feat(api): inherit manager pricing for managed profiles

Author: gianfra-t

apps/api/src/api/controllers/quote.controller.ts

@@ -50,6 +50,7 @@ export const createQuote = async (
     const quote = await quoteService.createQuote({
       apiCredentialId: req.credential?.credentialId,
       apiKey: publicApiKey,
+      controllingManagerProfileId: req.managedProfileContext?.controllingManagerProfileId,
       from,
       inputAmount,
       inputCurrency,
@@ -112,6 +113,7 @@ export const createBestQuote = async (
     const quote = await quoteService.createBestQuote({
       apiCredentialId: req.credential?.credentialId,
       apiKey: publicApiKey,
+      controllingManagerProfileId: req.managedProfileContext?.controllingManagerProfileId,
       countryCode,
       from,
       inputAmount,

apps/api/src/api/services/quote/core/partner-resolution.test.ts

@@ -107,6 +107,79 @@ describe("resolveQuotePartner", () => {
     expect(result.ownerPartnerId).toBeNull();
   });
 
+  it("uses the child assignment before the controlling manager assignment", async () => {
+    const assignmentLookups: string[] = [];
+    ProfilePartnerAssignment.findOne = mock(async ({ where }: { where: { userId: string } }) => {
+      assignmentLookups.push(where.userId);
+      return where.userId === "child-1" ? { partnerId: "child-partner-id" } : { partnerId: "manager-partner-id" };
+    }) as unknown as typeof ProfilePartnerAssignment.findOne;
+    Partner.findOne = mock(async ({ where }: { where: { id?: string } }) =>
+      where.id === "child-partner-id" ? stubPartner("child-partner-id", "ChildPartner") : null
+    ) as typeof Partner.findOne;
+    PartnerPricingConfig.findOne = mock(async ({ where }: { where: { partnerId?: string; rampType?: RampDirection } }) =>
+      where.partnerId === "child-partner-id" && where.rampType === RampDirection.BUY
+        ? stubConfig("child-partner-id", RampDirection.BUY)
+        : null
+    ) as typeof PartnerPricingConfig.findOne;
+
+    const result = await resolveQuotePartner({
+      ...baseRequest,
+      controllingManagerProfileId: "manager-1",
+      userId: "child-1"
+    });
+
+    expect(result.source).toBe("profileAssignment");
+    expect(result.pricingPartnerId).toBe("child-partner-id");
+    expect(result.ownerPartnerId).toBeNull();
+    expect(assignmentLookups).toEqual(["child-1"]);
+  });
+
+  it("uses the controlling manager assignment when the child has no assignment", async () => {
+    const assignmentLookups: string[] = [];
+    ProfilePartnerAssignment.findOne = mock(async ({ where }: { where: { userId: string } }) => {
+      assignmentLookups.push(where.userId);
+      return where.userId === "manager-1" ? { partnerId: "manager-partner-id" } : null;
+    }) as unknown as typeof ProfilePartnerAssignment.findOne;
+    Partner.findOne = mock(async ({ where }: { where: { id?: string } }) =>
+      where.id === "manager-partner-id" ? stubPartner("manager-partner-id", "ManagerPartner") : null
+    ) as typeof Partner.findOne;
+    PartnerPricingConfig.findOne = mock(async ({ where }: { where: { partnerId?: string; rampType?: RampDirection } }) =>
+      where.partnerId === "manager-partner-id" && where.rampType === RampDirection.BUY
+        ? stubConfig("manager-partner-id", RampDirection.BUY)
+        : null
+    ) as typeof PartnerPricingConfig.findOne;
+
+    const result = await resolveQuotePartner({
+      ...baseRequest,
+      controllingManagerProfileId: "manager-1",
+      userId: "child-1"
+    });
+
+    expect(result.source).toBe("managerProfileAssignment");
+    expect(result.pricingPartnerId).toBe("manager-partner-id");
+    expect(result.ownerPartnerId).toBeNull();
+    expect(assignmentLookups).toEqual(["child-1", "manager-1"]);
+  });
+
+  it("does not expose manager pricing when an active child assignment is invalid", async () => {
+    const assignmentLookups: string[] = [];
+    ProfilePartnerAssignment.findOne = mock(async ({ where }: { where: { userId: string } }) => {
+      assignmentLookups.push(where.userId);
+      return where.userId === "child-1" ? { partnerId: null } : { partnerId: "manager-partner-id" };
+    }) as unknown as typeof ProfilePartnerAssignment.findOne;
+
+    const result = await resolveQuotePartner({
+      ...baseRequest,
+      controllingManagerProfileId: "manager-1",
+      userId: "child-1"
+    });
+
+    expect(result.source).toBe("none");
+    expect(result.pricingPartnerId).toBeNull();
+    expect(result.ownerPartnerId).toBeNull();
+    expect(assignmentLookups).toEqual(["child-1"]);
+  });
+
   it("resolves the sell-direction pricing config for sell users", async () => {
     ProfilePartnerAssignment.findOne = mock(async () => ({
       partnerId: "assigned-id"

