fix(billing): checkout guard, admin panel case

Author: icecrasher321

apps/sim/app/workspace/[workspaceId]/upgrade/hooks/use-upgrade-state.test.tsx

@@ -120,6 +120,22 @@ describe('useUpgradeState', () => {
     })
   })
 
+  it('shows checkout admission failures through the standard error toast', async () => {
+    mockHandleUpgrade.mockRejectedValueOnce(
+      new Error('Your subscription payment is still processing.')
+    )
+
+    await act(async () => {
+      root.render(<Harness />)
+    })
+
+    await act(async () => {
+      await currentState?.doUpgrade('team', 25000)
+    })
+
+    expect(mockToastError).toHaveBeenCalledWith('Your subscription payment is still processing.')
+  })
+
   it('includes the routed workspace when switching the host billing interval', async () => {
     await act(async () => {
       root.render(<Harness />)

apps/sim/lib/auth/auth.ts

@@ -1001,9 +1001,9 @@ export const auth = betterAuth({
       /**
        * Personal checkout guard. The Stripe plugin's `authorizeReference`
        * only runs for organization references (it skips references equal to
-       * the session user), so duplicate-coverage enforcement for personal
-       * checkouts lives here: a member of an org with an entitled paid
-       * subscription must not buy a personal plan on top of it.
+       * the session user), so personal checkout admission lives here. It
+       * prevents both a duplicate checkout while Stripe payment is pending
+       * and a personal plan for someone already covered by an organization.
        */
       if (isBillingEnabled && ctx.path === '/subscription/upgrade') {
         const session = await getSessionFromCtx(ctx)

apps/sim/lib/auth/stripe-adapter-guard.test.ts

@@ -22,7 +22,12 @@ function createBaseAdapter() {
 const asAdapter = (base: ReturnType<typeof createBaseAdapter>) =>
   guardSubscriptionPlanWrites(base as unknown as Parameters<typeof guardSubscriptionPlanWrites>[0])
 
-const ORG_ROW = { id: 'sub-1', referenceId: 'org-1', plan: 'team_6000' }
+const ORG_ROW = {
+  id: 'sub-1',
+  referenceId: 'org-1',
+  plan: 'team_6000',
+  stripeSubscriptionId: 'stripe-sub-1',
+}
 const WHERE = [{ field: 'id', value: 'sub-1' }]
 
 describe('guardSubscriptionPlanWrites', () => {
@@ -144,6 +149,86 @@ describe('guardSubscriptionPlanWrites', () => {
     expect(base.update).toHaveBeenCalled()
   })
 
+  it('blocks rebinding a personal subscription to a different Stripe subscription', async () => {
+    const base = createBaseAdapter()
+    const personalPro = {
+      id: 'personal-pro',
+      referenceId: 'user-1',
+      plan: 'pro',
+      stripeSubscriptionId: 'sub_personal_pro',
+    }
+    base.findOne.mockResolvedValueOnce(personalPro)
+
+    const guarded = asAdapter(base)
+    const result = await guarded.update({
+      model: 'subscription',
+      where: [{ field: 'id', value: personalPro.id }] as never,
+      update: {
+        stripeSubscriptionId: 'sub_enterprise',
+        status: 'active',
+        periodEnd: new Date('2026-09-11T18:36:09Z'),
+        billingInterval: 'month',
+      },
+    })
+
+    expect(result).toBeNull()
+    expect(base.update).not.toHaveBeenCalled()
+  })
+
+  it('allows Stripe state updates when the subscription ID is unchanged', async () => {
+    const base = createBaseAdapter()
+    base.findOne.mockResolvedValueOnce({
+      id: 'personal-pro',
+      referenceId: 'user-1',
+      plan: 'pro',
+      stripeSubscriptionId: 'sub_personal_pro',
+    })
+
+    const guarded = asAdapter(base)
+    await guarded.update({
+      model: 'subscription',
+      where: WHERE as never,
+      update: {
+        stripeSubscriptionId: 'sub_personal_pro',
+        status: 'active',
+        cancelAtPeriodEnd: true,
+      },
+    })
+
+    expect(base.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        update: {
+          stripeSubscriptionId: 'sub_personal_pro',
+          status: 'active',
+          cancelAtPeriodEnd: true,
+        },
+      })
+    )
+  })
+
+  it('allows binding an unbound local subscription to Stripe', async () => {
+    const base = createBaseAdapter()
+    base.findOne.mockResolvedValueOnce({
+      id: 'new-subscription',
+      referenceId: 'user-1',
+      plan: 'pro',
+      stripeSubscriptionId: null,
+    })
+
+    const guarded = asAdapter(base)
+    await guarded.update({
+      model: 'subscription',
+      where: WHERE as never,
+      update: { stripeSubscriptionId: 'sub_new', status: 'incomplete' },
+    })
+
+    expect(base.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        update: { stripeSubscriptionId: 'sub_new', status: 'incomplete' },
+      })
+    )
+  })
+
   it('rejects creating an org-referenced subscription with a non-org plan', async () => {
     const base = createBaseAdapter()
     dbChainMockFns.limit.mockResolvedValueOnce([{ id: 'org-1' }])

