chore(source): update CHANGELOG.md supabase/functions/_shared/pricing-shadow.ts supabase/functions/config/index.ts

Author: therajanmaurya

CHANGELOG.md

@@ -63,6 +63,22 @@
   dead, since the SDK cannot mint an `idToken` itself.
   26 localised strings, new paywall-state test tags, and 13 Roborazzi goldens each paired with a
   named semantic assertion so no golden can be captured from a blank surface.
+- **093** constrains `paycraft_price_shadow_deltas.served_provenance` / `shadow_provenance` to the
+  provenance vocabulary. 092 constrained `platform` but not these, and the edge function cast a
+  client-supplied `X-PayCraft-Country-Provenance` header past the type system — so arbitrary text
+  reached the table an operator reads before authorising a price cut-over. The edge now whitelists
+  the header as well; this is the column-level half.
+- **Price-chain corrections (Stage A).** `resolveServed` no longer honours `?country=`/`x-country`.
+  It had been doing so on the stated assumption that an override was already priced pre-deploy —
+  it was not (pre-deploy read only `apiKey` and priced unconditionally off `Accept-Language`), so
+  any request carrying an override was priced differently after the deploy than before. That is the
+  one thing D11's staging exists to prevent. The override now lives only in the shadow chain.
+  Also: the SDK arm is native-gated BEFORE the provenance header is consulted, so a web caller
+  sending `X-PayCraft-Country-Provenance: storefront` can no longer be priced off its own
+  Accept-Language; provider filtering and the response `locale` follow the country actually priced
+  on rather than `Accept-Language`; and the edge's geo-header order and ISO-2/`XX` validation now
+  match `dashboard/lib/customer-geo.ts`, which resolved five inputs differently between the two
+  chains.
 - **091 (security)** revokes `anon`/`PUBLIC` EXECUTE on `tenant_products_upsert`,
   `tenant_pricing_upsert`, `tenant_products_delete`, `sync_event_emit`,
   `tenant_providers_set_account_label` and `_tenant_products_upsert_core`. Migration 084's

supabase/functions/_shared/pricing-shadow.ts

@@ -68,9 +68,14 @@ const NATIVE: ReadonlySet<Platform> = new Set<Platform>(["android", "ios"]);
  */
 function sdkSignal(i: PriceInputs): Resolved | null {
   if (!i.sdkCountry) return null;
+  // The NATIVE gate is checked BEFORE the provenance header, and the order is load-bearing.
+  // Previously an explicit `sdkProvenance` short-circuited it, so a web client sending
+  // `X-PayCraft-Platform: web` with `X-PayCraft-Country-Provenance: storefront` reached the SDK arm
+  // and was priced off its own Accept-Language — the exact thing AC-15 says web must never do.
+  // There is no storefront on the web, so no header a client sends can make one exist.
+  if (!NATIVE.has(i.platform)) return null;
   if (i.sdkProvenance) return { country: i.sdkCountry, provenance: i.sdkProvenance };
-  if (NATIVE.has(i.platform)) return { country: i.sdkCountry, provenance: "device" };
-  return null;
+  return { country: i.sdkCountry, provenance: "device" };
 }
 
 /**
@@ -90,15 +95,20 @@ export function resolveShadow(i: PriceInputs): Resolved {
 }
 
 /**
- * The OLD chain, preserved byte-for-byte for D11 Stage A: price off Accept-Language alone.
+ * The OLD chain, preserved byte-for-byte for D11 Stage A: price off Accept-Language ALONE.
  *
- * An override was already honoured upstream before this phase, so it stays in the served chain —
- * excluding it here would make Stage A change behaviour, which is the one thing Stage A must not do.
+ * CORRECTED — this previously honoured `overrideCountry`, on the stated assumption that an override
+ * "was already honoured upstream before this phase". That assumption was wrong and was never
+ * checked: pre-deploy `config/index.ts` read only `apiKey` from the query string and passed
+ * `p_locale: localeCountry` unconditionally. There was no override path anywhere in the priced
+ * request. Honouring one here meant any request carrying `?country=` or `x-country` was priced
+ * DIFFERENTLY than before the deploy — which is precisely the thing Stage A exists to guarantee
+ * cannot happen, and it would have happened silently.
+ *
+ * The override still exists, in `resolveShadow`, where it can only affect a price after the Stage B
+ * cut-over that a human has to authorise.
  */
 export function resolveServed(i: PriceInputs): Resolved {
-  if (i.overrideCountry) {
-    return { country: i.overrideCountry.toUpperCase(), provenance: "override" };
-  }
   return { country: i.localeCountry.toUpperCase(), provenance: "locale" };
 }
 

