Skip to content

fix: team metadata restriction for subscription #23327

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
emrysal merged 7 commits into from
Aug 26, 2025
Merged

fix: team metadata restriction for subscription #23327

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3545d3e
fix: team metadata restriction for stripe
anikdhabal Aug 25, 2025
0d8633b
Merge branch 'main' into stripe_metadat_restriction
anikdhabal Aug 25, 2025
4a12107
restrict write operstion only
anikdhabal Aug 25, 2025
a2df137
Merge branch 'main' into stripe_metadat_restriction
anikdhabal Aug 25, 2025
d297edd
Update teams.repository.ts
anikdhabal Aug 25, 2025
48cf2aa
Merge branch 'main' into stripe_metadat_restriction
anikdhabal Aug 26, 2025
65f0dac
Merge branch 'main' into stripe_metadat_restriction
emrysal Aug 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 69 additions & 18 deletions packages/features/ee/teams/lib/payments.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,8 +338,8 @@ describe("updateQuantitySubscriptionFromStripe", () => {
describe("For an organization", () => {
it("should not update subscription when team members are less than metadata.orgSeats", async () => {
const FAKE_PAYMENT_ID = "FAKE_PAYMENT_ID";
const FAKE_SUBITEM_ID = "FAKE_SUBITEM_ID";
const FAKE_SUB_ID = "FAKE_SUB_ID";
const FAKE_SUBITEM_ID = "si_FAKE_SUBITEM_ID";
const FAKE_SUB_ID = "sub_FAKE_SUB_ID";
const FAKE_SUBSCRIPTION_QTY_IN_STRIPE = 1000;
const consoleInfoSpy = vi.spyOn(console, "info");

Expand All @@ -363,7 +363,7 @@ describe("updateQuantitySubscriptionFromStripe", () => {
items: {
data: [
{
id: "FAKE_SUBITEM_ID",
id: FAKE_SUBITEM_ID,
quantity: FAKE_SUBSCRIPTION_QTY_IN_STRIPE,
},
],
Expand All @@ -384,8 +384,8 @@ describe("updateQuantitySubscriptionFromStripe", () => {

it("should update subscription when team members are more than metadata.orgSeats", async () => {
const FAKE_PAYMENT_ID = "FAKE_PAYMENT_ID";
const FAKE_SUB_ID = "FAKE_SUB_ID";
const FAKE_SUBITEM_ID = "FAKE_SUBITEM_ID";
const FAKE_SUBITEM_ID = "si_FAKE_SUBITEM_ID";
const FAKE_SUB_ID = "sub_FAKE_SUB_ID";
const FAKE_SUBSCRIPTION_QTY_IN_STRIPE = 1000;
const membersInTeam = 4;
const organization = await createOrgWithMembersAndPaymentData({
Expand Down Expand Up @@ -434,8 +434,8 @@ describe("updateQuantitySubscriptionFromStripe", () => {

it("should not update subscription when team members are less than MINIMUM_NUMBER_OF_ORG_SEATS(if metadata.orgSeats is null)", async () => {
const FAKE_PAYMENT_ID = "FAKE_PAYMENT_ID";
const FAKE_SUBITEM_ID = "FAKE_SUBITEM_ID";
const FAKE_SUB_ID = "FAKE_SUB_ID";
const FAKE_SUBITEM_ID = "si_FAKE_SUBITEM_ID";
const FAKE_SUB_ID = "sub_FAKE_SUB_ID";
const FAKE_SUBSCRIPTION_QTY_IN_STRIPE = 1000;
const membersInTeam = 2;
const consoleInfoSpy = vi.spyOn(console, "info");
Expand All @@ -453,7 +453,7 @@ describe("updateQuantitySubscriptionFromStripe", () => {
items: {
data: [
{
id: "FAKE_SUBITEM_ID",
id: FAKE_SUBITEM_ID,
quantity: FAKE_SUBSCRIPTION_QTY_IN_STRIPE,
},
],
Expand All @@ -480,8 +480,8 @@ describe("updateQuantitySubscriptionFromStripe", () => {

