builtbykev
889e8621b4
The billing portal is fully configured in Stripe (cancellations, plan switching, invoice history) and the Express endpoint (POST /api/stripe/portal) existed, but nothing in the UI linked to it. Added the Next proxy (app/api/stripe/portal) and a "Manage billing →" button in the profile billing section (paid tiers) that mints a portal session and redirects. Kev still activates the hosted portal in the Stripe dashboard; this is the app-side link. Dunning verification (item 6): cancel-on-exhaustion is correctly wired — Smart Retries exhausting cancels the subscription → customer.subscription.deleted → webhook sets a 48h grace → middleware/gracePeriod.checkGracePeriod downgrades tier to free in both users + user_profiles after the grace expires. See the report for one nuance (the 48h grace on the FIRST payment_failed is shorter than Stripe's 2-week retry window — self-correcting via subscription.updated, but worth a product decision). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
36 lines
1.4 KiB
TypeScript
36 lines
1.4 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server';
|
|
import { jsonError } from '@/lib/auth-helpers';
|
|
|
|
export const dynamic = 'force-dynamic';
|
|
|
|
const BACKEND_URL = process.env.BACKEND_URL || 'http://localhost:3000';
|
|
|
|
/**
|
|
* Stripe billing-portal proxy (security follow-up item 6) — Next → Express →
|
|
* Stripe. Forwards the browser's bearer token (Express's requireAuth verifies
|
|
* the same one) and returns the hosted portal URL. The portal is fully
|
|
* configured in Stripe (cancellations, plan switching, invoice history); this
|
|
* is the app-side link from account settings.
|
|
*/
|
|
export async function POST(req: NextRequest) {
|
|
const authHeader = req.headers.get('authorization');
|
|
if (!authHeader) return jsonError(401, 'Log in to manage billing.');
|
|
|
|
try {
|
|
const upstream = await fetch(`${BACKEND_URL}/api/stripe/portal`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json', Authorization: authHeader },
|
|
});
|
|
const data = (await upstream.json().catch(() => ({}))) as { portal_url?: string; error?: string };
|
|
if (!upstream.ok || !data.portal_url) {
|
|
return NextResponse.json(
|
|
{ error: data.error || 'Billing portal is unavailable right now.' },
|
|
{ status: upstream.ok ? 502 : upstream.status },
|
|
);
|
|
}
|
|
return NextResponse.json({ portal_url: data.portal_url }, { status: 200 });
|
|
} catch {
|
|
return jsonError(503, 'Billing portal is unavailable right now.');
|
|
}
|
|
}
|