Fix remaining tests

Author: StaberindeZA

packages/fxa-auth-server/lib/oauth/grant.js

@@ -31,6 +31,7 @@ const JWT_ACCESS_TOKENS_ENABLED = config.get(
 const JWT_ACCESS_TOKENS_CLIENT_IDS = new Set(
   config.get('oauthServer.jwtAccessTokens.enabledClientIds')
 );
+const SUBSCRIPTIONS_ENABLED = !!config.get('subscriptions.enabled');
 
 const UNTRUSTED_CLIENT_ALLOWED_SCOPES = ScopeSet.fromArray([
   'openid',
@@ -264,7 +265,14 @@ exports.generateAccessToken = async function generateAccessToken(grant) {
     return accessToken;
   }
 
-  if (grant.scope.contains('profile:subscriptions')) {
+  // Skip when subscriptions are disabled. Mirrors the gate
+  // `lib/routes/account.ts` already applies before calling
+  // `capabilityService.subscriptionCapabilities` / `hasFreeAccess` —
+  // without it, this path drives a chain that ends in
+  // `planIdsToClientCapabilities` throwing (errno 998) because no
+  // `CapabilityManager` is registered in Container when subscriptions
+  // are off.
+  if (SUBSCRIPTIONS_ENABLED && grant.scope.contains('profile:subscriptions')) {
     const capabilities =
       await capabilityService.determineClientVisibleSubscriptionCapabilities(
         clientId,

packages/fxa-auth-server/lib/oauth/grant.spec.ts

@@ -2,9 +2,10 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-// `grant.js` captures `JWT_ACCESS_TOKENS_ENABLED` and the allow-list at
-// module load, so the config is fixed once here. validateRequestedGrant
-// tests don't depend on those values; generateTokens tests do.
+// `grant.js` captures `JWT_ACCESS_TOKENS_ENABLED`, the allow-list, and
+// `SUBSCRIPTIONS_ENABLED` at module load, so the config is fixed once
+// here. validateRequestedGrant tests don't depend on those values;
+// generateTokens tests do.
 jest.mock('../../config', () => {
   const realConfig = jest.requireActual('../../config').config;
   return {
@@ -15,6 +16,8 @@ jest.mock('../../config', () => {
             return true;
           case 'oauthServer.jwtAccessTokens.enabledClientIds':
             return ['9876543210'];
+          case 'subscriptions.enabled':
+            return true;
           default:
             return realConfig.get(key);
         }

packages/fxa-auth-server/lib/payments/capability.spec.ts

@@ -905,14 +905,14 @@ describe('CapabilityService', () => {
 
   describe('subscriptionCapabilities — email-list merge', () => {
     beforeEach(() => {
-      // No subscriptions so we isolate the email-list contribution.
-      mockStripeHelper.fetchCustomer = jest.fn(async () => ({
-        subscriptions: { data: [] },
-      }));
-      mockStripeHelper.iapPurchasesToPriceIds = jest.fn().mockReturnValue([]);
-      mockPlayBilling.userManager.queryCurrentSubscriptions = jest
-        .fn()
-        .mockResolvedValue([]);
+      // Stub the price-ID lookup so it returns a single placeholder price.
+      // The merge tests rely on the `priceIdsToClientCapabilities` mock
+      // returning subscription caps; `planIdsToClientCapabilities`
+      // short-circuits on an empty input, so we need a non-empty array
+      // here for the CapabilityManager path to be exercised at all.
+      jest
+        .spyOn(CapabilityService.prototype, 'subscribedPriceIds')
+        .mockResolvedValue(['price_test']);
       mockCapabilityManager.priceIdsToClientCapabilities = jest
         .fn()
         .mockResolvedValue({});

packages/fxa-auth-server/lib/payments/capability.ts

@@ -799,6 +799,14 @@ export class CapabilityService {
   async planIdsToClientCapabilities(
     subscribedPrices: string[]
   ): Promise<ClientIdCapabilityMap> {
+    // No prices to resolve → no capabilities. Short-circuit before the
+    // CapabilityManager guard so callers that pass through with an empty
+    // list (e.g. `/v1/oauth/token` for an account with no Stripe subs)
+    // don't hit a 500 just because CMS isn't wired in this environment.
+    if (subscribedPrices.length === 0) {
+      return {};
+    }
+
     if (!this.capabilityManager) {
       throw error.internalValidationError(
         'planIdsToClientCapabilities',