocks()
- resetRateLimit()
})
it('rejects missing token with 400', async () => {
@@ -46,94 +44,10 @@ describe('auth verify endpoint', () => {
await expect(verifyHandler(event)).rejects.toMatchObject({
statusCode: 400,
- statusMessage: 'Validation failed'
+ statusMessage: 'Token is required'
})
})
- it('rejects non-string number token with 400 before jwt.verify', async () => {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/verify',
- body: { token: 123 }
- })
-
- await expect(verifyHandler(event)).rejects.toMatchObject({
- statusCode: 400,
- statusMessage: 'Validation failed'
- })
- expect(jwt.verify).not.toHaveBeenCalled()
- })
-
- it('rejects non-string boolean token with 400 before jwt.verify', async () => {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/verify',
- body: { token: true }
- })
-
- await expect(verifyHandler(event)).rejects.toMatchObject({
- statusCode: 400,
- statusMessage: 'Validation failed'
- })
- expect(jwt.verify).not.toHaveBeenCalled()
- })
-
- it('rejects empty string token with 400 before jwt.verify', async () => {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/verify',
- body: { token: '' }
- })
-
- await expect(verifyHandler(event)).rejects.toMatchObject({
- statusCode: 400,
- statusMessage: 'Validation failed'
- })
- expect(jwt.verify).not.toHaveBeenCalled()
- })
-
- it('rejects oversized token (>2000 chars) with 400 before jwt.verify', async () => {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/verify',
- body: { token: 'x'.repeat(2001) }
- })
-
- await expect(verifyHandler(event)).rejects.toMatchObject({
- statusCode: 400,
- statusMessage: 'Validation failed'
- })
- expect(jwt.verify).not.toHaveBeenCalled()
- })
-
- it('rejects null body with 400 before jwt.verify', async () => {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/verify',
- body: null
- })
-
- await expect(verifyHandler(event)).rejects.toMatchObject({
- statusCode: 400,
- statusMessage: 'Validation failed'
- })
- expect(jwt.verify).not.toHaveBeenCalled()
- })
-
- it('rejects unknown extra keys with 400 before jwt.verify (strict mode)', async () => {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/verify',
- body: { token: 'valid-token', email: 'extra@example.com' }
- })
-
- await expect(verifyHandler(event)).rejects.toMatchObject({
- statusCode: 400,
- statusMessage: 'Validation failed'
- })
- expect(jwt.verify).not.toHaveBeenCalled()
- })
-
it('rejects invalid JWT with 401', async () => {
jwt.verify.mockImplementation(() => { throw new Error('invalid') })
@@ -304,79 +218,4 @@ describe('auth verify endpoint', () => {
expect(result).toEqual({ success: true, redirectUrl: '/member/dashboard' })
})
-
- describe('rate limiting', () => {
- it('allows up to 5 verify attempts from a single IP', async () => {
- jwt.verify.mockImplementation(() => { throw new Error('invalid') })
-
- // 5 calls reach jwt.verify (and fail with 401, but not 429)
- for (let i = 0; i < 5; i++) {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/verify',
- body: { token: 'bad-token' },
- remoteAddress: '10.0.0.1'
- })
- await expect(verifyHandler(event)).rejects.toMatchObject({
- statusCode: 401
- })
- }
- expect(jwt.verify).toHaveBeenCalledTimes(5)
- })
-
- it('rate-limits a single IP after 5 verify attempts', async () => {
- jwt.verify.mockImplementation(() => { throw new Error('invalid') })
-
- for (let i = 0; i < 5; i++) {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/verify',
- body: { token: 'bad-token' },
- remoteAddress: '10.0.0.1'
- })
- await expect(verifyHandler(event)).rejects.toMatchObject({
- statusCode: 401
- })
- }
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/verify',
- body: { token: 'bad-token' },
- remoteAddress: '10.0.0.1'
- })
- await expect(verifyHandler(event)).rejects.toMatchObject({
- statusCode: 429
- })
- // Rate limit fires before jwt.verify on the 6th call
- expect(jwt.verify).toHaveBeenCalledTimes(5)
- })
-
- it('does not block different IPs (per-IP keying)', async () => {
- jwt.verify.mockImplementation(() => { throw new Error('invalid') })
-
- for (let i = 0; i < 5; i++) {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/verify',
- body: { token: 'bad-token' },
- remoteAddress: '10.0.0.1'
- })
- await expect(verifyHandler(event)).rejects.toMatchObject({
- statusCode: 401
- })
- }
-
- // A different IP should still be allowed.
- const event = createMockEvent({
- method: 'POST',
- path: '/api/auth/verify',
- body: { token: 'bad-token' },
- remoteAddress: '10.0.0.2'
- })
- await expect(verifyHandler(event)).rejects.toMatchObject({
- statusCode: 401
- })
- })
- })
})
diff --git a/tests/server/api/cancel-subscription.test.js b/tests/server/api/cancel-subscription.test.js
deleted file mode 100644
index bd509fb..0000000
--- a/tests/server/api/cancel-subscription.test.js
+++ /dev/null
@@ -1,201 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-
-import Member from '../../../server/models/member.js'
-import { cancelHelcimSubscription } from '../../../server/utils/helcim.js'
-import handler from '../../../server/api/members/cancel-subscription.post.js'
-import { createMockEvent } from '../helpers/createMockEvent.js'
-
-vi.mock('../../../server/models/member.js', () => ({
- default: { findByIdAndUpdate: vi.fn() }
-}))
-vi.mock('../../../server/utils/mongoose.js', () => ({ connectDB: vi.fn() }))
-vi.mock('../../../server/utils/auth.js', () => ({ requireAuth: vi.fn() }))
-vi.mock('../../../server/utils/helcim.js', () => ({
- cancelHelcimSubscription: vi.fn(),
-}))
-
-// Nitro auto-imports — stub as globals
-const logActivityMock = vi.fn()
-vi.stubGlobal('logActivity', logActivityMock)
-
-function setMember(mockMember) {
- globalThis.requireAuth = vi.fn().mockResolvedValue(mockMember)
-}
-
-function buildEvent() {
- return createMockEvent({
- method: 'POST',
- path: '/api/members/cancel-subscription',
- body: {},
- })
-}
-
-describe('cancel-subscription endpoint', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- })
-
- it('happy path: active paid member → cancels Helcim, drops to free tier (status stays active), returns success', async () => {
- const mockMember = {
- _id: 'member-1',
- status: 'active',
- contributionAmount: 15,
- helcimSubscriptionId: 'sub-1',
- }
- setMember(mockMember)
- cancelHelcimSubscription.mockResolvedValue({})
- Member.findByIdAndUpdate.mockResolvedValue({})
-
- const result = await handler(buildEvent())
-
- expect(cancelHelcimSubscription).toHaveBeenCalledWith('sub-1')
- expect(Member.findByIdAndUpdate).toHaveBeenCalledWith(
- 'member-1',
- expect.objectContaining({
- $set: expect.objectContaining({
- status: 'active',
- contributionAmount: 0,
- helcimSubscriptionId: null,
- paymentMethod: 'none',
- }),
- $unset: expect.objectContaining({ nextBillingDate: 1 }),
- }),
- { runValidators: false }
- )
- // Per Fix #9: lastCancelledAt must be set as a Date
- const updateArg = Member.findByIdAndUpdate.mock.calls[0][1]
- expect(updateArg.$set.lastCancelledAt).toBeInstanceOf(Date)
- expect(result).toEqual(expect.objectContaining({
- success: true,
- message: 'Subscription cancelled successfully',
- status: 'active',
- contributionAmount: 0,
- }))
- })
-
- it('persists subscriptionEndDate as a Date instance', async () => {
- setMember({
- _id: 'member-2',
- status: 'active',
- contributionAmount: 5,
- helcimSubscriptionId: 'sub-2',
- })
- cancelHelcimSubscription.mockResolvedValue({})
- Member.findByIdAndUpdate.mockResolvedValue({})
-
- await handler(buildEvent())
-
- const call = Member.findByIdAndUpdate.mock.calls[0]
- expect(call[1].$set.subscriptionEndDate).toBeInstanceOf(Date)
- })
-
- it('emits subscription_cancelled activity log entry', async () => {
- setMember({
- _id: 'member-3',
- status: 'active',
- contributionAmount: 15,
- helcimSubscriptionId: 'sub-3',
- })
- cancelHelcimSubscription.mockResolvedValue({})
- Member.findByIdAndUpdate.mockResolvedValue({})
-
- await handler(buildEvent())
-
- expect(logActivityMock).toHaveBeenCalledWith(
- 'member-3',
- 'subscription_cancelled',
- expect.objectContaining({ effectiveDate: expect.any(String) })
- )
- })
-
- it('free-tier member (contributionAmount=0): no Helcim call, no DB write, returns no-op success', async () => {
- const mockMember = {
- _id: 'member-4',
- status: 'active',
- contributionAmount: 0,
- helcimSubscriptionId: null,
- }
- setMember(mockMember)
-
- const result = await handler(buildEvent())
-
- expect(cancelHelcimSubscription).not.toHaveBeenCalled()
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- expect(logActivityMock).not.toHaveBeenCalled()
- expect(result).toEqual({
- success: true,
- message: 'No active subscription to cancel',
- status: 'active',
- contributionAmount: 0,
- })
- })
-
- it('member without helcimSubscriptionId (data inconsistency): no Helcim call, no DB write', async () => {
- setMember({
- _id: 'member-5',
- status: 'active',
- contributionAmount: 15,
- helcimSubscriptionId: null,
- })
-
- const result = await handler(buildEvent())
-
- expect(cancelHelcimSubscription).not.toHaveBeenCalled()
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- expect(result.success).toBe(true)
- expect(result.message).toBe('No active subscription to cancel')
- })
-
- it('Helcim cancel failure: swallows error, still updates Member to free tier (status stays active)', async () => {
- setMember({
- _id: 'member-6',
- status: 'active',
- contributionAmount: 15,
- helcimSubscriptionId: 'sub-6',
- })
- cancelHelcimSubscription.mockRejectedValue(new Error('Helcim 503'))
- Member.findByIdAndUpdate.mockResolvedValue({})
-
- const result = await handler(buildEvent())
-
- expect(cancelHelcimSubscription).toHaveBeenCalledWith('sub-6')
- expect(Member.findByIdAndUpdate).toHaveBeenCalledWith(
- 'member-6',
- expect.objectContaining({
- $set: expect.objectContaining({ status: 'active', helcimSubscriptionId: null }),
- }),
- { runValidators: false }
- )
- expect(result.success).toBe(true)
- expect(result.status).toBe('active')
- })
-
- it('unauthenticated: requireAuth throws → handler rejects with that statusCode', async () => {
- globalThis.requireAuth = vi.fn().mockRejectedValue(
- Object.assign(new Error('Unauthorized'), { statusCode: 401 })
- )
-
- await expect(handler(buildEvent())).rejects.toMatchObject({
- statusCode: 401,
- })
-
- expect(cancelHelcimSubscription).not.toHaveBeenCalled()
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- })
-
- it('Mongo update failure: rejects with 500', async () => {
- setMember({
- _id: 'member-7',
- status: 'active',
- contributionAmount: 15,
- helcimSubscriptionId: 'sub-7',
- })
- cancelHelcimSubscription.mockResolvedValue({})
- Member.findByIdAndUpdate.mockRejectedValue(new Error('Mongo down'))
-
- await expect(handler(buildEvent())).rejects.toMatchObject({
- statusCode: 500,
- statusMessage: 'Mongo down',
- })
- })
-})
diff --git a/tests/server/api/event-save-validators.test.js b/tests/server/api/event-save-validators.test.js
deleted file mode 100644
index 4645d13..0000000
--- a/tests/server/api/event-save-validators.test.js
+++ /dev/null
@@ -1,139 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-
-import Event from '../../../server/models/event.js'
-import Member from '../../../server/models/member.js'
-import { waitlistSchema, waitlistDeleteSchema } from '../../../server/utils/schemas.js'
-import waitlistPostHandler from '../../../server/api/events/[id]/waitlist.post.js'
-import waitlistDeleteHandler from '../../../server/api/events/[id]/waitlist.delete.js'
-import { createMockEvent } from '../helpers/createMockEvent.js'
-
-vi.mock('../../../server/models/event.js', () => ({
- default: { findOne: vi.fn() }
-}))
-vi.mock('../../../server/models/member.js', () => ({
- default: { findOne: vi.fn() }
-}))
-vi.mock('../../../server/utils/mongoose.js', () => ({ connectDB: vi.fn() }))
-
-vi.stubGlobal('waitlistSchema', waitlistSchema)
-vi.stubGlobal('waitlistDeleteSchema', waitlistDeleteSchema)
-
-// Override the global validateBody stub so the route actually parses against
-// the schema it passed in.
-vi.stubGlobal('validateBody', vi.fn(async (event, schema) => {
- const body = await readBody(event)
- return schema.parse(body)
-}))
-
-/**
- * Build a mock Event document whose `save()` simulates the legacy validator
- * problem we're protecting against: when called WITHOUT `validateBeforeSave:
- * false` it throws (mimicking a stale `location` validator failing on
- * unrelated writes). When called WITH `validateBeforeSave: false` it resolves
- * normally. The route is correct iff it bypasses validators.
