Phase 3.7: paid pairing flow + returning chat + extension flip

- Backend: payment_sessions + pairing_failures tables; payment.service.js and pairing-failure.service.js (new); rewritten pairing.service.js (payment-gated blast + targeted "Curhat lagi" + cancel + fallback); rewritten extension.service.js (data-driven auto-approve with offline safeguard, charge-at-approval); pricing.service.js (extension tiers without free trial); mitra-status.service.js (countAvailableMitras cached path); 60s sweeper for stale payment sessions - Backend routes: client.payment.routes, client.mitra-availability.routes, internal/failed-pairings.routes; client.chat.routes rewritten for payment-gated start + /returning + /cancel + /fallback-to-blast; internal/config.routes adds 4 new keys with Valkey invalidate publish - client_app: mitra-availability poll, payment screen + notifier, pairing notifier rewrite (PairingTargetedWaiting + PairingFailed states), targeted-waiting overlay + bestie-unavailable dialog, "Curhat lagi" CTA, failed-pairing terminal, extension via payment-session - mitra_app: PairingRequestType enum, returning-chat 20s countdown auto-dismiss, extension card "otomatis disetujui" copy - control_center: 4 new config rows in Settings, Failed Pairings page (filter + paginate + action menu), sidebar + route registered - Test infrastructure: Vitest backend (7/7 pass), Playwright CC (4/4 pass), Maestro mobile scaffold (CLI install pending) - Bugs found via Playwright + fixed: LoginPage labels not associated with inputs (a11y); backend internal CORS missing PATCH/PUT/DELETE in allow-methods (silent settings breakage in browsers since Stage 4) - Docs: phase3.7.md PRD, phase3.7-plan.md, phase3.7-questions.md (Q&A), phase3.7-testing.md (E2E checklist), phase3.7-test-run-2026-05-03.md (today's run results) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-03 23:02:49 +08:00
parent f3766813f3
commit d09e50af55
92 changed files with 9579 additions and 437 deletions
--- a/backend/src/services/extension.service.js
+++ b/backend/src/services/extension.service.js
@@ -1,20 +1,53 @@
 import { getDb } from '../db/client.js'
-import { publish } from '../plugins/valkey.js'
-import { sendToSessionParticipant } from '../plugins/websocket.js'
+import { sendToSessionParticipant, isUserOnlineWs } from '../plugins/websocket.js'
 import { extendSessionTimer, clearClosureGraceTimer, startClosureGraceTimer } from './session-timer.service.js'
-import { UserType, SessionStatus, ExtensionStatus, TransactionType, WsMessage } from '../constants.js'
+import { isMitraReachable } from './mitra-status.service.js'
+import { consumePaymentSession, failPaymentSession, getPaymentSession } from './payment.service.js'
+import {
+  getExtensionTimeoutConfig,
+  getExtensionDefaultActionOnTimeout,
+} from './config.service.js'
+import {
+  UserType,
+  SessionStatus,
+  ExtensionStatus,
+  TransactionType,
+  WsMessage,
+  PaymentSessionStatus,
+  ExtensionTimeoutAction,
+  PairingFailureCause,
+} from '../constants.js'

 const sql = getDb()

 // Extension timeout map: extensionId → timeoutId
 const extensionTimeouts = new Map()

-const getExtensionTimeout = async () => {
-  const [row] = await sql`SELECT value FROM app_config WHERE key = 'extension_timeout_seconds'`
-  return (row?.value?.value ?? 60) * 1000 // Convert to ms
+const getExtensionTimeoutMs = async () => {
+  const { extension_timeout_seconds } = await getExtensionTimeoutConfig()
+  return extension_timeout_seconds * 1000
 }

