Payments test mode toggle (#929)

<!--

Make sure you've read the CONTRIBUTING.md guidelines:
https://github.com/stack-auth/stack-auth/blob/dev/CONTRIBUTING.md

-->

<!-- ELLIPSIS_HIDDEN -->


----

> [!IMPORTANT]
> Add test mode toggle for payments, update API and UI, and expand tests
for test-mode flows.
> 
>   - **Behavior**:
> - Added test mode toggle to Project Payments settings in
`page-client-catalogs-view.tsx` and `page-client-list-view.tsx`.
> - API responses in `validate-code/route.ts` now include `test_mode`
flag.
> - Purchase page in `page-client.tsx` shows Test mode bypass button
when test mode is enabled.
>   - **API**:
> - `test-mode-purchase-session/route.tsx` requires test mode enabled
for test-mode purchase sessions, returns 403 otherwise.
> - Simplified error message for server-only products in `payments.tsx`.
>   - **Config**:
> - Added `testMode` to payments config schema in `schema.ts` and
defaults in `schema.ts`.
>   - **Tests**:
> - Expanded end-to-end tests in `transactions.test.ts` and
`purchase-session.test.ts` to cover test-mode flows.
>   - **Misc**:
> - Removed `testModePurchase` method from `admin-interface.ts` and
`admin-app-impl.ts`.
> 
> <sup>This description was created by </sup>[<img alt="Ellipsis"
src="https://img.shields.io/badge/Ellipsis-blue?color=175173">](https://www.ellipsis.dev?ref=stack-auth%2Fstack-auth&utm_source=github&utm_medium=referral)<sup>
for a1ac7ef. You can
[customize](https://app.ellipsis.dev/stack-auth/settings/summaries) this
summary. It will automatically update as commits are pushed.</sup>

----


<!-- ELLIPSIS_HIDDEN -->

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- New Features
- Test mode toggle added to Project Payments settings; UI reflects and
can update live.
  - API responses for code validation include a test_mode flag.
- Purchase page shows a Test mode bypass button only when test mode is
enabled; it’s disabled if price/quantity are invalid.

- Changes
- Test-mode purchase sessions require Test mode enabled; otherwise
return 403 with a clear message.
- Simpler client-side error message when accessing server-only products
from the client.

- Chores
  - Added testMode to payments config defaults and schema.

- Tests
  - End-to-end tests expanded to cover test-mode flows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

<!-- RECURSEML_SUMMARY:START -->
## High-level PR Summary


[![Analyze latest
changes](https://img.shields.io/badge/Analyze%20latest%20changes-238636?style=plastic)](https://squash-322339097191.europe-west3.run.app/interactive/eada05884195c27340017c23544f302e4a9c3823f4152dcb2fa96aec3ea20b7d/?repo_owner=stack-auth&repo_name=stack-auth&pr_number=929)

[![Need help? Join our
Discord](https://img.shields.io/badge/Need%20help%3F%20Join%20our%20Discord-5865F2?style=plastic&logo=discord&logoColor=white)](https://discord.gg/n3SsVDAW6U)

<!-- RECURSEML_SUMMARY:END -->

Author: BilalG1

apps/backend/src/app/api/latest/internal/payments/test-mode-purchase-session/route.tsx

@@ -1,10 +1,11 @@
 import { purchaseUrlVerificationCodeHandler } from "@/app/api/latest/payments/purchases/verification-code-handler";
 import { validatePurchaseSession } from "@/lib/payments";
+import { getTenancy } from "@/lib/tenancies";
 import { getStripeForAccount } from "@/lib/stripe";
 import { getPrismaClientForTenancy } from "@/prisma-client";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
 import { SubscriptionStatus } from "@prisma/client";
-import { adaptSchema, adminAuthTypeSchema, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { addInterval } from "@stackframe/stack-shared/dist/utils/dates";
 import { StackAssertionError, StatusError } from "@stackframe/stack-shared/dist/utils/errors";
 import { typedToUppercase } from "@stackframe/stack-shared/dist/utils/strings";
@@ -14,11 +15,6 @@ export const POST = createSmartRouteHandler({
     hidden: true,
   },
   request: yupObject({
-    auth: yupObject({
-      type: adminAuthTypeSchema.defined(),
-      project: adaptSchema.defined(),
-      tenancy: adaptSchema.defined(),
-    }).defined(),
     body: yupObject({
       full_code: yupString().defined(),
       price_id: yupString().defined(),
@@ -29,17 +25,22 @@ export const POST = createSmartRouteHandler({
     statusCode: yupNumber().oneOf([200]).defined(),
     bodyType: yupString().oneOf(["success"]).defined(),
   }),
-  handler: async ({ auth, body }) => {
+  handler: async ({ body }) => {
     const { full_code, price_id, quantity } = body;
     const { data, id: codeId } = await purchaseUrlVerificationCodeHandler.validateCode(full_code);
-    if (auth.tenancy.id !== data.tenancyId) {
-      throw new StatusError(400, "Tenancy id does not match value from code data");
+
+    const tenancy = await getTenancy(data.tenancyId);
+    if (!tenancy) {
+      throw new StackAssertionError("Tenancy not found for test mode purchase session");
+    }
+    if (tenancy.config.payments.testMode !== true) {
+      throw new StatusError(403, "Test mode is not enabled for this project");
     }
-    const prisma = await getPrismaClientForTenancy(auth.tenancy);
+    const prisma = await getPrismaClientForTenancy(tenancy);
 