apps/sim/lib/auth/stripe-adapter-guard.ts

@@ -17,11 +17,13 @@ type SubscriptionWriteSurface = Pick<
 /**
  * The Better Auth Stripe plugin persists webhook state through the raw
  * database adapter BEFORE invoking our subscription callbacks — including the
- * `plan` column resolved from the Stripe price. That makes the adapter the
- * only in-process seam that can enforce the billing invariant that
- * organization-referenced subscriptions hold Team/Enterprise plans: by the
- * time `syncSubscriptionPlan` runs in a callback, the plugin's write has
- * already landed.
+ * Stripe subscription ID and `plan` column resolved from the Stripe price.
+ * That makes the adapter the only in-process seam that can enforce two billing
+ * invariants before the write lands:
+ *
+ * - an existing subscription cannot be rebound to a different Stripe
+ *   subscription merely because both subscriptions share a customer;
+ * - organization-referenced subscriptions hold Team/Enterprise plans.
  *
  * Checkout admission blocks user-driven violations; this guard blocks the
  * remaining vector — an operator swapping an org subscription onto a personal
@@ -77,11 +79,28 @@ function guardWriteSurface<TAdapter extends SubscriptionWriteSurface>(
       return adapter.create(data)
     },
     update: async (data) => {
-      if (data.model === 'subscription' && hasNonOrgPlanWrite(data.update)) {
+      if (data.model === 'subscription' && needsSubscriptionRowInspection(data.update)) {
         const row = await adapter.findOne<SubscriptionRowSlice>({
           model: 'subscription',
           where: data.where,
         })
+
+        if (row && attemptsStripeSubscriptionRebind(row, data.update)) {
+          logger.error(
+            'Blocked rebinding an existing subscription to a different Stripe subscription',
+            {
+              subscriptionId: row.id,
+              referenceId: row.referenceId,
+              currentStripeSubscriptionId: row.stripeSubscriptionId,
+              rejectedStripeSubscriptionId: (data.update as { stripeSubscriptionId: string })
+                .stripeSubscriptionId,
+            }
+          )
+          return null as never
+        }
+
+        if (!hasNonOrgPlanWrite(data.update)) return adapter.update(data)
+
         const sanitized = await stripPlanWhenOrgReferenced(
           row ? [row] : [],
           data.update as Record<string, unknown>
@@ -110,6 +129,27 @@ interface SubscriptionRowSlice {
   id: string
   referenceId: string
   plan: string
+  stripeSubscriptionId: string | null
+}
+
+function needsSubscriptionRowInspection(update: unknown): boolean {
+  return hasStripeSubscriptionIdWrite(update) || hasNonOrgPlanWrite(update)
+}
+
+function hasStripeSubscriptionIdWrite(
+  update: unknown
+): update is { stripeSubscriptionId: unknown } {
+  return Boolean(update && typeof update === 'object' && 'stripeSubscriptionId' in update)
+}
+
+function attemptsStripeSubscriptionRebind(row: SubscriptionRowSlice, update: unknown): boolean {
+  if (!hasStripeSubscriptionIdWrite(update)) return false
+  const incomingStripeSubscriptionId = update.stripeSubscriptionId
+  return (
+    typeof row.stripeSubscriptionId === 'string' &&
+    typeof incomingStripeSubscriptionId === 'string' &&
+    incomingStripeSubscriptionId !== row.stripeSubscriptionId
+  )
 }
 
