# TEST REPORT: Paid-But-Locked Fix (Stripe + Supabase) v1.0.0

Run by `DENO=~/.local/bin/deno MUTATIONS=1 bash tests/run_all.sh`; full output in `tests/logs/run-20261102.txt`.
Started 2026-11-02 07:41:04 GMT, finished 07:44:40 GMT (from `date`). Box: Linux, Deno 2.9.8, Node v24.22.1.

**Result: 5/5 steps, `FAILED STEPS: 0`.** 21 Deno tests (webhook, SQL, snippets, Next.js adapter) + 5 doctor tests (Deno also runs these
under Node compatibility, so its line reads "26 passed"), doctor exit codes on both fixtures, **mutation check 10/10 caught**.

## What is real and what is not
- **Real:** the shipped migration SQL on a real Postgres engine (PGlite 0.5.14 = Postgres compiled to WASM) with Supabase-like roles
  (`anon`, `authenticated`, `service_role`), default grants, an `auth.users` table and `auth.uid()` from a JWT claim. The real
  `stripe` npm SDK 23.1.0 (`constructEventAsync` + SubtleCrypto provider) and real `@supabase/supabase-js` 2.118.0 calling `.rpc()`.
  Signatures are made by an independent WebCrypto HMAC signer in the tests, not by the SDK being tested.
- **Mocked:** PostgREST (a ~40-line stand-in serving `POST /rest/v1/rpc/<fn>`, running the SQL as the role in the key) and Stripe
  (events are hand-built JSON in the snapshot format; no Stripe API calls).
- **Not tested:** a live Supabase project (real Kong/PostgREST/GoTrue, `supabase functions deploy`, the real `verify_jwt` gateway
  behaviour; the 401 claim comes from Supabase's docs and the reports listed in the handoff), a live Stripe account or `stripe listen`,
  real Next.js build/runtime (the route is exercised by calling its exported `POST` with a `Request`), Postgres versions other than
  PGlite's 18.x, Vercel Edge runtime.

## 1. Webhook + SQL (`tests/webhook.test.ts`, 17)
Happy path (link + grant, `billing_access.has_access`); subscription event before checkout link still unlocks once linked; duplicate
event id is a no-op (200 duplicate); stale (older `event.created`) update never overwrites; deleted removes access and a late "active"
can't resurrect it; status policy (active/trialing/past_due grant; unpaid/incomplete/incomplete_expired/paused/canceled don't);
pre-Basil top-level `current_period_end` still read; signature failures -> 400 with nothing written (missing header, wrong secret,
tampered body, stale timestamp, re-stringified body); GET -> 405; DB failure -> 500, event not marked processed, retry then succeeds;
an error inside the SQL function rolls back the event record too; unlinkable checkouts recorded and 200'd with an outcome; one-time
async payment unlocks only after `async_payment_succeeded`; unhandled types -> 200 ignored; signed-in users cannot call the RPC,
write billing rows or see other users' rows; **Deno fact check: sync `constructEvent()` throws "SubtleCryptoProvider cannot be used in a
synchronous context", `constructEventAsync` works**; missing env var fails at startup.

## 2. Snippets + Next.js (`tests/snippets_and_next.test.ts` 3, `tests/next_adapter.test.ts` 1)
`waitForAccess` resolves once access lands, gives up at the timeout, tolerates transient errors. Next.js route: valid delivery 200 +
access granted; bad signature 400.

## 3. Doctor (`tests/doctor.test.mjs`, 5 + 2 exit-code steps)
`fixtures/bad-app` triggers all 9 rules at the expected files; `fixtures/good-app` (a copy of the shipped code with `config.toml`) is
has zero findings; CLI exit codes 1 / 0 / 2 (errors / clean / bad dir) and `--json` parses; a commented-out `req.json()` causes no finding; fixture files are unchanged after a scan (read-only). Running the doctor on the pack folder itself
reports VERIFY-JWT-ON, which is expected: the pack ships a `config.toml.snippet`, not a `config.toml`.

## 4. Mutation check (`tests/mutation_check.sh`, 10/10 caught)
Each bug is injected into a copy and the suite must fail: RPC executable by authenticated; out-of-order guard removed; canceled can be
resurrected; dedupe removed; past_due no longer grants; one-time granted before payment; UPDATE policy for users; JSON parse +
re-stringify before verify; 200 on DB failure; verification skipped.

## Failures seen during development (fixed before the logged run)
1. Deno type errors on `rows[0]` (fixed with typed queries).
2. Doctor fix text printed a literal `\n` (reworded).
3. The "comments ignored" doctor test passed without testing anything; added a fixture with a commented-out `req.json()` so it now fails if comment stripping breaks.

Nothing was published, deployed or sent.

## Pre-launch re-run 2026-11-02
`DENO=~/.local/bin/deno MUTATIONS=1 bash tests/run_all.sh`; full output in `tests/logs/run-20261102-prelaunch.txt`, started 08:00:30 GMT, finished 08:03:59 GMT. **5/5 steps, `FAILED STEPS: 0`**: 26 Deno-run tests passed (21 + the 5 doctor tests under Node compatibility), 5/5 doctor tests under Node, doctor exit codes 0/1 on the good/bad fixtures, **mutation check 10/10 caught**. Counts unchanged. Still not tested against a live Supabase project or live Stripe account.
Extra pre-launch check: the shipped migration on a throwaway **native PostgreSQL 17.11** (not PGlite), with the same Supabase-like roles: 8/8 checks passed (migration applies; subscription-before-checkout unlocks once linked; other user sees nothing; duplicate event is a no-op; deleted is not resurrected by a stale event; anon and authenticated cannot call `stripe_apply_event`; a signed-in user cannot insert billing rows: RLS refuses it). Output appended to `tests/logs/run-20261102-prelaunch.txt`. Stripe test mode was not run: no test-mode Stripe account or key was available.