Skip to main content

max / makenotwork

23.6 KB · 706 lines History Blame Raw
1 //! Unified promo code management: creation, validation, usage tracking, and deletion.
2 //!
3 //! Replaces the old `discount_codes` and `download_codes` modules. Supports three
4 //! code purposes: discount, free_access, and free_trial.
5
6 use sqlx::PgPool;
7
8 use super::enums::DiscountType;
9 use super::models::*;
10 use super::{ItemId, ProjectId, PromoCodeId, SubscriptionTierId, UserId};
11 use crate::error::Result;
12
13 /// Create a new promo code for a creator.
14 #[allow(clippy::too_many_arguments)]
15 #[tracing::instrument(skip_all)]
16 pub async fn create_promo_code(
17 pool: &PgPool,
18 creator_id: UserId,
19 code: &str,
20 code_purpose: super::CodePurpose,
21 discount_type: Option<DiscountType>,
22 discount_value: Option<i32>,
23 min_price_cents: i32,
24 trial_days: Option<i32>,
25 max_uses: Option<i32>,
26 expires_at: Option<chrono::DateTime<chrono::Utc>>,
27 starts_at: Option<chrono::DateTime<chrono::Utc>>,
28 item_id: Option<ItemId>,
29 project_id: Option<ProjectId>,
30 tier_id: Option<SubscriptionTierId>,
31 ) -> Result<DbPromoCode> {
32 let promo_code = sqlx::query_as::<_, DbPromoCode>(
33 r#"
34 INSERT INTO promo_codes (creator_id, code, code_purpose, discount_type, discount_value,
35 min_price_cents, trial_days, max_uses, expires_at, starts_at, item_id, project_id, tier_id)
36 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
37 RETURNING *
38 "#,
39 )
40 .bind(creator_id)
41 .bind(code)
42 .bind(code_purpose)
43 .bind(discount_type)
44 .bind(discount_value)
45 .bind(min_price_cents)
46 .bind(trial_days)
47 .bind(max_uses)
48 .bind(expires_at)
49 .bind(starts_at)
50 .bind(item_id)
51 .bind(project_id)
52 .bind(tier_id)
53 .fetch_one(pool)
54 .await?;
55
56 Ok(promo_code)
57 }
58
59 /// Fetch a promo code by primary key.
60 #[tracing::instrument(skip_all)]
61 pub async fn get_promo_code_by_id(pool: &PgPool, id: PromoCodeId) -> Result<Option<DbPromoCode>> {
62 let code = sqlx::query_as::<_, DbPromoCode>(
63 "SELECT * FROM promo_codes WHERE id = $1",
64 )
65 .bind(id)
66 .fetch_optional(pool)
67 .await?;
68
69 Ok(code)
70 }
71
72 /// Look up a promo code by creator ID and code string (case-insensitive).
73 /// Used at checkout to validate discount codes.
74 #[tracing::instrument(skip_all)]
75 pub async fn get_promo_code_by_creator_and_code(
76 pool: &PgPool,
77 creator_id: UserId,
78 code: &str,
79 ) -> Result<Option<DbPromoCode>> {
80 let promo_code = sqlx::query_as::<_, DbPromoCode>(
81 "SELECT * FROM promo_codes WHERE creator_id = $1 AND upper(code) = upper($2)",
82 )
83 .bind(creator_id)
84 .bind(code)
85 .fetch_optional(pool)
86 .await?;
87
88 Ok(promo_code)
89 }
90
91 /// Look up a free_access promo code by code string (case-insensitive, cross-creator).
92 /// Used for free_access code claims where the buyer doesn't know the creator.
93 /// Scoped to free_access purpose to prevent cross-creator collision with discount codes.
94 #[tracing::instrument(skip_all)]
95 pub async fn get_promo_code_by_code(
96 pool: &PgPool,
97 code: &str,
98 ) -> Result<Option<DbPromoCode>> {
99 let promo_code = sqlx::query_as::<_, DbPromoCode>(
100 "SELECT * FROM promo_codes WHERE upper(code) = upper($1) AND code_purpose = 'free_access'",
101 )
102 .bind(code)
103 .fetch_optional(pool)
104 .await?;
105
106 Ok(promo_code)
107 }
108
109 /// SQL fragment for promo code listing queries: selects all promo_codes columns
110 /// plus LEFT JOINed item and project titles.