 function hasNonOrgPlanWrite(update: unknown): boolean {

apps/sim/lib/billing/authorization.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { resetDbChainMock } from '@sim/testing'
+import { dbChainMockFns, hasMockCondition, resetDbChainMock, schemaMock } from '@sim/testing'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
@@ -96,6 +96,20 @@ describe('authorizeSubscriptionReference', () => {
     expect(mockIsOwnerOrAdmin).toHaveBeenCalledWith('owner-1', 'org-1')
   })
 
+  it('blocks an organization checkout while its bound Stripe subscription is incomplete', async () => {
+    dbChainMockFns.limit.mockResolvedValueOnce([
+      { id: 'subscription-1', stripeSubscriptionId: 'sub_pending' },
+    ])
+
+    await expect(
+      authorizeSubscriptionReference('owner-1', 'org-1', 'upgrade-subscription', 'team_6000')
+    ).rejects.toThrow(/subscription payment is still processing/)
+
+    expect(mockHasPaidSubscription).not.toHaveBeenCalled()
+    expect(mockAssertNoUnresolved).not.toHaveBeenCalled()
+    expect(mockIsOwnerOrAdmin).not.toHaveBeenCalled()
+  })
+
   it('rejects an organization checkout for a pro plan — org references only hold Team/Enterprise', async () => {
     await expect(
       authorizeSubscriptionReference('owner-1', 'org-1', 'upgrade-subscription', 'pro_6000')
@@ -148,6 +162,46 @@ describe('assertPersonalCheckoutAllowed', () => {
     await expect(assertPersonalCheckoutAllowed('user-1')).resolves.toBeUndefined()
   })
 
+  it('keeps abandoned, unbound checkout placeholders retryable', async () => {
+    await assertPersonalCheckoutAllowed('user-1')
+
+    const predicate = dbChainMockFns.where.mock.calls[0]?.[0]
+    expect(
+      hasMockCondition(
+        predicate,
+        (node) => node.type === 'eq' && node.left === schemaMock.subscription.referenceId
+      )
+    ).toBe(true)
+    expect(
+      hasMockCondition(
+        predicate,
+        (node) =>
+          node.type === 'eq' &&
+          node.left === schemaMock.subscription.status &&
+          node.right === 'incomplete'
+      )
+    ).toBe(true)
+    expect(
+      hasMockCondition(
+        predicate,
+        (node) =>
+          node.type === 'isNotNull' && node.column === schemaMock.subscription.stripeSubscriptionId
+      )
+    ).toBe(true)
+  })
+
+  it('blocks a personal checkout while its bound Stripe subscription is incomplete', async () => {
+    dbChainMockFns.limit.mockResolvedValueOnce([
+      { id: 'subscription-1', stripeSubscriptionId: 'sub_pending' },
+    ])
+
+    await expect(assertPersonalCheckoutAllowed('user-1')).rejects.toThrow(
+      /subscription payment is still processing/
+    )
+
+    expect(mockGetOrganizationCoverageForMember).not.toHaveBeenCalled()
+  })
+
   it('rejects checkout when an organization subscription already covers the user', async () => {
     mockGetOrganizationCoverageForMember.mockResolvedValueOnce({
       status: 'covered',

apps/sim/lib/billing/authorization.ts

@@ -1,6 +1,8 @@
 import { db } from '@sim/db'
+import { subscription } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { APIError } from 'better-auth/api'
+import { and, eq, isNotNull } from 'drizzle-orm'
 import { hasPaidSubscription } from '@/lib/billing'
 import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
 import { getOrganizationCoverageForMember } from '@/lib/billing/core/subscription'
@@ -13,6 +15,44 @@ import { isOrgScopedSubscription } from '@/lib/billing/subscriptions/utils'
 
 const logger = createLogger('BillingAuthorization')
 
