inline product cancelling#1199
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
No actionable comments were generated in the recent review. 🎉 📝 WalkthroughWalkthroughAdds cancel-by- Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant Backend
participant StripeDB as Stripe/Database
alt Cancel by subscription_id
Client->>Backend: DELETE /products/[type]/[id]/[productId]?subscription_id=SUB_123
Backend->>StripeDB: Lookup active/trialing subscription by subscription_id, tenant, customer_type, customer_id
alt Found
Backend->>StripeDB: Cancel via Stripe (if stripeSubscriptionId) or mark canceled in DB
StripeDB-->>Backend: Success
Backend-->>Client: 204 No Content
else Not found
Backend-->>Client: 404 No active subscription found with this ID
end
else Cancel by product_id
Client->>Backend: DELETE /products/[type]/[id]/[productId]
Backend->>StripeDB: Validate product ownership and fetch active subscriptions for product/customer
alt Found & cancelable
Backend->>StripeDB: Cancel via Stripe or update DB
StripeDB-->>Backend: Success
Backend-->>Client: 204 No Content
else Not found / not cancelable
Backend-->>Client: 404 No active subscription found
end
end
Estimated Code Review Effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly Related PRs
Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Greptile SummaryThis PR enables cancellation of inline product subscriptions — subscriptions that were granted via Key changes:
Confidence Score: 4/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant UI as PaymentsPanel (UI)
participant SDK as StackClientApp
participant API as DELETE /payments/products/:type/:id/:productId
participant DB as Prisma (Subscription)
UI->>UI: User clicks "Cancel subscription"
UI->>SDK: cancelSubscription({ productId: "_inline", subscriptionId })
SDK->>API: DELETE .../_inline?subscription_id=<uuid>
alt subscription_id provided (inline product)
API->>DB: findMany({ id: subscription_id, customerId, customerType })
DB-->>API: matching subscriptions
else no subscription_id (configured product)
API->>DB: findMany({ productId, customerId, customerType })
DB-->>API: matching subscriptions
end
alt has Stripe subscription
API->>API: stripe.subscriptions.cancel()
else local-only subscription
API->>DB: update status → canceled
end
API-->>SDK: { success: true }
SDK-->>UI: void (cache invalidated)
Last reviewed commit: 63c1391 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🤖 Fix all issues with AI agents
Before applying any fix, first verify the finding against the current code and
decide whether a code change is actually needed. If the finding is not valid or
no change is required, do not modify code for that item and briefly explain why
it was skipped.
In
`@apps/backend/src/app/api/latest/payments/products/`[customer_type]/[customer_id]/[product_id]/route.ts:
- Around line 66-80: The route currently ignores params.product_id when
query.subscription_id is present; after the prisma.subscription.findMany call
(and after confirming subscriptions.length > 0) validate that the
subscription(s) belong to the product in params.product_id: for each
subscription returned by prisma.subscription.findMany ensure
subscription.productId (or subscription.product_id field) matches
params.product_id (when params.product_id is provided/known) and throw a
StatusError(400, "...") if not; alternatively, if you prefer to keep backward
compatibility, add a clear comment/route metadata noting that
query.subscription_id takes precedence and params.product_id is ignored. Use the
existing symbols query.subscription_id, params.product_id,
prisma.subscription.findMany and StatusError to locate where to add the check or
the documentation.
🧹 Nitpick comments (1)
🤖 Fix all nitpicks with AI agents
Before applying any fix, first verify the finding against the current code and decide whether a code change is actually needed. If the finding is not valid or no change is required, do not modify code for that item and briefly explain why it was skipped. In `@apps/backend/src/app/api/latest/payments/products/`[customer_type]/[customer_id]/[product_id]/route.ts: - Around line 66-80: The route currently ignores params.product_id when query.subscription_id is present; after the prisma.subscription.findMany call (and after confirming subscriptions.length > 0) validate that the subscription(s) belong to the product in params.product_id: for each subscription returned by prisma.subscription.findMany ensure subscription.productId (or subscription.product_id field) matches params.product_id (when params.product_id is provided/known) and throw a StatusError(400, "...") if not; alternatively, if you prefer to keep backward compatibility, add a clear comment/route metadata noting that query.subscription_id takes precedence and params.product_id is ignored. Use the existing symbols query.subscription_id, params.product_id, prisma.subscription.findMany and StatusError to locate where to add the check or the documentation.apps/backend/src/app/api/latest/payments/products/[customer_type]/[customer_id]/[product_id]/route.ts (1)
66-80:product_idpath parameter is silently ignored whensubscription_idis provided.When
query.subscription_idis set, theproduct_idroute parameter is never validated or used. A caller can pass an arbitrary (or non-existent)product_idin the URL and still cancel any of their subscriptions bysubscription_id. This isn't a security issue (tenancy + customer checks still apply), but it's semantically misleading for a route whose path includes[product_id].Consider either:
- Validating that the resolved subscription's product matches
params.product_id(if known), or- Documenting clearly in the route metadata that
product_idis ignored whensubscription_idis present.🤖 Prompt for AI Agents
Before applying any fix, first verify the finding against the current code and decide whether a code change is actually needed. If the finding is not valid or no change is required, do not modify code for that item and briefly explain why it was skipped. In `@apps/backend/src/app/api/latest/payments/products/`[customer_type]/[customer_id]/[product_id]/route.ts around lines 66 - 80, The route currently ignores params.product_id when query.subscription_id is present; after the prisma.subscription.findMany call (and after confirming subscriptions.length > 0) validate that the subscription(s) belong to the product in params.product_id: for each subscription returned by prisma.subscription.findMany ensure subscription.productId (or subscription.product_id field) matches params.product_id (when params.product_id is provided/known) and throw a StatusError(400, "...") if not; alternatively, if you prefer to keep backward compatibility, add a clear comment/route metadata noting that query.subscription_id takes precedence and params.product_id is ignored. Use the existing symbols query.subscription_id, params.product_id, prisma.subscription.findMany and StatusError to locate where to add the check or the documentation.
N2D4
approved these changes
Feb 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Tests