apps/e2e/tests/backend/endpoints/api/v1/stripe-webhooks.test.ts (1)

6-15: Consider increasing the timeout for flaky environments.

The 15-second timeout (30 iterations × 500ms) should be sufficient for most cases, but consider making this configurable or adding a comment explaining the expected SLA for email processing.

apps/backend/src/app/api/latest/integrations/stripe/webhooks/route.tsx (2)

75-96: Good implementation, but "custom" customer type silently returns empty recipients.

For customerType === "custom", the function returns an empty array, which means no emails will be sent. This behavior is correct if custom customers don't have associated emails in the system, but it might be worth adding a debug log or comment to make this explicit.

💡 Optional: Add a comment for clarity

   if (options.customerType === "team") {
     const permissions = await listPermissions(options.prisma, {
       scope: "team",
       tenancy: options.tenancy,
       teamId: options.customerId,
       permissionId: "team_admin",
       recursive: true,
     });
     const userIds = [...new Set(permissions.map((permission) => permission.user_id))];
     return userIds.map((userId) => ({ type: "user-primary-email", userId }));
   }
+  // "custom" customer type has no associated email recipients
   return [];

---

248-290: Consider extracting duplicate logic for invoice email handling.

The invoice.payment_succeeded and invoice.payment_failed handlers share significant duplicated logic for:

• Retrieving tenancy and prisma client
• Fetching and validating the Stripe customer
• Getting payment recipients

This could be extracted into a shared helper function.

♻️ Example refactor

async function getInvoiceEmailContext(
  stripe: Stripe,
  accountId: string,
  invoice: Stripe.Invoice,
  mockData?: StripeOverridesMap
) {
  const tenancy = await getTenancyForStripeAccountId(accountId, mockData);
  const prisma = await getPrismaClientForTenancy(tenancy);
  const stripeCustomerId = invoice.customer;
  if (typeof stripeCustomerId !== "string") {
    throw new StackAssertionError("Stripe invoice customer id missing", { invoice });
  }
  const stripeCustomer = await stripe.customers.retrieve(stripeCustomerId);
  if (stripeCustomer.deleted) {
    throw new StackAssertionError("Stripe invoice customer deleted", { invoice });
  }
  const customerType = normalizeCustomerType(stripeCustomer.metadata.customerType);
  if (!stripeCustomer.metadata.customerId || !customerType) {
    throw new StackAssertionError("Stripe invoice customer metadata missing", { invoice });
  }
  const recipients = await getPaymentRecipients({
    tenancy,
    prisma,
    customerType,
    customerId: stripeCustomer.metadata.customerId,
  });
  return { tenancy, recipients };
}

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Learnt from: CR
Repo: stack-auth/stack-auth PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-01-13T18:14:29.974Z
Learning: Applies to packages/stack-shared/src/config/schema.ts : Whenever making backwards-incompatible changes to the config schema, update the migration functions in `packages/stack-shared/src/config/schema.ts`

Learnt from: CR
Repo: stack-auth/stack-auth PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-01-13T18:14:29.974Z
Learning: Applies to **/*.test.{ts,tsx,js,jsx} : Always add new E2E tests when changing the API or SDK interface, erring on the side of creating too many tests due to the critical nature of the industry

_{✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.}

apps/backend/src/lib/telegram.tsx (1)

22-24: Prefer urlString/encoding for Telegram URL construction.

Line 23 builds the URL via interpolation; guideline recommends urlString/encodeURIComponent for URL parts (token/path).

♻️ Suggested change

+import { urlString } from "@stackframe/stack-shared/dist/utils/urls";
 ...
-  const response = await fetch(`https://${TELEGRAM_HOSTNAME}/bot${options.botToken}${TELEGRAM_ENDPOINT_PATH}`, {
+  const response = await fetch(urlString`https://${TELEGRAM_HOSTNAME}/bot${options.botToken}${TELEGRAM_ENDPOINT_PATH}`, {

packages/template/src/components-page/account-settings/payments/payments-panel.tsx (2)

32-72: Guard against currency/zero‑decimal assumptions in invoice totals.

Line 62 divides by 100 and line 64 hard‑codes $. This will misformat non‑USD or zero‑decimal currencies (e.g., JPY). If multi‑currency is possible, store currency in the invoice model and format via Intl.NumberFormat({ style: "currency", currency }); otherwise please document USD‑only assumptions.

---

84-105: Prefer interface for object shapes (TS guideline).

Consider converting CustomerLike from a type alias to an interface for consistency.

♻️ Example refactor

-type CustomerLike = {
+interface CustomerLike {
   id: string,
   useBilling: () => CustomerBilling,
   useProducts: () => Array<{
     id: string | null,
     quantity: number,
@@
-  switchSubscription: (options: { fromProductId: string, toProductId: string, priceId?: string, quantity?: number }) => Promise<void>,
-};
+  switchSubscription: (options: { fromProductId: string, toProductId: string, priceId?: string, quantity?: number }) => Promise<void>,
+}

apps/e2e/tests/backend/endpoints/api/v1/payments/invoices.test.ts (1)

30-31: Encode path parameters in the invoices URL.
Line 30 interpolates userId directly; remember to encode path segments in case IDs contain URL‑unsafe chars. As per coding guidelines, prefer encodeURIComponent for URLs.

♻️ Proposed tweak

-  const response = await niceBackendFetch(`/api/latest/payments/invoices/user/${userId}`, {
+  const response = await niceBackendFetch(`/api/latest/payments/invoices/user/${encodeURIComponent(userId)}`, {

packages/template/src/lib/stack-app/customers/index.ts (1)

71-86: Prefer interface for new invoice object shapes.
CustomerInvoice and CustomerInvoicesListOptions are plain object shapes and can be interface per TS style guidance. As per coding guidelines, prefer interface for object shapes.

♻️ Possible refactor

-export type CustomerInvoice = {
+export interface CustomerInvoice {
   createdAt: Date,
   status: CustomerInvoiceStatus,
   amountTotal: number,
   hostedInvoiceUrl: string | null,
-};
+}
@@
-export type CustomerInvoicesListOptions = {
+export interface CustomerInvoicesListOptions {
   cursor?: string,
   limit?: number,
-};
+}

packages/template/src/lib/stack-app/apps/implementations/client-app-impl.ts (1)

273-294: Consider a refresh/invalidation path for invoice caches.

If invoices can change via webhooks while the session remains valid, the cache may stay stale until a reload. Consider exposing a refresh/invalidate or invalidating after payment-related flows.