- */
-function makeMockEvent(overrides = {}) {
- const doc = {
- _id: 'event-1',
- slug: 'event-slug',
- tickets: {
- waitlist: {
- enabled: true,
- maxSize: 10,
- entries: [],
- },
- },
- registrations: [],
- ...overrides,
- }
- doc.save = vi.fn(async (options) => {
- if (!options || options.validateBeforeSave !== false) {
- const err = new Error('Validation failed: location: legacy field invalid')
- err.name = 'ValidationError'
- throw err
- }
- return doc
- })
- return doc
-}
-
-function buildPostEvent(body) {
- const ev = createMockEvent({
- method: 'POST',
- path: '/api/events/event-slug/waitlist',
- body,
- })
- ev.context = { params: { id: 'event-slug' } }
- return ev
-}
-
-function buildDeleteEvent(body) {
- const ev = createMockEvent({
- method: 'DELETE',
- path: '/api/events/event-slug/waitlist',
- body,
- })
- ev.context = { params: { id: 'event-slug' } }
- return ev
-}
-
-describe('POST /api/events/[id]/waitlist — bypasses save validators', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- Member.findOne.mockResolvedValue(null)
- })
-
- it('save() succeeds because the route passes { validateBeforeSave: false }', async () => {
- const mockEvent = makeMockEvent()
- Event.findOne.mockResolvedValue(mockEvent)
-
- const result = await waitlistPostHandler(buildPostEvent({
- name: 'Waiter',
- email: 'wait@example.com',
- }))
-
- expect(result.success).toBe(true)
- expect(mockEvent.save).toHaveBeenCalledTimes(1)
- expect(mockEvent.save).toHaveBeenCalledWith({ validateBeforeSave: false })
- // Entry was actually appended.
- expect(mockEvent.tickets.waitlist.entries).toHaveLength(1)
- expect(mockEvent.tickets.waitlist.entries[0].email).toBe('wait@example.com')
- })
-})
-
-describe('DELETE /api/events/[id]/waitlist — bypasses save validators', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- })
-
- it('save() succeeds because the route passes { validateBeforeSave: false }', async () => {
- const mockEvent = makeMockEvent({
- tickets: {
- waitlist: {
- enabled: true,
- maxSize: 10,
- entries: [
- {
- name: 'Waiter',
- email: 'wait@example.com',
- membershipLevel: 'non-member',
- addedAt: new Date(),
- notified: false,
- },
- ],
- },
- },
- })
- Event.findOne.mockResolvedValue(mockEvent)
-
- const result = await waitlistDeleteHandler(buildDeleteEvent({
- email: 'wait@example.com',
- }))
-
- expect(result.success).toBe(true)
- expect(mockEvent.save).toHaveBeenCalledTimes(1)
- expect(mockEvent.save).toHaveBeenCalledWith({ validateBeforeSave: false })
- // Entry was actually removed.
- expect(mockEvent.tickets.waitlist.entries).toHaveLength(0)
- })
-})
diff --git a/tests/server/api/free-signup-flow.test.js b/tests/server/api/free-signup-flow.test.js
deleted file mode 100644
index b95b752..0000000
--- a/tests/server/api/free-signup-flow.test.js
+++ /dev/null
@@ -1,145 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-
-import Member from '../../../server/models/member.js'
-import { createHelcimCustomer } from '../../../server/utils/helcim.js'
-import customerHandler from '../../../server/api/helcim/customer.post.js'
-import subscriptionHandler from '../../../server/api/helcim/subscription.post.js'
-import { resetRateLimit } from '../../../server/utils/rateLimit.js'
-import { sendWelcomeEmail } from '../../../server/utils/resend.js'
-import { createMockEvent } from '../helpers/createMockEvent.js'
-
-// Deliberately does NOT mock server/utils/auth.js — the bridge-cookie
-// hand-off between the two handlers is the contract under test.
-
-vi.mock('../../../server/models/member.js', () => ({
- default: {
- findOne: vi.fn(),
- create: vi.fn(),
- findByIdAndUpdate: vi.fn(),
- findById: vi.fn(),
- findOneAndUpdate: vi.fn()
- }
-}))
-vi.mock('../../../server/models/preRegistration.js', () => ({
- default: { findOne: vi.fn().mockResolvedValue(null), findByIdAndUpdate: vi.fn() }
-}))
-vi.mock('../../../server/utils/mongoose.js', () => ({ connectDB: vi.fn() }))
-vi.mock('../../../server/utils/helcim.js', () => ({
- createHelcimCustomer: vi.fn(),
- createHelcimSubscription: vi.fn(),
- generateIdempotencyKey: vi.fn().mockReturnValue('idem-1'),
- listHelcimCustomerTransactions: vi.fn().mockResolvedValue([])
-}))
-vi.mock('../../../server/utils/magicLink.js', () => ({
- sendMagicLink: vi.fn().mockResolvedValue(undefined)
-}))
-vi.mock('../../../server/utils/resend.js', () => ({
- sendWelcomeEmail: vi.fn().mockResolvedValue({ success: true })
-}))
-vi.mock('../../../server/utils/slack.ts', () => ({
- getSlackService: vi.fn().mockReturnValue(null)
-}))
-vi.mock('../../../server/utils/payments.js', () => ({
- upsertPaymentFromHelcim: vi.fn().mockResolvedValue({ created: true })
-}))
-
-vi.stubGlobal('helcimCustomerSchema', {})
-vi.stubGlobal('helcimSubscriptionSchema', {})
-
-const ALLOWED_ORIGIN = 'https://ghostguild.test'
-const MEMBER_ID = '69f231152939bf109ac79d83'
-
-const SUBSCRIPTION_BODY = {
- customerId: 999,
- customerCode: 'CST999',
- contributionAmount: 0,
- cadence: 'monthly',
- cardToken: null
-}
-
-function extractBridgeCookie(event) {
- const setCookie = event.node.res.getHeader('set-cookie')
- const cookies = Array.isArray(setCookie) ? setCookie : [setCookie].filter(Boolean)
- const match = cookies.find(c => typeof c === 'string' && c.startsWith('signup-bridge='))
- if (!match) return null
- return match.match(/signup-bridge=([^;]+)/)[1]
-}
-
-describe('signup → subscription bridge-cookie hand-off', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- resetRateLimit()
- process.env.BASE_URL = ALLOWED_ORIGIN
-
- createHelcimCustomer.mockResolvedValue({ id: 999, customerCode: 'CST999' })
- })
-
- it('$0 signup: customer endpoint issues a bridge cookie that subscription endpoint accepts', async () => {
- Member.findOne.mockResolvedValue(null)
- Member.create.mockResolvedValue({
- _id: MEMBER_ID,
- email: 'free@example.com',
- name: 'Free User',
- circle: 'community',
- contributionAmount: 0,
- status: 'pending_payment'
- })
-
- const customerEvent = createMockEvent({
- method: 'POST',
- path: '/api/helcim/customer',
- headers: { origin: ALLOWED_ORIGIN },
- body: {
- name: 'Free User',
- email: 'free@example.com',
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true,
- billingAddress: { country: 'CA' }
- }
- })
-
- const result1 = await customerHandler(customerEvent)
- expect(result1.success).toBe(true)
- expect(result1.member.status).toBe('pending_payment')
-
- const bridgeToken = extractBridgeCookie(customerEvent)
- expect(bridgeToken, 'signup-bridge cookie missing on $0 signup').toBeTruthy()
-
- Member.findOneAndUpdate.mockResolvedValue({ _id: MEMBER_ID, status: 'pending_payment' })
- Member.findById.mockResolvedValue({
- _id: MEMBER_ID,
- email: 'free@example.com',
- name: 'Free User',
- circle: 'community',
- contributionAmount: 0,
- status: 'active'
- })
-
- const subscriptionEvent = createMockEvent({
- method: 'POST',
- path: '/api/helcim/subscription',
- headers: { origin: ALLOWED_ORIGIN },
- cookies: { 'signup-bridge': bridgeToken },
- body: SUBSCRIPTION_BODY
- })
-
- const result2 = await subscriptionHandler(subscriptionEvent)
- expect(result2.success).toBe(true)
- expect(result2.member.status).toBe('active')
- expect(sendWelcomeEmail).toHaveBeenCalledTimes(1)
- })
-
- it('$0 signup with no bridge cookie carried forward → subscription returns 401', async () => {
- const subscriptionEvent = createMockEvent({
- method: 'POST',
- path: '/api/helcim/subscription',
- headers: { origin: ALLOWED_ORIGIN },
- body: SUBSCRIPTION_BODY
- })
-
- await expect(subscriptionHandler(subscriptionEvent)).rejects.toMatchObject({
- statusCode: 401
- })
- })
-})
diff --git a/tests/server/api/helcim-customer.test.js b/tests/server/api/helcim-customer.test.js
deleted file mode 100644
index 2aa6ae3..0000000
--- a/tests/server/api/helcim-customer.test.js
+++ /dev/null
@@ -1,388 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-
-import Member from '../../../server/models/member.js'
-import { createHelcimCustomer } from '../../../server/utils/helcim.js'
-import { sendMagicLink } from '../../../server/utils/magicLink.js'
-import { setAuthCookie, setSignupBridgeCookie } from '../../../server/utils/auth.js'
-import customerHandler from '../../../server/api/helcim/customer.post.js'
-import { resetRateLimit } from '../../../server/utils/rateLimit.js'
-import { createMockEvent } from '../helpers/createMockEvent.js'
-
-// --- Mocks ---
-vi.mock('../../../server/models/member.js', () => ({
- default: { findOne: vi.fn(), create: vi.fn(), findByIdAndUpdate: vi.fn() }
-}))
-vi.mock('../../../server/models/preRegistration.js', () => ({
- default: { findOne: vi.fn().mockResolvedValue(null), findByIdAndUpdate: vi.fn() }
-}))
-vi.mock('../../../server/utils/mongoose.js', () => ({ connectDB: vi.fn() }))
-vi.mock('../../../server/utils/helcim.js', () => ({
- createHelcimCustomer: vi.fn()
-}))
-vi.mock('../../../server/utils/magicLink.js', () => ({
- sendMagicLink: vi.fn().mockResolvedValue(undefined)
-}))
-vi.mock('../../../server/utils/auth.js', () => ({
- setAuthCookie: vi.fn(),
- setSignupBridgeCookie: vi.fn()
-}))
-
-// helcimCustomerSchema is auto-imported in the handler — stub it to a passthrough
-vi.stubGlobal('helcimCustomerSchema', {})
-
-// Helper to build a same-origin request body+headers
-const ALLOWED_ORIGIN = 'https://ghostguild.test'
-
-function build(opts = {}) {
- const {
- origin = ALLOWED_ORIGIN,
- remoteAddress = '127.0.0.1',
- body = {
- name: 'Test User',
- email: 'test@example.com',
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true
- }
- } = opts
- const headers = {}
- if (origin !== null) headers.origin = origin
- return createMockEvent({
- method: 'POST',
- path: '/api/helcim/customer',
- body,
- headers,
- remoteAddress
- })
-}
-
-describe('POST /api/helcim/customer', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- process.env.BASE_URL = ALLOWED_ORIGIN
- resetRateLimit()
- Member.findOne.mockResolvedValue(null)
- Member.create.mockImplementation(async (doc) => ({ _id: 'mem-1', ...doc }))
- Member.findByIdAndUpdate.mockImplementation(async (id, update) => ({
- _id: id,
- ...(update?.$set || {})
- }))
- createHelcimCustomer.mockResolvedValue({ id: 'cust-1', customerCode: 'CUST-1' })
- })
-
- describe('origin check', () => {
- it('rejects requests with missing Origin header', async () => {
- const event = build({ origin: null })
- await expect(customerHandler(event)).rejects.toMatchObject({
- statusCode: 403,
- statusMessage: 'Invalid origin'
- })
- expect(Member.create).not.toHaveBeenCalled()
- })
-
- it('rejects requests with foreign Origin header', async () => {
- const event = build({ origin: 'https://attacker.example' })
- await expect(customerHandler(event)).rejects.toMatchObject({
- statusCode: 403,
- statusMessage: 'Invalid origin'
- })
- expect(Member.create).not.toHaveBeenCalled()
- })
-
- it('accepts requests with matching Origin header', async () => {
- const event = build()
- const result = await customerHandler(event)
- expect(result.success).toBe(true)
- })
- })
-
- describe('rate limiting', () => {
- it('rate-limits a single IP after 5 signup attempts', async () => {
- // 5 calls succeed (each with a unique email so we don't hit email limit
- // and don't hit the dedupe 409)
- for (let i = 0; i < 5; i++) {
- Member.findOne.mockResolvedValueOnce(null)
- const event = build({
- remoteAddress: '10.0.0.1',
- body: {
- name: 'User',
- email: `u${i}@example.com`,
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true
- }
- })
- await customerHandler(event)
- }
- // 6th call returns 429
- const event = build({
- remoteAddress: '10.0.0.1',
- body: {
- name: 'User',
- email: 'u6@example.com',
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true
- }
- })
- await expect(customerHandler(event)).rejects.toMatchObject({
- statusCode: 429
- })
- })
-
- it('rate-limits a single email after 3 signup attempts (different IPs)', async () => {
- const email = 'shared@example.com'
- for (let i = 0; i < 3; i++) {
- Member.findOne.mockResolvedValueOnce(null)
- const event = build({
- remoteAddress: `10.0.0.${i + 10}`,
- body: {
- name: 'User',
- email,
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true
- }
- })
- await customerHandler(event)
- }
- // 4th call returns 429
- const event = build({
- remoteAddress: '10.0.0.99',
- body: {
- name: 'User',
- email,
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true
- }
- })
- await expect(customerHandler(event)).rejects.toMatchObject({
- statusCode: 429
- })
- })
- })
-
- describe('existing-member dedupe (Fix #5)', () => {
- it('brand-new email succeeds and creates a pending_payment member', async () => {
- Member.findOne.mockResolvedValue(null)
- const event = build({
- body: {
- name: 'Brand New',
- email: 'brandnew@example.com',
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true
- }
- })
- const result = await customerHandler(event)
- expect(result.success).toBe(true)
- expect(result.customerId).toBe('cust-1')
- expect(result.member.status).toBe('pending_payment')
- expect(Member.create).toHaveBeenCalledTimes(1)
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- })
-
- it('returns 409 for an existing active member', async () => {
- Member.findOne.mockResolvedValue({
- _id: 'mem-active',
- email: 'active@example.com',
- status: 'active'
- })
- const event = build({
- body: {
- name: 'Active User',
- email: 'active@example.com',
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true
- }
- })
- await expect(customerHandler(event)).rejects.toMatchObject({
- statusCode: 409,
- statusMessage: 'A member with this email already exists'
- })
- expect(Member.create).not.toHaveBeenCalled()
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- expect(createHelcimCustomer).not.toHaveBeenCalled()
- })
-
- it('returns 409 for an existing pending_payment member (re-submit guard)', async () => {
- Member.findOne.mockResolvedValue({
- _id: 'mem-pending',
- email: 'pending@example.com',
- status: 'pending_payment'
- })
- const event = build({
- body: {
- name: 'Pending User',
- email: 'pending@example.com',
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true
- }
- })
- await expect(customerHandler(event)).rejects.toMatchObject({
- statusCode: 409
- })
- expect(Member.create).not.toHaveBeenCalled()
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- expect(createHelcimCustomer).not.toHaveBeenCalled()
- })
-
- it('returns 409 for suspended and cancelled members', async () => {
- for (const status of ['suspended', 'cancelled']) {
- vi.clearAllMocks()
- resetRateLimit()
- Member.findOne.mockResolvedValue({ _id: `mem-${status}`, status })
- const event = build({
- body: {
- name: 'User',
- email: `${status}@example.com`,
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true
- }
- })
- await expect(customerHandler(event)).rejects.toMatchObject({
- statusCode: 409
- })
- expect(Member.create).not.toHaveBeenCalled()
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- expect(createHelcimCustomer).not.toHaveBeenCalled()
- }
- })
-
- it('upgrades an existing guest member in place (preserves _id)', async () => {
- const guestId = 'guest-1'
- Member.findOne.mockResolvedValue({
- _id: guestId,
- email: 'guest@example.com',
- name: 'Old Guest Name',
- circle: 'community',
- contributionAmount: 0,
- status: 'guest'
- })
- const event = build({
- body: {
- name: 'New Member Name',
- email: 'guest@example.com',
- circle: 'founder',
- contributionAmount: 25,
- agreedToGuidelines: true
- }
- })
- const result = await customerHandler(event)
-
- // No new member doc created — existing guest is reused.
