apps/backend/prisma/migrations/20250917193043_store_price_id/migration.sql (1)

2-5: Migration shape is fine; confirm no backfill needed and consider future index needs.

Both columns are nullable (good for forward/backward deploys). If you’ll ever filter by priceId, plan an index (e.g., per-table on (tenancyId, priceId)) separately.

Would you like a follow-up migration diff to add a composite index after usage is confirmed?

apps/backend/prisma/schema.prisma (2)

761-783: priceId on Subscription added correctly; consider documenting semantics and potential index.

Clarify that priceId refers to your offer price key (not Stripe price object id) to avoid confusion later. Add an index if you’ll query by it.

---

799-814: priceId on OneTimePurchase matches Subscription; same semantics/index note applies.

apps/backend/src/app/api/latest/integrations/stripe/webhooks/route.tsx (2)

56-58: Defensive parse for metadata.offer.

JSON.parse on untrusted metadata can throw. Fall back to {} if invalid.

-    const offer = JSON.parse(metadata.offer || "{}");
+    const offer = (() => { try { return JSON.parse(metadata.offer ?? "{}"); } catch { return {}; } })();

---

73-86: Use nullish coalescing for priceId to avoid storing empty strings.

Standardize with stripe.tsx which uses ?? null.

-        offerId: metadata.offerId || null,
-        priceId: metadata.priceId || null,
+        offerId: metadata.offerId ?? null,
+        priceId: metadata.priceId ?? null,

-        offerId: metadata.offerId || null,
-        priceId: metadata.priceId || null,
+        offerId: metadata.offerId ?? null,
+        priceId: metadata.priceId ?? null,

apps/e2e/tests/backend/endpoints/api/v1/stripe-webhooks.test.ts (1)

73-173: Optional: assert DB persistence of priceId.

If there’s an admin/readback endpoint, add an assertion that OneTimePurchase/Subscription rows persist priceId to catch regressions.

Would you like me to draft an e2e readback using an internal admin route (if available)?

Also applies to: 175-286, 288-430

apps/backend/src/app/api/latest/internal/payments/test-mode-purchase-session/route.tsx (1)

22-26: Validate price_id is non-empty.

Prevent empty strings slipping into DB.

-      price_id: yupString().defined(),
+      price_id: yupString().trim().min(1).defined(),

apps/backend/src/app/api/latest/payments/purchases/purchase-session/route.tsx (2)

16-20: Validate price_id is non-empty.

Align with TEST_MODE route to avoid empty strings.

-      price_id: yupString().defined(),
+      price_id: yupString().trim().min(1).defined(),

---

102-127: Optional: add Stripe idempotency keys using the purchase code id.

Reduces duplicate Stripe objects on retries.

-      const paymentIntent = await stripe.paymentIntents.create({
+      const paymentIntent = await stripe.paymentIntents.create({
         amount: amountCents,
         currency: "usd",
         customer: data.stripeCustomerId,
         automatic_payment_methods: { enabled: true },
         metadata: {
           offerId: data.offerId || "",
           offer: JSON.stringify(data.offer),
           customerId: data.customerId,
           customerType: data.offer.customerType,
           purchaseQuantity: String(quantity),
           purchaseKind: "ONE_TIME",
           tenancyId: data.tenancyId,
           priceId: price_id,
         },
-      });
+      }, { idempotencyKey: codeId });

-    const created = await stripe.subscriptions.create({
+    const created = await stripe.subscriptions.create({
       customer: data.stripeCustomerId,
       payment_behavior: 'default_incomplete',
       payment_settings: { save_default_payment_method: 'on_subscription' },
       expand: ['latest_invoice.confirmation_secret'],
       items: [{
         price_data: {
           currency: "usd",
           unit_amount: Number(selectedPrice.USD) * 100,
           product: product.id,
           recurring: {
             interval_count: selectedPrice.interval![0],
             interval: selectedPrice.interval![1],
           },
         },
         quantity,
       }],
       metadata: {
         offerId: data.offerId ?? null,
         offer: JSON.stringify(data.offer),
         priceId: price_id,
       },
-    });
+    }, { idempotencyKey: codeId });

Also applies to: 132-155

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

apps/backend/prisma/migrations/20250918005821_item_quantity_change_customer_type/migration.sql (2)

10-15: Backfill USER via join — beware cast-induced full scans; add supporting indexes.

Casting pu.projectUserId::text prevents index usage and can be slow on large tables. Prefer ensuring usable composite indexes and avoiding casts where possible.

Consider adding (or verifying presence of) these indexes in a follow-up migration:

-- ItemQuantityChange often filtered by tenancyId + customerId
CREATE INDEX IF NOT EXISTS "idx_iqc_tenancy_customer"
  ON "ItemQuantityChange" ("tenancyId","customerId");

-- ProjectUser join keys
CREATE INDEX IF NOT EXISTS "idx_pu_tenancy_projectuser"
  ON "ProjectUser" ("tenancyId","projectUserId");

-- Team join keys
CREATE INDEX IF NOT EXISTS "idx_team_tenancy_team"
  ON "Team" ("tenancyId","teamId");

If you want to leverage UUID indexes while safely avoiding cast failures, split the update to only UUID-shaped customerIds:

UPDATE "ItemQuantityChange" iqc
SET "customerType" = 'USER'
FROM "ProjectUser" pu
WHERE iqc."customerType" IS NULL
  AND iqc."tenancyId" = pu."tenancyId"
  AND iqc."customerId" ~ '^[0-9a-fA-F-]{36}$'
  AND iqc."customerId"::uuid = pu."projectUserId";

---

16-22: TEAM backfill has the same casting/index concern.

