CTO Sub-Audit Fix Wave + moderation (#693) — money/security/booking integrity, Sonar-clean

.github/workflows/cleanup-abandoned-payments.yml

@@ -26,8 +26,6 @@ jobs:
       STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
       RAZORPAY_KEY_ID: ${{ secrets.RAZORPAY_KEY_ID }}
       RAZORPAY_SECRET: ${{ secrets.RAZORPAY_SECRET }}
-      LEMON_SQUEEZY_API_KEY: ${{ secrets.LEMON_SQUEEZY_API_KEY }}
-      XFLOW_SECRET_KEY: ${{ secrets.XFLOW_SECRET_KEY }}
 
     steps:
       - name: Checkout code

.github/workflows/detect-consultant-no-shows.yml

@@ -0,0 +1,53 @@
+name: Detect Consultant No-Shows
+
+on:
+  schedule:
+    # Run hourly (offset to avoid colliding with other :00/:07 crons)
+    - cron: "17 * * * *"
+  workflow_dispatch: # Allow manual triggering
+
+jobs:
+  detect-consultant-no-shows:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    env:
+      # Database connection (required for Prisma)
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      DIRECT_URL: ${{ secrets.DIRECT_URL }}
+      # #476 cron locks load lib/redis at import — every job entry needs these
+      UPSTASH_REDIS_REST_URL: ${{ secrets.UPSTASH_REDIS_REST_URL }}
+      UPSTASH_REDIS_REST_TOKEN: ${{ secrets.UPSTASH_REDIS_REST_TOKEN }}
+      # #471 auto-refund reuses refundPayment (#990) — gateway creds for parity
+      # with the other money jobs (reconcile-pending-refunds).
+      STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
+      RAZORPAY_KEY_ID: ${{ secrets.RAZORPAY_KEY_ID }}
+      RAZORPAY_SECRET: ${{ secrets.RAZORPAY_SECRET }}
+      # Both-party no-show + refund notifications
+      NOVU_SECRET_KEY: ${{ secrets.NOVU_SECRET_KEY }}
+      NEXT_PUBLIC_APP_URL: ${{ secrets.NEXT_PUBLIC_APP_URL }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: "22"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Generate Prisma client
+        run: npx prisma generate
+
+      - name: Detect consultant no-shows
+        run: npx tsx jobs/appointments/detect-consultant-no-shows.ts
+
+      - name: Notify on failure
+        if: failure()
+        env:
+          SLACK_OPS_WEBHOOK_URL: ${{ secrets.SLACK_OPS_WEBHOOK_URL }}
+        run: bash scripts/ci/notify-ops-failure.sh "detect-consultant-no-shows"

__tests__/booking-algorithm/rescheduleCancel.test.ts

@@ -216,6 +216,10 @@
       update: jest.fn(),
       // B2 — the cancel/reschedule CAS guards use updateMany.
       updateMany: jest.fn().mockResolvedValue({ count: 1 }),
+      // #448 — a PARTIAL (slotIds) subscription reschedule only terminal-guards
+      // via count (no status write); a positive count means the from-state is
+      // still reschedulable so the route proceeds without flipping to PENDING.
+      count: jest.fn().mockResolvedValue(1),
     },
     webinar: {
       update: jest.fn(),
@@ -319,7 +323,7 @@
     });
     expect(result.success).toBe(true);
     if (result.success) {
       expect(result.data.reason).toBe("SCHEDULE_CONFLICT");
     }
   });
 
@@ -348,7 +352,7 @@
     });
     expect(result.success).toBe(true);
     if (result.success) {
       expect(result.data.notes).toBe(
         "Need to cancel due to scheduling conflict",
       );
     }

__tests__/booking-algorithm/rescheduleResponses.test.ts

@@ -155,6 +155,10 @@ function makeMockTx(appointmentData: any) {
       update: jest.fn(),
       // B2 — the cancel/reschedule CAS guards use updateMany.
       updateMany: jest.fn().mockResolvedValue({ count: 1 }),
+      // #448 — a PARTIAL (slotIds) subscription reschedule only terminal-guards
+      // via count (no status write); positive count keeps the route on the
+      // happy path without flipping the whole subscription to PENDING.
+      count: jest.fn().mockResolvedValue(1),
     },
     webinar: {
       update: jest.fn(),

__tests__/booking-algorithm/slotAllocationService.test.ts

@@ -70,7 +70,7 @@
   AppointmentsType,
   AppointmentStatus,
 } from "@prisma/client";
 import {
   makeWeeklyAvailabilitySlot,
   makeCustomAvailabilitySlot,
 } from "./__mocks__/booking.mockData";
@@ -2213,8 +2213,12 @@
       slots: ["2025-01-06T10:00:00Z", "2025-01-06T10:30:00Z"],
     });
 
