MattssonandClaude Fable 5.1
9879fb53e9
Checkout success/cancel URLs and the customer-portal return URL were built from NEXT_PUBLIC_APP_URL, so a user on a white-label host came back to the canonical app, where they hold no session, and saw a foreign-branded login. Both routes now resolve the request host through resolveRequestAppOrigin: a registered white-label host stays on its brand, anything else falls back to the canonical app. Return paths stay fixed literals. Claude-Session: https://claude.ai/code/session_01DAGcgQDEAGmhGNSeMbgsn2 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
59 lines
2.2 KiB
TypeScript
59 lines
2.2 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { withRouteContext } from '@/lib/api/with-route-context'
|
|
import { createServiceClient } from '@/lib/supabase/server'
|
|
import { getStripe } from '@/lib/stripe/client'
|
|
import { guardSandbox, sandboxBlockedResponse } from '@/lib/sandbox/guard'
|
|
import { resolveRequestAppOrigin } from '@/lib/domains/trusted-app-origin'
|
|
|
|
/**
|
|
* Create a Stripe Billing Customer Portal session so the user can manage,
|
|
* upgrade/downgrade, or cancel their subscription. Stripe handles all the
|
|
* compliance/PCI surface: we never build those flows ourselves.
|
|
*
|
|
* company_subscriptions is read via the service client on purpose: the row
|
|
* is webhook-owned and not member-readable under RLS; the query still filters
|
|
* by the membership-validated companyId.
|
|
*/
|
|
export const POST = withRouteContext('billing.portal', async (request, ctx) => {
|
|
const { user, supabase, companyId } = ctx
|
|
|
|
// Demo accounts must never reach Stripe (see billing/checkout for the full
|
|
// rationale). Defense in depth: a demo tenant should never own a portal
|
|
// session even if a stray customer row exists.
|
|
if (user.is_anonymous) return sandboxBlockedResponse()
|
|
const blocked = await guardSandbox(supabase, companyId)
|
|
if (blocked) return blocked
|
|
|
|
const service = createServiceClient()
|
|
const { data: sub } = await service
|
|
.from('company_subscriptions')
|
|
.select('stripe_customer_id')
|
|
.eq('company_id', companyId)
|
|
.maybeSingle()
|
|
|
|
const customerId = (sub as { stripe_customer_id: string | null } | null)?.stripe_customer_id
|
|
if (!customerId) {
|
|
return NextResponse.json(
|
|
{
|
|
error: {
|
|
code: 'NO_SUBSCRIPTION',
|
|
message: 'Det finns inget abonnemang att hantera.',
|
|
message_en: 'No subscription to manage.',
|
|
},
|
|
},
|
|
{ status: 400 },
|
|
)
|
|
}
|
|
|
|
// Same host the user started on (see billing/checkout): a registered
|
|
// white-label host stays on its brand, anything else returns to the
|
|
// canonical app. The path is fixed.
|
|
const appOrigin = resolveRequestAppOrigin(request)
|
|
const portal = await getStripe().billingPortal.sessions.create({
|
|
customer: customerId,
|
|
return_url: `${appOrigin}/settings/billing`,
|
|
})
|
|
|
|
return NextResponse.json({ url: portal.url })
|
|
})
|