Jakob WennbergandClaude Opus 4.8
c9d9c5fe99
* fix(billing): block demo/sandbox accounts from Stripe checkout An anonymous demo user on a sandbox company reached POST /api/billing/checkout and created a live Stripe customer. Neither the checkout nor the portal route checked is_anonymous or is_sandbox, and withRouteContext lets anonymous users through (they are authenticated, just anonymously). Guard both routes on both conditions before any Stripe call: refuse anonymous users (identity truth, cheap in-memory check) and sandbox companies (matches the existing lib/sandbox/guard.ts "never charge a token" doctrine). Surface isDemo on GET /api/billing/status so the client hides the upgrade CTA instead of showing a button that 403s. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(billing): redact tenant/customer IDs from incident note (CodeRabbit) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
55 lines
2.0 KiB
TypeScript
55 lines
2.0 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { withRouteContext } from '@/lib/api/with-route-context'
|
|
import { createServiceClient } from '@/lib/supabase/server'
|
|
import { getStripe } from '@/lib/stripe/client'
|
|
import { guardSandbox, sandboxBlockedResponse } from '@/lib/sandbox/guard'
|
|
|
|
/**
|
|
* Create a Stripe Billing Customer Portal session so the user can manage,
|
|
* upgrade/downgrade, or cancel their subscription. Stripe handles all the
|
|
* compliance/PCI surface: we never build those flows ourselves.
|
|
*
|
|
* company_subscriptions is read via the service client on purpose: the row
|
|
* is webhook-owned and not member-readable under RLS; the query still filters
|
|
* by the membership-validated companyId.
|
|
*/
|
|
export const POST = withRouteContext('billing.portal', async (_request, ctx) => {
|
|
const { user, supabase, companyId } = ctx
|
|
|
|
// Demo accounts must never reach Stripe (see billing/checkout for the full
|
|
// rationale). Defense in depth: a demo tenant should never own a portal
|
|
// session even if a stray customer row exists.
|
|
if (user.is_anonymous) return sandboxBlockedResponse()
|
|
const blocked = await guardSandbox(supabase, companyId)
|
|
if (blocked) return blocked
|
|
|
|
const service = createServiceClient()
|
|
const { data: sub } = await service
|
|
.from('company_subscriptions')
|
|
.select('stripe_customer_id')
|
|
.eq('company_id', companyId)
|
|
.maybeSingle()
|
|
|
|
const customerId = (sub as { stripe_customer_id: string | null } | null)?.stripe_customer_id
|
|
if (!customerId) {
|
|
return NextResponse.json(
|
|
{
|
|
error: {
|
|
code: 'NO_SUBSCRIPTION',
|
|
message: 'Det finns inget abonnemang att hantera.',
|
|
message_en: 'No subscription to manage.',
|
|
},
|
|
},
|
|
{ status: 400 },
|
|
)
|
|
}
|
|
|
|
const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? ''
|
|
const portal = await getStripe().billingPortal.sessions.create({
|
|
customer: customerId,
|
|
return_url: `${appUrl}/settings/billing`,
|
|
})
|
|
|
|
return NextResponse.json({ url: portal.url })
|
|
})
|