-    // Lock should have been acquired with the consultant profile ID
-    expect(lockAutoAllocate).toHaveBeenCalledWith("consultant-profile-1");
+    // Lock should have been acquired with the consultant profile ID,
+    // day-sharded (#860) by the earliest target slot's day.
+    expect(lockAutoAllocate).toHaveBeenCalledWith(
+      "consultant-profile-1",
+      "2025-01-06",
+    );
     // Lock should have been released in finally block
     expect(unlockAutoAllocate).toHaveBeenCalled();
   });

__tests__/enterprise/live-payout-submission.test.ts

@@ -280,10 +280,12 @@ describe("processOrgPayout — live submission gating", () => {
       }),
     );
 
-    // Earnings release: PAID → READY, orgPayoutId nulled.
+    // #993 — a PROCESSING→FAILED submission never reached PAID: batch creation
+    // staged the earnings READY→BATCHED, so the failure release is BATCHED→READY
+    // (orgPayoutId nulled), not PAID→READY.
     expect(mockedPrisma.organizationEarnings.updateMany).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { orgPayoutId: PAYOUT_ID, status: "PAID" },
+        where: { orgPayoutId: PAYOUT_ID, status: "BATCHED" },
         data: { status: "READY", orgPayoutId: null },
       }),
     );

__tests__/payments/capture-amount-parity.test.ts

@@ -3,15 +3,17 @@
  */
 
 /**
- * #677 — defence-in-depth capture-amount parity in handlePaymentSuccess.
+ * #677 / #990 — defence-in-depth capture-amount parity in handlePaymentSuccess.
  *
  * The gateway order is created at checkout for exactly Payment.amount and the
  * webhook is HMAC-verified, so a captured amount that differs is a gateway
- * anomaly or our-own bug. handlePaymentSuccess must NOT silently confirm the
- * booking — it marks the payment REQUIRES_MANUAL_RECOVERY, pages (Sentry), and
- * returns before confirming. (The matching-amount happy path is exercised
- * end-to-end by the live signed-webhook verification; here we pin the new guard,
- * whose mismatch branch returns early — before any Phase-2 work.)
+ * anomaly or our-own bug. handlePaymentSuccess must NOT confirm the booking.
+ * #990 changed the remediation: Phase 1 pages (Sentry, fatal) and stamps
+ * REQUIRES_MANUAL_RECOVERY as a FALLBACK marker, then Phase 2 AUTO-REFUNDS the
+ * wrong-amount capture via refundPayment and clears the marker. The manual
+ * marker only survives if the refund call itself throws. Either way the booking
+ * is never confirmed (no appointment lookup, no earnings, no Phase-2 confirm
+ * work). The matching-amount happy path is inert on the guard.
  */
 
 const captureException = jest.fn();
@@ -35,9 +37,17 @@ const txStub = {
   payment: { findUnique: paymentFindUnique, update: paymentUpdate },
   appointment: { findUnique: appointmentFindUnique },
 };
+// #990 — the Phase-2 clear-marker write runs on the base client (outside the
+// tx). Give it its own update mock so the auto-refund success path completes.
+const prismaPaymentUpdate = jest.fn(
+  async (_args: { where: unknown; data: { description?: string } }) => ({}),
+);
 jest.mock("../../lib/prisma", () => ({
   __esModule: true,
-  default: { $transaction: async (fn: (tx: unknown) => unknown) => fn(txStub) },
+  default: {
+    $transaction: async (fn: (tx: unknown) => unknown) => fn(txStub),
+    payment: { update: (...a: unknown[]) => prismaPaymentUpdate(...(a as [never])) },
+  },
 }));
 
 // Side-effectful import graph — present only so the module loads; the mismatch
@@ -46,7 +56,10 @@ const createEarningsFromPayment = jest.fn();
 jest.mock("../../lib/payments/payouts", () => ({
   createEarningsFromPayment: (...a: unknown[]) => createEarningsFromPayment(...a),
 }));
-jest.mock("../../lib/payments/operations/refund", () => ({ refundPayment: jest.fn() }));
+const refundPayment = jest.fn();
+jest.mock("../../lib/payments/operations/refund", () => ({
+  refundPayment: (...a: unknown[]) => refundPayment(...a),
+}));
 jest.mock("../../lib/email", () => ({
   sendPaymentSuccessEmail: jest.fn(),
   sendPaymentFailedEmail: jest.fn(),
@@ -92,22 +105,60 @@ beforeEach(() => {
   });
 });
 
-describe("#677 — handlePaymentSuccess capture-amount parity", () => {
-  it("blocks confirmation + pages when the captured amount ≠ Payment.amount", async () => {
+describe("#677 / #990 — handlePaymentSuccess capture-amount parity", () => {
+  it("blocks confirmation, pages, and AUTO-REFUNDS when captured amount ≠ Payment.amount", async () => {
+    refundPayment.mockResolvedValue({ id: "rfnd1" });
+
     await handlePaymentSuccess("order1", { appointmentType: "CONSULTATION" }, 9999);
 