supabase/functions/config/index.ts

@@ -97,10 +97,26 @@ export async function handleConfigRequest(req: Request): Promise<Response> {
   // it below the store storefront and above the device locale — one consistent signal on every
   // platform, including web/desktop where no store storefront exists. Null when the edge did not
   // attach a header (local dev / unknown host); the SDK degrades to device/locale in that case.
-  const geoCountry =
-    (req.headers.get("x-vercel-ip-country") ??
-      req.headers.get("cf-ipcountry") ??
-      req.headers.get("cloudfront-viewer-country"))?.trim()?.toUpperCase() || null
+  // Header order and validation are deliberately IDENTICAL to dashboard/lib/customer-geo.ts.
+  // They were not, and the two chains disagreed on five real inputs — a buyer priced one way in the
+  // app and another way through web checkout (AC-19). Cloudflare first because that is the runtime
+  // this deploys on; the ISO-2 shape check and the "XX" rejection are the dashboard's, which were
+  // the stricter and more correct of the two: "XX" is the CDN's *unknown-country* placeholder, so
+  // treating it as a country prices someone in a country that does not exist, and a 3-letter code
+  // is not an ISO-3166-alpha-2 value at all.
+  const GEO_HEADERS = [
+    "cf-ipcountry",
+    "x-vercel-ip-country",
+    "cloudfront-viewer-country",
+    "x-country",
+    "x-geo-country",
+  ] as const
+  const ISO2 = /^[A-Z]{2}$/
+  let geoCountry: string | null = null
+  for (const h of GEO_HEADERS) {
+    const raw = req.headers.get(h)?.trim()?.toUpperCase()
+    if (raw && ISO2.test(raw) && raw !== "XX") { geoCountry = raw; break }
+  }
   const geoSource = geoCountry ? "SERVER_IP_GEO" : "ABSENT"
 
