feat(subplat): add support for free access program

Because

- Transfer ownership of the Mozilla VPN Free Access program to the
  SubPlat and EntPlat teams, which aligns with the goal of evolving the
  subscirption platform beyond subscriptions.
- Allow other Mozilla services to also utilize the Free Access Program.

This commit

- Adds support for the Free Access Program, by broadcasting capabilities
  for enabled customers, even if they don't have a subscription.
- Read list of emails from Strapi and what capabilities should be
  provided to these users.
- On auth-server /profile query, return the relevant capability if the
  user email is in the list configured in Strapi.
- Add webhook listener to `payments-api` that listens for changes in
  Strapi and then calls an API in auth-server, which broadcasts
  capability added or removed via event-broker to RPs.
- Show Paid Subscriptions option to user that have access via a B2B
  subscription. On the subscription management page added a new section
  indicating services provided by the customers organization.

Closes PAY-3780

Author: StaberindeZA

apps/payments/api/.env

@@ -1,3 +1,7 @@
+# Auth Server
+AUTH_SERVER_EMAIL_CAPABILITY_CONFIG__BASE_URL=http://localhost:9000/v1
+AUTH_SERVER_EMAIL_CAPABILITY_CONFIG__SUBSCRIPTIONS_SECRET=devsecret
+
 # MySQLConfig
 MYSQL_CONFIG__DATABASE=fxa
 MYSQL_CONFIG__HOST=::1
@@ -100,3 +104,7 @@ METERING_CONFIG__CLOUD_TASKS__THRESHOLD__TASK_URL=http://127.0.0.1:3000/v1/meter
 METERING_CONFIG__CLOUD_TASKS__THRESHOLD__QUEUE_NAME=metering-threshold-checks
 METERING_CONFIG__CLOUD_TASKS__THRESHOLD__BUCKET_SIZE_MS=300000
 METERING_CONFIG__CLOUD_TASKS__THRESHOLD__SCHEDULE_DELAY_MS=420000
+
+# Free Access Program Client Config 
+# NB: This needs to match config in payments-next
+FREE_ACCESS_PROGRAM_CLIENT_CONFIG__COLLECTION_NAME=subplat-free-access-program

apps/payments/api/src/app/app.module.ts

@@ -49,6 +49,14 @@ import {
   PaypalCustomerManager,
 } from '@fxa/payments/paypal';
 import { CurrencyManager } from '@fxa/payments/currency';
+import {
+  AuthServerEmailCapabilityClient,
+  FreeAccessProgramManager,
+  FreeAccessProgramNotifierService,
+  FreeAccessProgramReconcilerService,
+  FreeAccessProgramWebhookController,
+  FreeAccessProgramWebhookService,
+} from '@fxa/free-access-program';
 import { AccountDatabaseNestFactory } from '@fxa/shared/db/mysql/account';
 import { AccountManager } from '@fxa/shared/account/account';
 import { CartManager } from '@fxa/payments/cart';
@@ -84,6 +92,7 @@ import { PaymentsMetricsAggregatorService } from '@fxa/payments/metrics-aggregat
     AppController,
     BillingAndSubscriptionsController,
     CmsWebhooksController,
+    FreeAccessProgramWebhookController,
     FxaWebhooksController,
     StripeWebhooksController,
   ],
@@ -106,7 +115,12 @@ import { PaymentsMetricsAggregatorService } from '@fxa/payments/metrics-aggregat
     PaymentsEmitterService,
     PriceManager,
     ProductManager,
+    AuthServerEmailCapabilityClient,
     FirestoreProvider,
+    FreeAccessProgramManager,
+    FreeAccessProgramNotifierService,
+    FreeAccessProgramReconcilerService,
+    FreeAccessProgramWebhookService,
     GoogleIapClient,
     GoogleIapPurchaseManager,
     StatsDProvider,

apps/payments/api/src/config/index.ts

@@ -3,6 +3,10 @@ import { IsDefined, ValidateNested } from 'class-validator';
 