- expect(Member.create).not.toHaveBeenCalled()
-
- // Helcim customer created for the upgraded member.
- expect(createHelcimCustomer).toHaveBeenCalledWith({
- customerType: 'PERSON',
- contactName: 'New Member Name',
- email: 'guest@example.com'
- })
-
- // findByIdAndUpdate called with guest's _id (preservation) and the form fields.
- expect(Member.findByIdAndUpdate).toHaveBeenCalledTimes(1)
- const [updateId, updatePayload, updateOpts] = Member.findByIdAndUpdate.mock.calls[0]
- expect(updateId).toBe(guestId)
- expect(updatePayload.$set).toMatchObject({
- name: 'New Member Name',
- circle: 'founder',
- contributionAmount: 25,
- helcimCustomerId: 'cust-1',
- status: 'pending_payment'
- })
- expect(updatePayload.$set['agreement.acceptedAt']).toBeInstanceOf(Date)
- expect(updateOpts).toMatchObject({ new: true, runValidators: false })
-
- // Magic link still issued, paid-tier bridge cookie still set.
- expect(sendMagicLink).toHaveBeenCalledWith(
- 'guest@example.com',
- expect.objectContaining({ subject: 'Verify your Ghost Guild signup' })
- )
- expect(setSignupBridgeCookie).toHaveBeenCalled()
- expect(setAuthCookie).not.toHaveBeenCalled()
-
- // Response shape mirrors new-signup case AND surfaces the preserved _id.
- expect(result.success).toBe(true)
- expect(result.member.id).toBe(guestId)
- expect(result.member.status).toBe('pending_payment')
- expect(result.customerId).toBe('cust-1')
- })
-
- it('lowercases mixed-case email at the existence lookup', async () => {
- Member.findOne.mockResolvedValue({
- _id: 'guest-mixed',
- email: 'foo@example.com',
- name: 'Existing Guest',
- circle: 'community',
- contributionAmount: 0,
- status: 'guest'
- })
- const event = build({
- body: {
- name: 'Foo Bar',
- email: 'Foo@Example.com',
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true
- }
- })
- await customerHandler(event)
- expect(Member.findOne).toHaveBeenCalledWith({ email: 'foo@example.com' })
- expect(Member.findByIdAndUpdate).toHaveBeenCalledTimes(1)
- expect(Member.create).not.toHaveBeenCalled()
- })
- })
-
- describe('no auth cookie + magic link', () => {
- it('does not set auth-token cookie on free-tier signup', async () => {
- const event = build()
- await customerHandler(event)
- expect(setAuthCookie).not.toHaveBeenCalled()
- const cookieHeader = event._testSetHeaders['set-cookie']
- const cookies = Array.isArray(cookieHeader) ? cookieHeader.join(';') : (cookieHeader || '')
- expect(cookies).not.toContain('auth-token=')
- })
-
- it('sends a magic link to the new member email', async () => {
- const event = build({
- body: {
- name: 'New User',
- email: 'newuser@example.com',
- circle: 'community',
- contributionAmount: 0,
- agreedToGuidelines: true
- }
- })
- await customerHandler(event)
- expect(sendMagicLink).toHaveBeenCalledWith(
- 'newuser@example.com',
- expect.objectContaining({ subject: 'Verify your Ghost Guild signup' })
- )
- })
-
- it('sets a signup-bridge cookie on paid-tier signup so checkout can proceed', async () => {
- const event = build({
- body: {
- name: 'Paid User',
- email: 'paid@example.com',
- circle: 'community',
- contributionAmount: 25,
- agreedToGuidelines: true
- }
- })
- await customerHandler(event)
- expect(setSignupBridgeCookie).toHaveBeenCalled()
- expect(sendMagicLink).toHaveBeenCalledWith(
- 'paid@example.com',
- expect.objectContaining({ subject: 'Verify your Ghost Guild signup' })
- )
- // still no full session cookie
- expect(setAuthCookie).not.toHaveBeenCalled()
- })
- })
-})
diff --git a/tests/server/api/helcim-existing-card.test.js b/tests/server/api/helcim-existing-card.test.js
deleted file mode 100644
index 8cf77ce..0000000
--- a/tests/server/api/helcim-existing-card.test.js
+++ /dev/null
@@ -1,93 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-
-import { requireAuth } from '../../../server/utils/auth.js'
-import { listHelcimCustomerCards } from '../../../server/utils/helcim.js'
-import existingCardHandler from '../../../server/api/helcim/existing-card.get.js'
-import { createMockEvent } from '../helpers/createMockEvent.js'
-
-vi.mock('../../../server/utils/auth.js', () => ({ requireAuth: vi.fn() }))
-vi.mock('../../../server/utils/helcim.js', () => ({
- listHelcimCustomerCards: vi.fn()
-}))
-
-const newEvent = () =>
- createMockEvent({ method: 'GET', path: '/api/helcim/existing-card' })
-
-describe('helcim existing-card endpoint', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- })
-
- it('requires auth', async () => {
- requireAuth.mockRejectedValue(
- createError({ statusCode: 401, statusMessage: 'Unauthorized' })
- )
-
- await expect(existingCardHandler(newEvent())).rejects.toMatchObject({ statusCode: 401 })
- expect(listHelcimCustomerCards).not.toHaveBeenCalled()
- })
-
- it('returns { cardToken: null } when member has no helcimCustomerId', async () => {
- requireAuth.mockResolvedValue({ _id: 'm1', helcimCustomerId: null })
-
- const result = await existingCardHandler(newEvent())
-
- expect(result).toEqual({ cardToken: null })
- expect(listHelcimCustomerCards).not.toHaveBeenCalled()
- })
-
- it('returns { cardToken: null } when customer has no cards', async () => {
- requireAuth.mockResolvedValue({ _id: 'm1', helcimCustomerId: 9876 })
- listHelcimCustomerCards.mockResolvedValue([])
-
- const result = await existingCardHandler(newEvent())
-
- expect(result).toEqual({ cardToken: null })
- expect(listHelcimCustomerCards).toHaveBeenCalledWith(9876)
- })
-
- it('returns the default card when one is flagged default:true', async () => {
- requireAuth.mockResolvedValue({ _id: 'm1', helcimCustomerId: 9876 })
- listHelcimCustomerCards.mockResolvedValue([
- { cardToken: 'tok-old' },
- { cardToken: 'tok-default', default: true }
- ])
-
- const result = await existingCardHandler(newEvent())
-
- expect(result).toEqual({ cardToken: 'tok-default' })
- })
-
- it('falls back to first card when no card is flagged default', async () => {
- requireAuth.mockResolvedValue({ _id: 'm1', helcimCustomerId: 9876 })
- listHelcimCustomerCards.mockResolvedValue([
- { cardToken: 'tok-first' },
- { cardToken: 'tok-second' }
- ])
-
- const result = await existingCardHandler(newEvent())
-
- expect(result).toEqual({ cardToken: 'tok-first' })
- })
-
- it('handles isDefault flag (alternative shape)', async () => {
- requireAuth.mockResolvedValue({ _id: 'm1', helcimCustomerId: 9876 })
- listHelcimCustomerCards.mockResolvedValue([
- { cardToken: 'tok-a' },
- { cardToken: 'tok-b', isDefault: true }
- ])
-
- const result = await existingCardHandler(newEvent())
-
- expect(result.cardToken).toBe('tok-b')
- })
-
- it('returns { cardToken: null } if the resolved card has no cardToken', async () => {
- requireAuth.mockResolvedValue({ _id: 'm1', helcimCustomerId: 9876 })
- listHelcimCustomerCards.mockResolvedValue([{ default: true }])
-
- const result = await existingCardHandler(newEvent())
-
- expect(result).toEqual({ cardToken: null })
- })
-})
diff --git a/tests/server/api/helcim-payment.test.js b/tests/server/api/helcim-payment.test.js
index d5df7f6..52e2342 100644
--- a/tests/server/api/helcim-payment.test.js
+++ b/tests/server/api/helcim-payment.test.js
@@ -1,40 +1,24 @@
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import { requireAuth, getOptionalMember } from '../../../server/utils/auth.js'
+import { requireAuth } from '../../../server/utils/auth.js'
import { validateBody as importedValidateBody } from '../../../server/utils/validateBody.js'
-import { loadPublicEvent } from '../../../server/utils/loadEvent.js'
-import { loadPublicSeries } from '../../../server/utils/loadSeries.js'
-import { PAYMENT_METADATA_TYPES } from '../../../server/utils/paymentTypes.js'
-import Member from '../../../server/models/member.js'
import initPaymentHandler from '../../../server/api/helcim/initialize-payment.post.js'
import verifyPaymentHandler from '../../../server/api/helcim/verify-payment.post.js'
import { createMockEvent } from '../helpers/createMockEvent.js'
-vi.mock('../../../server/utils/auth.js', () => ({
- requireAuth: vi.fn(),
- getOptionalMember: vi.fn()
-}))
+vi.mock('../../../server/utils/auth.js', () => ({ requireAuth: vi.fn() }))
vi.mock('../../../server/utils/validateBody.js', () => ({ validateBody: vi.fn() }))
vi.mock('../../../server/utils/schemas.js', () => ({ paymentVerifySchema: {} }))
-vi.mock('../../../server/utils/loadEvent.js', () => ({ loadPublicEvent: vi.fn() }))
-vi.mock('../../../server/utils/loadSeries.js', () => ({ loadPublicSeries: vi.fn() }))
-vi.mock('../../../server/models/member.js', () => ({ default: { findOne: vi.fn() } }))
// helcimInitializePaymentSchema is a Nitro auto-import used by validateBody
vi.stubGlobal('helcimInitializePaymentSchema', {})
-// PAYMENT_METADATA_TYPES is a Nitro auto-import from server/utils/paymentTypes.js
-vi.stubGlobal('PAYMENT_METADATA_TYPES', PAYMENT_METADATA_TYPES)
-
const mockFetch = vi.fn()
vi.stubGlobal('fetch', mockFetch)
describe('initialize-payment endpoint', () => {
beforeEach(() => {
vi.clearAllMocks()
- getOptionalMember.mockResolvedValue(null)
- Member.findOne.mockResolvedValue(null)
- loadPublicSeries.mockResolvedValue(null)
})
afterEach(() => {
@@ -47,11 +31,6 @@ describe('initialize-payment endpoint', () => {
metadata: { type: 'event_ticket', eventTitle: 'Test Event', eventId: 'evt-1' }
}
globalThis.validateBody.mockResolvedValue(body)
- loadPublicEvent.mockResolvedValue({
- _id: 'evt-1',
- title: 'Test Event',
- tickets: { enabled: true, public: { available: true, price: 2500 } }
- })
mockFetch.mockResolvedValue({
ok: true,
@@ -96,11 +75,6 @@ describe('initialize-payment endpoint', () => {
metadata: { type: 'event_ticket', eventTitle: 'Workshop', eventId: 'evt-2' }
}
globalThis.validateBody.mockResolvedValue(body)
- loadPublicEvent.mockResolvedValue({
- _id: 'evt-2',
- title: 'Workshop',
- tickets: { enabled: true, public: { available: true, price: 1500 } }
- })
mockFetch.mockResolvedValue({
ok: true,
@@ -118,152 +92,9 @@ describe('initialize-payment endpoint', () => {
expect(result).toEqual({
success: true,
checkoutToken: 'ct-abc',
- secretToken: 'st-xyz',
- amount: 1500
+ secretToken: 'st-xyz'
})
})
-
- it('ignores client-supplied amount and re-derives event_ticket price server-side', async () => {
- const body = {
- amount: 1, // tampered low value
- metadata: { type: 'event_ticket', eventId: 'evt-x' }
- }
- globalThis.validateBody.mockResolvedValue(body)
- loadPublicEvent.mockResolvedValue({
- _id: 'evt-x',
- title: 'Pricey Workshop',
- tickets: { enabled: true, public: { available: true, price: 5000 } }
- })
-
- mockFetch.mockResolvedValue({
- ok: true,
- text: async () => JSON.stringify({ checkoutToken: 'ct-1', secretToken: 'st-1' })
- })
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/helcim/initialize-payment',
- body
- })
-
- const result = await initPaymentHandler(event)
-
- // Verify the fetch to Helcim was called with the server-derived amount, not body.amount
- expect(mockFetch).toHaveBeenCalledTimes(1)
- const [, init] = mockFetch.mock.calls[0]
- const sentBody = JSON.parse(init.body)
- expect(sentBody.amount).toBe(5000)
- expect(sentBody.amount).not.toBe(1)
- expect(sentBody.paymentType).toBe('purchase')
- expect(result.amount).toBe(5000)
- })
-
- it('returns 400 when event_ticket metadata is missing eventId', async () => {
- const body = { amount: 25, metadata: { type: 'event_ticket' } }
- globalThis.validateBody.mockResolvedValue(body)
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/helcim/initialize-payment',
- body
- })
-
- await expect(initPaymentHandler(event)).rejects.toMatchObject({
- statusCode: 400
- })
- })
-
- it('returns 400 when series_ticket metadata is missing seriesId', async () => {
- const body = { amount: 50, metadata: { type: 'series_ticket' } }
- globalThis.validateBody.mockResolvedValue(body)
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/helcim/initialize-payment',
- body
- })
-
- await expect(initPaymentHandler(event)).rejects.toMatchObject({
- statusCode: 400
- })
- })
-
- it('re-derives series_ticket price via loadPublicSeries + calculateSeriesTicketPrice', async () => {
- const body = {
- amount: 100, // tampered
- metadata: { type: 'series_ticket', seriesId: 'ser-x' }
- }
- globalThis.validateBody.mockResolvedValue(body)
- loadPublicSeries.mockResolvedValue({
- _id: 'ser-x',