-export const requestExtension = async (sessionId, customerId, { duration_minutes, price }) => {
+const getExtensionTimeoutAction = async () => {
+  const { extension_default_action_on_timeout } = await getExtensionDefaultActionOnTimeout()
+  return Object.values(ExtensionTimeoutAction).includes(extension_default_action_on_timeout)
+    ? extension_default_action_on_timeout
+    : ExtensionTimeoutAction.AUTO_APPROVE
+}
+
+/**
+ * Customer requests an extension.
+ *
+ * `extension_payment_session_id` is REQUIRED. The payment session must:
+ *   - belong to this customer
+ *   - be in `confirmed` status (not yet consumed)
+ *   - have `is_extension = true`
+ *   - have `is_free_trial = false` (extensions never use free trial)
+ *
+ * The payment session is NOT consumed at request time. It is consumed at approval moment
+ * (mitra explicit accept OR auto-approve fires).
+ */
+export const requestExtension = async (sessionId, customerId, { duration_minutes, price, extension_payment_session_id }) => {
  // Verify session belongs to customer and is in an extendable state
  const [session] = await sql`
    SELECT id, customer_id, mitra_id, status, topic_sensitivity FROM chat_sessions
@@ -25,16 +58,51 @@ export const requestExtension = async (sessionId, customerId, { duration_minutes
    throw Object.assign(new Error('Session not found or already ended'), { code: 'SESSION_NOT_ACTIVE', statusCode: 409 })
  }

-  // Create extension record
+  // Validate extension payment session
+  if (!extension_payment_session_id) {
+    throw Object.assign(new Error('extension_payment_session_id is required'), {
+      code: 'VALIDATION_ERROR', statusCode: 422,
+    })
+  }
+  const paySession = await getPaymentSession(extension_payment_session_id)
+  if (!paySession) {
+    throw Object.assign(new Error('Payment session not found'), { code: 'NOT_FOUND', statusCode: 404 })
+  }
+  if (paySession.customer_id !== customerId) {
+    throw Object.assign(new Error('Payment session does not belong to this customer'), {
+      code: 'FORBIDDEN', statusCode: 403,
+    })
+  }
+  if (paySession.status !== PaymentSessionStatus.CONFIRMED) {
+    throw Object.assign(new Error(`Payment session is ${paySession.status}, must be confirmed`), {
+      code: 'INVALID_STATE', statusCode: 409,
+    })
+  }
+  if (!paySession.is_extension) {
+    throw Object.assign(new Error('Payment session is not flagged as an extension payment'), {
+      code: 'INVALID_STATE', statusCode: 409,
+    })
+  }
+  if (paySession.is_free_trial) {
+    throw Object.assign(new Error('Free trial is not available for extensions'), {
+      code: 'FREE_TRIAL_NOT_ALLOWED', statusCode: 400,
+    })
+  }
+
+  // Create extension record (linked to its payment session)
  const [extension] = await sql`
-    INSERT INTO session_extensions (session_id, requested_duration_minutes, requested_price, status)
-    VALUES (${sessionId}, ${duration_minutes}, ${price}, ${ExtensionStatus.PENDING})
-    RETURNING id, session_id, requested_duration_minutes, requested_price, status, requested_at
+    INSERT INTO session_extensions (session_id, requested_duration_minutes, requested_price, status, payment_session_id)
+    VALUES (${sessionId}, ${duration_minutes}, ${price}, ${ExtensionStatus.PENDING}, ${extension_payment_session_id})
+    RETURNING id, session_id, requested_duration_minutes, requested_price, status, requested_at, payment_session_id
  `

  // Pause the session
  await sql`UPDATE chat_sessions SET status = ${SessionStatus.EXTENDING} WHERE id = ${sessionId}`

+  // Resolve timeout once so we can both surface it in the WS payload and start the server-side timer.
+  const timeoutMs = await getExtensionTimeoutMs()
+  const timeoutSeconds = Math.round(timeoutMs / 1000)
+
  // Notify mitra — include current topic sensitivity so UI can highlight
  sendToSessionParticipant(sessionId, UserType.MITRA, {
    type: WsMessage.EXTENSION_REQUEST,
@@ -43,6 +111,7 @@ export const requestExtension = async (sessionId, customerId, { duration_minutes
    duration_minutes,
    price,
    topic_sensitivity: session.topic_sensitivity,
+    timeout_seconds: timeoutSeconds,
  })