111 const PROMO_CODE_WITH_NAMES_SELECT: &str = r#"
112 SELECT pc.*, i.title AS item_title, p.title AS project_title
113 FROM promo_codes pc
114 LEFT JOIN items i ON pc.item_id = i.id
115 LEFT JOIN projects p ON pc.project_id = p.id
116 "#;
117
118 /// List all promo codes for a creator, newest first. Capped at 500.
119 #[tracing::instrument(skip_all)]
120 pub async fn get_promo_codes_by_creator(pool: &PgPool, creator_id: UserId) -> Result<Vec<DbPromoCodeWithNames>> {
121 let query = format!("{PROMO_CODE_WITH_NAMES_SELECT} WHERE pc.creator_id = $1 ORDER BY pc.created_at DESC LIMIT 500");
122 let codes = sqlx::query_as::<_, DbPromoCodeWithNames>(&query)
123 .bind(creator_id)
124 .fetch_all(pool)
125 .await?;
126
127 Ok(codes)
128 }
129
130 /// List all promo codes scoped to a project, newest first. Capped at 500.
131 #[tracing::instrument(skip_all)]
132 pub async fn get_promo_codes_by_project(pool: &PgPool, project_id: ProjectId) -> Result<Vec<DbPromoCodeWithNames>> {
133 let query = format!("{PROMO_CODE_WITH_NAMES_SELECT} WHERE pc.project_id = $1 ORDER BY pc.created_at DESC LIMIT 500");
134 let codes = sqlx::query_as::<_, DbPromoCodeWithNames>(&query)
135 .bind(project_id)
136 .fetch_all(pool)
137 .await?;
138
139 Ok(codes)
140 }
141
142 /// List all promo codes scoped to an item, newest first. Capped at 500.
143 #[tracing::instrument(skip_all)]
144 pub async fn get_promo_codes_by_item(pool: &PgPool, item_id: ItemId) -> Result<Vec<DbPromoCodeWithNames>> {
145 let query = format!("{PROMO_CODE_WITH_NAMES_SELECT} WHERE pc.item_id = $1 ORDER BY pc.created_at DESC LIMIT 500");
146 let codes = sqlx::query_as::<_, DbPromoCodeWithNames>(&query)
147 .bind(item_id)
148 .fetch_all(pool)
149 .await?;
150
151 Ok(codes)
152 }
153
154 /// Batch-load item-scoped promo codes for multiple items, grouped by item_id.
155 #[tracing::instrument(skip_all)]
156 pub async fn get_promo_codes_by_items(
157 pool: &PgPool,
158 item_ids: &[ItemId],
159 ) -> Result<std::collections::HashMap<ItemId, Vec<DbPromoCodeWithNames>>> {
160 let query = format!("{PROMO_CODE_WITH_NAMES_SELECT} WHERE pc.item_id = ANY($1) ORDER BY pc.item_id, pc.created_at DESC");
161 let codes = sqlx::query_as::<_, DbPromoCodeWithNames>(&query)
162 .bind(item_ids)
163 .fetch_all(pool)
164 .await?;
165
166 let mut map: std::collections::HashMap<ItemId, Vec<DbPromoCodeWithNames>> = std::collections::HashMap::new();
167 for pc in codes {
168 if let Some(item_id) = pc.item_id {
169 map.entry(item_id).or_default().push(pc);
170 }
171 }
172 Ok(map)
173 }
174
175 /// Atomically increment use_count, respecting the max_uses limit.
176 ///
177 /// Returns `true` if the increment succeeded, `false` if the code has already
178 /// reached its usage limit. The `WHERE` clause enforces the limit at the
179 /// database level, preventing TOCTOU races.
180 ///
181 /// Accepts any sqlx executor (`&PgPool`, `&mut Transaction`, etc.) so callers
182 /// can include this in a larger transaction when needed.