- title: 'Coop Foundations',
- tickets: { enabled: true, public: { available: true, price: 7500 } }
- })
-
- mockFetch.mockResolvedValue({
- ok: true,
- text: async () => JSON.stringify({ checkoutToken: 'ct-s', secretToken: 'st-s' })
- })
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/helcim/initialize-payment',
- body
- })
-
- const result = await initPaymentHandler(event)
-
- expect(mockFetch).toHaveBeenCalledTimes(1)
- const [, init] = mockFetch.mock.calls[0]
- const sentBody = JSON.parse(init.body)
- expect(sentBody.amount).toBe(7500)
- expect(sentBody.paymentType).toBe('purchase')
- expect(result.amount).toBe(7500)
- expect(loadPublicSeries).toHaveBeenCalled()
- })
-
- it('uses member pricing when metadata.email matches an active member', async () => {
- const body = {
- amount: 5000,
- metadata: { type: 'event_ticket', eventId: 'evt-m', email: '[email protected]' }
- }
- globalThis.validateBody.mockResolvedValue(body)
- Member.findOne.mockResolvedValue({
- _id: 'm-1',
- email: '[email protected]',
- status: 'active',
- circle: 'community'
- })
- loadPublicEvent.mockResolvedValue({
- _id: 'evt-m',
- title: 'Member Event',
- tickets: {
- enabled: true,
- member: { available: true, isFree: true },
- public: { available: true, price: 5000 }
- }
- })
-
- mockFetch.mockResolvedValue({
- ok: true,
- text: async () => JSON.stringify({ checkoutToken: 'ct-m', secretToken: 'st-m' })
- })
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/helcim/initialize-payment',
- body
- })
-
- const result = await initPaymentHandler(event)
-
- expect(mockFetch).toHaveBeenCalledTimes(1)
- const [, init] = mockFetch.mock.calls[0]
- const sentBody = JSON.parse(init.body)
- expect(sentBody.amount).toBe(0)
- expect(sentBody.paymentType).toBe('verify')
- expect(result.amount).toBe(0)
- })
})
describe('verify-payment endpoint', () => {
diff --git a/tests/server/api/helcim-subscription.test.js b/tests/server/api/helcim-subscription.test.js
index 6845cd4..9a24285 100644
--- a/tests/server/api/helcim-subscription.test.js
+++ b/tests/server/api/helcim-subscription.test.js
@@ -5,18 +5,14 @@ import { requireAuth } from '../../../server/utils/auth.js'
import { requiresPayment, getHelcimPlanId } from '../../../server/config/contributions.js'
import { createHelcimSubscription, listHelcimCustomerTransactions } from '../../../server/utils/helcim.js'
import { upsertPaymentFromHelcim } from '../../../server/utils/payments.js'
-import { sendWelcomeEmail } from '../../../server/utils/resend.js'
import subscriptionHandler from '../../../server/api/helcim/subscription.post.js'
import { createMockEvent } from '../helpers/createMockEvent.js'
vi.mock('../../../server/models/member.js', () => ({
- default: { findOneAndUpdate: vi.fn(), findOne: vi.fn(), findById: vi.fn() }
+ default: { findOneAndUpdate: vi.fn(), findOne: vi.fn() }
}))
vi.mock('../../../server/utils/mongoose.js', () => ({ connectDB: vi.fn() }))
-vi.mock('../../../server/utils/auth.js', () => ({
- requireAuth: vi.fn(),
- getSignupBridgeMember: vi.fn().mockResolvedValue(null)
-}))
+vi.mock('../../../server/utils/auth.js', () => ({ requireAuth: vi.fn() }))
vi.mock('../../../server/utils/slack.ts', () => ({
getSlackService: vi.fn().mockReturnValue(null)
}))
@@ -42,9 +38,8 @@ vi.stubGlobal('helcimSubscriptionSchema', {})
describe('helcim subscription endpoint', () => {
beforeEach(() => {
vi.clearAllMocks()
- // Default: pre-update doc reflects first activation from pending_payment.
- // findOneAndUpdate returns pre-update doc; findById returns post-update doc.
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-default', status: 'pending_payment' })
+ // Default: first activation from pending_payment
+ Member.findOne.mockResolvedValue({ status: 'pending_payment' })
})
it('requires auth', async () => {
@@ -79,8 +74,7 @@ describe('helcim subscription endpoint', () => {
status: 'active',
save: vi.fn()
}
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-1', status: 'pending_payment' })
- Member.findById.mockResolvedValue(mockMember)
+ Member.findOneAndUpdate.mockResolvedValue(mockMember)
const event = createMockEvent({
method: 'POST',
@@ -103,9 +97,8 @@ describe('helcim subscription endpoint', () => {
expect(Member.findOneAndUpdate).toHaveBeenCalledWith(
{ helcimCustomerId: 'cust-1' },
expect.objectContaining({ status: 'active', contributionAmount: 0 }),
- { new: false, projection: { status: 1 } }
+ { new: true }
)
- expect(Member.findById).toHaveBeenCalledWith('member-1')
expect(createHelcimSubscription).not.toHaveBeenCalled()
})
@@ -139,8 +132,7 @@ describe('helcim subscription endpoint', () => {
contributionAmount: 15,
status: 'active',
}
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-2', status: 'pending_payment' })
- Member.findById.mockResolvedValue(mockMember)
+ Member.findOneAndUpdate.mockResolvedValue(mockMember)
createHelcimSubscription.mockResolvedValue({
data: [{ id: 'sub-monthly-1', status: 'active', nextBillingDate: '2026-05-18' }]
})
@@ -161,44 +153,8 @@ describe('helcim subscription endpoint', () => {
expect(Member.findOneAndUpdate).toHaveBeenCalledWith(
{ helcimCustomerId: 'cust-1' },
{ $set: expect.objectContaining({ billingCadence: 'monthly', contributionAmount: 15, status: 'active' }) },
- { new: false, runValidators: false, projection: { status: 1 } }
+ { new: true, runValidators: false }
)
- expect(Member.findById).toHaveBeenCalledWith('member-2')
- })
-
- it('reads dateBilling from Helcim CREATE response and threads it to $set + response', async () => {
- requireAuth.mockResolvedValue(undefined)
- requiresPayment.mockReturnValue(true)
- getHelcimPlanId.mockReturnValue('99999')
-
- const mockMember = {
- _id: 'member-db',
- email: 'datebilling@example.com',
- name: 'DateBilling User',
- circle: 'founder',
- contributionAmount: 15,
- status: 'active',
- }
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-db', status: 'pending_payment' })
- Member.findById.mockResolvedValue(mockMember)
- createHelcimSubscription.mockResolvedValue({
- data: [{ id: 'sub-x', status: 'active', dateBilling: '2026-06-01' }]
- })
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/helcim/subscription',
- body: { customerId: 'cust-1', contributionAmount: 15, customerCode: 'code-1', cardToken: 'tok-123', cadence: 'monthly' }
- })
-
- const result = await subscriptionHandler(event)
-
- expect(Member.findOneAndUpdate).toHaveBeenCalledWith(
- { helcimCustomerId: 'cust-1' },
- { $set: expect.objectContaining({ nextBillingDate: new Date('2026-06-01') }) },
- { new: false, runValidators: false, projection: { status: 1 } }
- )
- expect(result.subscription.nextBillingDate).toBe('2026-06-01')
})
it('annual $15 tier creates subscription with correct paymentPlanId and recurringAmount', async () => {
@@ -214,8 +170,7 @@ describe('helcim subscription endpoint', () => {
contributionAmount: 15,
status: 'active',
}
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-3', status: 'pending_payment' })
- Member.findById.mockResolvedValue(mockMember)
+ Member.findOneAndUpdate.mockResolvedValue(mockMember)
createHelcimSubscription.mockResolvedValue({
data: [{ id: 'sub-annual-1', status: 'active', nextBillingDate: '2027-04-18' }]
})
@@ -236,9 +191,8 @@ describe('helcim subscription endpoint', () => {
expect(Member.findOneAndUpdate).toHaveBeenCalledWith(
{ helcimCustomerId: 'cust-1' },
{ $set: expect.objectContaining({ billingCadence: 'annual', contributionAmount: 15, status: 'active' }) },
- { new: false, runValidators: false, projection: { status: 1 } }
+ { new: true, runValidators: false }
)
- expect(Member.findById).toHaveBeenCalledWith('member-3')
})
it('annual $50 tier recurringAmount is 600', async () => {
@@ -254,8 +208,7 @@ describe('helcim subscription endpoint', () => {
contributionAmount: 50,
status: 'active',
}
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-4', status: 'pending_payment' })
- Member.findById.mockResolvedValue(mockMember)
+ Member.findOneAndUpdate.mockResolvedValue(mockMember)
createHelcimSubscription.mockResolvedValue({
data: [{ id: 'sub-annual-50', status: 'active', nextBillingDate: '2027-04-18' }]
})
@@ -327,8 +280,7 @@ describe('helcim subscription endpoint', () => {
contributionAmount: 15,
status: 'active',
}
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-9', status: 'pending_payment' })
- Member.findById.mockResolvedValue(mockMember)
+ Member.findOneAndUpdate.mockResolvedValue(mockMember)
createHelcimSubscription.mockResolvedValue({
data: [{ id: 'sub-log-1', status: 'active', nextBillingDate: '2026-05-18' }]
})
@@ -367,8 +319,7 @@ describe('helcim subscription endpoint', () => {
contributionAmount: 15,
status: 'active',
}
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-10', status: 'pending_payment' })
- Member.findById.mockResolvedValue(mockMember)
+ Member.findOneAndUpdate.mockResolvedValue(mockMember)
createHelcimSubscription.mockResolvedValue({
data: [{ id: 'sub-annual-log', status: 'active', nextBillingDate: '2027-04-20' }]
})
@@ -404,8 +355,7 @@ describe('helcim subscription endpoint', () => {
contributionAmount: 15,
status: 'active',
}
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-11', status: 'pending_payment' })
- Member.findById.mockResolvedValue(mockMember)
+ Member.findOneAndUpdate.mockResolvedValue(mockMember)
createHelcimSubscription.mockResolvedValue({
data: [{ id: 'sub-boom', status: 'active', nextBillingDate: '2026-05-18' }]
})
@@ -423,120 +373,6 @@ describe('helcim subscription endpoint', () => {
expect(upsertPaymentFromHelcim).not.toHaveBeenCalled()
})
- it('first activation (pending_payment → active) sends welcome email on free tier', async () => {
- requireAuth.mockResolvedValue(undefined)
- requiresPayment.mockReturnValue(false)
-
- const mockMember = {
- _id: 'member-first-free',
- email: 'newbie@example.com',
- name: 'Newbie',
- circle: 'community',
- contributionAmount: 0,
- status: 'active',
- }
- // Pre-update status was pending_payment → first activation
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-first-free', status: 'pending_payment' })
- Member.findById.mockResolvedValue(mockMember)
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/helcim/subscription',
- body: { customerId: 'cust-first-free', contributionAmount: 0, customerCode: 'code-1' }
- })
-
- await subscriptionHandler(event)
-
- expect(sendWelcomeEmail).toHaveBeenCalledWith(mockMember)
- })
-
- it('first activation (pending_payment → active) sends welcome email on paid tier', async () => {
- requireAuth.mockResolvedValue(undefined)
- requiresPayment.mockReturnValue(true)
- getHelcimPlanId.mockReturnValue('99999')
-
- const mockMember = {
- _id: 'member-first-paid',
- email: 'newpaid@example.com',
- name: 'NewPaid',
- circle: 'founder',
- contributionAmount: 15,
- status: 'active',
- }
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-first-paid', status: 'pending_payment' })
- Member.findById.mockResolvedValue(mockMember)
- createHelcimSubscription.mockResolvedValue({
- data: [{ id: 'sub-first-paid', status: 'active', nextBillingDate: '2026-05-18' }]
- })
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/helcim/subscription',
- body: { customerId: 'cust-first-paid', contributionAmount: 15, customerCode: 'code-1', cardToken: 'tok-123', cadence: 'monthly' }
- })
-
- await subscriptionHandler(event)
-
- expect(sendWelcomeEmail).toHaveBeenCalledWith(mockMember)
- })
-
- it('already-active retry (active → active) does NOT send welcome email on free tier', async () => {
- requireAuth.mockResolvedValue(undefined)
- requiresPayment.mockReturnValue(false)
-
- const mockMember = {
- _id: 'member-retry-free',
- email: 'existing@example.com',
- name: 'Existing',
- circle: 'community',
- contributionAmount: 0,
- status: 'active',
- }
- // Pre-update status was already active → tier upgrade, not first activation
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-retry-free', status: 'active' })
- Member.findById.mockResolvedValue(mockMember)
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/helcim/subscription',
- body: { customerId: 'cust-retry-free', contributionAmount: 0, customerCode: 'code-1' }
- })
-
- await subscriptionHandler(event)
-
- expect(sendWelcomeEmail).not.toHaveBeenCalled()
- })
-
- it('already-active retry (active → active) does NOT send welcome email on paid tier', async () => {
