fix(payments): point premium/family webhook at the route that actually exists#123
Open
eltociear wants to merge 1 commit into
Open
fix(payments): point premium/family webhook at the route that actually exists#123eltociear wants to merge 1 commit into
eltociear wants to merge 1 commit into
Conversation
…at doesn't exist
POST /api/payments creates the CoinPayPortal payment with
webhookUrl: `${baseUrl}/api/payments/webhook`, but no such route exists
in the app (only src/app/api/webhooks/coinpayportal/route.ts does, which
is the one that actually verifies the signature and calls
activateSubscription()). Since isSubscriptionActive()/isPaidSubscriptionActive()
gate access purely off the user_subscriptions table, and that table is only
ever written by activateSubscription() inside the webhook handler, every
premium/family payment made through this flow pays real crypto but never
gets the subscription activated — CoinPayPortal has nowhere to deliver the
confirmation to.
The IPTV subscription flow doesn't have this problem: both
src/app/api/iptv/subscription/route.ts and .../extend/route.ts correctly
point webhookUrl at src/app/api/iptv/subscription/webhook, which exists.
There's also no reconciliation/cron job that would catch this after the
fact (the only cron route is expire-subscriptions).
Fix: point the main payments route's webhookUrl at the real
/api/webhooks/coinpayportal route, same as the other CoinPayPortal
integrations in this codebase. Added a regression test asserting the
webhook URL passed to createPayment() actually matches an existing route.
Wasn't able to run the suite locally (this sandbox has no pnpm and plain
npm install didn't produce node_modules for the workspace) — traced the
test through the existing mock setup by hand instead; happy to fix up
anything the CI run flags.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #122.
POST /api/paymentswas registering the CoinPayPortal webhook at${baseUrl}/api/payments/webhook, which doesn't exist as a route — only/api/webhooks/coinpayportaldoes (the handler that verifies the signature and callsactivateSubscription()). Since subscription access is gated entirely by theuser_subscriptionstable, and that table is only ever written from the webhook handler, premium/family payments confirm on CoinPayPortal's side but the app never activates the subscription.The IPTV subscription flow doesn't have this bug — both of its payment-creation routes correctly point
webhookUrlat/api/iptv/subscription/webhook, which exists. This PR makes the main payments route consistent with that.Change:
src/app/api/payments/route.ts: pointwebhookUrlat/api/webhooks/coinpayportal.src/app/api/payments/route.test.ts: added a regression test asserting the webhook URL passed tocreatePayment()matches the real route, so this can't silently regress again.Couldn't run the suite locally — this sandbox doesn't have pnpm and a plain
npm installdidn't producenode_modulesfor the workspace — so I traced the new test through the existing mock setup by hand rather than executing it. Happy to adjust if CI flags anything.