183 #[tracing::instrument(skip_all)]
184 pub async fn try_increment_use_count<'e>(
185 executor: impl sqlx::PgExecutor<'e>,
186 id: PromoCodeId,
187 ) -> Result<bool> {
188 let result = sqlx::query(
189 "UPDATE promo_codes SET use_count = use_count + 1 \
190 WHERE id = $1 \
191 AND (max_uses IS NULL OR use_count < max_uses) \
192 AND (expires_at IS NULL OR expires_at > NOW()) \
193 AND (starts_at IS NULL OR starts_at <= NOW())",
194 )
195 .bind(id)
196 .execute(executor)
197 .await?;
198
199 Ok(result.rows_affected() > 0)
200 }
201
202 /// Release a reserved use_count slot (decrement, clamped to 0).
203 ///
204 /// Used in two places that must coordinate so the count doesn't drop twice
205 /// for the same reservation:
206 /// 1. Route handlers, when a Stripe checkout creation or pending-tx
207 /// insert fails AFTER the use_count was reserved. They call
208 /// `release_use_count_and_detach` (below) which also nulls the
209 /// `promo_code_id` on any pending transaction rows for this
210 /// reservation, so `cleanup_stale_pending` can't fire a second
211 /// release for the same buyer's promo hold.
212 /// 2. `cleanup_stale_pending` itself, when it deletes stale pending
213 /// rows past the 24h checkout-session expiry. Those rows still
214 /// carry their `promo_code_id`, so this plain function is the
215 /// right call from there.
216 ///
217 /// `GREATEST(0, ...)` makes a double-release harmless (count clamps at
218 /// zero) but the structural fix above prevents it from happening at all.
219 #[tracing::instrument(skip_all)]
220 pub async fn release_use_count(pool: &PgPool, id: PromoCodeId) -> Result<()> {
221 sqlx::query(
222 "UPDATE promo_codes SET use_count = GREATEST(0, use_count - 1) WHERE id = $1",
223 )
224 .bind(id)
225 .execute(pool)
226 .await?;
227
228 Ok(())
229 }
230
231 /// Release a use_count slot AND detach the same promo_code_id from any
232 /// pending transactions for `buyer_id` so the scheduler's
233 /// `cleanup_stale_pending` doesn't release it a second time when those
234 /// stale rows eventually time out.
235 ///
236 /// Use this from route-level failure paths (Stripe session creation
237 /// failed, pending-tx insert failed mid-cart, etc). The detach is a
238 /// no-op when the failure happened BEFORE any pending row was inserted;
239 /// it's the safety net for when a partial pending row may have landed.
240 #[tracing::instrument(skip_all)]
241 pub async fn release_use_count_and_detach(
242 pool: &PgPool,
243 id: PromoCodeId,
244 buyer_id: UserId,
245 ) -> Result<()> {
246 let mut tx = pool.begin().await?;
247
248 sqlx::query(
249 "UPDATE transactions SET promo_code_id = NULL \
250 WHERE buyer_id = $1 AND promo_code_id = $2 AND status = 'pending'",
251 )
252 .bind(buyer_id)
253 .bind(id)
254 .execute(&mut *tx)
255 .await?;
256
257 sqlx::query(
258 "UPDATE promo_codes SET use_count = GREATEST(0, use_count - 1) WHERE id = $1",
259 )
260 .bind(id)
261 .execute(&mut *tx)
262 .await?;
263
264 tx.commit().await?;
265 Ok(())
266 }
267
268 /// Update editable fields on a promo code (expires_at, starts_at, max_uses).
269 #[tracing::instrument(skip_all)]
270 pub async fn update_promo_code(
271 pool: &PgPool,
272 id: PromoCodeId,
273 expires_at: Option<Option<chrono::DateTime<chrono::Utc>>>,
274 starts_at: Option<Option<chrono::DateTime<chrono::Utc>>>,
275 max_uses: Option<Option<i32>>,
276 ) -> Result<DbPromoCode> {
277 // Build SET clauses for provided fields only
278 let mut sets = Vec::new();
279 let mut param_idx = 2u32; // $1 = id
280
281 if expires_at.is_some() {
282 sets.push(format!("expires_at = ${param_idx}"));
283 param_idx += 1;
284 }
285 if starts_at.is_some() {
286 sets.push(format!("starts_at = ${param_idx}"));
287 param_idx += 1;
288 }
289 if max_uses.is_some() {
290 sets.push(format!("max_uses = ${param_idx}"));
291 // Final SET clause; param_idx is never read after this point, so the
292 // increment is elided to avoid an unused_assignments warning. Restore
293 // it if a new optional field is added below.