apps/api/src/api/services/quote/core/partner-resolution.ts

@@ -7,6 +7,7 @@ import { getTargetFiatCurrency } from "../../phases/blocks/core/helpers";
 import type { PartnerPricingSource } from "./types";
 
 type QuotePartnerResolutionRequest = CreateQuoteRequest & {
+  controllingManagerProfileId?: string;
   userId?: string;
 };
 
@@ -52,7 +53,7 @@ async function findPartnerByIdForRamp(
   return partner;
 }
 
-async function findAssignedPartnerId(userId: string, now: Date): Promise<string | null> {
+async function findAssignment(userId: string, now: Date): Promise<{ partnerId: string | null } | null> {
   const assignment = await ProfilePartnerAssignment.findOne({
     order: [["createdAt", "DESC"]],
     where: {
@@ -62,7 +63,7 @@ async function findAssignedPartnerId(userId: string, now: Date): Promise<string
     }
   });
 
-  return assignment?.partnerId ?? null;
+  return assignment ? { partnerId: assignment.partnerId } : null;
 }
 
 export async function resolveQuotePartner(
@@ -82,14 +83,31 @@ export async function resolveQuotePartner(
   }
 
   if (request.userId) {
-    const assignedPartnerId = await findAssignedPartnerId(request.userId, now);
-    if (assignedPartnerId) {
-      const partner = await findPartnerByIdForRamp(assignedPartnerId, request.rampType, fiatCurrency);
+    const assignment = await findAssignment(request.userId, now);
+    if (assignment) {
+      const partner = assignment.partnerId
+        ? await findPartnerByIdForRamp(assignment.partnerId, request.rampType, fiatCurrency)
+        : null;
       return {
         ownerPartnerId: null,
         partner,
         pricingPartnerId: partner?.id ?? null,
-        source: "profileAssignment"
+        source: partner ? "profileAssignment" : "none"
+      };
+    }
+  }
+
+  if (request.controllingManagerProfileId) {
+    const assignment = await findAssignment(request.controllingManagerProfileId, now);
+    if (assignment) {
+      const partner = assignment.partnerId
+        ? await findPartnerByIdForRamp(assignment.partnerId, request.rampType, fiatCurrency)
+        : null;
+      return {
+        ownerPartnerId: null,
+        partner,
+        pricingPartnerId: partner?.id ?? null,
+        source: partner ? "managerProfileAssignment" : "none"
       };
     }
   }

apps/api/src/api/services/quote/core/quote-context.ts

@@ -11,7 +11,11 @@ import { CreateQuoteRequest, RampCurrency, RampDirection } from "@vortexfi/share
 import type { QuoteContext as IQuoteContext, PartnerInfo, PartnerPricingSource } from "./types";
 
 export function createQuoteContext(args: {
-  request: CreateQuoteRequest & { apiCredentialId?: string; userId?: string };
+  request: CreateQuoteRequest & {
+    apiCredentialId?: string;
+    controllingManagerProfileId?: string;
+    userId?: string;
+  };
   targetFeeFiatCurrency: RampCurrency;
   partner: PartnerInfo | null;
   partnerOwnerId?: string | null;

apps/api/src/api/services/quote/core/types.ts

@@ -46,13 +46,17 @@ export interface PartnerInfo {
   payoutAddressEvm?: string | null;
 }
 
