Item 0 — founder count = REAL active Stripe subscriptions (kills the phantom 1)

The counter showed 1/100 from user_profiles (founder_pricing=true AND
subscription_status='active'), but the live Stripe account has ZERO
subscriptions of any status — the "1" is a comped/manually-tiered profile, not a
paying founder. A tier/founder_pricing field on a profile can be set without
ever paying, so it is not proof of a paid seat.

Now the count is Stripe's OWN truth: stripeService.countFounderSeats() counts
ACTIVE subscriptions on a founder price. The route reads that (cached 5 min);
null or any failure → hidden, never a number. A comped profile no longer counts
→ the honest number is 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/routes/founders.js

@@ -1,20 +1,21 @@
 /**
  * GET /api/founders/count — the REAL founder-seat counter.
  *
- * TRUTH LAW (Truth-Everywhere Part 2, item 2): the ClaimMeter used to render a
- * hardcoded "47 / 100 CLAIMED". This counts ONLY real paying founders — the
- * Stripe-synced subscription records in Supabase (`user_profiles` where
- * founder_pricing = true AND subscription_status = 'active'). Counting the
- * webhook-synced mirror, not the Stripe API, is the cache — we never hammer
- * Stripe. Cached 5 min in Redis on top of that.
+ * TRUTH LAW: the ClaimMeter used to render a hardcoded "47 / 100 CLAIMED", then
+ * a DB-profile count that showed a phantom "1" (a comped/manually-tiered account
+ * with founder_pricing=true but no real payment). Security follow-up item 0: the
+ * count is now Stripe's OWN truth — the number of ACTIVE subscriptions on a
+ * founder price (`stripeService.countFounderSeats`), verified against
+ * subscription status, never a tier/founder_pricing field a profile can set
+ * without paying. Cached 5 min in Redis so we never hammer the API.
  *
- * If the source is unavailable (Supabase unconfigured, query error, column not
- * migrated), we return { available: false } and the UI HIDES the counter — we
- * never fall back to a number. A low real count is fine; the truth is the feature.
+ * If Stripe / the founder prices aren't configured, or any call fails, we return
+ * { available: false } and the UI HIDES the counter — never a fabricated number.
+ * A count of 0 is shown honestly; the truth is the feature.
  */
 
 const express = require('express');
-const { getSupabaseServiceClient } = require('../utils/supabase');
+const stripeService = require('../services/stripeService');
 const { cacheGet, cacheSet } = require('../utils/redis');
 
 const router = express.Router();
@@ -23,18 +24,18 @@ const TOTAL = Number(process.env.FOUNDER_SEATS_TOTAL || 100);
 const CACHE_KEY = 'founders:count';
 const CACHE_TTL = 300; // 5 min — the founder count moves slowly
 
-// Injectable for tests (never hits network in the unit suite).
-let _getClient = getSupabaseServiceClient;
+// Injectable for tests (never hits the network in the unit suite).
+let _countSeats = stripeService.countFounderSeats;
 let _cacheGet = cacheGet;
 let _cacheSet = cacheSet;
-function __setDeps({ getClient, cacheGet: cg, cacheSet: cs } = {}) {
-  _getClient = getClient || getSupabaseServiceClient;
+function __setDeps({ countSeats, cacheGet: cg, cacheSet: cs } = {}) {
+  _countSeats = countSeats || stripeService.countFounderSeats;
   _cacheGet = cg || cacheGet;
   _cacheSet = cs || cacheSet;
 }
 
 router.get('/count', async (req, res) => {
-  // Cache first — don't recount on every landing hit.
+  // Cache first — don't recount (a Stripe API call) on every landing hit.
   try {
     const cached = await _cacheGet(CACHE_KEY);
     if (cached && typeof cached.claimed === 'number') {
@@ -42,22 +43,11 @@ router.get('/count', async (req, res) => {
     }
   } catch { /* cache miss/degraded — fall through to a live count */ }
 
-  let supabase;
   try {
-    supabase = _getClient();
-  } catch {
-    return res.json({ available: false }); // unconfigured → hide, never a number
-  }
-  if (!supabase) return res.json({ available: false });
-
-  try {
-    const { count, error } = await supabase
-      .from('user_profiles')
-      .select('id', { count: 'exact', head: true })
-      .eq('founder_pricing', true)
-      .eq('subscription_status', 'active');
-    if (error) return res.json({ available: false }); // column missing / query error → hide
-    const claimed = Math.max(0, Number(count) || 0);
+    const count = await _countSeats();
+    // null = Stripe / founder prices unconfigured → hide, never a number.
+    if (count == null || !Number.isFinite(Number(count))) return res.json({ available: false });
+    const claimed = Math.max(0, Number(count));
     try { await _cacheSet(CACHE_KEY, { claimed }, CACHE_TTL); } catch { /* best-effort */ }
     return res.json({ available: true, claimed, total: TOTAL });
   } catch {

src/services/stripeService.js

@@ -284,6 +284,28 @@ function constructWebhookEvent(body, signature) {
   return getStripe().webhooks.constructEvent(body, signature, process.env.STRIPE_WEBHOOK_SECRET);
 }
 
+// Security follow-up item 0 — the REAL founder-seat count is the number of
+// ACTIVE Stripe subscriptions on a founder price. It counts Stripe's OWN truth
+// (subscription status on the live account), NOT a tier/founder_pricing field on
+// a DB profile — a comped or manually-tiered account can set those without ever
+// paying, which is exactly the phantom "1" the ClaimMeter was showing. Returns
+// null when Stripe or the founder prices aren't configured → the counter hides.
+async function countFounderSeats() {
+  const founderPrices = [PRICE_MAP.analyst_founder, PRICE_MAP.desk_founder].filter(Boolean);
+  if (!process.env.STRIPE_SECRET_KEY || founderPrices.length === 0) return null;
+  const stripe = getStripe();
+  let count = 0;
+  for (const price of founderPrices) {
+    // Only 'active' (paid + current) subscriptions are a claimed paid seat —
+    // trialing / past_due / canceled are not. Auto-pages the full list.
+    // eslint-disable-next-line no-await-in-loop
+    for await (const _sub of stripe.subscriptions.list({ price, status: 'active', limit: 100 })) {
+      count += 1;
+    }
+  }
+  return count;
+}
+
 module.exports = {
   createCheckoutSession,
   handleWebhookEvent,
@@ -292,6 +314,7 @@ module.exports = {
   constructWebhookEvent,
   isFounderCodeValid,
   getPriceId,
+  countFounderSeats,
   // Session 14 — exposed so the route layer + tests can recognize
   // the "tier valid but Stripe price not provisioned" state.
   PRICE_UNCONFIGURED,