     const { selectedPrice, conflictingCatalogSubscriptions } = await validatePurchaseSession({
       prisma,
-      tenancy: auth.tenancy,
+      tenancy,
       codeData: data,
       priceId: price_id,
       quantity,
@@ -51,7 +52,7 @@ export const POST = createSmartRouteHandler({
     if (!selectedPrice.interval) {
       await prisma.oneTimePurchase.create({
         data: {
-          tenancyId: auth.tenancy.id,
+          tenancyId: tenancy.id,
           customerId: data.customerId,
           customerType: typedToUppercase(data.product.customerType),
           productId: data.productId,
@@ -66,13 +67,13 @@ export const POST = createSmartRouteHandler({
       if (conflictingCatalogSubscriptions.length > 0) {
         const conflicting = conflictingCatalogSubscriptions[0];
         if (conflicting.stripeSubscriptionId) {
-          const stripe = await getStripeForAccount({ tenancy: auth.tenancy });
+          const stripe = await getStripeForAccount({ tenancy });
           await stripe.subscriptions.cancel(conflicting.stripeSubscriptionId);
         } else if (conflicting.id) {
           await prisma.subscription.update({
             where: {
               tenancyId_id: {
-                tenancyId: auth.tenancy.id,
+                tenancyId: tenancy.id,
                 id: conflicting.id,
               },
             },
@@ -83,7 +84,7 @@ export const POST = createSmartRouteHandler({
 
       await prisma.subscription.create({
         data: {
-          tenancyId: auth.tenancy.id,
+          tenancyId: tenancy.id,
           customerId: data.customerId,
           customerType: typedToUppercase(data.product.customerType),
           status: "active",
@@ -99,7 +100,7 @@ export const POST = createSmartRouteHandler({
       });
     }
     await purchaseUrlVerificationCodeHandler.revokeCode({
-      tenancy: auth.tenancy,
+      tenancy,
       id: codeId,
     });
 

apps/backend/src/app/api/latest/payments/purchases/validate-code/route.ts

@@ -39,6 +39,7 @@ export const POST = createSmartRouteHandler({
         product_id: yupString().defined(),
         display_name: yupString().defined(),
       }).defined()).defined(),
+      test_mode: yupBoolean().defined(),
     }).defined(),
   }),
   async handler({ body }) {
@@ -102,6 +103,7 @@ export const POST = createSmartRouteHandler({
         project_id: tenancy.project.id,
         already_bought_non_stackable: alreadyBoughtNonStackable,
         conflicting_products: conflictingCatalogProducts,
+        test_mode: tenancy.config.payments.testMode === true,
       },
     };
   },

apps/backend/src/lib/payments.tsx

@@ -31,9 +31,12 @@ export async function ensureProductIdOrInlineProduct(
   }
   if (productId) {
     const product = getOrUndefined(tenancy.config.payments.products, productId);
-    if (!product || (product.serverOnly && accessType === "client")) {
+    if (!product) {
       throw new KnownErrors.ProductDoesNotExist(productId, accessType);
     }
+    if (product.serverOnly && accessType === "client") {
+      throw new StatusError(400, "This product is marked as server-only and cannot be accessed client side!");
+    }
     return product;
   } else {
     if (!inlineProduct) {

apps/dashboard/src/app/(main)/(protected)/projects/[projectId]/payments/products/item-dialog.tsx

@@ -91,7 +91,8 @@ export function ItemDialog({
               id="item-id"
               value={itemId}
               onChange={(e) => {
-                setItemId(e.target.value);
+                const nextValue = e.target.value.toLowerCase();
+                setItemId(nextValue);
                 if (errors.itemId) {
                   setErrors(prev => {
                     const newErrors = { ...prev };