stack-auth · BilalG1 · Jan 13, 2026 · Dec 13, 2025 · Dec 15, 2025 · Dec 16, 2025
diff --git a/apps/backend/src/app/api/latest/payments/billing/[customer_type]/[customer_id]/route.ts b/apps/backend/src/app/api/latest/payments/billing/[customer_type]/[customer_id]/route.ts
@@ -0,0 +1,100 @@
+import { ensureClientCanAccessCustomer, getDefaultCardPaymentMethodSummary, getStripeCustomerForCustomerOrNull } from "@/lib/payments";
+import { getStripeForAccount } from "@/lib/stripe";
+import { getPrismaClientForTenancy, globalPrismaClient } from "@/prisma-client";
+import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
+import { adaptSchema, clientOrHigherAuthTypeSchema, yupBoolean, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+
+export const GET = createSmartRouteHandler({
+  metadata: {
+    summary: "Get payment method info",
+    hidden: true,
+    tags: ["Payments"],
+  },
+  request: yupObject({
+    auth: yupObject({
+      type: clientOrHigherAuthTypeSchema.defined(),
+      project: adaptSchema.defined(),
+      tenancy: adaptSchema.defined(),
+    }).defined(),
+    params: yupObject({
+      customer_type: yupString().oneOf(["user", "team"]).defined(),
+      customer_id: yupString().defined(),
+    }).defined(),
+  }),
+  response: yupObject({
+    statusCode: yupNumber().oneOf([200]).defined(),
+    bodyType: yupString().oneOf(["json"]).defined(),
+    body: yupObject({
+      has_customer: yupBoolean().defined(),
+      default_payment_method: yupObject({
+        id: yupString().defined(),
+        brand: yupString().nullable().defined(),
+        last4: yupString().nullable().defined(),
+        exp_month: yupNumber().nullable().defined(),
+        exp_year: yupNumber().nullable().defined(),
+      }).nullable().defined(),
+    }).defined(),
+  }),
+  handler: async ({ auth, params }, fullReq) => {
+    if (auth.type === "client") {
+      await ensureClientCanAccessCustomer({
+        customerType: params.customer_type,
+        customerId: params.customer_id,
+        user: fullReq.auth?.user,
+        tenancy: auth.tenancy,
+        forbiddenMessage: "Clients can only manage their own billing.",
+      });
+    }
+
+    const project = await globalPrismaClient.project.findUnique({
+      where: { id: auth.tenancy.project.id },
+      select: { stripeAccountId: true },
+    });
+    const stripeAccountId = project?.stripeAccountId;
+    if (!stripeAccountId) {
+      return {
+        statusCode: 200,
+        bodyType: "json",
+        body: {
+          has_customer: false,
+          default_payment_method: null,
+        },
+      };
+    }
+
+    const prisma = await getPrismaClientForTenancy(auth.tenancy);
+    const stripe = await getStripeForAccount({ accountId: stripeAccountId });
+    const stripeCustomer = await getStripeCustomerForCustomerOrNull({
+      stripe,
+      prisma,
+      tenancyId: auth.tenancy.id,
+      customerType: params.customer_type,
+      customerId: params.customer_id,
+    });
+
+    if (!stripeCustomer) {
+      return {
+        statusCode: 200,
+        bodyType: "json",
+        body: {
+          has_customer: false,
+          default_payment_method: null,
+        },
+      };
+    }
+
+    const defaultPaymentMethod = await getDefaultCardPaymentMethodSummary({
+      stripe,
+      stripeCustomer,
+    });
+
+    return {
+      statusCode: 200,
+      bodyType: "json",
+      body: {
+        has_customer: true,
+        default_payment_method: defaultPaymentMethod,
+      },
+    };
+  },
+});
diff --git a/...app/api/latest/payments/payment-method/[customer_type]/[customer_id]/set-default/route.ts b/...app/api/latest/payments/payment-method/[customer_type]/[customer_id]/set-default/route.ts
@@ -0,0 +1,99 @@