Same recommendations as above apply to t.teamId::text.

packages/stack-shared/src/schema-fields.ts (2)

426-426: Message/regex mismatch for userSpecifiedIdSchema (nit).

The message says IDs may start with a number, but the regex disallows it. Pick one and align.

Apply:

-export const userSpecifiedIdSchema = (idName: `${string}Id`) => yupString().max(63).matches(/^[a-zA-Z_][a-zA-Z0-9_-]*$/, `${idName} must start with a letter, underscore, or number, and contain only letters, numbers, underscores, and hyphens`);
+export const userSpecifiedIdSchema = (idName: `${string}Id`) =>
+  yupString()
+    .max(63)
+    .matches(
+      /^[a-zA-Z0-9_][a-zA-Z0-9_-]*$/,
+      `${idName} must start with a letter, underscore, or number, and contain only letters, numbers, underscores, and hyphens`
+    );

---

550-553: Minor perf nit: precompute supported currency codes Set.

Micro-optimization; simplifies lookup and reads cleaner.

-const validateHasAtLeastOneSupportedCurrency = (value: Record<string, unknown> | null, context: any) => {
-  if (!value) return true;
-  const currencies = Object.keys(value).filter(key => SUPPORTED_CURRENCIES.some(c => c.code === key));
+const _SUPPORTED_CURRENCY_CODES = new Set(SUPPORTED_CURRENCIES.map(c => c.code));
+const validateHasAtLeastOneSupportedCurrency = (value: Record<string, unknown> | null, context: any) => {
+  if (!value) return true;
+  const currencies = Object.keys(value).filter(key => _SUPPORTED_CURRENCY_CODES.has(key as any));

apps/backend/src/app/api/latest/internal/payments/transactions/route.tsx (3)

132-143: Consider surfacing price_id alongside price for completeness.
Given the PR’s goal (store Stripe price IDs), include price_id in the unified payload.

Apply this diff:

     const subRows: AdminTransaction[] = subs.map((s) => ({
       id: s.id,
       type: 'subscription',
       created_at_millis: s.createdAt.getTime(),
       customer_type: typedToLowercase(s.customerType),
       customer_id: s.customerId,
       quantity: s.quantity,
       test_mode: s.creationSource === 'TEST_MODE',
       offer_display_name: getOfferDisplayName(s.offer as OfferWithPrices),
+      price_id: s.priceId ?? null,
       price: resolveSelectedPriceFromOffer(s.offer as OfferWithPrices, s.priceId ?? null),
       status: s.status,
     }));

     const otpRows: AdminTransaction[] = otps.map((o) => ({
       id: o.id,
       type: 'one_time',
       created_at_millis: o.createdAt.getTime(),
       customer_type: typedToLowercase(o.customerType),
       customer_id: o.customerId,
       quantity: o.quantity,
       test_mode: o.creationSource === 'TEST_MODE',
       offer_display_name: getOfferDisplayName(o.offer as OfferWithPrices),
+      price_id: o.priceId ?? null,
       price: resolveSelectedPriceFromOffer(o.offer as OfferWithPrices, o.priceId ?? null),
       status: null,
     }));

---

109-114: Nit: Prefer Map over Record for prices if not bound to persisted JSON shape.
If this mirrors persisted offer JSON, ignore. Otherwise, Map improves key semantics and avoids accidental prototype keys.

---

181-194: Add e2e assertions for concatenated cursor pagination (no duplicates; dominant‑type stalls)

Found an existing e2e test apps/e2e/tests/backend/endpoints/api/v1/internal/transactions.test.ts ("supports concatenated cursor pagination") but it only verifies next_cursor and that page2 returns items — it does not assert completeness or absence of duplicate ids across pages.

• Update that test to assert page1.items + page2.items == full result (or compare against an all‑items response) and assert no overlapping IDs between pages.
• Add an e2e scenario where one type dominates (many one_time or item_quantity_change rows) and verify the cursor still advances for other streams (no repeated items / no “stalls”).
• Implementation note: backend file apps/backend/src/app/api/latest/internal/payments/transactions/route.tsx (lines ~181–194) builds the concatenated cursor from last per‑type IDs — tests should target this behavior.

apps/e2e/tests/backend/endpoints/api/v1/internal/transactions.test.ts (2)

50-53: Regex character class includes unintended ranges; escape/move -.

[a-z0-9-_]+ treats - as a range (9-_), matching extra chars. Make - first/last or escape it.

Apply:

-  const codeMatch = (res.body.url as string).match(/\/purchase\/([a-z0-9-_]+)/);
+  const codeMatch = (res.body.url as string).match(/\/purchase\/([a-z0-9_-]+)/i);

---

3-3: Remove unused imports to keep tests lean.

InternalProjectKeys and backendContext are imported but unused.

-import { niceBackendFetch, Payments as PaymentsHelper, Project, User, InternalProjectKeys, backendContext } from "../../../../backend-helpers";
+import { niceBackendFetch, Payments as PaymentsHelper, Project, User } from "../../../../backend-helpers";

apps/dashboard/src/components/data-table/transaction-table.tsx (1)

24-39: Minor: unify display label for one-time.

UI elsewhere uses “One-time”. Align for consistency.

-    case 'one_time': {
-      return 'One Time';
+    case 'one_time': {
+      return 'One-time';

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro