fix(billing): checkout guard, admin panel case - #6641

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 12, 2026 10:12pm

PR Summary

High Risk
Changes touch billing checkout, authorization, Stripe webhook adapter writes, and enterprise org provisioning—areas where races or incorrect guards can block revenue or corrupt subscription binding.

Overview
Checkout admission adds a short-lived database lease per billing reference on /subscription/upgrade, claimed in auth before hooks and released in after, so overlapping checkouts cannot race past read-only checks. Personal and org flows still run existing coverage rules; failures release the claim and surface user-facing errors (including in the upgrade UI toast test).

Pending payment guard blocks a new checkout when the reference already has an incomplete subscription bound to a Stripe subscription ID, while leaving unbound abandoned placeholders retryable. This applies to personal checkouts and org upgrade-subscription authorization.

Stripe adapter guard now refuses updates that rebind an existing local subscription row to a different stripeSubscriptionId (webhook path), while still allowing first-time binding and same-ID status updates.

Enterprise provisioning on correlated issuance sweeps the owner’s attachable personal workspaces into the new org (with locks, identity lock, stable workspace-set check, cache invalidation), and retries if the workspace set changes mid-reconciliation.

Diagnostics: subscription/reference mismatch errors mention the bound reference explicitly.

^{Reviewed by Cursor Bugbot for commit 89877b4. Configure here.}

Greptile Summary

The PR adds database-backed checkout admission fencing and bound-incomplete-subscription checks, while tightening Stripe subscription binding and Enterprise workspace reconciliation.

• Serializes overlapping checkout creation by resolved billing reference and releases claims using ownership tokens.
• Keeps abandoned, unbound checkout placeholders retryable while blocking checkouts whose Stripe payment remains incomplete.
• Prevents webhook updates from rebinding an existing local row to another Stripe subscription.
• Moves eligible Enterprise-owner workspaces into the newly provisioned organization under transactional locks.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported concurrent checkout race is addressed by an atomic database claim keyed by billing reference, with claim-token-fenced release preventing stale requests from releasing newer claims.

sequenceDiagram
  participant Client
  participant Auth as Better Auth hooks
  participant Lease as Checkout admission DB
  participant Stripe as Stripe plugin
  participant DB as Subscription DB

  Client->>Auth: POST /subscription/upgrade
  Auth->>Lease: Atomically claim billing reference
  alt Claim already held
    Lease-->>Auth: Conflict
    Auth-->>Client: Checkout already starting
  else Claim acquired
    Auth->>DB: Check bound incomplete subscription
    Auth->>Stripe: Prepare local row and create Checkout
    Stripe-->>Auth: Checkout result
    Auth->>Lease: Release with fencing token
    Auth-->>Client: Checkout response
  end

_{Reviews (3): Last reviewed commit: "fix(billing): release checkout admission..." | Re-trigger Greptile}

@greptile

@cursor review

@greptile

@cursor review