  // Notify customer that chat is paused
@@ -51,13 +120,12 @@ export const requestExtension = async (sessionId, customerId, { duration_minutes
    session_id: sessionId,
    reason: 'extension_pending',
  })
-
-  // Start timeout
-  const timeoutMs = await getExtensionTimeout()
  const timeoutId = setTimeout(async () => {
    try {
-      await timeoutExtension(extension.id, sessionId)
-    } catch (_) {}
+      await timeoutExtension(extension.id, sessionId, session.mitra_id)
+    } catch (err) {
+      console.error('timeoutExtension failed', { extensionId: extension.id, sessionId, err })
+    }
  }, timeoutMs)
  extensionTimeouts.set(extension.id, timeoutId)

@@ -73,16 +141,25 @@ export const respondToExtension = async (extensionId, sessionId, mitraId, accept
    throw Object.assign(new Error('Session not found'), { code: 'FORBIDDEN', statusCode: 403 })
  }

+  return finalizeExtension(extensionId, sessionId, accepted, /* viaTimeout */ false)
+}
+
+/**
+ * Internal: applies the accepted/rejected outcome. Used by both explicit response
+ * and the data-driven timeout path.
+ */
+const finalizeExtension = async (extensionId, sessionId, accepted, viaTimeout) => {
  const status = accepted ? ExtensionStatus.ACCEPTED : ExtensionStatus.REJECTED

  const [extension] = await sql`
    UPDATE session_extensions
    SET status = ${status}, responded_at = NOW()
    WHERE id = ${extensionId} AND session_id = ${sessionId} AND status = ${ExtensionStatus.PENDING}
-    RETURNING id, session_id, requested_duration_minutes, requested_price, status
+    RETURNING id, session_id, requested_duration_minutes, requested_price, status, payment_session_id
  `

  if (!extension) {
+    if (viaTimeout) return null // race: already resolved before timer fired
    throw Object.assign(new Error('Extension not found or already resolved'), {
      code: 'EXTENSION_RESOLVED', statusCode: 409,
    })
@@ -96,6 +173,11 @@ export const respondToExtension = async (extensionId, sessionId, mitraId, accept
  }

  if (accepted) {
+    // Charge fires AT approval moment (explicit OR auto-approve).
+    if (extension.payment_session_id) {
+      await consumePaymentSession(extension.payment_session_id)
+    }
+
    // Clear any pending grace timer from the previous expiry
    clearClosureGraceTimer(sessionId)

@@ -117,6 +199,7 @@ export const respondToExtension = async (extensionId, sessionId, mitraId, accept
      type: WsMessage.EXTENSION_RESPONSE,
      accepted: true,
      duration_minutes: extension.requested_duration_minutes,
+      via_timeout: viaTimeout,
    })
    sendToSessionParticipant(sessionId, UserType.CUSTOMER, {
      type: WsMessage.SESSION_RESUMED,
@@ -127,12 +210,19 @@ export const respondToExtension = async (extensionId, sessionId, mitraId, accept
      session_id: sessionId,
    })
  } else {
-    // Rejected — proceed to closure
+    // Rejected — no charge. Fail the extension payment session if present.
+    // viaTimeout=false here means an explicit mitra reject (the timer path goes through
+    // timeoutExtension which never enters this branch with viaTimeout=true for reject).
+    if (extension.payment_session_id) {
+      await failPaymentSession(extension.payment_session_id, PairingFailureCause.EXTENSION_REJECTED)
+    }
+
    await sql`UPDATE chat_sessions SET status = ${SessionStatus.CLOSING} WHERE id = ${extension.session_id}`

    sendToSessionParticipant(sessionId, UserType.CUSTOMER, {
      type: WsMessage.EXTENSION_RESPONSE,
      accepted: false,
+      via_timeout: viaTimeout,
    })
    sendToSessionParticipant(sessionId, UserType.MITRA, {
      type: WsMessage.SESSION_CLOSING,
@@ -148,24 +238,72 @@ export const respondToExtension = async (extensionId, sessionId, mitraId, accept
  return extension
 }