-    // Paged with the mismatch error.
+    // Paged exactly once with the mismatch error (the fatal Phase-1 page). No
+    // second page fires because the refund succeeds.
     expect(captureException).toHaveBeenCalledTimes(1);
     expect(String(captureException.mock.calls[0][0])).toContain(
       "Capture amount mismatch",
     );
 
-    // Marked for manual recovery (and NOT a normal confirmation).
+    // Phase 1 stamped the REQUIRES_MANUAL_RECOVERY fallback marker (in-tx).
     expect(paymentUpdate).toHaveBeenCalledTimes(1);
     const update = paymentUpdate.mock.calls[0][0];
     expect(update.data.description).toContain("REQUIRES_MANUAL_RECOVERY");
 
-    // Returned before confirming the booking or doing any Phase-2 work.
+    // #990 — Phase 2 auto-refunded the wrong-amount capture for this payment.
+    expect(refundPayment).toHaveBeenCalledTimes(1);
+    expect(refundPayment.mock.calls[0][0]).toMatchObject({
+      paymentId: "pay1",
+      initiatedByUserId: null,
+    });
+
+    // …then cleared the fallback marker on the base client (refund succeeded).
+    expect(prismaPaymentUpdate).toHaveBeenCalledTimes(1);
+    expect(prismaPaymentUpdate.mock.calls[0][0].data.description).toContain(
+      "Auto-refunded",
+    );
+
+    // Booking was never confirmed and no Phase-2 confirm work ran.
+    expect(appointmentFindUnique).not.toHaveBeenCalled();
+    expect(createEarningsFromPayment).not.toHaveBeenCalled();
+  });
+
+  it("keeps REQUIRES_MANUAL_RECOVERY + pages twice when the auto-refund itself fails", async () => {
+    // #990 fallback: if refundPayment throws, the manual-recovery marker is NOT
+    // cleared (no clear-marker write) and the refund failure is paged too.
+    refundPayment.mockRejectedValue(new Error("gateway 500"));
+
+    await handlePaymentSuccess("order1", { appointmentType: "CONSULTATION" }, 9999);
+
+    // Two pages: the Phase-1 mismatch page + the Phase-2 refund-failure page.
+    expect(captureException).toHaveBeenCalledTimes(2);
+    expect(String(captureException.mock.calls[0][0])).toContain(
+      "Capture amount mismatch",
+    );
+
+    // The REQUIRES_MANUAL_RECOVERY marker survives (clear-marker write skipped).
+    expect(refundPayment).toHaveBeenCalledTimes(1);
+    expect(prismaPaymentUpdate).not.toHaveBeenCalled();
+
+    // Still no booking confirmation.
     expect(appointmentFindUnique).not.toHaveBeenCalled();
     expect(createEarningsFromPayment).not.toHaveBeenCalled();
   });

__tests__/payments/stuck-payouts-money-handler.test.ts

@@ -54,7 +54,9 @@ const PAYOUT: Row = {
   tdsDeducted: 1000,
   tdsRateAppliedBps: 100,
   tdsFinancialYear: "2026-27",
-  earnings: [{ id: "ce_1", payoutId: "po_1", status: "READY" }],
+  // #993 — a PROCESSING payout's earnings were staged READY→BATCHED at batch
+  // creation; the COMPLETED webhook flips BATCHED→PAID.
+  earnings: [{ id: "ce_1", payoutId: "po_1", status: "BATCHED" }],
 };
 
 let payoutRow: Row;
@@ -96,7 +98,7 @@ import { handlePayoutWebhook } from "../../lib/payments/payouts/payout-service";
 
 beforeEach(() => {
   jest.clearAllMocks();
-  payoutRow = { ...PAYOUT, earnings: [{ id: "ce_1", payoutId: "po_1", status: "READY" }] };
+  payoutRow = { ...PAYOUT, earnings: [{ id: "ce_1", payoutId: "po_1", status: "BATCHED" }] };
 });
 
 describe("PM-15 — handlePayoutWebhook records TDS + ledger on COMPLETED", () => {
@@ -119,11 +121,13 @@ describe("PM-15 — handlePayoutWebhook records TDS + ledger on COMPLETED", () =
       idempotencyKey: "payout:po_1",
     });
 
-    // Canonical state landed: COMPLETED + earnings PAID.
+    // Canonical state landed: COMPLETED + earnings BATCHED→PAID. #993 — the PAID
+    // flip is CAS-guarded on the BATCHED from-state (staged at batch creation),
+    // so only genuinely-batched earnings settle at completion.
     expect(payoutRow.status).toBe("COMPLETED");
     expect(prismaStub.consultantEarnings.updateMany).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { payoutId: "po_1" },
+        where: { payoutId: "po_1", status: "BATCHED" },
         data: expect.objectContaining({ status: "PAID" }),
       }),
     );

