apps/e2e/tests/backend/endpoints/api/v1/payments/products.test.ts (5)

146-202: Missing userAuth on client requests may cause test failures.

This test uses Auth.fastSignUp() but does not pass userAuth on the client DELETE (line 176) and GET (line 188) requests. Given the PR's goal is to add client-access guards that validate whether the client can access the customer, these requests may now require authentication tokens to succeed.

🐛 Proposed fix

+  const { userId, accessToken, refreshToken } = await Auth.fastSignUp();
-  const { userId } = await Auth.fastSignUp();
   await niceBackendFetch(`/api/v1/payments/products/user/${userId}`, {
     method: "POST",
     accessType: "server",
     body: {
       product_id: "pro-plan",
     },
   });

   const cancelResponse = await niceBackendFetch(`/api/v1/payments/products/user/${userId}/pro-plan`, {
     method: "DELETE",
     accessType: "client",
+    userAuth: { accessToken, refreshToken },
   });
   expect(cancelResponse).toMatchInlineSnapshot(`
     NiceResponse {
       "status": 200,
       "body": { "success": true },
       "headers": Headers { <some fields may have been hidden> },
     }
   `);

   const listResponse = await niceBackendFetch(`/api/v1/payments/products/user/${userId}`, {
     accessType: "client",
+    userAuth: { accessToken, refreshToken },
   });

---

225-248: Test for unauthorized access may need authentication tokens.

This test verifies that a client cannot cancel someone else's subscription. However, the second user's accessToken and refreshToken are not passed in the cancel request (line 237). If the backend now requires authentication to determine "who is making the request", the test may not correctly simulate an authenticated but unauthorized user.

🐛 Proposed fix

-  const { userId: userId2 } = await Auth.fastSignUp();
+  const { userId: userId2, accessToken, refreshToken } = await Auth.fastSignUp();
   expect(userId2).not.toEqual(userId1);

   const cancelResponse = await niceBackendFetch(`/api/v1/payments/products/user/${userId1}/pro-plan`, {
     method: "DELETE",
     accessType: "client",
+    userAuth: { accessToken, refreshToken },
   });

---

314-356: Missing userAuth on client requests for cancellation and listing.

Similar to other tests, the client DELETE (line 330) and GET (line 342) requests don't include userAuth. The test expects these to succeed, but if client-access guards now require authentication, these requests will fail.

---

378-398: Unused destructured variables and missing userAuth.

The accessToken and refreshToken are not used. Additionally, the client DELETE request (line 387) lacks userAuth.

---

421-443: Unused destructured variables and missing userAuth.

Line 421 destructures variables that aren't used. The client DELETE (line 432) likely needs userAuth for the new access guards.

apps/e2e/tests/backend/endpoints/api/v1/payments/items.test.ts (7)

52-67: Missing userAuth on client request.

The test uses Auth.fastSignUp() but doesn't pass userAuth to the client request. If the backend now enforces client access guards, this request may fail without authentication.

🐛 Proposed fix

-  const { userId } = await Auth.fastSignUp();
+  const { userId, accessToken, refreshToken } = await Auth.fastSignUp();
   const response = await niceBackendFetch(`/api/latest/payments/items/user/${userId}/test-item`, {
     accessType: "client",
+    userAuth: { accessToken, refreshToken },
   });

---

82-100: Missing userAuth on client request.

Same issue - client request without authentication tokens.

---

115-138: Missing userAuth on client request.

Client request lacks authentication, which may be required by the new access guards.

---

181-195: Missing userAuth on client GET request.

Line 190 makes a client request without userAuth.

🐛 Proposed fix

-  const { userId } = await Auth.fastSignUp();
+  const { userId, accessToken, refreshToken } = await Auth.fastSignUp();

   const post1 = await niceBackendFetch(`/api/latest/payments/items/user/${userId}/test-item/update-quantity?allow_negative=false`, {
     method: "POST",
     accessType: "admin",
     body: { delta: 2 },
   });
   expect(post1.status).toBe(200);

   const get1 = await niceBackendFetch(`/api/latest/payments/items/user/${userId}/test-item`, {
     accessType: "client",
+    userAuth: { accessToken, refreshToken },
   });

---

210-224: Missing userAuth on client GET request.

Line 219's client request lacks authentication.

---

239-255: Missing userAuth on client GET request.

Line 250's client request lacks authentication.

---

407-438: Missing userAuth on client GET request.

Line 424's client request lacks authentication.

apps/e2e/tests/backend/endpoints/api/v1/stripe-webhooks.test.ts (3)

142-149: Missing userAuth on client request.

The client request at line 145 lacks authentication tokens. If the backend now requires client authentication for the items endpoint, this test will fail.

🐛 Proposed fix

-  const { userId } = await Auth.fastSignUp();
+  const { userId, accessToken, refreshToken } = await Auth.fastSignUp();

   // Before webhook: quantity should be 0
   const getBefore = await niceBackendFetch(`/api/latest/payments/items/user/${userId}/${itemId}`, {
     accessType: "client",
+    userAuth: { accessToken, refreshToken },
   });

And similarly for line 208:

   const getAfter = await niceBackendFetch(`/api/latest/payments/items/user/${userId}/${itemId}`, {
     accessType: "client",
+    userAuth: { accessToken, refreshToken },
   });

---

522-528: Missing userAuth on client requests.

Multiple client requests in this test (lines 524, 591, 601) lack userAuth.

---

635-641: Missing userAuth on client requests.

Client requests at lines 637, 704, 744 lack authentication tokens.

packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts (1)

1762-1774: Apply consistent session derivation pattern to listInvoices method.

The listProducts method correctly derives the session from the current user's _internalSession when available, but listInvoices (line 1776) still uses await this._getSession() directly. Since both are payment-related endpoints requiring proper access guards, they should follow the same pattern.

Update listInvoices to use:

const currentUser = await this.getUser();
const session = currentUser?._internalSession ?? await this._getSession();