it("should update subscription when team members are more than MINIMUM_NUMBER_OF_ORG_SEATS(if metadata.orgSeats is null)", async () => {
const FAKE_PAYMENT_ID = "FAKE_PAYMENT_ID";
const FAKE_SUB_ID = "FAKE_SUB_ID";
const FAKE_SUBITEM_ID = "FAKE_SUBITEM_ID";
const FAKE_SUBITEM_ID = "si_FAKE_SUBITEM_ID";
const FAKE_SUB_ID = "sub_FAKE_SUB_ID";
const FAKE_SUBSCRIPTION_QTY_IN_STRIPE = 1000;
const membersInTeam = 35;
const organization = await createOrgWithMembersAndPaymentData({
Expand Down Expand Up @@ -537,8 +537,8 @@ describe("getTeamWithPaymentMetadata", () => {
isOrganization: true,
name: "TestTeam",
metadata: {
subscriptionId: "FAKE_SUB_ID",
subscriptionItemId: "FAKE_SUB_ITEM_ID",
subscriptionId: "sub_FAKE_SUB_ID",
subscriptionItemId: "si_FAKE_SUB_ITEM_ID",
},
},
});
Expand All @@ -552,7 +552,7 @@ describe("getTeamWithPaymentMetadata", () => {
name: "TestTeam",
metadata: {
paymentId: "FAKE_PAY_ID",
subscriptionItemId: "FAKE_SUB_ITEM_ID",
subscriptionItemId: "si_FAKE_SUB_ITEM_ID",
},
},
});
Expand All @@ -566,7 +566,7 @@ describe("getTeamWithPaymentMetadata", () => {
name: "TestTeam",
metadata: {
paymentId: "FAKE_PAY_ID",
subscriptionId: "FAKE_SUB_ID",
subscriptionId: "sub_FAKE_SUB_ID",
},
},
});
Expand All @@ -580,8 +580,8 @@ describe("getTeamWithPaymentMetadata", () => {
name: "TestTeam",
metadata: {
paymentId: "FAKE_PAY_ID",
subscriptionId: "FAKE_SUB_ID",
subscriptionItemId: "FAKE_SUB_ITEM_ID",
subscriptionId: "sub_FAKE_SUB_ID",
subscriptionItemId: "si_FAKE_SUB_ITEM_ID",
},
},
});
Expand All @@ -597,14 +597,65 @@ describe("getTeamWithPaymentMetadata", () => {
metadata: {
orgSeats: 5,
paymentId: "FAKE_PAY_ID",
subscriptionId: "FAKE_SUB_ID",
subscriptionItemId: "FAKE_SUB_ITEM_ID",
subscriptionId: "sub_FAKE_SUB_ID",
subscriptionItemId: "si_FAKE_SUB_ITEM_ID",
},
},
});
const teamWithPaymentData = await getTeamWithPaymentMetadata(team.id);
expect(teamWithPaymentData.metadata.orgSeats).toEqual(5);
});

it("should error if subscriptionId doesn't start with 'sub_'", async () => {
const team = await prismock.team.create({
data: {
isOrganization: true,
name: "TestTeam",
metadata: {
paymentId: "FAKE_PAY_ID",
subscriptionId: "invalid_sub_id",
subscriptionItemId: "si_FAKE_SUB_ITEM_ID",
},
},
});
expect(() => getTeamWithPaymentMetadata(team.id)).rejects.toThrow(
"subscriptionId must start with 'sub_'"
);
});

it("should error if subscriptionItemId doesn't start with 'si_'", async () => {
const team = await prismock.team.create({
data: {
isOrganization: true,
name: "TestTeam",
metadata: {
paymentId: "FAKE_PAY_ID",
subscriptionId: "sub_FAKE_SUB_ID",
subscriptionItemId: "invalid_item_id",
},
},
});
expect(() => getTeamWithPaymentMetadata(team.id)).rejects.toThrow(
"subscriptionItemId must start with 'si_'"
);
});

it("should parse successfully with valid prefixes", async () => {
const team = await prismock.team.create({
data: {
isOrganization: true,
name: "TestTeam",
metadata: {
paymentId: "FAKE_PAY_ID",
subscriptionId: "sub_FAKE_SUB_ID",
subscriptionItemId: "si_FAKE_SUB_ITEM_ID",
},
},
});
const teamWithPaymentData = await getTeamWithPaymentMetadata(team.id);
expect(teamWithPaymentData.metadata.subscriptionId).toEqual("sub_FAKE_SUB_ID");
expect(teamWithPaymentData.metadata.subscriptionItemId).toEqual("si_FAKE_SUB_ITEM_ID");
});
});

async function createOrgWithMembersAndPaymentData({
Expand Down
4 changes: 2 additions & 2 deletions packages/features/ee/teams/lib/payments.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,8 @@ const log = logger.getSubLogger({ prefix: ["teams/lib/payments"] });
const teamPaymentMetadataSchema = z.object({
// Redefine paymentId, subscriptionId and subscriptionItemId to ensure that they are present and nonNullable
paymentId: z.string(),
subscriptionId: z.string(),
subscriptionItemId: z.string(),
subscriptionId: z.string().startsWith("sub_", "subscriptionId must start with 'sub_'"),
subscriptionItemId: z.string().startsWith("si_", "subscriptionItemId must start with 'si_'"),
orgSeats: teamMetadataSchema.unwrap().shape.orgSeats,
});

Expand Down
14 changes: 12 additions & 2 deletions packages/prisma/zod-utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,8 +377,18 @@ export const teamMetadataSchema = z
defaultConferencingApp: schemaDefaultConferencingApp.optional(),
requestedSlug: z.string().or(z.null()),
paymentId: z.string(),
subscriptionId: z.string().nullable(),
subscriptionItemId: z.string().nullable(),
subscriptionId: z
.string()
.refine((val) => val.startsWith("sub_"), {
message: "subscriptionId must start with 'sub_'",
})
.nullable(),
subscriptionItemId: z
.string()
.refine((val) => val.startsWith("si_"), {
message: "subscriptionItemId must start with 'si_'",
})
.nullable(),
orgSeats: z.number().nullable(),
orgPricePerSeat: z.number().nullable(),
migratedToOrgFrom: z
Expand Down
Loading