294 }
295
296 if sets.is_empty() {
297 // Nothing to update — just return current state
298 return get_promo_code_by_id(pool, id)
299 .await?
300 .ok_or_else(|| crate::error::AppError::NotFound);
301 }
302
303 let sql = format!("UPDATE promo_codes SET {} WHERE id = $1 RETURNING *", sets.join(", "));
304 let mut query = sqlx::query_as::<_, DbPromoCode>(&sql).bind(id);
305
306 if let Some(val) = expires_at {
307 query = query.bind(val);
308 }
309 if let Some(val) = starts_at {
310 query = query.bind(val);
311 }
312 if let Some(val) = max_uses {
313 query = query.bind(val);
314 }
315
316 let code = query.fetch_one(pool).await?;
317 Ok(code)
318 }
319
320 /// Delete all expired promo codes for a creator. Returns number of rows deleted.
321 #[tracing::instrument(skip_all)]
322 pub async fn delete_expired_by_creator(pool: &PgPool, creator_id: UserId) -> Result<u64> {
323 let result = sqlx::query(
324 "DELETE FROM promo_codes WHERE creator_id = $1 AND expires_at IS NOT NULL AND expires_at < NOW()",
325 )
326 .bind(creator_id)
327 .execute(pool)
328 .await?;
329
330 Ok(result.rows_affected())
331 }
332
333 /// Delete a promo code permanently.
334 #[tracing::instrument(skip_all)]
335 pub async fn delete_promo_code(pool: &PgPool, id: PromoCodeId) -> Result<()> {
336 sqlx::query("DELETE FROM promo_codes WHERE id = $1")
337 .bind(id)
338 .execute(pool)
339 .await?;
340
341 Ok(())
342 }
343
344 /// A single row in the "who redeemed this code" view.
345 ///
346 /// `display_name` / `username` are `None` for guest checkouts; `guest_email`
347 /// fills that gap. `item_title` is denormalized on the transaction row so
348 /// renaming an item later doesn't strand the audit trail.
349 #[derive(Debug, sqlx::FromRow, serde::Serialize)]
350 pub struct PromoRedemption {
351 pub redeemed_at: chrono::DateTime<chrono::Utc>,
352 pub display_name: Option<String>,
353 pub username: Option<String>,
354 pub guest_email: Option<String>,
355 pub item_title: Option<String>,
356 pub amount_cents: i32,
357 }
358
359 /// List redemptions of a single promo code, newest first.
360 ///
361 /// Joins through to `users` for buyer identity but falls back to the
362 /// transaction's `guest_email` for unauthenticated checkouts. Capped at 500
363 /// rows — promo codes that exceed that bound are an outlier worth its own
364 /// CSV-export flow rather than a paginated UI.
365 #[tracing::instrument(skip_all)]
366 pub async fn list_redemptions(
367 pool: &PgPool,
368 id: PromoCodeId,
369 ) -> Result<Vec<PromoRedemption>> {
370 let rows = sqlx::query_as::<_, PromoRedemption>(
371 r#"
372 SELECT
373 COALESCE(t.completed_at, t.created_at) AS redeemed_at,
374 u.display_name AS display_name,
375 u.username AS username,
376 t.guest_email AS guest_email,
377 t.item_title AS item_title,
378 t.amount_cents AS amount_cents
379 FROM transactions t
380 LEFT JOIN users u ON u.id = t.buyer_id
381 WHERE t.promo_code_id = $1
382 AND t.status = 'completed'
383 ORDER BY redeemed_at DESC
384 LIMIT 500
385 "#,
386 )
387 .bind(id)
388 .fetch_all(pool)
389 .await?;
390
391 Ok(rows)
392 }
393
394 /// Create a platform-wide promo code (used for Fan+ monthly credits).