- requireAuth.mockResolvedValue(undefined)
- requiresPayment.mockReturnValue(true)
- getHelcimPlanId.mockReturnValue('99999')
-
- const mockMember = {
- _id: 'member-retry-paid',
- email: 'upgrader@example.com',
- name: 'Upgrader',
- circle: 'founder',
- contributionAmount: 25,
- status: 'active',
- }
- Member.findOneAndUpdate.mockResolvedValue({ _id: 'member-retry-paid', status: 'active' })
- Member.findById.mockResolvedValue(mockMember)
- createHelcimSubscription.mockResolvedValue({
- data: [{ id: 'sub-retry', status: 'active', nextBillingDate: '2026-05-18' }]
- })
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/helcim/subscription',
- body: { customerId: 'cust-retry-paid', contributionAmount: 25, customerCode: 'code-1', cardToken: 'tok-123', cadence: 'monthly' }
- })
-
- await subscriptionHandler(event)
-
- expect(sendWelcomeEmail).not.toHaveBeenCalled()
- })
-
it('Helcim API failure returns 500 and does NOT activate member', async () => {
requireAuth.mockResolvedValue(undefined)
requiresPayment.mockReturnValue(true)
diff --git a/tests/server/api/reconcile-payments-route.test.js b/tests/server/api/reconcile-payments-route.test.js
deleted file mode 100644
index 5fcd9cc..0000000
--- a/tests/server/api/reconcile-payments-route.test.js
+++ /dev/null
@@ -1,335 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-
-import Member from '../../../server/models/member.js'
-import Payment from '../../../server/models/payment.js'
-import { getHelcimCustomer, listHelcimCustomerTransactions } from '../../../server/utils/helcim.js'
-import { upsertPaymentFromHelcim } from '../../../server/utils/payments.js'
-import reconcileHandler from '../../../server/api/internal/reconcile-payments.post.js'
-import { createMockEvent } from '../helpers/createMockEvent.js'
-
-vi.mock('../../../server/models/member.js', () => ({
- default: { find: vi.fn(), findByIdAndUpdate: vi.fn() }
-}))
-vi.mock('../../../server/models/payment.js', () => ({
- default: { findOne: vi.fn() }
-}))
-vi.mock('../../../server/utils/mongoose.js', () => ({ connectDB: vi.fn() }))
-vi.mock('../../../server/utils/helcim.js', () => ({
- getHelcimCustomer: vi.fn(),
- listHelcimCustomerTransactions: vi.fn()
-}))
-vi.mock('../../../server/utils/payments.js', () => ({
- upsertPaymentFromHelcim: vi.fn()
-}))
-
-// Override useRuntimeConfig from setup.js for these tests
-const RECONCILE_TOKEN = 'test-reconcile-secret-32-characters-long-xx'
-beforeEach(() => {
- vi.stubGlobal('useRuntimeConfig', () => ({
- jwtSecret: 'test-jwt-secret',
- helcimApiToken: 'test-helcim-token',
- reconcileToken: RECONCILE_TOKEN
- }))
-})
-
-function leanResolver(value) {
- return { lean: vi.fn().mockResolvedValue(value) }
-}
-
-describe('POST /api/internal/reconcile-payments', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- })
-
- it('rejects requests without the shared-secret token', async () => {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments'
- })
-
- await expect(reconcileHandler(event)).rejects.toMatchObject({
- statusCode: 401,
- statusMessage: 'Unauthorized'
- })
- })
-
- it('rejects requests with the wrong token', async () => {
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments',
- headers: { 'x-reconcile-token': 'not-the-right-secret' }
- })
-
- await expect(reconcileHandler(event)).rejects.toMatchObject({
- statusCode: 401,
- statusMessage: 'Unauthorized'
- })
- })
-
- it('rejects when reconcileToken is not configured on the server', async () => {
- vi.stubGlobal('useRuntimeConfig', () => ({
- jwtSecret: 'test-jwt-secret',
- helcimApiToken: 'test-helcim-token',
- reconcileToken: ''
- }))
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments',
- headers: { 'x-reconcile-token': 'anything' }
- })
-
- await expect(reconcileHandler(event)).rejects.toMatchObject({
- statusCode: 401
- })
- })
-
- it('queries members with helcimCustomerId and returns a summary', async () => {
- Member.find.mockReturnValue(leanResolver([
- {
- _id: 'm1',
- email: 'a@example.com',
- helcimCustomerId: 'cust-1',
- helcimCustomerCode: 'CST-1',
- helcimSubscriptionId: 'sub-1',
- billingCadence: 'monthly'
- }
- ]))
- listHelcimCustomerTransactions.mockResolvedValue([
- { id: 'tx-paid', status: 'paid', amount: 10, currency: 'CAD' },
- { id: 'tx-other', status: 'other', amount: 0, currency: 'CAD' },
- { id: 'tx-failed', status: 'failed', amount: 10, currency: 'CAD' }
- ])
- upsertPaymentFromHelcim.mockResolvedValueOnce({ created: true, payment: { _id: 'p1' } })
- upsertPaymentFromHelcim.mockResolvedValueOnce({ created: false, payment: { _id: 'p2' } })
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments',
- headers: { 'x-reconcile-token': RECONCILE_TOKEN }
- })
-
- const result = await reconcileHandler(event)
-
- // Verify the query shape: filter by helcimCustomerId existence + projection
- expect(Member.find).toHaveBeenCalledWith(
- { helcimCustomerId: { $exists: true, $ne: null } },
- expect.objectContaining({
- helcimCustomerId: 1,
- helcimCustomerCode: 1,
- helcimSubscriptionId: 1,
- billingCadence: 1
- })
- )
-
- // upsert called for paid + failed (status='other' is skipped)
- expect(upsertPaymentFromHelcim).toHaveBeenCalledTimes(2)
-
- expect(result).toMatchObject({
- membersScanned: 1,
- txExamined: 3,
- created: 1,
- existed: 1,
- skipped: 1,
- memberErrors: 0,
- apply: true
- })
- })
-
- it('does NOT pass sendConfirmation: true (no duplicate confirmation emails)', async () => {
- Member.find.mockReturnValue(leanResolver([
- { _id: 'm1', helcimCustomerId: 'cust-1', helcimCustomerCode: 'CST-1' }
- ]))
- listHelcimCustomerTransactions.mockResolvedValue([
- { id: 'tx-paid', status: 'paid', amount: 10, currency: 'CAD' }
- ])
- upsertPaymentFromHelcim.mockResolvedValue({ created: true, payment: { _id: 'p1' } })
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments',
- headers: { 'x-reconcile-token': RECONCILE_TOKEN }
- })
- await reconcileHandler(event)
-
- // The cron must not pass sendConfirmation. Either no opts or sendConfirmation falsy.
- const opts = upsertPaymentFromHelcim.mock.calls[0][2]
- if (opts) {
- expect(opts.sendConfirmation).toBeFalsy()
- }
- })
-
- it('continues iterating when listHelcimCustomerTransactions throws for one member', async () => {
- Member.find.mockReturnValue(leanResolver([
- { _id: 'm1', helcimCustomerId: 'cust-1', helcimCustomerCode: 'CST-1' },
- { _id: 'm2', helcimCustomerId: 'cust-2', helcimCustomerCode: 'CST-2' },
- { _id: 'm3', helcimCustomerId: 'cust-3', helcimCustomerCode: 'CST-3' }
- ]))
- // m1 succeeds first try, m2 fails all 3 retries, m3 succeeds first try.
- // Keyed by customerCode so it works regardless of call order (chunked Promise.all).
- listHelcimCustomerTransactions.mockImplementation((customerCode) => {
- if (customerCode === 'CST-1') return Promise.resolve([{ id: 'tx1', status: 'paid', amount: 5 }])
- if (customerCode === 'CST-3') return Promise.resolve([{ id: 'tx3', status: 'paid', amount: 7 }])
- return Promise.reject(new Error('helcim 503'))
- })
- upsertPaymentFromHelcim.mockResolvedValue({ created: true, payment: { _id: 'p' } })
-
- vi.useFakeTimers()
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments',
- headers: { 'x-reconcile-token': RECONCILE_TOKEN }
- })
- const promise = reconcileHandler(event)
- // Drain m2's exponential backoff (250 + 500 + 1000ms)
- await vi.advanceTimersByTimeAsync(2000)
- const result = await promise
-
- expect(result.membersScanned).toBe(3)
- expect(result.memberErrors).toBe(1)
- expect(result.created).toBe(2) // m1 + m3 succeeded
- vi.useRealTimers()
- })
-
- it('retries transient Helcim errors with exponential backoff (3 attempts)', async () => {
- vi.useFakeTimers()
- Member.find.mockReturnValue(leanResolver([
- { _id: 'm1', helcimCustomerId: 'cust-1', helcimCustomerCode: 'CST-1' }
- ]))
- listHelcimCustomerTransactions
- .mockRejectedValueOnce(new Error('boom 1'))
- .mockRejectedValueOnce(new Error('boom 2'))
- .mockResolvedValueOnce([{ id: 'tx-paid', status: 'paid', amount: 9 }])
- upsertPaymentFromHelcim.mockResolvedValue({ created: true, payment: { _id: 'p1' } })
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments',
- headers: { 'x-reconcile-token': RECONCILE_TOKEN }
- })
- const promise = reconcileHandler(event)
- // Advance through the 250ms + 500ms backoff windows
- await vi.advanceTimersByTimeAsync(250)
- await vi.advanceTimersByTimeAsync(500)
- const result = await promise
-
- expect(listHelcimCustomerTransactions).toHaveBeenCalledTimes(3)
- expect(result.memberErrors).toBe(0)
- expect(result.created).toBe(1)
- vi.useRealTimers()
- })
-
- it('counts memberErrors when all 3 retry attempts fail', async () => {
- vi.useFakeTimers()
- Member.find.mockReturnValue(leanResolver([
- { _id: 'm1', helcimCustomerId: 'cust-1', helcimCustomerCode: 'CST-1' }
- ]))
- listHelcimCustomerTransactions.mockRejectedValue(new Error('persistent 503'))
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments',
- headers: { 'x-reconcile-token': RECONCILE_TOKEN }
- })
- const promise = reconcileHandler(event)
- await vi.advanceTimersByTimeAsync(250)
- await vi.advanceTimersByTimeAsync(500)
- await vi.advanceTimersByTimeAsync(1000)
- const result = await promise
-
- expect(listHelcimCustomerTransactions).toHaveBeenCalledTimes(3)
- expect(result.memberErrors).toBe(1)
- vi.useRealTimers()
- })
-
- it('honors ?apply=false dry-run mode (Payment.findOne, no upsert)', async () => {
- Member.find.mockReturnValue(leanResolver([
- { _id: 'm1', helcimCustomerId: 'cust-1', helcimCustomerCode: 'CST-1' }
- ]))
- listHelcimCustomerTransactions.mockResolvedValue([
- { id: 'tx-existing', status: 'paid', amount: 10 },
- { id: 'tx-new', status: 'paid', amount: 12 }
- ])
- Payment.findOne
- .mockResolvedValueOnce({ _id: 'p-existing' })
- .mockResolvedValueOnce(null)
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments?apply=false',
- headers: { 'x-reconcile-token': RECONCILE_TOKEN }
- })
- const result = await reconcileHandler(event)
-
- expect(upsertPaymentFromHelcim).not.toHaveBeenCalled()
- expect(Payment.findOne).toHaveBeenCalledTimes(2)
- expect(result).toMatchObject({
- apply: false,
- created: 1, // would-create
- existed: 1
- })
- })
-
- describe('helcimCustomerCode backfill', () => {
- it('writes helcimCustomerCode when missing on the member doc', async () => {
- Member.find.mockReturnValue(leanResolver([
- { _id: 'm1', helcimCustomerId: 'cust-1' } // no helcimCustomerCode
- ]))
- getHelcimCustomer.mockResolvedValue({ id: 'cust-1', customerCode: 'CST-NEW' })
- listHelcimCustomerTransactions.mockResolvedValue([])
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments',
- headers: { 'x-reconcile-token': RECONCILE_TOKEN }
- })
- await reconcileHandler(event)
-
- expect(getHelcimCustomer).toHaveBeenCalledWith('cust-1')
- expect(Member.findByIdAndUpdate).toHaveBeenCalledWith(
- 'm1',
- { $set: { helcimCustomerCode: 'CST-NEW' } },
- { runValidators: false }
- )
- expect(listHelcimCustomerTransactions).toHaveBeenCalledWith('CST-NEW')
- })
-
- it('skips backfill when helcimCustomerCode is already present', async () => {
- Member.find.mockReturnValue(leanResolver([
- { _id: 'm1', helcimCustomerId: 'cust-1', helcimCustomerCode: 'CST-EXISTING' }
- ]))
- listHelcimCustomerTransactions.mockResolvedValue([])
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments',
- headers: { 'x-reconcile-token': RECONCILE_TOKEN }
- })
- await reconcileHandler(event)
-
- expect(getHelcimCustomer).not.toHaveBeenCalled()
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- expect(listHelcimCustomerTransactions).toHaveBeenCalledWith('CST-EXISTING')
- })
-
- it('does not fail the run when getHelcimCustomer throws during backfill', async () => {
- Member.find.mockReturnValue(leanResolver([
- { _id: 'm1', helcimCustomerId: 'cust-1' }
- ]))
- getHelcimCustomer.mockRejectedValue(new Error('helcim 503'))
- listHelcimCustomerTransactions.mockResolvedValue([])
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/internal/reconcile-payments',
- headers: { 'x-reconcile-token': RECONCILE_TOKEN }
- })
- const result = await reconcileHandler(event)
-
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- // Without a customerCode, we skip the transactions API entirely (best-effort, not error).