 import { CurrencyConfig } from '@fxa/payments/currency';
 import { MeteringConfig } from '@fxa/entitlements/metering';
+import {
+  AuthServerEmailCapabilityConfig,
+  FreeAccessProgramClientConfig,
+} from '@fxa/free-access-program';
 import { AppleIapClientConfig, GoogleIapClientConfig } from '@fxa/payments/iap';
 import { PaymentsGleanConfig } from '@fxa/payments/metrics';
 import { PaypalClientConfig } from '@fxa/payments/paypal';
@@ -11,7 +15,7 @@ import { StrapiClientConfig } from '@fxa/shared/cms';
 import { MySQLConfig } from '@fxa/shared/db/mysql/core';
 import { FxaWebhookConfig, StripeEventConfig } from '@fxa/payments/webhooks';
 import { StatsDConfig } from '@fxa/shared/metrics/statsd';
-import { FirestoreConfig } from 'libs/shared/db/firestore/src/lib/firestore.config';
+import { FirestoreConfig } from '@fxa/shared/db/firestore';
 import { FxaOAuthConfig } from '@fxa/payments/auth';
 
 export class RootConfig {
@@ -84,4 +88,14 @@ export class RootConfig {
   @ValidateNested()
   @IsDefined()
   public readonly meteringConfig!: Partial<MeteringConfig>;
+
+  @Type(() => FreeAccessProgramClientConfig)
+  @ValidateNested()
+  @IsDefined()
+  public readonly freeAccessProgramClientConfig!: Partial<FreeAccessProgramClientConfig>;
+
+  @Type(() => AuthServerEmailCapabilityConfig)
+  @ValidateNested()
+  @IsDefined()
+  public readonly authServerEmailCapabilityConfig!: Partial<AuthServerEmailCapabilityConfig>;
 }

apps/payments/next/.env

@@ -99,6 +99,10 @@ CHURN_INTERVENTION_CONFIG__ENABLED=
 # Free Trial Config
 FREE_TRIAL_CONFIG__FIRESTORE_COLLECTION_NAME=freeTrials
 
+# Free Access Program Client Config 
+# NB: This needs to match config in payments-api
+FREE_ACCESS_PROGRAM_CLIENT_CONFIG__COLLECTION_NAME=subplat-free-access-program
+
 # StatsD Config
 STATS_D_CONFIG__SAMPLE_RATE=
 STATS_D_CONFIG__MAX_BUFFER_SIZE=

apps/payments/next/app/[locale]/subscriptions/manage/en.ftl

@@ -5,6 +5,8 @@ subscription-management-page-banner-warning-link-no-payment-method = Add a payme
 subscription-management-subscriptions-heading = Subscriptions
 subscription-management-free-trial-heading = Free trials
 subscription-management-your-free-trials-aria = Your free trials
+subscription-management-free-access-heading = Services included with your account
+subscription-management-your-free-access-aria = Services included with your account
 
 # Heading for mobile only quick links menu
 subscription-management-jump-to-heading = Jump to

apps/payments/next/app/[locale]/subscriptions/manage/page.tsx

@@ -14,6 +14,7 @@ import { SubPlatPaymentMethodType } from '@fxa/payments/customer';
 import {
   Banner,
   BannerVariant,
+  FreeAccessContent,
   formatPlanInterval,
   FreeTrialContent,
   getCardIcon,
@@ -76,6 +77,7 @@ export default async function Manage({
     appleIapSubscriptions,
     googleIapSubscriptions,
     trialSubscriptions,
+    freeAccess,
   } = await getSubManPageContentAction(
     { ...resolvedParams },
     { ...resolvedSearchParams },
@@ -268,6 +270,44 @@ export default async function Manage({
         </nav>
       )}
 
+      {freeAccess && freeAccess.length > 0 && (
+        <section
+          id="free-access"
+          className="scroll-mt-16"
+          aria-labelledby="free-access-heading"
+        >
+          <h2
+            id="free-access-heading"
+            className="font-bold px-4 pt-8 pb-4 text-lg tablet:px-6"
+          >
+            {l10n.getString(
+              'subscription-management-free-access-heading',
+              'Services included with your account'
+            )}
+          </h2>
+          <ul
+            aria-label={l10n.getString(
+              'subscription-management-your-free-access-aria',
+              'Services included with your account'
+            )}
+          >
+            {freeAccess.map((grant, index) => (
+              <li
+                key={`${grant.clientId}-${index}`}
+                aria-labelledby={`${grant.clientId}-free-access-information`}
+                className="leading-6 pb-4 last:pb-0"
+              >
+                <div className="w-full py-6 text-grey-600 bg-white rounded-xl border border-grey-200 opacity-100 shadow-[0_0_16px_0_rgba(0,0,0,0.08)] tablet:px-6 tablet:py-8">
+                  <div className="flex flex-col px-4 tablet:px-0 tablet:flex-row tablet:items-start">
+                    <FreeAccessContent freeAccess={grant} />
+                  </div>
+                </div>
+              </li>
+            ))}
+          </ul>
+        </section>
+      )}
+
       {trialSubscriptions.length > 0 && (
         <section
           id="free-trial"