   // Caller platform (SDK sends X-PayCraft-Platform: ios|android|desktop|web). Drives per-platform
@@ -117,15 +133,31 @@ export async function handleConfigRequest(req: Request): Promise<Response> {
   // A real browser has no such header, so its Accept-Language stays a language preference and the
   // shadow chain falls through to server geo — which is the actual revenue fix (a US buyer whose
   // browser prefers fr-FR is currently billed in EUR).
-  const overrideCountry =
-    (new URL(req.url).searchParams.get("country") ??
-      req.headers.get("x-country"))?.trim()?.toUpperCase() || null
-  const sdkProvenanceHeader =
+  // `?country=` ONLY. `x-country` used to be an override alias here while the dashboard treated it
+  // as a geo header — the same request resolved with a different PROVENANCE depending on which
+  // entry point served it. An override should be something a caller states explicitly in the URL,
+  // not a header a CDN might inject on its behalf. It is a geo header on both sides now.
+  const overrideRaw = new URL(req.url).searchParams.get("country")?.trim()?.toUpperCase() || null
+  const overrideCountry = overrideRaw && ISO2.test(overrideRaw) && overrideRaw !== "XX"
+    ? overrideRaw
+    : null
+  // Whitelisted, not cast. This value is client-supplied and flows into every product row AND into
+  // paycraft_price_shadow_deltas — the table an operator reads before authorising the Stage B
+  // cut-over. An `as never` cast let arbitrary text through, so the audit trail the release
+  // decision rests on was shapeable by any caller.
+  const PROVENANCE_VALUES = [
+    "override", "storefront", "server_geo", "device", "locale", "default",
+  ] as const
+  const rawProvenance =
     (req.headers.get("x-paycraft-country-provenance") ?? "").trim().toLowerCase() || null
+  const sdkProvenanceHeader =
+    rawProvenance && (PROVENANCE_VALUES as readonly string[]).includes(rawProvenance)
+      ? rawProvenance
+      : null
   const priceInputs = {
     overrideCountry,
     sdkCountry: callerPlatform ? localeCountry : null,
-    sdkProvenance: (sdkProvenanceHeader as never) ?? null,
+    sdkProvenance: sdkProvenanceHeader as never,
     geoCountry,
     localeCountry,
     platform: (callerPlatform ?? "unknown") as never,
@@ -341,7 +373,10 @@ export async function handleConfigRequest(req: Request): Promise<Response> {
     }) => {
       const localeOk = !pr.supported_locales ||
         pr.supported_locales.length === 0 ||
-        pr.supported_locales.includes(localeCountry)
+        // effectiveCountry, not localeCountry: after cut-over a buyer priced on server_geo (say IN)
+        // would otherwise only be offered providers whose supported_locales carry their
+        // Accept-Language country (say US) — priced in one country, unable to pay in it.
+        pr.supported_locales.includes(effectiveCountry.country)
       const bySku = isTestMode ? pr.test_payment_links : pr.live_payment_links
       const linksOk = !!bySku && Object.values(bySku).some(perCurrency =>
         !!perCurrency && Object.keys(perCurrency).length > 0
@@ -435,7 +470,9 @@ export async function handleConfigRequest(req: Request): Promise<Response> {
     products: pricedProducts,
     providers: orderedProviders,
     paywall: paywallWithLegal,
-    locale: localeCountry,
+    // The country actually priced on. Emitting the raw Accept-Language country here would make
+    // SuiteConfig.locale disagree with served_country the moment cut-over lands.
+    locale: effectiveCountry.country,
     geo_country: geoCountry,
     geo_source: geoSource,
     served_country: effectiveCountry.country,

supabase/migrations/093_shadow_delta_provenance_check.sql

@@ -0,0 +1,39 @@
+-- 093_shadow_delta_provenance_check.sql — constrain the provenance columns.
+--
+-- 092 put a CHECK on `platform` but none on the two provenance columns, and the edge function cast
+-- a client-supplied `X-PayCraft-Country-Provenance` header past the type system with `as never`.
+-- Arbitrary text therefore reached the table an operator reads before authorising the Stage B
+-- price cut-over — an audit trail any caller could shape.
+--
+-- The edge function now whitelists the header. This is the second half: defence at the column, so
+-- the guarantee does not depend on one caller remembering to validate. Belt and braces is right
+-- here because the cost of a bad row is a release decision made on false evidence.
+--
+-- Idempotent per PayCraft migration policy: constraint creation is guarded on pg_constraint.
+
+-- Any pre-existing out-of-vocabulary rows are normalised rather than blocking the migration; they
+-- came from the unvalidated path and carry no trustworthy meaning.
+UPDATE paycraft_price_shadow_deltas
+   SET served_provenance = 'default'
+ WHERE served_provenance NOT IN ('override','storefront','server_geo','device','locale','default');
+UPDATE paycraft_price_shadow_deltas
+   SET shadow_provenance = 'default'
+ WHERE shadow_provenance NOT IN ('override','storefront','server_geo','device','locale','default');
+
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'shadow_delta_served_provenance_valid'
+  ) THEN
+    ALTER TABLE paycraft_price_shadow_deltas
+      ADD CONSTRAINT shadow_delta_served_provenance_valid
+      CHECK (served_provenance IN ('override','storefront','server_geo','device','locale','default'));
+  END IF;
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint WHERE conname = 'shadow_delta_shadow_provenance_valid'
+  ) THEN
+    ALTER TABLE paycraft_price_shadow_deltas
+      ADD CONSTRAINT shadow_delta_shadow_provenance_valid
+      CHECK (shadow_provenance IN ('override','storefront','server_geo','device','locale','default'));
+  END IF;
+END $$;

tests/fixtures/paycraft-foundation-canary/green/cross-chain-equivalence/equivalence_test.ts

