fix: require auth token for manual payments

2026-05-30 14:09:57 +08:00
parent c26f89f134
commit 57240e02ee
2 changed files with 12 additions and 3 deletions
@@ -58,6 +58,10 @@ export function runTests() {
  const hookSource = fs.existsSync(hookPath)
    ? fs.readFileSync(hookPath, "utf8")
    : "";
+  const paymentFlowSource = fs.readFileSync(
+    path.join(accountDir, "usePaymentFlow.ts"),
+    "utf8",
+  );
  assert(
    (accountCenterSource.includes('import { usePaymentState } from "./usePaymentState";') ||
      hookSource.includes('import { usePaymentState } from "./usePaymentState";')) &&
@@ -327,4 +331,9 @@ export function runTests() {
    paymentRuntimeRouteSource.includes("includeSupabaseIdentity: false"),
    "payment runtime proxy must not read Supabase session cookies because backend entitlement token already protects the runtime status payload",
  );
+  assert(
+    (paymentFlowSource.match(/await buildAuthedHeaders\(true, true\);/g) || [])
+      .length >= 3,
+    "manual payment mutations must require a valid Supabase bearer token instead of forwarding unauthenticated requests that surface raw backend JSON",
+  );
 }