__tests__/stream/__mocks__/stream-mocks.ts

@@ -98,7 +98,7 @@ export const createMockRoleMapper = () => ({
       ADMIN: "admin",
       CONSULTANT: "user",
       CONSULTEE: "user",
-      STAFF: "user",
+      STAFF: "admin",
     };
     return mapping[role] || "user";
   }),

__tests__/stream/channel-actions.test.ts

@@ -39,11 +39,27 @@ jest.mock("../../actions/stream/chat/user.action", () => ({
   upsertUsersToStream: jest.fn().mockResolvedValue({ users: {} }),
 }));
 
+// #899 — addMemberToChannel is session-gated; mocking auth-server also keeps
+// jest away from lib/auth's better-auth ESM imports. Default: privileged.
+const mockGetSession = jest.fn();
+jest.mock("../../lib/auth-server", () => ({
+  getSession: () => mockGetSession(),
+}));
+
+// auth-helpers imports next/server (NextResponse), which needs the fetch
+// globals jest's node env lacks — mirror the real one-liner instead.
+jest.mock("../../lib/auth-helpers", () => ({
+  isPrivileged: (role?: string | null) => role === "ADMIN" || role === "STAFF",
+}));
+
 describe("Channel Actions", () => {
   beforeEach(() => {
     jest.clearAllMocks();
     mockStreamClient.channel.mockReturnValue(mockChannel);
     mockStreamClient.queryChannels.mockResolvedValue([]);
+    mockGetSession.mockResolvedValue({
+      user: { id: "staff-user", role: "ADMIN" },
+    });
   });
 
   describe("createChannel", () => {
@@ -264,6 +280,63 @@ describe("Channel Actions", () => {
       await expect(addMemberToChannel("", "user")).rejects.toThrow();
       await expect(addMemberToChannel("channel", "")).rejects.toThrow();
     });
+
+    // #899 — server-side Stream calls bypass Stream's permission system, so
+    // the app-layer guard is the only gate.
+    it("should reject unauthenticated callers", async () => {
+      mockGetSession.mockResolvedValueOnce(null);
+
+      const { addMemberToChannel } =
+        await import("../../actions/stream/chat/channel.action");
+
+      await expect(
+        addMemberToChannel("consultation-123", "new-user-id"),
+      ).rejects.toThrow("Unauthorized");
+      expect(mockChannel.addMembers).not.toHaveBeenCalled();
+    });
+
+    it("should reject a non-privileged caller who is not the creator", async () => {
+      mockGetSession.mockResolvedValueOnce({
+        user: { id: "random-user", role: "CONSULTEE" },
+      });
+      // mockReset flushes unconsumed query Onces leaked from earlier tests
+      // (clearAllMocks doesn't), which would otherwise shift this value
+      mockChannel.query.mockReset();
+      mockChannel.query.mockResolvedValue({
+        channel: { created_by: { id: "someone-else" } },
+      });
+
+      const { addMemberToChannel } =
+        await import("../../actions/stream/chat/channel.action");
+
+      await expect(
+        addMemberToChannel("consultation-123", "new-user-id"),
+      ).rejects.toThrow("Forbidden");
+      expect(mockChannel.addMembers).not.toHaveBeenCalled();
+      expect(mockChannel.create).not.toHaveBeenCalled();
+    });
+
+    it("should allow the channel creator without lazy channel creation", async () => {
+      mockGetSession.mockResolvedValueOnce({
+        user: { id: "creator-user", role: "CONSULTANT" },
+      });
+      mockChannel.query.mockReset();
+      mockChannel.query.mockResolvedValue({
+        channel: { created_by: { id: "creator-user" } },
+      });
+
+      const { addMemberToChannel } =
+        await import("../../actions/stream/chat/channel.action");
+
+      const result = await addMemberToChannel(
+        "consultation-123",
+        "new-user-id",
+      );
+
+      expect(result.success).toBe(true);
+      expect(mockChannel.addMembers).toHaveBeenCalledWith(["new-user-id"]);
+      expect(mockChannel.create).not.toHaveBeenCalled();
+    });
   });
 });
 
@@ -637,6 +710,9 @@ describe("addMemberToChannel error handling", () => {
   beforeEach(() => {
     jest.clearAllMocks();
     mockStreamClient.channel.mockReturnValue(mockChannel);
+    mockGetSession.mockResolvedValue({
+      user: { id: "staff-user", role: "ADMIN" },
+    });
   });
 
   it("should throw error when addMembers fails", async () => {