@@ -22,6 +22,33 @@ function mockReq(url: string, headers: Record<string, string>): never {
   } as never;
 }
 
+
+/**
+ * The edge's header→geo resolution, mirroring supabase/functions/config/index.ts.
+ *
+ * These fixtures previously hand-fed `geoCountry` into resolveShadow, which meant the header
+ * PARSING — the half the two chains actually disagreed on — was never compared at all. Five real
+ * disagreements hid behind that: inverted header priority, `x-country` treated as an override on
+ * one side and geo on the other, `x-geo-country` honoured on one side only, and the CDN's "XX"
+ * unknown-country placeholder plus 3-letter codes accepted as countries by the edge.
+ */
+const GEO_HEADERS = [
+  "cf-ipcountry",
+  "x-vercel-ip-country",
+  "cloudfront-viewer-country",
+  "x-country",
+  "x-geo-country",
+] as const;
+const ISO2 = /^[A-Z]{2}$/;
+
+function edgeGeoFromHeaders(headers: Record<string, string>): string | null {
+  for (const h of GEO_HEADERS) {
+    const raw = headers[h]?.trim()?.toUpperCase();
+    if (raw && ISO2.test(raw) && raw !== "XX") return raw;
+  }
+  return null;
+}
+
 interface Fixture {
   name: string;
   query: string;
@@ -91,3 +118,56 @@ Deno.test("AC-19 no signal at all: dashboard falls to merchant default, edge to
   });
   assertEquals(edge, { country: "FR", provenance: "locale" });
 });
+
+// ── The five disagreements an adversarial audit found, now pinned ────────────────────────────
+const adversarial: Array<{ name: string; headers: Record<string, string>; merchant: string | null }> = [
+  {
+    name: "both cf-ipcountry and x-vercel-ip-country present — priority order must agree",
+    headers: { "cf-ipcountry": "IN", "x-vercel-ip-country": "US" },
+    merchant: "GB",
+  },
+  {
+    name: "x-country alone — geo on BOTH sides, never an override on one",
+    headers: { "x-country": "DE" },
+    merchant: "GB",
+  },
+  {
+    name: "x-geo-country alone — honoured on both sides, not just the dashboard",
+    headers: { "x-geo-country": "BR" },
+    merchant: "GB",
+  },
+  {
+    name: "XX is the CDN unknown-country placeholder, not a country",
+    headers: { "cf-ipcountry": "XX" },
+    merchant: "GB",
+  },
+  {
+    name: "a 3-letter code is not ISO-3166-alpha-2",
+    headers: { "cf-ipcountry": "USA" },
+    merchant: "GB",
+  },
+];
+
+for (const c of adversarial) {
+  Deno.test(`AC-19 cross-chain: ${c.name}`, () => {
+    const dash = detectCustomerCountryWithProvenance(
+      mockReq("https://x/api/checkout-options", c.headers),
+      c.merchant,
+    );
+    const geo = edgeGeoFromHeaders(c.headers);
+    const edge = resolveShadow({
+      overrideCountry: null, sdkCountry: null, sdkProvenance: null,
+      geoCountry: geo, localeCountry: "US", platform: "web",
+    });
+    if (geo === null) {
+      // Neither side found a usable geo signal. The known, accepted asymmetry applies: the
+      // dashboard knows which merchant is being checked out and falls back to their market; the
+      // edge answers for an SDK that already has a locale. Both are last-resort arms.
+      assertEquals(dash.provenance, "default");
+      assertEquals(edge.provenance, "locale");
+      return;
+    }
+    assertEquals(dash.country, edge.country, "country mismatch across chains");
+    assertEquals(dash.provenance, edge.provenance, "provenance mismatch across chains");
+  });
+}

tests/fixtures/paycraft-foundation-canary/green/price-chain-shadow/chain_test.ts

@@ -65,24 +65,65 @@ Deno.test("an older SDK is reported as 'device', never as 'storefront'", () => {
   assertEquals(resolveShadow(i).provenance, "device");
 });
 