+/**
+ * Prevent a billing reference from starting a second Stripe Checkout while a
+ * previously completed Checkout still has a payment in flight.
+ *
+ * Better Auth intentionally reuses an unbound `incomplete` placeholder when a
+ * customer retries an abandoned Checkout. Once Stripe has bound that row to a
+ * subscription, however, reusing it would create another Stripe subscription
+ * and make later webhooks race to own the same local row.
+ */
+async function assertNoBoundIncompleteSubscription(referenceId: string): Promise<void> {
+  const [pendingSubscription] = await db
+    .select({
+      id: subscription.id,
+      stripeSubscriptionId: subscription.stripeSubscriptionId,
+    })
+    .from(subscription)
+    .where(
+      and(
+        eq(subscription.referenceId, referenceId),
+        eq(subscription.status, 'incomplete'),
+        isNotNull(subscription.stripeSubscriptionId)
+      )
+    )
+    .limit(1)
+
+  if (!pendingSubscription) return
+
+  logger.warn('Blocking checkout - Stripe subscription payment is still pending', {
+    referenceId,
+    subscriptionId: pendingSubscription.id,
+    stripeSubscriptionId: pendingSubscription.stripeSubscriptionId,
+  })
+  throw new APIError('CONFLICT', {
+    message:
+      'Your subscription payment is still processing. Wait for it to finish before starting another checkout. If this takes longer than expected, contact support.',
+  })
+}
+
 /**
  * Classify a `/subscription/upgrade` request as a personal checkout using
  * the same reference resolution as the Better Auth Stripe plugin
@@ -39,11 +79,9 @@ export function isPersonalCheckoutRequest(
 /**
  * Guard for personal (user-referenced) checkouts on `/subscription/upgrade`.
  *
- * A member of an organization with an entitled paid subscription is already
- * covered by that org — their usage pools to it and personal Pro
- * subscriptions are paused on join — so a personal checkout would bill the
- * same human twice. Throws {@link APIError} with a user-facing message; the
- * checkout UI surfaces it as-is.
+ * Blocks both a bound, incomplete Stripe subscription and a member already
+ * covered by an entitled organization subscription. Throws {@link APIError}
+ * with a user-facing message; the checkout UI surfaces it as-is.
  *
  * Called from the Better Auth `hooks.before` middleware, NOT from
  * `authorizeReference`: the Stripe plugin skips `authorizeReference`
@@ -54,6 +92,8 @@ export function isPersonalCheckoutRequest(
  * rejected rather than risking a duplicate subscription.
  */
 export async function assertPersonalCheckoutAllowed(userId: string): Promise<void> {
+  await assertNoBoundIncompleteSubscription(userId)
+
   const coverage = await getOrganizationCoverageForMember(userId)
 
   if (coverage.status === 'covered') {
@@ -90,6 +130,8 @@ export async function assertPersonalCheckoutAllowed(userId: string): Promise<voi
  * reason instead of a generic "Unauthorized":
  * - Organizations can only check out Team or Enterprise plans — a `pro_*`
  *   plan can never become org-referenced.
+ * - A bound, incomplete Stripe subscription must finish before another
+ *   checkout can start.
  * - Organizations cannot start a checkout while they already have an
  *   active subscription (prevents duplicates).
  * - Checkout is deferred while an Enterprise issuance is unresolved.
@@ -115,6 +157,10 @@ export async function authorizeSubscriptionReference(
     })
   }
 
+  if (action === 'upgrade-subscription') {
+    await assertNoBoundIncompleteSubscription(referenceId)
+  }
+
   if (action === 'upgrade-subscription' && (await hasPaidSubscription(referenceId))) {
     logger.warn('Blocking checkout - active subscription already exists for organization', {
       userId,