- expect(listHelcimCustomerTransactions).not.toHaveBeenCalled()
- expect(result.memberErrors).toBe(0)
- })
- })
-})
diff --git a/tests/server/api/series-tickets-purchase.test.js b/tests/server/api/series-tickets-purchase.test.js
deleted file mode 100644
index c8f03d5..0000000
--- a/tests/server/api/series-tickets-purchase.test.js
+++ /dev/null
@@ -1,177 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest'
-
-import Member from '../../../server/models/member.js'
-import Series from '../../../server/models/series.js'
-import Event from '../../../server/models/event.js'
-import {
- validateSeriesTicketPurchase,
- completeSeriesTicketPurchase,
- registerForAllSeriesEvents,
- hasMemberAccess,
-} from '../../../server/utils/tickets.js'
-import { sendSeriesPassConfirmation } from '../../../server/utils/resend.js'
-import { seriesTicketPurchaseSchema } from '../../../server/utils/schemas.js'
-import handler from '../../../server/api/series/[id]/tickets/purchase.post.js'
-import { createMockEvent } from '../helpers/createMockEvent.js'
-
-vi.mock('../../../server/models/member.js', () => ({
- default: { findOne: vi.fn(), findOneAndUpdate: vi.fn() }
-}))
-vi.mock('../../../server/models/series.js', () => ({
- default: { findOne: vi.fn() }
-}))
-vi.mock('../../../server/models/event.js', () => ({
- default: {
- find: vi.fn(() => ({ sort: vi.fn().mockResolvedValue([]) }))
- }
-}))
-vi.mock('../../../server/utils/mongoose.js', () => ({ connectDB: vi.fn() }))
-vi.mock('../../../server/utils/tickets.js', () => ({
- validateSeriesTicketPurchase: vi.fn(),
- calculateSeriesTicketPrice: vi.fn(),
- reserveSeriesTicket: vi.fn(),
- releaseSeriesTicket: vi.fn(),
- completeSeriesTicketPurchase: vi.fn().mockResolvedValue(undefined),
- registerForAllSeriesEvents: vi.fn().mockResolvedValue([]),
- hasMemberAccess: vi.fn(() => false),
-}))
-vi.mock('../../../server/utils/resend.js', () => ({
- sendSeriesPassConfirmation: vi.fn().mockResolvedValue(undefined),
-}))
-
-// Auto-imports the handler relies on but the global setup doesn't stub.
-const setAuthCookieMock = vi.fn()
-vi.stubGlobal('setAuthCookie', setAuthCookieMock)
-vi.stubGlobal('seriesTicketPurchaseSchema', seriesTicketPurchaseSchema)
-
-// Capture schema passed to validateBody so we can prove the route validates
-// against seriesTicketPurchaseSchema specifically.
-const validateBodyCalls = []
-const validateBodyMock = vi.fn(async (event, schema) => {
- validateBodyCalls.push(schema)
- // Mirror real behavior: parse body via the schema so invalid bodies still throw.
- const body = await readBody(event)
- return schema.parse(body)
-})
-vi.stubGlobal('validateBody', validateBodyMock)
-
-function buildEvent(body) {
- const ev = createMockEvent({
- method: 'POST',
- path: '/api/series/series-1/tickets/purchase',
- body,
- })
- ev.context = { params: { id: 'series-1' } }
- return ev
-}
-
-const baseSeries = () => ({
- _id: 'series-1',
- id: 'series-1',
- slug: 'series-slug',
- title: 'Test Series',
- description: 'desc',
- type: 'workshop',
- registrations: [],
-})
-
-describe('POST /api/series/[id]/tickets/purchase — guest upsert + auth cookie', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- validateBodyCalls.length = 0
- // Default: unauthenticated buyer
- globalThis.requireAuth = vi.fn().mockRejectedValue(
- Object.assign(new Error('Unauthorized'), { statusCode: 401 })
- )
- Series.findOne.mockResolvedValue(baseSeries())
- Member.findOne.mockResolvedValue(null)
- validateSeriesTicketPurchase.mockReturnValue({
- valid: true,
- ticketInfo: {
- ticketType: 'public',
- price: 0,
- currency: 'CAD',
- isFree: true,
- },
- })
- })
-
- it('upserts a guest Member with $setOnInsert + upsert:true when buyer has no account', async () => {
- Member.findOneAndUpdate.mockResolvedValue({
- _id: 'new-member-1',
- email: 'guest@example.com',
- status: 'guest',
- })
-
- await handler(buildEvent({
- name: 'Guest Buyer',
- email: 'guest@example.com',
- ticketType: 'public',
- }))
-
- expect(Member.findOneAndUpdate).toHaveBeenCalledTimes(1)
- const [filter, update, options] = Member.findOneAndUpdate.mock.calls[0]
- expect(filter).toEqual({ email: 'guest@example.com' })
- expect(update).toEqual({
- $setOnInsert: {
- email: 'guest@example.com',
- name: 'Guest Buyer',
- circle: 'community',
- contributionAmount: 0,
- status: 'guest',
- },
- })
- expect(options).toEqual({
- upsert: true,
- new: true,
- setDefaultsOnInsert: true,
- })
- })
-
- it('sets the auth cookie for newly-created guest accounts', async () => {
- const newMember = {
- _id: 'new-member-2',
- email: 'newbie@example.com',
- status: 'guest',
- }
- Member.findOneAndUpdate.mockResolvedValue(newMember)
-
- const result = await handler(buildEvent({
- name: 'Newbie',
- email: 'newbie@example.com',
- ticketType: 'public',
- }))
-
- expect(setAuthCookieMock).toHaveBeenCalledTimes(1)
- expect(setAuthCookieMock.mock.calls[0][1]).toBe(newMember)
- expect(result.signedIn).toBe(true)
- expect(result.accountCreated).toBe(true)
- expect(result.requiresSignIn).toBe(false)
- })
-
- it('validates input via seriesTicketPurchaseSchema', async () => {
- Member.findOneAndUpdate.mockResolvedValue({
- _id: 'm',
- email: 'a@b.com',
- status: 'guest',
- })
-
- await handler(buildEvent({
- name: 'A',
- email: 'a@b.com',
- ticketType: 'public',
- }))
-
- expect(validateBodyMock).toHaveBeenCalled()
- expect(validateBodyCalls[0]).toBe(seriesTicketPurchaseSchema)
- })
-
- it('rejects invalid body (no name) via schema validation', async () => {
- await expect(
- handler(buildEvent({ email: 'a@b.com', ticketType: 'public' }))
- ).rejects.toBeDefined()
-
- expect(Member.findOneAndUpdate).not.toHaveBeenCalled()
- expect(setAuthCookieMock).not.toHaveBeenCalled()
- })
-})
diff --git a/tests/server/api/update-contribution.test.js b/tests/server/api/update-contribution.test.js
index 0519c44..a62e243 100644
--- a/tests/server/api/update-contribution.test.js
+++ b/tests/server/api/update-contribution.test.js
@@ -261,30 +261,6 @@ describe('update-contribution endpoint — Case 1 (free→paid)', () => {
expect(result.message).toBe('Successfully upgraded to paid tier')
})
- it('reads dateBilling from Helcim CREATE response and threads it to $set + response', async () => {
- setMember(freeMember)
- getHelcimPlanId.mockReturnValue('111')
- getHelcimCustomer.mockResolvedValue({ customerCode: 'code-1' })
- listHelcimCustomerCards.mockResolvedValue([{ id: 'card-1' }])
- createHelcimSubscription.mockResolvedValue({ data: [{ id: 'sub-new', status: 'active', dateBilling: '2026-05-18' }] })
- Member.findByIdAndUpdate.mockResolvedValue({})
-
- const event = createMockEvent({
- method: 'POST',
- path: '/api/members/update-contribution',
- body: { contributionAmount: 15, cadence: 'monthly' },
- })
-
- const result = await handler(event)
-
- expect(Member.findByIdAndUpdate).toHaveBeenCalledWith(
- 'member-c1',
- { $set: expect.objectContaining({ nextBillingDate: new Date('2026-05-18') }) },
- { runValidators: false }
- )
- expect(result.subscription.nextBillingDate).toBe('2026-05-18')
- })
-
it('annual: calls createHelcimSubscription with annual plan id and recurringAmount 180, persists billingCadence annual', async () => {
setMember(freeMember)
getHelcimPlanId.mockReturnValue('222')
diff --git a/tests/server/api/validation-phase3.test.js b/tests/server/api/validation-phase3.test.js
index 1d17c02..e34acde 100644
--- a/tests/server/api/validation-phase3.test.js
+++ b/tests/server/api/validation-phase3.test.js
@@ -12,6 +12,7 @@ import {
waitlistDeleteSchema,
cancelRegistrationSchema,
checkRegistrationSchema,
+ eventPaymentSchema,
updateContributionSchema,
seriesTicketPurchaseSchema,
seriesTicketEligibilitySchema,
@@ -311,6 +312,25 @@ describe('waitlistSchema', () => {
})
})
+describe('eventPaymentSchema', () => {
+ it('accepts valid payment data', () => {
+ const result = eventPaymentSchema.safeParse({
+ name: 'Payer',
+ email: 'payer@example.com',
+ paymentToken: 'tok_abc123'
+ })
+ expect(result.success).toBe(true)
+ })
+
+ it('rejects missing paymentToken', () => {
+ const result = eventPaymentSchema.safeParse({
+ name: 'Payer',
+ email: 'payer@example.com'
+ })
+ expect(result.success).toBe(false)
+ })
+})
+
// --- Member schemas ---
describe('updateContributionSchema', () => {
@@ -537,6 +557,7 @@ describe('validateBody migration coverage', () => {
'events/[id]/waitlist.delete.js',
'events/[id]/cancel-registration.post.js',
'events/[id]/check-registration.post.js',
+ 'events/[id]/payment.post.js',
'members/update-contribution.post.js',
'series/[id]/tickets/purchase.post.js',
'series/[id]/tickets/check-eligibility.post.js',
diff --git a/tests/server/config/__snapshots__/runtime-config-public.test.js.snap b/tests/server/config/__snapshots__/runtime-config-public.test.js.snap
deleted file mode 100644
index d089ad3..0000000
--- a/tests/server/config/__snapshots__/runtime-config-public.test.js.snap
+++ /dev/null
@@ -1,11 +0,0 @@
-// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
-
-exports[`runtimeConfig.public > matches public runtime config snapshot 1`] = `
-[
- "appUrl",
- "cloudinaryCloudName",
- "comingSoon",
- "helcimAccountId",
- "helcimPortalUrl",
-]
-`;
diff --git a/tests/server/config/runtime-config-public.test.js b/tests/server/config/runtime-config-public.test.js
deleted file mode 100644
index 797f2ab..0000000
--- a/tests/server/config/runtime-config-public.test.js
+++ /dev/null
@@ -1,36 +0,0 @@
-import { describe, it, expect, beforeAll } from 'vitest'
-
-// nuxt.config.ts uses the auto-imported defineNuxtConfig() global. Stub it to
-// the identity function so we can dynamically import the config in node and
-// assert against the actual runtimeConfig object the build will use.
-let nuxtConfig
-
-beforeAll(async () => {
- globalThis.defineNuxtConfig = (config) => config
- const mod = await import('../../../nuxt.config.ts')
- nuxtConfig = mod.default
-})
-
-describe('runtimeConfig.public', () => {
- it('does not expose helcimToken in runtimeConfig.public', () => {
- expect('helcimToken' in nuxtConfig.runtimeConfig.public).toBe(false)
- })
-
- it('does not expose any *ApiToken or *Secret keys in runtimeConfig.public', () => {
- // Keys that are intentionally public despite matching the pattern.
- const allowlist = new Set(['helcimAccountId', 'cloudinaryCloudName'])
- const sensitivePattern = /token|secret|key$/i
-
- const violations = Object.keys(nuxtConfig.runtimeConfig.public).filter(
- (key) => sensitivePattern.test(key) && !allowlist.has(key)
- )
-
- expect(violations).toEqual([])
- })
-
- it('matches public runtime config snapshot', () => {
- // Snapshot only the sorted key list, not values (values come from env).
