AUTH_BILLING_VERIFICATION.md

Authentication, database, and billing verification

Verified on 26 August 2026 against the current local checkout and the supplied services.

Status: authentication and database service checks pass, and prepaid billing now passes actual Stripe/Autumn sandbox settlement checks. Pricing is $0.14 per audio hour with $0 starting credit. Hosted checkout, saved-card automatic purchases, declines, duplicate protection, monthly limits, disabling and debt recovery are verified. This establishes sandbox readiness, not a guarantee of production readiness or a completed authenticated browser audit.

Latest automated verification: 83 tests passed, seven conditional model tests skipped, zero failures, 352 assertions; TypeScript and whole-app lint pass. The production Turbopack build also passes from an isolated snapshot of the same sources and cloned dependencies, using inert build credentials without accessing the real services or disturbing port 3000. The generated client files were scanned with no matches for configured service credentials, including the new Stripe test key. The earlier standalone native transcription/billing probe separately exercised real Parakeet inference.

What was verified

Area	Evidence	Scope
Email	Resend delivered a real OTP from auth@send.sandchest.com; domain/DKIM/SPF records reported verified	Resend's delivered@resend.dev simulator, not a personal inbox or spam-placement test
Authentication	Correct code signs in; incorrect, expired, exhausted and reused codes fail; concurrent reuse cannot create two sessions	Real email/HTTP/PlanetScale flow plus focused isolated regression tests
Sessions and authorization	Session persists; sign-out revokes it; tenant workspace is durable; API keys authenticate and stop working after revocation; cross-origin mutations and non-owner billing are rejected	Local Next server with the real database; regression coverage for negative cases
Database	All four migration entries applied; 13 application tables; indexed queries verified with 20,000 transcripts and 20,000 usage events	Real PlanetScale Postgres; synthetic scale data was rolled back
Billing	Fractional audio duration deducted once; duplicate requests rejected by Autumn; overflow debt retained across a later credit grant; exhausted balances blocked	Dedicated, non-default Autumn sandbox fixtures
Actual Sandchest pricing	A new account starts at $0 and cannot transcribe; one hour deducts $0.14 and 2.5 seconds deducts approximately $0.0000972222; a repeated job deducts nothing more	Actual audio_seconds / usd_credits catalog, funded with an explicitly labeled sandbox verification grant, not a payment
Zero-credit public API	A valid API key receives HTTP 402 and no transcription job is created	Real local HTTP API, existing verified workspace, real database and actual Autumn catalog
Actual speech-to-billing chain	7,821 ms of generated speech produced 21 words through real Parakeet, one durable usage event, and one exact Autumn deduction	Real HTTP API, native Metal inference, real Postgres, Autumn sandbox
Retry after depletion	Existing result remained readable; repeating the original idempotency key returned the original transcript; a new request returned HTTP 402	Real HTTP and provider verification
Hosted checkout	Browser completed a $25 USD purchase with Stripe's test card; Stripe PaymentIntent succeeded, invoice was paid for 2,500 cents, Autumn granted exactly $25	Actual Sandchest catalog and labeled sandbox customer; no real money
Checkout card storage	Checkout authorized the saved card for off-session use; an eight-hour synthetic usage report deducted $1.12, then a $24 threshold triggered exactly one additional $25 payment and credit grant	Same card saved in the browser, with no manual replacement/default-card setup; final balance $48.88
Concurrent usage and automatic payments	A $5 purchase funded usage; no payment above the $4 threshold; eight concurrent one-hour reports triggered exactly one $5 top-up	Completed-job rows in real Postgres, actual $0.14/hour catalog and paid Stripe invoices
Monthly purchase limit	After the documented 30-second cooldown, another 40 hours reduced the balance to $3.14 without another purchase; Autumn reported count 1 against limit 1	Independent of cooldown suppression; actual provider purchase counter
Declines and recovery	Initial declined purchase granted $0; declined auto-payment granted nothing; a $2 usage debt blocked new work; a later paid $5 purchase left $3 and restored access	Actual Stripe decline fixture and Autumn balances; unpaid test invoices subsequently voided
Disabling automatic payments	Usage crossed the threshold while disabled and produced no additional charge	Verified separately from the monthly-cap case; all seven payment-audit customers confirmed disabled at cleanup
Duplicate purchases	Repeating the same scoped purchase key returned Autumn's idempotency conflict, with one paid invoice and one credit grant	Actual Stripe/Autumn settlement, not just mocked responses
Customer portal	Autumn returned a customer portal link	API link creation verified; portal UI and card-update form were not exercised
Browser	Stripe hosted payment form and successful return to Sandchest's login page rendered	Final authenticated dashboard interactions await action-time sign-in approval; no browser access restriction was bypassed