-export type PartnerPricingSource = "request" | "profileAssignment" | "none";
+export type PartnerPricingSource = "request" | "profileAssignment" | "managerProfileAssignment" | "none";
 
 // Quote context flows through all stages. Defined in quote-context.ts.
 // Re-export here for convenience to avoid deep imports.
 export interface QuoteContext {
   // immutable request details
-  readonly request: CreateQuoteRequest & { apiCredentialId?: string; userId?: string };
+  readonly request: CreateQuoteRequest & {
+    apiCredentialId?: string;
+    controllingManagerProfileId?: string;
+    userId?: string;
+  };
   readonly now: Date;
 
   // Partner info (if any)

apps/api/src/api/services/quote/index.ts

@@ -45,6 +45,7 @@ export class QuoteService extends BaseRampService {
     request: CreateQuoteRequest & {
       apiCredentialId?: string;
       apiKey?: string | null;
+      controllingManagerProfileId?: string;
       userId?: string;
     }
   ): Promise<QuoteResponse> {
@@ -74,6 +75,7 @@ export class QuoteService extends BaseRampService {
     request: CreateBestQuoteRequest & {
       apiCredentialId?: string;
       apiKey?: string | null;
+      controllingManagerProfileId?: string;
       userId?: string;
     }
   ): Promise<QuoteResponse> {
@@ -179,6 +181,7 @@ export class QuoteService extends BaseRampService {
     request: CreateQuoteRequest & {
       apiCredentialId?: string;
       apiKey?: string | null;
+      controllingManagerProfileId?: string;
       userId?: string;
     },
     skipPersistence = false

apps/api/src/tests/managed-profile-quote-ramp-lifecycle.integration.test.ts

@@ -86,6 +86,20 @@ describe("managed-profile quote and registered-ramp lifecycle", () => {
       payoutAddressEvm: DESTINATION,
       rampType: RampDirection.BUY
     });
+    const managerPricingPartner = await createTestPartner({
+      fiatCurrency: FiatToken.BRL,
+      markupCurrency: FiatToken.BRL,
+      markupType: "absolute",
+      markupValue: 2,
+      payoutAddressEvm: DESTINATION,
+      rampType: RampDirection.BUY
+    });
+    await ProfilePartnerAssignment.create({
+      isActive: true,
+      partnerId: managerPricingPartner.id,
+      partnerName: managerPricingPartner.name,
+      userId: manager.id
+    });
     await ProfilePartnerAssignment.create({
       isActive: true,
       partnerId: pricingPartner.id,
@@ -180,6 +194,17 @@ describe("managed-profile quote and registered-ramp lifecycle", () => {
     expect(Number(directQuoteResponse.partnerFeeFiat)).toBe(5);
     expect(Number(directQuoteResponse.outputAmount)).toBe(99.9);
 
+    const delegatedSiblingQuoteResponse = await createQuote({
+      ...managerHeaders,
+      "X-Managed-Profile-Id": siblingId
+    });
+    const delegatedSiblingQuote = await QuoteTicket.findByPk(delegatedSiblingQuoteResponse.id as string);
+    expect(delegatedSiblingQuote?.userId).toBe(siblingId);
+    expect(delegatedSiblingQuote?.partnerId).toBeNull();
+    expect(delegatedSiblingQuote?.pricingPartnerId).toBe(managerPricingPartner.id);
+    expect(delegatedSiblingQuote?.apiCredentialId).toBe(managerCredential.record.id);
+    expect(Number(delegatedSiblingQuoteResponse.partnerFeeFiat)).toBe(2);
+
     const pendingQuoteResponse = await createQuote({
       "Content-Type": "application/json",
       "X-API-Key": childCredential.secretKey
@@ -214,6 +239,12 @@ describe("managed-profile quote and registered-ramp lifecycle", () => {
       "X-API-Key": siblingCredential.secretKey
     });
     const siblingQuoteId = siblingQuoteResponse.id as string;
+    const siblingQuote = await QuoteTicket.findByPk(siblingQuoteId);
+    expect(siblingQuote?.userId).toBe(siblingId);
+    expect(siblingQuote?.partnerId).toBeNull();
+    expect(siblingQuote?.pricingPartnerId).toBe(managerPricingPartner.id);
+    expect(siblingQuote?.apiCredentialId).toBe(siblingCredential.id);
+    expect(Number(siblingQuoteResponse.partnerFeeFiat)).toBe(2);
     const siblingRegistration = await jsonRequest("/v1/ramp/register", {
       body: JSON.stringify({
         additionalData: { destinationAddress: DESTINATION, taxId: "12345678902" },