+import { ensureClientCanAccessCustomer, ensureStripeCustomerForCustomer, getDefaultCardPaymentMethodSummary } from "@/lib/payments";
+import { getStripeForAccount } from "@/lib/stripe";
+import { getPrismaClientForTenancy } from "@/prisma-client";
+import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
+import { adaptSchema, clientOrHigherAuthTypeSchema, yupBoolean, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
+
+export const POST = createSmartRouteHandler({
+  metadata: {
+    summary: "Set default payment method from a setup intent",
+    hidden: true,
+    tags: ["Payments"],
+  },
+  request: yupObject({
+    auth: yupObject({
+      type: clientOrHigherAuthTypeSchema.defined(),
+      project: adaptSchema.defined(),
+      tenancy: adaptSchema.defined(),
+    }).defined(),
+    params: yupObject({
+      customer_type: yupString().oneOf(["user", "team"]).defined(),
+      customer_id: yupString().defined(),
+    }).defined(),
+    body: yupObject({
+      setup_intent_id: yupString().defined(),
+    }).defined(),
+  }),
+  response: yupObject({
+    statusCode: yupNumber().oneOf([200]).defined(),
+    bodyType: yupString().oneOf(["json"]).defined(),
+    body: yupObject({
+      success: yupBoolean().oneOf([true]).defined(),
+      default_payment_method: yupObject({
+        id: yupString().defined(),
+        brand: yupString().nullable().defined(),
+        last4: yupString().nullable().defined(),
+        exp_month: yupNumber().nullable().defined(),
+        exp_year: yupNumber().nullable().defined(),
+      }).nullable().defined(),
+    }).defined(),
+  }),
+  handler: async ({ auth, params, body }, fullReq) => {
+    if (auth.type === "client") {
+      await ensureClientCanAccessCustomer({
+        customerType: params.customer_type,
+        customerId: params.customer_id,
+        user: fullReq.auth?.user,
+        tenancy: auth.tenancy,
+        forbiddenMessage: "Clients can only manage their own payment method.",
+      });
+    }
+
+    const prisma = await getPrismaClientForTenancy(auth.tenancy);
+    const stripe = await getStripeForAccount({ tenancy: auth.tenancy });
+    const stripeCustomer = await ensureStripeCustomerForCustomer({
+      stripe,
+      prisma,
+      tenancyId: auth.tenancy.id,
+      customerType: params.customer_type,
+      customerId: params.customer_id,
+    });
+
+    const setupIntent = await stripe.setupIntents.retrieve(body.setup_intent_id);
+    if (setupIntent.customer !== stripeCustomer.id) {
+      throw new StatusError(StatusError.Forbidden, "Setup intent does not belong to this customer.");
+    }
+    if (setupIntent.status !== "succeeded") {
+      throw new StatusError(400, "Setup intent has not succeeded.");
+    }
+    if (!setupIntent.payment_method || typeof setupIntent.payment_method !== "string") {
+      throw new StatusError(500, "Setup intent missing payment method.");
+    }
+
+    await stripe.customers.update(stripeCustomer.id, {
+      invoice_settings: {
+        default_payment_method: setupIntent.payment_method,
+      },
+    });
+
+    const updatedCustomer = await stripe.customers.retrieve(stripeCustomer.id);
+    if (updatedCustomer.deleted) {
+      throw new StatusError(500, "Stripe customer was deleted unexpectedly.");
+    }
+
+    const summary = await getDefaultCardPaymentMethodSummary({
+      stripe,
+      stripeCustomer: updatedCustomer,
+    });
+
+    return {
+      statusCode: 200,
+      bodyType: "json",
+      body: {
+        success: true,
+        default_payment_method: summary,
+      },
+    };
+  },
+});
diff --git a/...pp/api/latest/payments/payment-method/[customer_type]/[customer_id]/setup-intent/route.ts b/...pp/api/latest/payments/payment-method/[customer_type]/[customer_id]/setup-intent/route.ts