Changes

• Recognize AUTUMN_API_KEY as well as AUTUMN_SECRET_KEY, and use RESEND_DOMAIN for the sender unless EMAIL_FROM overrides it.
• Generate missing independent authentication and API-key hashing secrets in the ignored .env.local; existing service credentials were preserved. Secrets are not included here or in the scoped patch.
• Limit the default database pool to five connections per process, configurable with SANDCHEST_DATABASE_POOL_SIZE. This database reports a 25-connection ceiling; replica counts must fit that total budget.
• Use database-backed authentication rate limits, indexed expiry cleanup, joined session reads, and request-scoped session/workspace deduplication.
• Keep external billing provisioning off the login path; recover billing customers from their durable workspace on first billing use.
• Protect dashboard mutations and auth POSTs against cross-origin requests. Bound billing request bodies to 4 KB.
• Replace subscription-oriented billing controls with prepaid credit balance, credit purchases, payment-method management, invoices, and optional automatic top-ups with a monthly purchase limit.
• Preview credit purchases before attaching them, requiring a one-time USD purchase matching both the requested payment and credit quantity, with no expiry, deferred grant, recurring cycle or replacement plan.
• Give checkout creation a 30-second timeout while keeping entitlement checks at five seconds with no automatic retries. A real saved-card purchase took more than five seconds and settled after the original client timed out; its invoice and grant were reconciled before any further action.
• Treat Autumn's requiredAction response as a payment failure or pending payment when no checkout URL is returned. The provider can return HTTP 200 with payment_failed; HTTP success alone never establishes settlement.
• Permit owners to disable existing automatic payments without a saved card, available pricing catalog, or valid amount fields. Explicitly select automatic charging rather than send-invoice mode when enabling top-ups.
• Meter from persisted measured audio duration, reject charges for incomplete/failed transcripts, and guard synchronization against concurrent workers.
• Deduct pending local usage when deciding whether a new request can run, so a provider outage does not expose an unchanged spendable balance.
• Carry overflow debt forward using granted credits minus usage. Autumn's displayed remaining value clamps at zero even when recorded usage exceeds the grant.
• Drain billing from the durable outbox instead of waiting on Autumn inside an inference lane. Retry with backoff and an indexed due-event query.
• Stop ambiguous retries before Autumn's 24-hour idempotency window expires. Such rows are marked reconciliation_required; an operator must reconcile them before retrying.
• Isolate bun test from the real database, Resend, Autumn and Stripe credentials using bunfig.toml and tests/setup.ts.

Performance evidence

These are bounded measurements, not a production load test or a cross-region latency guarantee.

Probe	Result
Real session endpoint, 20 warm reads	190 ms median; 243 ms p95
Local client → real database, 30 reads	92 ms median; 159 ms p95
40 concurrent simple reads, pool of five	869 ms total
Transcript history query, 20,000 synthetic rows	0.159 ms database execution; transcription_org_created_idx
Monthly usage aggregate, 20,000 synthetic rows	0.230 ms; usage_event_org_created_idx
Pending billing outbox query	0.091 ms; usage_event_pending_idx
Genuine 7.821-second recording	Worker reported 97 ms inference; 5,334 ms total local API/result time

The local-to-US database round trips dominate the complete application path. The database query times and native inference time do not establish a sub-second end-to-end service. Production application, queue and database placement must be verified together before making that claim.

The database URL uses sslmode=verify-full. The provider's pooler rejects arbitrary startup parameters such as statement_timeout, so unsupported connection parameters were not retained.

Sandbox direct card payments took roughly 4.3–5.7 seconds in these probes. They are external payment settlement operations, not inference latency. One later provider request also timed out during verification; follow-up reads confirmed the correct balance, invoices and disabled controls. The final complete suite passed, but provider availability is not guaranteed. Entitlement failures remain closed and metering retries remain durable and idempotent.

AssemblyAI alignment

The intended model is prepaid USD credits, audio-duration billing after successful completion, no charges for failed transcripts, exhausted-credit gating, optional automatic replenishment, and no required monthly subscription. AssemblyAI documents those mechanics in its pricing explanation.

This is alignment of billing behavior, not a claim that Sandchest implements every AssemblyAI product, enterprise invoicing arrangement, rate or dashboard function. The user authorized the same or slightly lower pricing and $0 starting credit. Sandchest is set to $0.14 per audio hour, approximately 6.7% below AssemblyAI Universal-2's published $0.15/hour base rate on the verification date; Universal-3.5 Pro is listed at $0.21/hour. See AssemblyAI's current pricing.