-const timeoutExtension = async (extensionId, sessionId) => {
+/**
+ * Data-driven timeout handler.
+ *
+ *   - read `extension_default_action_on_timeout` config:
+ *     - 'auto_approve': check mitra reachability (WS + Valkey online). If both OK → approve.
+ *       If either is offline/disconnected → fall back to reject (no charge).
+ *     - 'auto_reject' (back-compat flag): reject regardless.
+ */
+const timeoutExtension = async (extensionId, sessionId, mitraId) => {
  extensionTimeouts.delete(extensionId)

-  const [extension] = await sql`
+  // Confirm extension is still pending (race with explicit response)
+  const [pending] = await sql`
+    SELECT id FROM session_extensions
+    WHERE id = ${extensionId} AND status = ${ExtensionStatus.PENDING}
+  `
+  if (!pending) return
+
+  const action = await getExtensionTimeoutAction()
+
+  // Track WHY we ended up rejecting so the failed-pairings audit row gets the right tag.
+  // Default: configured policy is auto_reject → use EXTENSION_REJECTED.
+  let causeTag = PairingFailureCause.EXTENSION_REJECTED
+  let reasonForClient = 'timeout'
+
+  if (action === ExtensionTimeoutAction.AUTO_APPROVE) {
+    // Safeguard: mitra must be reachable (online in Valkey AND connected via WS).
+    // Never use "in-session" as a proxy for "online".
+    const wsConnected = isUserOnlineWs(UserType.MITRA, mitraId)
+    const onlineFlag = await isMitraReachable(mitraId)
+
+    if (wsConnected && onlineFlag) {
+      // Approve via the same path as explicit accept.
+      await finalizeExtension(extensionId, sessionId, /* accepted */ true, /* viaTimeout */ true)
+      return
+    }
+    // Safeguard tripped — treat as auto-reject (no charge), but tag the audit row distinctly
+    // so CC operators can see this was a system-safety decision, not a mitra reject or a
+    // configured auto-reject policy decision.
+    causeTag = PairingFailureCause.EXTENSION_SAFEGUARD_TRIPPED
+    reasonForClient = 'safeguard'
+  }
+
+  // auto_reject (configured) OR auto_approve-with-safeguard-tripped — both end with
+  // the extension marked TIMEOUT, no charge, session moves to CLOSING. The cause_tag
+  // distinguishes them in the failed-pairings audit log. RETURNING guards against a race
+  // with explicit accept/decline that landed between the pending check above and here —
+  // if no row was matched, the extension is no longer ours to time out.
+  const [timedOut] = await sql`
    UPDATE session_extensions
    SET status = ${ExtensionStatus.TIMEOUT}, responded_at = NOW()
    WHERE id = ${extensionId} AND status = ${ExtensionStatus.PENDING}
-    RETURNING id, session_id
+    RETURNING id, payment_session_id
  `
-  if (!extension) return
+  if (!timedOut) return

-  // Timeout = proceed to closure
-  await sql`UPDATE chat_sessions SET status = ${SessionStatus.CLOSING} WHERE id = ${extension.session_id}`
+  if (timedOut.payment_session_id) {
+    await failPaymentSession(timedOut.payment_session_id, causeTag)
+  }

+  // Move session to closing & notify both parties (matches the explicit-reject UX).
+  await sql`UPDATE chat_sessions SET status = ${SessionStatus.CLOSING} WHERE id = ${sessionId}`
  sendToSessionParticipant(sessionId, UserType.CUSTOMER, {
    type: WsMessage.EXTENSION_RESPONSE,
    accepted: false,
-    reason: 'timeout',
+    reason: reasonForClient,
  })
  sendToSessionParticipant(sessionId, UserType.MITRA, {
    type: WsMessage.SESSION_CLOSING,