-Deno.test("override wins in BOTH chains, so Stage A cannot change an overridden price", () => {
+Deno.test("an override moves the SHADOW chain only — Stage A must not honour it", () => {
+  // Regression for a real Stage A violation. `resolveServed` used to honour the override on the
+  // stated assumption that one "was already honoured upstream". It was not: pre-deploy
+  // config/index.ts read only `apiKey` from the query string and priced unconditionally off
+  // Accept-Language. Honouring it in the served chain meant any request carrying `?country=` or
+  // `x-country` was priced differently after the deploy than before — silently, and precisely
+  // what Stage A exists to make impossible.
   const i: PriceInputs = {
     ...base, platform: "web", overrideCountry: "jp", localeCountry: "FR", geoCountry: "US",
   };
-  assertEquals(resolveServed(i), { country: "JP", provenance: "override" });
+  assertEquals(resolveServed(i), { country: "FR", provenance: "locale" });
   assertEquals(resolveShadow(i), { country: "JP", provenance: "override" });
-  assertEquals(diverges(resolveServed(i), resolveShadow(i)), false);
+  assertEquals(diverges(resolveServed(i), resolveShadow(i)), true);
+});
+
+Deno.test("AC-15 a spoofed provenance header cannot buy a web client into the SDK arm", () => {
+  // The native gate used to sit AFTER the provenance check, so a caller sending
+  // `X-PayCraft-Platform: web` with `X-PayCraft-Country-Provenance: storefront` was priced off its
+  // own Accept-Language while being recorded as an authoritative storefront. There is no storefront
+  // on the web, so no header can make one exist.
+  for (const claimed of ["storefront", "device", "override", "default"] as const) {
+    const i: PriceInputs = {
+      ...base, platform: "web", sdkCountry: "IN", sdkProvenance: claimed,
+      geoCountry: "US", localeCountry: "IN",
+    };
+    assertEquals(resolveShadow(i), { country: "US", provenance: "server_geo" });
+  }
+  // Desktop is the same story.
+  const d: PriceInputs = {
+    ...base, platform: "desktop", sdkCountry: "IN", sdkProvenance: "storefront",
+    geoCountry: "US", localeCountry: "IN",
+  };
+  assertEquals(resolveShadow(d).provenance, "server_geo");
 });
 
-Deno.test("STAGE A INVARIANT — served is always locale-or-override, for every input", () => {
+Deno.test("STAGE A INVARIANT — served is ALWAYS the Accept-Language country, for every input", () => {
+  // Deliberately swept over the override too. The previous version of this test asserted
+  // "locale-OR-override", which is the Stage A violation restated as an expectation — it passed
+  // while the served chain was moving prices for any request carrying an override.
   const countries = ["US", "FR", "IN", "JP"];
   const platforms: PriceInputs["platform"][] = ["android", "ios", "web", "desktop", "unknown"];
+  const provenances: (PriceInputs["sdkProvenance"])[] = [null, "storefront", "device", "override"];
   for (const platform of platforms) {
     for (const localeCountry of countries) {
       for (const geoCountry of [null, "US", "DE"]) {
         for (const sdkCountry of [null, "IN"]) {
-          const i: PriceInputs = { ...base, platform, localeCountry, geoCountry, sdkCountry };
-          assertEquals(resolveServed(i), { country: localeCountry, provenance: "locale" });
+          for (const overrideCountry of [null, "JP", "br"]) {
+            for (const sdkProvenance of provenances) {
+              const i: PriceInputs = {
+                ...base, platform, localeCountry, geoCountry, sdkCountry,
+                overrideCountry, sdkProvenance,
+              };
+              assertEquals(
+                resolveServed(i),
+                { country: localeCountry, provenance: "locale" },
+                `served must equal pre-deploy for ${JSON.stringify(i)}`,
+              );
+            }
+          }
         }
       }
     }