- const sortedKeys = Object.keys(nuxtConfig.runtimeConfig.public).sort()
- expect(sortedKeys).toMatchSnapshot()
- })
-})
diff --git a/tests/server/middleware/rate-limit.test.js b/tests/server/middleware/rate-limit.test.js
index fa165ae..2f81a62 100644
--- a/tests/server/middleware/rate-limit.test.js
+++ b/tests/server/middleware/rate-limit.test.js
@@ -18,6 +18,35 @@ describe('rate-limit middleware', () => {
})
})
+ describe('auth endpoint limiting (5 per 5 min)', () => {
+ it('allows 5 requests then blocks the 6th', async () => {
+ const ip = '10.0.1.1'
+
+ // First 5 should succeed
+ for (let i = 0; i < 5; i++) {
+ const event = createMockEvent({
+ method: 'POST',
+ path: '/api/auth/login',
+ remoteAddress: ip
+ })
+ await expect(rateLimitMiddleware(event)).resolves.toBeUndefined()
+ }
+
+ // 6th should be rate limited
+ const event = createMockEvent({
+ method: 'POST',
+ path: '/api/auth/login',
+ remoteAddress: ip
+ })
+ await expect(rateLimitMiddleware(event)).rejects.toMatchObject({
+ statusCode: 429
+ })
+
+ // Check Retry-After header was set
+ expect(event._testSetHeaders['retry-after']).toBeDefined()
+ })
+ })
+
describe('payment endpoint limiting (10 per min)', () => {
it('allows 10 requests then blocks the 11th', async () => {
const ip = '10.0.2.1'
@@ -39,19 +68,16 @@ describe('rate-limit middleware', () => {
await expect(rateLimitMiddleware(event)).rejects.toMatchObject({
statusCode: 429
})
-
- // Check Retry-After header was set
- expect(event._testSetHeaders['retry-after']).toBeDefined()
})
})
describe('IP isolation', () => {
it('different IPs have separate rate limit counters', async () => {
- // Exhaust payment limit for IP A
- for (let i = 0; i < 10; i++) {
+ // Exhaust limit for IP A
+ for (let i = 0; i < 5; i++) {
const event = createMockEvent({
method: 'POST',
- path: '/api/helcim/initialize-payment',
+ path: '/api/auth/login',
remoteAddress: '10.0.3.1'
})
await rateLimitMiddleware(event)
@@ -60,7 +86,7 @@ describe('rate-limit middleware', () => {
// IP B should still be able to make requests
const event = createMockEvent({
method: 'POST',
- path: '/api/helcim/initialize-payment',
+ path: '/api/auth/login',
remoteAddress: '10.0.3.2'
})
await expect(rateLimitMiddleware(event)).resolves.toBeUndefined()
diff --git a/tests/server/middleware/security-headers.test.js b/tests/server/middleware/security-headers.test.js
index acd3a35..e6b50b1 100644
--- a/tests/server/middleware/security-headers.test.js
+++ b/tests/server/middleware/security-headers.test.js
@@ -86,7 +86,7 @@ describe('security-headers middleware', () => {
const csp = event._testSetHeaders['content-security-policy']
expect(csp).toContain('myposjs.helcim.com')
expect(csp).toContain('api.helcim.com')
- expect(csp).toContain('secure.helcim.app')
+ expect(csp).toContain('secure.helcim.com')
})
it('includes Cloudinary sources in CSP', () => {
diff --git a/tests/server/models/member-slack-fields.test.js b/tests/server/models/member-slack-fields.test.js
deleted file mode 100644
index 4fccef4..0000000
--- a/tests/server/models/member-slack-fields.test.js
+++ /dev/null
@@ -1,69 +0,0 @@
-// Spec: docs/specs/wave-based-slack-onboarding.md
-// Test plan: docs/specs/wave-based-slack-onboarding-tests.md §1
-//
-// SCAFFOLD: `describe.skip` until the schema migration lands. Tests use the
-// schema's path metadata only — no DB connection required.
-
-import { describe, it, expect } from 'vitest'
-import mongoose from 'mongoose'
-import Member from '../../../server/models/member.js'
-
-describe.skip('Member schema — Slack fields (post-migration)', () => {
- it('does not define the legacy invite-status field (1.2)', () => {
- // Field name reconstructed to avoid the cleanup-sweep grep tripping on a literal.
- const legacyField = 'slackInvite' + 'Status'
- expect(Member.schema.path(legacyField)).toBeUndefined()
- })
-
- it('defines slackInvited as Boolean with default false (1.1)', () => {
- const path = Member.schema.path('slackInvited')
- expect(path).toBeDefined()
- expect(path.instance).toBe('Boolean')
- expect(path.defaultValue).toBe(false)
- })
-
- it('defines slackInvitedAt as an optional Date (1.3)', () => {
- const path = Member.schema.path('slackInvitedAt')
- expect(path).toBeDefined()
- expect(path.instance).toBe('Date')
- expect(path.isRequired).toBeFalsy()
- })
-
- it('retains slackUserId as String (1.4)', () => {
- const path = Member.schema.path('slackUserId')
- expect(path).toBeDefined()
- expect(path.instance).toBe('String')
- })
-
- it('does not auto-stamp slackInvitedAt via pre-save hook (1.5)', () => {
- // Constructing a doc and flipping slackInvited should NOT set slackInvitedAt
- // — call sites are responsible (project convention).
- const doc = new Member({
- email: 't@example.com',
- name: 'T',
- circle: 'community',
- contributionAmount: 0
- })
- doc.slackInvited = true
- expect(doc.slackInvitedAt).toBeUndefined()
- })
-
- it('new member defaults: slackInvited false, slackInvitedAt unset (1.1)', () => {
- const doc = new Member({
- email: 'new@example.com',
- name: 'New',
- circle: 'community',
- contributionAmount: 0
- })
- expect(doc.slackInvited).toBe(false)
- expect(doc.slackInvitedAt).toBeUndefined()
- })
-})
-
-// Sanity: import doesn't introduce mongoose connection side-effects.
-describe('mongoose import sanity', () => {
- it('imports without error', () => {
- expect(mongoose).toBeDefined()
- expect(Member).toBeDefined()
- })
-})
diff --git a/tests/server/setup.js b/tests/server/setup.js
index ad47f25..f2fc815 100644
--- a/tests/server/setup.js
+++ b/tests/server/setup.js
@@ -15,9 +15,6 @@ import {
sendRedirect
} from 'h3'
-// Real server/utils that are safe to use as-is in tests
-import { escapeRegex } from '../../server/utils/escapeRegex.js'
-
// Register real h3 functions as globals so server code that relies on
// Nitro auto-imports can find them in the test environment.
vi.stubGlobal('getCookie', getCookie)
@@ -45,5 +42,7 @@ vi.stubGlobal('requireAdmin', vi.fn())
vi.stubGlobal('validateBody', vi.fn(async (event) => readBody(event)))
vi.stubGlobal('logActivity', vi.fn())
vi.stubGlobal('validateTagSlugs', vi.fn())
-vi.stubGlobal('autoFlagPreExistingSlackAccess', vi.fn().mockResolvedValue(undefined))
+
+// Real server/utils that are safe to use as-is in tests
+import { escapeRegex } from '../../server/utils/escapeRegex.js'
vi.stubGlobal('escapeRegex', escapeRegex)
diff --git a/tests/_archive/server/tasks/check-slack-joins.test.js b/tests/server/tasks/check-slack-joins.test.js
similarity index 100%
rename from tests/_archive/server/tasks/check-slack-joins.test.js
rename to tests/server/tasks/check-slack-joins.test.js
diff --git a/tests/server/utils/adminAlerts.test.js b/tests/server/utils/adminAlerts.test.js
index 40769a9..aae36e2 100644
--- a/tests/server/utils/adminAlerts.test.js
+++ b/tests/server/utils/adminAlerts.test.js
@@ -1,23 +1,5 @@
import { describe, it, expect, vi, beforeEach } from 'vitest'
-import {
- ALERT_THRESHOLDS,
- computeSignature,
- detectNoSlackHandleAfterWeek,
- detectStuckPendingPayment,
- detectSuspendedMembers,
- detectPreRegistrantSelectedNotInvited,
- detectPreRegistrantExpired,
- detectDraftEventsImminent,
- detectEventsNearCapacity, detectPendingTagSuggestions , computeAllAlerts
-} from '../../../server/utils/adminAlerts.js'
-import Member from '../../../server/models/member.js'
-import PreRegistration from '../../../server/models/preRegistration.js'
-import Event from '../../../server/models/event.js'
-import TagSuggestion from '../../../server/models/tagSuggestion.js'
-
-import AdminAlertDismissal from '../../../server/models/adminAlertDismissal.js'
-
vi.mock('../../../server/utils/mongoose.js', () => ({
connectDB: vi.fn()
}))
@@ -52,6 +34,7 @@ vi.mock('../../../server/models/adminAlertDismissal.js', () => ({
find: vi.fn()
},
ADMIN_ALERT_TYPES: [
+ 'slack_invite_failed',
'no_slack_handle_week',
'stuck_pending_payment',
'member_suspended',
@@ -63,6 +46,24 @@ vi.mock('../../../server/models/adminAlertDismissal.js', () => ({
]
}))
+import {
+ ALERT_THRESHOLDS,
+ computeSignature,
+ detectSlackInviteFailed,
+ detectNoSlackHandleAfterWeek,
+ detectStuckPendingPayment,
+ detectSuspendedMembers,
+ detectPreRegistrantSelectedNotInvited,
+ detectPreRegistrantExpired,
+ detectDraftEventsImminent,
+ detectEventsNearCapacity
+} from '../../../server/utils/adminAlerts.js'
+import Member from '../../../server/models/member.js'
+import PreRegistration from '../../../server/models/preRegistration.js'
+import Event from '../../../server/models/event.js'
+import { detectPendingTagSuggestions } from '../../../server/utils/adminAlerts.js'
+import TagSuggestion from '../../../server/models/tagSuggestion.js'
+
describe('adminAlerts module shell', () => {
describe('ALERT_THRESHOLDS', () => {
it('exposes the four documented thresholds', () => {
@@ -112,6 +113,36 @@ describe('adminAlerts module shell', () => {
})
}
+ describe('detectSlackInviteFailed', () => {
+ it('returns matching members with critical severity', async () => {
+ mockMemberFind([
+ { _id: 'm1', name: 'Alex', email: 'alex@example.com' },
+ { _id: 'm2', name: 'Bea', email: 'bea@example.com' }
+ ])
+
+ const alert = await detectSlackInviteFailed()
+
+ expect(alert.type).toBe('slack_invite_failed')
+ expect(alert.severity).toBe('critical')
+ expect(alert.items).toHaveLength(2)
+ expect(alert.items[0]).toEqual({
+ id: 'm1',
+ label: 'Alex',
+ sublabel: 'alex@example.com',
+ href: '/admin/members/m1'
+ })
+ expect(Member.find).toHaveBeenCalledWith(
+ { slackInviteStatus: 'failed' }
+ )
+ })
+
+ it('returns an empty list when nothing matches', async () => {
+ mockMemberFind([])
+ const alert = await detectSlackInviteFailed()
+ expect(alert.items).toEqual([])
+ })
+ })
+
describe('detectNoSlackHandleAfterWeek', () => {
it('queries active members joined more than 7 days ago without a slackUserId', async () => {
mockMemberFind([
@@ -361,6 +392,9 @@ describe('adminAlerts module shell', () => {
})
})
+import { computeAllAlerts } from '../../../server/utils/adminAlerts.js'
+import AdminAlertDismissal from '../../../server/models/adminAlertDismissal.js'
+
describe('computeAllAlerts aggregator', () => {
beforeEach(() => {
vi.clearAllMocks()
@@ -389,7 +423,7 @@ describe('computeAllAlerts aggregator', () => {
it('returns alerts that have items and have not been dismissed', async () => {
Member.find.mockImplementation((query) => {
- if (query.status === 'suspended') {
+ if (query.slackInviteStatus === 'failed') {
return { select: vi.fn().mockReturnValue({ lean: vi.fn().mockResolvedValue([
{ _id: 'm1', name: 'Alex', email: 'alex@example.com' }
]) }) }
@@ -399,13 +433,13 @@ describe('computeAllAlerts aggregator', () => {
const alerts = await computeAllAlerts('admin-1')
expect(alerts).toHaveLength(1)
- expect(alerts[0].type).toBe('member_suspended')
+ expect(alerts[0].type).toBe('slack_invite_failed')
expect(alerts[0].signature).toMatch(/^[a-f0-9]+$/)
})
it('hides alerts whose signature matches an existing dismissal', async () => {
Member.find.mockImplementation((query) => {
- if (query.status === 'suspended') {
+ if (query.slackInviteStatus === 'failed') {
return { select: vi.fn().mockReturnValue({ lean: vi.fn().mockResolvedValue([
{ _id: 'm1', name: 'Alex', email: 'alex@example.com' }
]) }) }
@@ -416,7 +450,7 @@ describe('computeAllAlerts aggregator', () => {
const sig = computeSignature(['m1'])
AdminAlertDismissal.find.mockReturnValue({
lean: vi.fn().mockResolvedValue([
- { adminId: 'admin-1', alertType: 'member_suspended', signature: sig }
+ { adminId: 'admin-1', alertType: 'slack_invite_failed', signature: sig }
])
})
@@ -426,7 +460,7 @@ describe('computeAllAlerts aggregator', () => {
it('shows an alert again when the underlying set changes', async () => {
Member.find.mockImplementation((query) => {
- if (query.status === 'suspended') {
+ if (query.slackInviteStatus === 'failed') {
return { select: vi.fn().mockReturnValue({ lean: vi.fn().mockResolvedValue([
{ _id: 'm1', name: 'Alex', email: 'alex@example.com' },
{ _id: 'm2', name: 'Bea', email: 'bea@example.com' }
@@ -438,7 +472,7 @@ describe('computeAllAlerts aggregator', () => {
const staleSig = computeSignature(['m1']) // dismissal was for the old single-member state
AdminAlertDismissal.find.mockReturnValue({
lean: vi.fn().mockResolvedValue([
- { adminId: 'admin-1', alertType: 'member_suspended', signature: staleSig }
+ { adminId: 'admin-1', alertType: 'slack_invite_failed', signature: staleSig }
])
})
diff --git a/tests/server/utils/helcim.test.js b/tests/server/utils/helcim.test.js
index 5fe63b0..d863b99 100644
--- a/tests/server/utils/helcim.test.js
+++ b/tests/server/utils/helcim.test.js
@@ -1,7 +1,6 @@
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
import {
- listHelcimCustomerCards,
listHelcimCustomerTransactions,
updateHelcimCustomerDefaultPaymentMethod,
updateHelcimSubscriptionPaymentMethod
@@ -26,56 +25,6 @@ function errResponse(status = 500, body = 'boom') {
}
}
-describe('listHelcimCustomerCards', () => {
- beforeEach(() => {
- vi.clearAllMocks()
- })
- afterEach(() => {
- mockFetch.mockReset()
- })
-
- it('passes through a bare array response', async () => {
- const cards = [
- { id: 1, cardToken: 'tok-a' },
- { id: 2, cardToken: 'tok-b' }
- ]
- mockFetch.mockResolvedValue(okResponse(cards))
-
- const result = await listHelcimCustomerCards('2488717')
-
- expect(result).toEqual(cards)
- })
-
- it('unwraps a { cards: [...] } response envelope', async () => {
- const cards = [{ id: 1, cardToken: 'tok-a' }]
- mockFetch.mockResolvedValue(okResponse({ cards }))
-
- const result = await listHelcimCustomerCards('2488717')
-
- expect(result).toEqual(cards)
- })
-
- it('unwraps a { data: [...] } response envelope', async () => {
- const cards = [{ id: 1, cardToken: 'tok-a' }]
- mockFetch.mockResolvedValue(okResponse({ data: cards }))
-
- const result = await listHelcimCustomerCards('2488717')
-
- expect(result).toEqual(cards)
- })
-
- it('returns an empty array for null, undefined, or unrecognized object responses', async () => {
- mockFetch.mockResolvedValueOnce(okResponse(null))
- expect(await listHelcimCustomerCards('2488717')).toEqual([])
-
- mockFetch.mockResolvedValueOnce(okResponse(undefined))
- expect(await listHelcimCustomerCards('2488717')).toEqual([])
-
- mockFetch.mockResolvedValueOnce(okResponse({ unexpected: 'shape' }))
- expect(await listHelcimCustomerCards('2488717')).toEqual([])
- })
-})
-
describe('listHelcimCustomerTransactions', () => {
beforeEach(() => {
vi.clearAllMocks()
diff --git a/tests/server/utils/slack-cleanup.test.js b/tests/server/utils/slack-cleanup.test.js
deleted file mode 100644
index b9c739d..0000000
--- a/tests/server/utils/slack-cleanup.test.js
+++ /dev/null
@@ -1,116 +0,0 @@
-// Spec: docs/specs/wave-based-slack-onboarding.md
-// Test plan: docs/specs/wave-based-slack-onboarding-tests.md §8
-//
-// Static-source / filesystem assertions for the dead-code removal &
-// archival checklist. These don't require booting any handler — they
-// grep the working tree.