395 ///
396 /// Same as `create_promo_code` but sets `is_platform_wide = true`.
397 /// Platform-wide codes are not scoped to a specific creator's items.
398 #[allow(clippy::too_many_arguments)]
399 #[tracing::instrument(skip_all)]
400 pub async fn create_platform_promo_code(
401 pool: &PgPool,
402 creator_id: UserId,
403 code: &str,
404 code_purpose: super::CodePurpose,
405 discount_type: Option<DiscountType>,
406 discount_value: Option<i32>,
407 min_price_cents: i32,
408 trial_days: Option<i32>,
409 max_uses: Option<i32>,
410 expires_at: Option<chrono::DateTime<chrono::Utc>>,
411 ) -> Result<DbPromoCode> {
412 let promo_code = sqlx::query_as::<_, DbPromoCode>(
413 r#"
414 INSERT INTO promo_codes (creator_id, code, code_purpose, discount_type, discount_value,
415 min_price_cents, trial_days, max_uses, expires_at, is_platform_wide)
416 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, true)
417 RETURNING *
418 "#,
419 )
420 .bind(creator_id)
421 .bind(code)
422 .bind(code_purpose)
423 .bind(discount_type)
424 .bind(discount_value)
425 .bind(min_price_cents)
426 .bind(trial_days)
427 .bind(max_uses)
428 .bind(expires_at)
429 .fetch_one(pool)
430 .await?;
431
432 Ok(promo_code)
433 }
434
435 /// Look up a platform-wide promo code by user ID and code string (case-insensitive).
436 ///
437 /// Used at checkout to validate Fan+ credits: the buyer owns the code, and it
438 /// applies to any item on the platform.
439 #[tracing::instrument(skip_all)]
440 pub async fn get_platform_promo_code_by_user_and_code(
441 pool: &PgPool,
442 user_id: UserId,
443 code: &str,
444 ) -> Result<Option<DbPromoCode>> {
445 let promo_code = sqlx::query_as::<_, DbPromoCode>(
446 "SELECT * FROM promo_codes WHERE creator_id = $1 AND upper(code) = upper($2) AND is_platform_wide = true",
447 )
448 .bind(user_id)
449 .bind(code)
450 .fetch_optional(pool)
451 .await?;
452
453 Ok(promo_code)
454 }
455
456 /// Apply a discount to a price, returning the discounted price in cents (minimum 0).
457 /// Negative discount values are clamped to 0 to prevent price increases.
458 #[tracing::instrument(skip_all)]
459 pub fn apply_discount(price_cents: i32, discount_type: DiscountType, discount_value: i32) -> i32 {
460 let discount_value = discount_value.max(0);
461 match discount_type {
462 DiscountType::Percentage => {
463 let discount = (price_cents as i64 * discount_value as i64) / 100;
464 (price_cents as i64 - discount).max(0) as i32
465 }
466 // Subtract in i64 (like the Percentage arm) so a configuration where
467 // `discount_value > i32::MAX - price_cents` can't underflow before the
468 // `.max(0)` clamp catches it. discount_value is i32 so the sub is
469 // bounded; we cast for parity with the Percentage path.