libs/free-access-program/.swcrc

@@ -0,0 +1,14 @@
+{
+  "jsc": {
+    "target": "es2017",
+    "parser": {
+      "syntax": "typescript",
+      "decorators": true,
+      "dynamicImport": true
+    },
+    "transform": {
+      "decoratorMetadata": true,
+      "legacyDecorator": true
+    }
+  }
+}

libs/free-access-program/README.md

@@ -0,0 +1,45 @@
+# free-access-program
+
+Firestore-backed projection of Strapi access records that grant
+free access to RP services. Each document carries a per-(email, entitlement)
+`expiresAt` enforced by a Firestore TTL policy; when a document is removed
+(TTL reap or manual delete), the resulting Eventarc `onDelete` event fans out
+a `subscription:update` notification so consumers re-resolve the user's
+capabilities.
+
+This library owns the read/write data layer only. The Strapi reconciler and
+the Eventarc → SNS notifier are wired up in the consuming service
+(`payments-api`).
+
+## Building
+
+Run `nx build free-access-program` to build the library.
+
+## Running unit tests
+
+Run `nx test-unit free-access-program` to execute the unit tests via
+[Jest](https://jestjs.io).
+
+## Reconcile script
+
+Run `nx run free-access-program:reconcile-all` to invoke a full Strapi →
+Firestore reconciliation pass. Intended to be wired to an external scheduler
+(Cloud Scheduler / Kubernetes CronJob) at the operator's preferred cadence.
+
+Required env vars (same `__` separator and `key_transformer` conventions as
+the payments-api `RootConfig`):
+
+```
+FIRESTORE_CONFIG__PROJECT_ID=...
+FIRESTORE_CONFIG__KEY_FILENAME=...           # or FIRESTORE_CONFIG__CREDENTIALS__*
+STRAPI_CLIENT_CONFIG__GRAPHQL_API_URI=...
+STRAPI_CLIENT_CONFIG__API_KEY=...
+FREE_ACCESS_PROGRAM_CLIENT_CONFIG__COLLECTION_NAME=free-access-program
+STATS_D_CONFIG__HOST=...
+STATS_D_CONFIG__PORT=...
+# Auth-server endpoint the notifier posts revocations to. Auth-server
+# resolves email → uid, invalidates the profile cache, and broadcasts
+# the `subscription:update` event over its existing SNS pipeline.
+AUTH_SERVER_EMAIL_CAPABILITY_CONFIG__BASE_URL=https://api.accounts.firefox.com
+AUTH_SERVER_EMAIL_CAPABILITY_CONFIG__SUBSCRIPTIONS_SECRET=...
+```

libs/free-access-program/jest.config.ts

@@ -0,0 +1,38 @@
+/* eslint-disable */
+import { readFileSync } from 'fs';
+import { Config } from 'jest';
+
+// Reading the SWC compilation config and remove the "exclude"
+// for the test files to be compiled by SWC
+const { exclude: _, ...swcJestConfig } = JSON.parse(
+  readFileSync(`${__dirname}/.swcrc`, 'utf-8')
+);
+
+// disable .swcrc look-up by SWC core because we're passing in swcJestConfig ourselves.
+// If we do not disable this, SWC Core will read .swcrc and won't transform our test files due to "exclude"
+if (swcJestConfig.swcrc === undefined) {
+  swcJestConfig.swcrc = false;
+}
+
+const config: Config = {
+  displayName: 'free-access-program',
+  preset: '../../jest.preset.js',
+  transform: {
+    '^.+\\.[tj]s$': ['@swc/jest', swcJestConfig],
+  },
+  moduleFileExtensions: ['ts', 'js', 'html'],
+  testEnvironment: 'node',
+  coverageDirectory: '../../coverage/libs/free-access-program',
+  reporters: [
+    'default',
+    [
+      'jest-junit',
+      {
+        outputDirectory: 'artifacts/tests/free-access-program',
+        outputName: 'free-access-program-jest-unit-results.xml',
+      },
+    ],
+  ],
+};
+
+export default config;

libs/free-access-program/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "@fxa/free-access-program",
+  "version": "0.0.1"
+}