The actual sandbox catalog contains audio_seconds, usd_credits, a zero-credit default account (sandchest_free), and one-off prepaid purchases (sandchest_top_up, $1 per USD credit). The one existing member workspace was backfilled. Applying the setup again made no additional attachment or grant. No production catalog was changed.

Autumn supports monetary credits, automatic top-ups, and idempotent requests. The live sandbox probes supplement those documented contracts.

Outstanding requirements

1. Finish authenticated browser verification and the portal/card-update UI after the requested action-time approval. The browser currently reaches Sandchest's login page following payment; the real HTTP authentication flow was already verified independently with the real database and email service. The hosted payment fixture is a separate labeled Autumn customer, not a claim that browser signup through purchase was exercised as one continuous session.
2. Before deployment, configure the public HTTPS application URL and production service credentials, verify total pool capacity across replicas, and test the deployed region/queue arrangement. Production catalog/payment settings and webhook delivery must be checked in that environment. Nothing was deployed or published in this task.

The former Stripe account-setup blocker is resolved: the new test key accesses the same account linked by Autumn; a dashboard name is present, charges are enabled, and account details are submitted. The successful hosted and automatic test payments establish this directly.

Autumn remains the application's billing API: credit balances, usage, checkout and automatic top-ups go through it. Stripe processes the payments underneath. STRIPE_SECRET_TEST_KEY is used only by explicit verification scripts to inspect settlement and prepare published Stripe test-card fixtures; no Stripe runtime dependency was added to the app. A separate Stripe key is not required in Sandchest's billing runtime. Autumn's Stripe integration

Reproduction

Run the isolated suite and build:

bun run typecheck
bun test
bun run lint
bun run build

Explicit service probes use real configured test services and create labeled test data:

bun run scripts/verify-services.ts
bun run scripts/verify-database.ts
bun run scripts/verify-billing.ts
bun run scripts/verify-commercial-billing.ts
bun run scripts/verify-payments.ts

verify-payments.ts requires both sandbox keys, creates labeled fixtures, exercises real test charges and completed usage rows without claiming queue jobs, and disables automatic purchases afterward. It leaves paid invoices and usage records for inspection. It writes a unique report for every run, including timeouts and partial failures.

After an approved $25 browser checkout and its private checkout artifact have been created, bun run scripts/verify-hosted-checkout.ts reconciles the session, invoice and saved-card authorization. Adding --auto-topup explicitly tests one further $25 sandbox purchase. This option requires an untouched $25 fixture and refuses to repeat against the already-used test account.

scripts/verify-transcription-billing.ts additionally requires SANDCHEST_VERIFY_WORKER_BINARY pointing to a verified native worker and exclusive use of ports 18766/3188. Coordinate GPU use before running it. It starts and stops only its own native process, refuses to claim unrelated queued jobs, and revokes its test API key.

The approved values are saved in the ignored local environment as SANDCHEST_PRICE_PER_HOUR_USD=0.14 and SANDCHEST_FREE_CREDIT_USD=0. Preview the catalog before applying it in another environment:

bun run scripts/setup-billing.ts

Then apply the reviewed catalog and explicitly provision existing member workspaces:

bun run scripts/setup-billing.ts --apply --backfill-existing-workspaces

The setup script refuses to overwrite differing existing pricing. It was applied and safely reapplied to the actual Sandchest catalog in the supplied sandbox. The commercial verification script checks zero-credit onboarding before explicitly granting $2 only to its isolated test customer for metering verification.

Evidence and workspace boundaries

Machine-readable evidence is under the ignored .sandchest/service-verification/ directory: auth.json, database.json, billing.json, transcription-billing.json, commercial-billing.json, stripe-key-check.json, hosted-checkout-result.json, payments.json, and payment-reconciliation.json, plus catalog previews, immutable per-run payment reports and final check logs. processor-setup.json records the earlier blocker and is superseded by the successful payment evidence. The seven labeled payment customers have $95 total in sandbox paid invoices across all audit attempts, with exact $5 or $25 amounts, no live charges and all automatic purchases disabled. Earlier fixture IDs prefixed audit_ use a synthetic $3.60/hour rate only as test data; current commercial/payment verification uses the actual $0.14/hour rate. No real money moved.

The native process used for the earlier integration probe was stopped and its runtime lease released. The later payment verification did not start inference or claim queue jobs. Rust worker, benchmark sources, model weights, benchmark recordings, and the other task's runtime/build caches were preserved. Four API/transcription paths were explicitly handed off to that task with a separate durable checkpoint; they were not edited during payment verification. Main was not switched, committed, pushed, reset or stashed. Port 3000 was left running. The scoped pre-edit comparison is saved under .git/auth-billing-audit/changes.patch.