470 DiscountType::Fixed => (price_cents as i64 - discount_value as i64).max(0) as i32,
471 }
472 }
473
474 #[cfg(test)]
475 mod tests {
476 use super::*;
477
478 #[test]
479 fn percentage_discount_50() {
480 assert_eq!(apply_discount(1000, DiscountType::Percentage, 50), 500);
481 }
482
483 #[test]
484 fn percentage_discount_100() {
485 assert_eq!(apply_discount(1000, DiscountType::Percentage, 100), 0);
486 }
487
488 #[test]
489 fn percentage_discount_10() {
490 // 999 * 10 / 100 = 99 (integer), 999 - 99 = 900
491 assert_eq!(apply_discount(999, DiscountType::Percentage, 10), 900);
492 }
493
494 #[test]
495 fn fixed_discount() {
496 assert_eq!(apply_discount(1000, DiscountType::Fixed, 300), 700);
497 }
498
499 #[test]
500 fn fixed_discount_exceeds_price() {
501 assert_eq!(apply_discount(100, DiscountType::Fixed, 500), 0);
502 }
503
504 // -- Percentage discount edge cases --
505
506 #[test]
507 fn percentage_discount_0() {
508 assert_eq!(apply_discount(1000, DiscountType::Percentage, 0), 1000);
509 }
510
511 #[test]
512 fn percentage_discount_over_100() {
513 // 150% discount should clamp to 0
514 assert_eq!(apply_discount(1000, DiscountType::Percentage, 150), 0);
515 }
516
517 #[test]
518 fn percentage_discount_1_percent() {
519 // 1000 * 1 / 100 = 10, result = 990
520 assert_eq!(apply_discount(1000, DiscountType::Percentage, 1), 990);
521 }
522
523 #[test]
524 fn percentage_discount_99_percent() {
525 // 1000 * 99 / 100 = 990, result = 10
526 assert_eq!(apply_discount(1000, DiscountType::Percentage, 99), 10);
527 }
528
529 #[test]
530 fn percentage_discount_rounding() {
531 // 1 cent * 50 / 100 = 0 (integer division), result = 1
532 assert_eq!(apply_discount(1, DiscountType::Percentage, 50), 1);
533 // 3 * 33 / 100 = 0 (integer), result = 3
534 assert_eq!(apply_discount(3, DiscountType::Percentage, 33), 3);
535 // 199 * 50 / 100 = 99, result = 100
536 assert_eq!(apply_discount(199, DiscountType::Percentage, 50), 100);
537 }
538
539 // -- Fixed discount edge cases --
540
541 #[test]
542 fn fixed_discount_exact_price() {
543 assert_eq!(apply_discount(500, DiscountType::Fixed, 500), 0);
544 }
545
546 #[test]
547 fn fixed_discount_zero_value() {
548 assert_eq!(apply_discount(1000, DiscountType::Fixed, 0), 1000);
549 }
550
551 #[test]
552 fn fixed_discount_one_cent() {
553 assert_eq!(apply_discount(1000, DiscountType::Fixed, 1), 999);
554 }
555
556 // -- Zero price --
557
558 #[test]
559 fn zero_price_percentage() {
560 assert_eq!(apply_discount(0, DiscountType::Percentage, 50), 0);
561 }
562
563 #[test]
564 fn zero_price_fixed() {
565 assert_eq!(apply_discount(0, DiscountType::Fixed, 100), 0);
566 }
567
568 // -- Negative values (defensive) --
569
570 #[test]
571 fn negative_discount_value_percentage() {
572 // Negative discount values are clamped to 0, so price is unchanged
573 assert_eq!(apply_discount(1000, DiscountType::Percentage, -50), 1000);
574 }
575
576 #[test]
577 fn negative_discount_value_fixed() {
578 // Negative discount values are clamped to 0, so price is unchanged
579 assert_eq!(apply_discount(1000, DiscountType::Fixed, -500), 1000);
580 }
581
582 #[test]
583 fn negative_price_percentage() {
584 // Negative price with percentage discount — documents current behavior
585 // -1000 * 50 / 100 = -500, -1000 - (-500) = -500, max(0) = 0
586 assert_eq!(apply_discount(-1000, DiscountType::Percentage, 50), 0);
587 }
588
589 #[test]
590 fn negative_price_fixed() {
591 // -1000 - 500 = -1500, max(0) = 0
592 assert_eq!(apply_discount(-1000, DiscountType::Fixed, 500), 0);
593 }
594
595 // -- Large values (overflow safety) --
596
597 #[test]
598 fn large_price_percentage_no_overflow() {
599 // The function uses i64 intermediate to avoid overflow
600 // i32::MAX = 2_147_483_647; 50% of that
601 let price = i32::MAX;