-//
-// SCAFFOLD: the whole suite is `.skip`ed until removal is done. As each
-// chunk lands, unskip the matching `it`.
-
-import { describe, it, expect } from 'vitest'
-import { readFileSync, existsSync, readdirSync } from 'node:fs'
-import { resolve } from 'node:path'
-
-const repoRoot = resolve(import.meta.dirname, '../../..')
-
-function read(rel) {
- const path = resolve(repoRoot, rel)
- return existsSync(path) ? readFileSync(path, 'utf-8') : null
-}
-
-function walk(dir, out = []) {
- for (const entry of readdirSync(resolve(repoRoot, dir), { withFileTypes: true })) {
- const rel = `${dir}/${entry.name}`
- if (entry.isDirectory()) {
- if (entry.name === 'node_modules' || entry.name.startsWith('.')) continue
- if (entry.name === '_archive') continue
- walk(rel, out)
- } else if (/\.(js|ts|vue|mjs)$/.test(entry.name)) {
- out.push(rel)
- }
- }
- return out
-}
-
-describe('Slack onboarding — dead code removal (§8)', () => {
- it('no admin.users.invite calls anywhere (8.1)', () => {
- const files = walk('server').concat(walk('app'))
- const hits = files.filter((f) => {
- const src = read(f)
- return src && /admin\.users\.invite/.test(src)
- })
- expect(hits).toEqual([])
- })
-
- it('inviteUserToSlack removed from slack.ts (8.2)', () => {
- const src = read('server/utils/slack.ts')
- expect(src).not.toMatch(/\binviteUserToSlack\b/)
- })
-
- it('findUserByEmail is callable (public or via wrapper) (8.3)', () => {
- const src = read('server/utils/slack.ts') ?? ''
- // Either the keyword `private` is removed from its declaration,
- // OR a public wrapper exists.
- const declLine = src.split('\n').find((l) => /findUserByEmail/.test(l)) ?? ''
- const isPrivate = /\bprivate\b/.test(declLine)
- const hasPublicWrapper = /export\s+(async\s+)?function\s+findUserByEmail/.test(src)
- || /findUserByEmail\s*[:=]\s*async/.test(src)
- expect(isPrivate && !hasPublicWrapper).toBe(false)
- })
-
- it('notifyNewMember retained (8.4)', () => {
- const src = read('server/utils/slack.ts') ?? ''
- expect(src).toMatch(/\bnotifyNewMember\b/)
- })
-
- it('checkSlackJoins archived, not at original path (8.5)', () => {
- expect(existsSync(resolve(repoRoot, 'server/utils/checkSlackJoins.js'))).toBe(false)
- // Any unloaded path is acceptable; check a couple of plausible ones.
- const archived =
- existsSync(resolve(repoRoot, 'server/utils/_archive/checkSlackJoins.js')) ||
- existsSync(resolve(repoRoot, 'server/_archive/utils/checkSlackJoins.js'))
- expect(archived).toBe(true)
- })
-
- it('no active cron/Nitro registration triggers checkSlackJoins (8.6)', () => {
- const candidates = [
- 'nitro.config.ts',
- 'nitro.config.js',
- 'nuxt.config.ts',
- 'nuxt.config.js'
- ].map(read).filter(Boolean)
- const tasksDir = resolve(repoRoot, 'server/tasks')
- const taskFiles = existsSync(tasksDir) ? walk('server/tasks') : []
- const allSrc = candidates.concat(taskFiles.map(read).filter(Boolean)).join('\n')
- expect(allSrc).not.toMatch(/checkSlackJoins/)
- })
-
- it('adminAlerts no longer queries the legacy invite-status field (8.7)', () => {
- const src = read('server/utils/adminAlerts.js') ?? ''
- expect(src).not.toMatch(new RegExp('slackInvite' + 'Status'))
- })
-
- it('adminAlerts.test.js drops the removed branch (8.8)', () => {
- const src = read('tests/server/utils/adminAlerts.test.js') ?? ''
- expect(src).not.toMatch(new RegExp('slackInvite' + 'Status'))
- expect(src).not.toMatch(/detectSlackInviteFailed/)
- })
-
- it('check-slack-joins.test.js archived alongside source (8.9)', () => {
- expect(existsSync(resolve(repoRoot, 'tests/server/tasks/check-slack-joins.test.js'))).toBe(false)
- })
-
- it('zero references to the legacy invite-status field repo-wide (8.10)', () => {
- const files = walk('server').concat(walk('app')).concat(walk('tests'))
- const hits = files.filter((f) => {
- const src = read(f)
- return src && new RegExp('slackInvite' + 'Status').test(src)
- })
- expect(hits).toEqual([])
- })
-
- it.todo('migration / cleanup story for dev/staging documented (8.11)')
-
- it.todo('notifyNewMember invitationStatus arg uses canonical value at all call sites (8.12)')
-})
diff --git a/tests/server/utils/slackAccess.test.js b/tests/server/utils/slackAccess.test.js
deleted file mode 100644
index 03db079..0000000
--- a/tests/server/utils/slackAccess.test.js
+++ /dev/null
@@ -1,134 +0,0 @@
-// Spec: docs/specs/wave-based-slack-onboarding.md
-// Test plan: docs/specs/wave-based-slack-onboarding-tests.md §2
-//
-// SCAFFOLD: `describe.skip` until the helper at server/utils/slackAccess.js
-// is created. Unskip during implementation (TDD).
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-
-vi.mock('../../../server/models/member.js', () => ({
- default: {
- findByIdAndUpdate: vi.fn().mockResolvedValue(null)
- }
-}))
-
-vi.mock('../../../server/utils/slack.ts', () => ({
- getSlackService: vi.fn()
-}))
-
-// `logActivity` is stubbed globally in tests/server/setup.js
-
-describe('autoFlagPreExistingSlackAccess (server/utils/slackAccess.js)', () => {
- let autoFlagPreExistingSlackAccess
- let Member
- let getSlackService
- let findUserByEmail
-
- beforeEach(async () => {
- vi.clearAllMocks()
- vi.useFakeTimers()
-
- findUserByEmail = vi.fn()
- getSlackService = (await import('../../../server/utils/slack.ts')).getSlackService
- getSlackService.mockReturnValue({ findUserByEmail })
-
- Member = (await import('../../../server/models/member.js')).default
- autoFlagPreExistingSlackAccess = (
- await import('../../../server/utils/slackAccess.js')
- ).autoFlagPreExistingSlackAccess
-
- globalThis.logActivity.mockClear?.()
- })
-
- afterEach(() => {
- vi.useRealTimers()
- })
-
- const baseMember = () => ({
- _id: 'member-abc',
- email: 'pat@example.com',
- name: 'Pat Example',
- slackInvited: false
- })
-
- it('flags member when Slack lookup finds the email (2.1)', async () => {
- findUserByEmail.mockResolvedValue('U123')
-
- await autoFlagPreExistingSlackAccess(baseMember())
-
- expect(Member.findByIdAndUpdate).toHaveBeenCalledWith(
- 'member-abc',
- expect.objectContaining({
- slackInvited: true,
- slackInvitedAt: expect.any(Date),
- slackUserId: 'U123'
- }),
- expect.objectContaining({ runValidators: false })
- )
- expect(globalThis.logActivity).toHaveBeenCalledWith(
- 'member-abc',
- 'slack_access_auto_detected',
- expect.any(Object),
- expect.any(Object)
- )
- })
-
- it('no-ops when lookup returns no match (2.2)', async () => {
- findUserByEmail.mockResolvedValue(null)
-
- await autoFlagPreExistingSlackAccess(baseMember())
-
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- expect(globalThis.logActivity).not.toHaveBeenCalled()
- })
-
- it('returns silently when Slack service is not configured (2.3)', async () => {
- getSlackService.mockReturnValue(null)
-
- await expect(
- autoFlagPreExistingSlackAccess(baseMember())
- ).resolves.not.toThrow()
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- })
-
- it('swallows Slack API errors and does not throw to caller (2.4)', async () => {
- findUserByEmail.mockRejectedValue(new Error('slack down'))
-
- await expect(
- autoFlagPreExistingSlackAccess(baseMember())
- ).resolves.not.toThrow()
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- })
-
- it('returns within timeout if Slack lookup hangs (2.5)', async () => {
- findUserByEmail.mockImplementation(() => new Promise(() => { /* never resolves */ }))
-
- const promise = autoFlagPreExistingSlackAccess(baseMember())
- await vi.advanceTimersByTimeAsync(3500)
- await expect(promise).resolves.not.toThrow()
- expect(Member.findByIdAndUpdate).not.toHaveBeenCalled()
- })
-
- it('uses findByIdAndUpdate with runValidators:false, never member.save (2.6)', async () => {
- findUserByEmail.mockResolvedValue('U999')
- const member = baseMember()
- member.save = vi.fn() // sentinel — must not be called
-
- await autoFlagPreExistingSlackAccess(member)
-
- expect(member.save).not.toHaveBeenCalled()
- const opts = Member.findByIdAndUpdate.mock.calls.at(-1)?.[2]
- expect(opts).toMatchObject({ runValidators: false })
- })
-
- it('writes activity log entry distinct from manual mark (2.7)', async () => {
- findUserByEmail.mockResolvedValue('U123')
- await autoFlagPreExistingSlackAccess(baseMember())
-
- const [, action] = globalThis.logActivity.mock.calls.at(-1)
- expect(action).toBe('slack_access_auto_detected')
- expect(action).not.toBe('slack_invited_manually')
- })
-
- it.todo('idempotent: does not re-stamp slackInvitedAt on already-flagged member (2.8)')
-})
diff --git a/tests/server/utils/tickets.test.js b/tests/server/utils/tickets.test.js
index 528208b..8ba74a1 100644
--- a/tests/server/utils/tickets.test.js
+++ b/tests/server/utils/tickets.test.js
@@ -394,52 +394,6 @@ describe('calculateTicketPrice', () => {
expect(result).toBeNull()
})
})
-
- describe('members-only gating', () => {
- it('returns null for unauthenticated user on members-only legacy event', () => {
- const event = legacyFreeEvent({ membersOnly: true })
- const result = calculateTicketPrice(event, null)
-
- expect(result).toBeNull()
- })
-
- it('returns null for unauthenticated user on members-only ticketed event', () => {
- const event = ticketedEvent({ membersOnly: true })
- const result = calculateTicketPrice(event, null)
-
- expect(result).toBeNull()
- })
-
- it('returns null for guest-status member on members-only event', () => {
- const event = ticketedEvent({ membersOnly: true })
- const result = calculateTicketPrice(event, baseMember({ status: 'guest' }))
-
- expect(result).toBeNull()
- })
-
- it('returns null for suspended member on members-only event', () => {
- const event = ticketedEvent({ membersOnly: true })
- const result = calculateTicketPrice(event, baseMember({ status: 'suspended' }))
-
- expect(result).toBeNull()
- })
-
- it('returns member pricing for active member on members-only event', () => {
- const event = ticketedEvent({ membersOnly: true })
- const result = calculateTicketPrice(event, baseMember())
-
- expect(result).not.toBeNull()
- expect(result.ticketType).toBe('member')
- })
-
- it('returns member pricing for pending_payment member on members-only event', () => {
- const event = ticketedEvent({ membersOnly: true })
- const result = calculateTicketPrice(event, baseMember({ status: 'pending_payment' }))
-
- expect(result).not.toBeNull()
- expect(result.ticketType).toBe('member')
- })
- })
})
// ===========================================================================