docs/adr-0003-managed-headless-profiles.md

@@ -27,7 +27,9 @@ than introduce a parallel tenant or impersonation model.
   non-empty subset. It never expands the canonical matrix.
 - Provisioning creates an `individual` or `business` child, active entity, immutable
   external subject ID, normalized provider contact email, and relationship atomically.
-  Pricing is resolved from the child and remains independent of management.
+  A managed child defaults to its controlling manager profile's pricing assignment. The
+  child may have its own profile pricing assignment, administered like any regular
+  profile assignment, which takes precedence over the manager assignment.
 - Deletion is logical and idempotent. It revokes child credentials and blocks new child
   activity while retaining provider, compliance, quote, ramp, callback, and attribution
   records needed for in-flight processing and reconciliation.

docs/api/pages/03-authentication-and-partner-keys.md

@@ -37,7 +37,7 @@ X-API-Key: sk_live_...
 X-Managed-Profile-Id: 00000000-0000-0000-0000-000000000002
 ```
 
-A Supabase Bearer session may replace the secret key. A public `pk_*` value cannot authenticate delegation. Vortex verifies the active manager, direct active child relationship, child's single active customer entity, allowed country, optional customer-type narrowing, and canonical country/type support for corridor-bound mutations. An omitted or null customer-type policy adds no restriction beyond the canonical corridor capability matrix; a configured non-empty list only narrows that matrix. The manager remains the authenticated actor; ownership, KYC/provider lookup, quote pricing, and ramp history resolve from the child subject.
+A Supabase Bearer session may replace the secret key. A public `pk_*` value cannot authenticate delegation. Vortex verifies the active manager, direct active child relationship, child's single active customer entity, allowed country, optional customer-type narrowing, and canonical country/type support for corridor-bound mutations. An omitted or null customer-type policy adds no restriction beyond the canonical corridor capability matrix; a configured non-empty list only narrows that matrix. The manager remains the authenticated actor; ownership, KYC/provider lookup, and ramp history resolve from the child subject. Quote pricing uses the child's active profile assignment when present, otherwise the controlling manager profile's active assignment, then default Vortex pricing. This precedence is identical for manager-delegated requests and direct child credentials.
 
 The header is supported for quote creation; ramp registration, update, start, status, history, and errors; exact limits and sanitized ramp info; aggregate onboarding status; BR customer/KYC operations; and customer creation, KYC/KYB, and fiat-account operations on the AR, CO, MX, and US corridors. Corridor removal blocks mutations and disallowed exact-limit requests but not quote discovery or historical/status reads. The EUR corridor's flows are bound to a verified login email, so they and all recipient-invitation routes do not support managed children.
 

docs/api/pages/06-quotes-and-pricing.md

@@ -112,4 +112,6 @@ Quotes are immutable and short-lived. If the user takes too long to confirm, or
 
 Pass the credential's public value through `X-Public-Key` to apply partner pricing and attribution. The SDK also retains it in the quote body for compatibility. When `X-Public-Key` and `X-API-Key` are both present, they must belong to the same credential or Vortex returns `403 CREDENTIAL_MISMATCH`. See [Authentication And API Credentials](https://api-docs.vortexfinance.co/authentication-and-partner-keys).
 
+Managed profiles default to the controlling manager profile's pricing assignment. Assigning pricing directly to a managed child overrides the manager's pricing just as a profile assignment does for any regular profile. The same precedence applies whether the manager delegates with `X-Managed-Profile-Id` or the child authenticates with its own credential: child assignment, manager assignment, then default Vortex pricing.
+
 ---