@@ -0,0 +1,82 @@
+import { ensureClientCanAccessCustomer, ensureStripeCustomerForCustomer } from "@/lib/payments";
+import { getStripeForAccount } from "@/lib/stripe";
+import { getPrismaClientForTenancy, globalPrismaClient } from "@/prisma-client";
+import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
+import { adaptSchema, clientOrHigherAuthTypeSchema, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
+
+export const POST = createSmartRouteHandler({
+  metadata: {
+    summary: "Create a setup intent to update default payment method",
+    hidden: true,
+    tags: ["Payments"],
+  },
+  request: yupObject({
+    auth: yupObject({
+      type: clientOrHigherAuthTypeSchema.defined(),
+      project: adaptSchema.defined(),
+      tenancy: adaptSchema.defined(),
+    }).defined(),
+    params: yupObject({
+      customer_type: yupString().oneOf(["user", "team"]).defined(),
+      customer_id: yupString().defined(),
+    }).defined(),
+    body: yupObject({}).default(() => ({})).defined(),
+  }),
+  response: yupObject({
+    statusCode: yupNumber().oneOf([200]).defined(),
+    bodyType: yupString().oneOf(["json"]).defined(),
+    body: yupObject({
+      client_secret: yupString().defined(),
+      stripe_account_id: yupString().defined(),
+    }).defined(),
+  }),
+  handler: async ({ auth, params }, fullReq) => {
+    if (auth.type === "client") {
+      await ensureClientCanAccessCustomer({
+        customerType: params.customer_type,
+        customerId: params.customer_id,
+        user: fullReq.auth?.user,
+        tenancy: auth.tenancy,
+        forbiddenMessage: "Clients can only manage their own payment method.",
+      });
+    }
+
+    const prisma = await getPrismaClientForTenancy(auth.tenancy);
+    const stripe = await getStripeForAccount({ tenancy: auth.tenancy });
+    const stripeCustomer = await ensureStripeCustomerForCustomer({
+      stripe,
+      prisma,
+      tenancyId: auth.tenancy.id,
+      customerType: params.customer_type,
+      customerId: params.customer_id,
+    });
+
+    const setupIntent = await stripe.setupIntents.create({
+      customer: stripeCustomer.id,
+      usage: "off_session",
+      payment_method_types: ["card"],
+    });
+    if (!setupIntent.client_secret) {
+      throw new StatusError(500, "No client secret returned from Stripe.");
+    }
+
+    const project = await globalPrismaClient.project.findUnique({
+      where: { id: auth.tenancy.project.id },
+      select: { stripeAccountId: true },
+    });
+    const stripeAccountId = project?.stripeAccountId;
+    if (!stripeAccountId) {
+      throw new StatusError(400, "Payments are not set up in this Stack Auth project.");
+    }
+
+    return {
+      statusCode: 200,
+      bodyType: "json",
+      body: {
+        client_secret: setupIntent.client_secret,
+        stripe_account_id: stripeAccountId,
+      },
+    };
+  },
+});
diff --git a/apps/backend/src/app/api/latest/payments/products/[customer_type]/[customer_id]/route.ts b/apps/backend/src/app/api/latest/payments/products/[customer_type]/[customer_id]/route.ts
@@ -54,6 +54,12 @@ export const GET = createSmartRouteHandler({
           id: product.id,
           quantity: product.quantity,
           product: productToInlineProduct(product.product),
+          type: product.type,
+          subscription: product.subscription ? {
+            current_period_end: product.subscription.currentPeriodEnd ? product.subscription.currentPeriodEnd.toISOString() : null,
+            cancel_at_period_end: product.subscription.cancelAtPeriodEnd,
+            is_cancelable: product.subscription.isCancelable,
+          } : null,
         },
       }));