Changes for hiding markup / challenge fee from copilots

Author: jmgasper

src/api/project/project.controller.ts

@@ -273,7 +273,7 @@ export class ProjectController {
    * @throws UnauthorizedException When the caller is unauthenticated.
    * @throws ForbiddenException When the caller lacks required permissions.
    * @throws NotFoundException When project or billing account is missing.
-   * @security The service strips `markup` for non-machine callers before
+   * @security The service strips `markup` for copilot-only callers before
    * returning the response payload.
    */
   @Get(':projectId/billingAccount')

src/api/project/project.service.spec.ts

@@ -604,7 +604,7 @@ describe('ProjectService', () => {
     ).toHaveBeenCalledWith('1001', '123');
   });
 
-  it('returns project billing account and strips markup for user tokens', async () => {
+  it('returns project billing account and strips markup for copilot-only user tokens', async () => {
     prismaMock.project.findFirst.mockResolvedValue({
       id: BigInt(1001),
       billingAccountId: BigInt(12),
@@ -617,6 +617,7 @@ describe('ProjectService', () => {
 
     const result = await service.getProjectBillingAccount('1001', {
       userId: '123',
+      roles: [UserRole.TC_COPILOT],
       isMachine: false,
     });
 
@@ -629,6 +630,30 @@ describe('ProjectService', () => {
     ).toHaveBeenCalledWith('12');
   });
 
+  it('returns project billing account markup for Project Manager tokens', async () => {
+    prismaMock.project.findFirst.mockResolvedValue({
+      id: BigInt(1001),
+      billingAccountId: BigInt(12),
+    });
+    billingAccountServiceMock.getDefaultBillingAccount.mockResolvedValue({
+      tcBillingAccountId: '12',
+      markup: 50,
+      active: true,
+    });
+
+    const result = await service.getProjectBillingAccount('1001', {
+      userId: '123',
+      roles: [UserRole.PROJECT_MANAGER],
+      isMachine: false,
+    });
+
+    expect(result).toEqual({
+      tcBillingAccountId: '12',
+      markup: 50,
+      active: true,
+    });
+  });
+
   it('returns project billing account markup for m2m tokens', async () => {
     prismaMock.project.findFirst.mockResolvedValue({
       id: BigInt(1001),

src/api/project/project.service.ts

@@ -49,6 +49,24 @@ import { ProjectWithRelationsDto } from './dto/project-response.dto';
 import { UpgradeProjectDto } from './dto/upgrade-project.dto';
 import { UpdateProjectDto } from './dto/update-project.dto';
 
+const BILLING_MARKUP_COPILOT_ROLES = [
+  UserRole.COPILOT,
+  UserRole.TC_COPILOT,
+];
+
+const BILLING_MARKUP_VISIBLE_HUMAN_ROLES = [
+  ...ADMIN_ROLES,
+  UserRole.MANAGER,
+  UserRole.TOPCODER_MANAGER,
+  UserRole.TOPCODER_ACCOUNT_MANAGER,
+  UserRole.COPILOT_MANAGER,
+  UserRole.PROJECT_MANAGER,
+  UserRole.TASK_MANAGER,
+  UserRole.TOPCODER_TASK_MANAGER,
+  UserRole.TALENT_MANAGER,
+  UserRole.TOPCODER_TALENT_MANAGER,
+];
+
 interface PaginatedProjectResponse {
   data: ProjectWithRelationsDto[];
   page: number;
@@ -1038,8 +1056,9 @@ export class ProjectService {
    * @param user Authenticated caller context.
    * @returns Default billing account details.
    * @throws NotFoundException When project or billing account is missing.
-   * @security Removes `markup` for non-machine callers to avoid exposing
-   * markup details to interactive users.
+   * @security Removes `markup` for copilot-only callers while preserving the
+   * existing response shape for M2M, Project Manager, Talent Manager, and
+   * administrator callers.
    */
   async getProjectBillingAccount(
     projectId: string,
@@ -1083,7 +1102,7 @@ export class ProjectService {
           tcBillingAccountId: projectBillingAccountId,
         };
 
-    if (this.isMachinePrincipal(user)) {
+    if (!this.shouldHideBillingAccountMarkupForCopilot(user)) {
       return billingAccount;
     }
 
@@ -2175,6 +2194,37 @@ export class ProjectService {
     return false;
   }
 
+  /**
+   * Determines whether project billing-account markup must be hidden.
+   *
+   * Copilot-only human callers should not receive raw billing-account markup.
+   * Manager, Talent Manager, and administrator roles retain the existing
+   * response shape even when the same token also carries a copilot role.
+   *
+   * @param user Authenticated caller context.
+   * @returns `true` when billing-account markup should be removed.
+   */
+  private shouldHideBillingAccountMarkupForCopilot(user: JwtUser): boolean {
+    if (this.isMachinePrincipal(user)) {
+      return false;
+    }
+
+    const roles = user.roles || [];
+    const hasCopilotRole = this.permissionService.hasIntersection(
+      roles,
+      BILLING_MARKUP_COPILOT_ROLES,
+    );
+
+    if (!hasCopilotRole) {
+      return false;
+    }
+
+    return !this.permissionService.hasIntersection(
+      roles,
+      BILLING_MARKUP_VISIBLE_HUMAN_ROLES,
+    );
+  }
+
   /**
    * Safely extracts template phase objects from JSON payload.
    *