602 let result = apply_discount(price, DiscountType::Percentage, 50);
603 assert_eq!(result, 1_073_741_824); // (MAX - MAX*50/100)
604 }
605
606 // ── Adversarial (test-fuzz) ──
607
608 #[test]
609 fn adversarial_percentage_max_price_max_percentage() {
610 // i32::MAX price with 100% discount
611 let result = apply_discount(i32::MAX, DiscountType::Percentage, 100);
612 assert_eq!(result, 0, "100% discount on any price should be 0");
613 }
614
615 #[test]
616 fn adversarial_percentage_max_price_99_percent() {
617 let result = apply_discount(i32::MAX, DiscountType::Percentage, 99);
618 // i32::MAX * 99 / 100 via i64 = 2_125_999_810, remainder = 21_483_837
619 // Exact: 2_147_483_647 * 99 = 212_600_881_053 / 100 = 2_126_008_810
620 // 2_147_483_647 - 2_126_008_810 = 21_474_837
621 assert_eq!(result, 21_474_837);
622 assert!(result > 0, "99% discount should leave some remaining");
623 }
624
625 #[test]
626 fn adversarial_fixed_max_price_max_discount() {
627 let result = apply_discount(i32::MAX, DiscountType::Fixed, i32::MAX);
628 assert_eq!(result, 0);
629 }
630
631 #[test]
632 fn adversarial_both_negative() {
633 // Both negative price and negative discount
634 let result = apply_discount(-100, DiscountType::Fixed, -100);
635 // -100 - (-100) = 0
636 assert_eq!(result, 0);
637 }
638
639 #[test]
640 fn adversarial_percentage_discount_exactly_50_odd_price() {
641 // Rounding: 1 cent * 50% = 0 (integer division), so result = 1
642 assert_eq!(apply_discount(1, DiscountType::Percentage, 50), 1);
643 // 3 cents * 50% = 1 (via i64: 3*50/100=1), result = 2
644 assert_eq!(apply_discount(3, DiscountType::Percentage, 50), 2);
645 }
646
647 #[test]
648 fn adversarial_apply_discount_invariant() {
649 // For any valid (positive) price and percentage 0-100,
650 // result should be in [0, price]
651 for price in [1, 50, 100, 999, 10000, 1_000_000] {
652 for pct in [0, 1, 10, 25, 33, 50, 75, 99, 100] {
653 let result = apply_discount(price, DiscountType::Percentage, pct);
654 assert!(
655 result >= 0 && result <= price,
656 "Invariant violated: price={}, pct={}, result={}",
657 price, pct, result
658 );
659 }
660 }
661 }
662
663 #[test]
664 fn adversarial_fixed_discount_invariant() {
665 // For any positive price and positive discount, result should be in [0, price]
666 for price in [1, 50, 100, 999, 10000] {
667 for discount in [0, 1, 50, 100, 999, 10000, 999999] {
668 let result = apply_discount(price, DiscountType::Fixed, discount);
669 assert!(
670 result >= 0 && result <= price,
671 "Invariant violated: price={}, discount={}, result={}",
672 price, discount, result
673 );
674 }
675 }
676 }
677
678 // ── Property-based tests (proptest) ──
679
680 proptest::proptest! {
681 #[test]
682 fn prop_percentage_discount_in_range(price in 0..=1_000_000i32, pct in 0..=100i32) {
683 let result = apply_discount(price, DiscountType::Percentage, pct);
684 proptest::prop_assert!(result >= 0, "Result {} should be >= 0", result);
685 proptest::prop_assert!(result <= price, "Result {} should be <= price {}", result, price);
686 }
687
688 #[test]
689 fn prop_fixed_discount_in_range(price in 0..=1_000_000i32, discount in 0..=1_000_000i32) {
690 let result = apply_discount(price, DiscountType::Fixed, discount);
691 proptest::prop_assert!(result >= 0, "Result {} should be >= 0", result);
692 proptest::prop_assert!(result <= price, "Result {} should be <= price {}", result, price);
693 }
694
695 #[test]
696 fn prop_100_percent_discount_is_zero(price in 0..=1_000_000i32) {
697 proptest::prop_assert_eq!(apply_discount(price, DiscountType::Percentage, 100), 0);
698 }
699
700 #[test]
701 fn prop_0_percent_discount_is_identity(price in 0..=1_000_000i32) {
702 proptest::prop_assert_eq!(apply_discount(price, DiscountType::Percentage, 0), price);
703 }
704 }
705 }
706