fix(subscription): require team admin for billing actions

Subscription actions ran on the session team without a role check. A user
who switched the session to a team where they are only a member could
cancel, refund, or change that team's subscription.

- Lock the team id at mount and require admin or owner of that team
- Check the locked team and the role again in every billing action
- Reject actions after the session switched to another team

tests/Feature/Subscription/SubscriptionActionsAuthorizationTest.php

@@ -0,0 +1,157 @@
+<?php
+
+use App\Livewire\Subscription\Actions;
+use App\Models\InstanceSettings;
+use App\Models\Subscription;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
+use Livewire\Livewire;
+use Stripe\Service\SubscriptionService;
+use Stripe\Stripe;
+use Stripe\StripeClient;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('constants.coolify.self_hosted', false);
+    config()->set('subscription.provider', 'stripe');
+    config()->set('subscription.stripe_api_key', 'sk_test_fake');
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+
+    $this->originalStripeApiBase = Stripe::$apiBase;
+    Stripe::$apiBase = 'http://127.0.0.1:1';
+
+    $this->stripeResolved = false;
+    $this->app->bind(StripeClient::class, function () {
+        $this->stripeResolved = true;
+
+        throw new RuntimeException('Stripe must not be called.');
+    });
+
+    $this->user = User::factory()->create();
+
+    $this->ownTeam = Team::factory()->create();
+    $this->ownTeam->members()->attach($this->user->id, ['role' => 'owner']);
+
+    Subscription::create([
+        'team_id' => $this->ownTeam->id,
+        'stripe_subscription_id' => 'sub_own_team',
+        'stripe_customer_id' => 'cus_own_team',
+        'stripe_invoice_paid' => true,
+        'stripe_plan_id' => 'price_test_123',
+        'stripe_cancel_at_period_end' => false,
+        'stripe_past_due' => false,
+    ]);
+
+    $this->otherTeam = Team::factory()->create();
+    $this->otherTeam->members()->attach($this->user->id, ['role' => 'member']);
+
+    $this->otherSubscription = Subscription::create([
+        'team_id' => $this->otherTeam->id,
+        'stripe_subscription_id' => 'sub_other_team',
+        'stripe_customer_id' => 'cus_other_team',
+        'stripe_invoice_paid' => true,
+        'stripe_plan_id' => 'price_test_123',
+        'stripe_cancel_at_period_end' => true,
+        'stripe_past_due' => false,
+    ]);
+
+    $this->actingAs($this->user);
+});
+
+afterEach(function () {
+    Stripe::$apiBase = $this->originalStripeApiBase;
+});
+
+dataset('subscription billing actions', [
+    'updateQuantity' => [fn ($component) => $component->set('quantity', 5)->call('updateQuantity')],
+    'loadPricePreview' => [fn ($component) => $component->call('loadPricePreview', 5)],
+    'refundSubscription' => [fn ($component) => $component->call('refundSubscription', 'password')],
+    'cancelImmediately' => [fn ($component) => $component->call('cancelImmediately', 'password')],
+    'cancelImmediately with refund' => [fn ($component) => $component->call('cancelImmediately', 'password', ['refundLatestPayment'])],
+    'cancelAtPeriodEnd' => [fn ($component) => $component->call('cancelAtPeriodEnd', 'password')],
+    'resumeSubscription' => [fn ($component) => $component->call('resumeSubscription')],
+    'loadRefundEligibility' => [fn ($component) => $component->call('loadRefundEligibility')],
+    'stripeCustomerPortal' => [fn ($component) => $component->call('stripeCustomerPortal')],
+]);
+
+function expectOtherTeamSubscriptionUntouched(): void
+{
+    $subscription = test()->otherSubscription->fresh();
+
+    expect($subscription->stripe_subscription_id)->toBe('sub_other_team')
+        ->and((bool) $subscription->stripe_invoice_paid)->toBeTrue()
+        ->and((bool) $subscription->stripe_cancel_at_period_end)->toBeTrue()
+        ->and($subscription->stripe_refunded_at)->toBeNull()
+        ->and(test()->stripeResolved)->toBeFalse();
+}
+
+test('a team member cannot mount the subscription actions', function () {
+    session(['currentTeam' => $this->otherTeam]);
+
+    Livewire::test(Actions::class)->assertForbidden();
+
+    expectOtherTeamSubscriptionUntouched();
+});
+
+test('a team admin can mount the subscription actions and lock the team', function (string $role) {
+    $this->otherTeam->members()->updateExistingPivot($this->user->id, ['role' => $role]);
+    $this->user->unsetRelation('teams');
+    session(['currentTeam' => $this->otherTeam]);
+
+    Livewire::test(Actions::class)
+        ->assertOk()
+        ->assertSet('teamId', $this->otherTeam->id);
+})->with(['admin', 'owner']);
+
+test('an admin can still resume the subscription of the locked team', function () {
+    $this->otherTeam->members()->updateExistingPivot($this->user->id, ['role' => 'admin']);
+    $this->user->unsetRelation('teams');
+    session(['currentTeam' => $this->otherTeam]);
+
+    $stripe = Mockery::mock(StripeClient::class);
+    $stripe->subscriptions = Mockery::mock(SubscriptionService::class);
+    $stripe->subscriptions->shouldReceive('update')->once()->with('sub_other_team', ['cancel_at_period_end' => false]);
+    $this->instance(StripeClient::class, $stripe);
+
+    Livewire::test(Actions::class)
+        ->call('resumeSubscription')
+        ->assertOk()
+        ->assertDispatched('success');
+
+    expect((bool) $this->otherSubscription->fresh()->stripe_cancel_at_period_end)->toBeFalse();
+});
+
+test('a billing action is rejected after the session switches to a team where the user is a member', function (Closure $action) {
+    session(['currentTeam' => $this->ownTeam]);
+    $component = Livewire::test(Actions::class)->assertOk();
+
+    session(['currentTeam' => $this->otherTeam]);
+
+    $action($component)->assertForbidden();
+
+    expectOtherTeamSubscriptionUntouched();
+})->with('subscription billing actions');
+
+test('a billing action is rejected after the user is demoted to member of the locked team', function (Closure $action) {
+    $this->otherTeam->members()->updateExistingPivot($this->user->id, ['role' => 'admin']);
+    $this->user->unsetRelation('teams');
+    session(['currentTeam' => $this->otherTeam]);
+    $component = Livewire::test(Actions::class)->assertOk();
+
+    $this->otherTeam->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->user->unsetRelation('teams');
+
+    $action($component)->assertForbidden();
+
+    expectOtherTeamSubscriptionUntouched();
+})->with('subscription billing actions');
+
+test('the locked team id cannot be changed by the client', function () {
+    session(['currentTeam' => $this->ownTeam]);
+
+    Livewire::test(Actions::class)->set('teamId', $this->otherTeam->id);
+})->throws(CannotUpdateLockedPropertyException::class);