stack-auth · BilalG1 · Oct 7, 2025 · Oct 6, 2025 · Oct 7, 2025 · Oct 7, 2025
diff --git a/apps/backend/src/app/api/latest/internal/payments/test-mode-purchase-session/route.tsx b/apps/backend/src/app/api/latest/internal/payments/test-mode-purchase-session/route.tsx
@@ -1,10 +1,11 @@
 import { purchaseUrlVerificationCodeHandler } from "@/app/api/latest/payments/purchases/verification-code-handler";
 import { validatePurchaseSession } from "@/lib/payments";
+import { getTenancy } from "@/lib/tenancies";
 import { getStripeForAccount } from "@/lib/stripe";
 import { getPrismaClientForTenancy } from "@/prisma-client";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
 import { SubscriptionStatus } from "@prisma/client";
-import { adaptSchema, adminAuthTypeSchema, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
+import { yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { addInterval } from "@stackframe/stack-shared/dist/utils/dates";
 import { StackAssertionError, StatusError } from "@stackframe/stack-shared/dist/utils/errors";
 import { typedToUppercase } from "@stackframe/stack-shared/dist/utils/strings";
@@ -14,11 +15,6 @@ export const POST = createSmartRouteHandler({
     hidden: true,
   },
   request: yupObject({
-    auth: yupObject({
-      type: adminAuthTypeSchema.defined(),
-      project: adaptSchema.defined(),
-      tenancy: adaptSchema.defined(),
-    }).defined(),
     body: yupObject({
       full_code: yupString().defined(),
       price_id: yupString().defined(),
@@ -29,17 +25,22 @@ export const POST = createSmartRouteHandler({
     statusCode: yupNumber().oneOf([200]).defined(),
     bodyType: yupString().oneOf(["success"]).defined(),
   }),
-  handler: async ({ auth, body }) => {
+  handler: async ({ body }) => {
     const { full_code, price_id, quantity } = body;
     const { data, id: codeId } = await purchaseUrlVerificationCodeHandler.validateCode(full_code);
-    if (auth.tenancy.id !== data.tenancyId) {
-      throw new StatusError(400, "Tenancy id does not match value from code data");
+
+    const tenancy = await getTenancy(data.tenancyId);
+    if (!tenancy) {
+      throw new StackAssertionError("Tenancy not found for test mode purchase session");
+    }
+    if (tenancy.config.payments.testMode !== true) {
+      throw new StatusError(403, "Test mode is not enabled for this project");
     }
-    const prisma = await getPrismaClientForTenancy(auth.tenancy);
+    const prisma = await getPrismaClientForTenancy(tenancy);
 
     const { selectedPrice, conflictingCatalogSubscriptions } = await validatePurchaseSession({
       prisma,
-      tenancy: auth.tenancy,
+      tenancy,
       codeData: data,
       priceId: price_id,
       quantity,
@@ -51,7 +52,7 @@ export const POST = createSmartRouteHandler({
     if (!selectedPrice.interval) {
       await prisma.oneTimePurchase.create({
         data: {
-          tenancyId: auth.tenancy.id,
+          tenancyId: tenancy.id,
           customerId: data.customerId,
           customerType: typedToUppercase(data.product.customerType),
           productId: data.productId,
@@ -66,13 +67,13 @@ export const POST = createSmartRouteHandler({
       if (conflictingCatalogSubscriptions.length > 0) {
         const conflicting = conflictingCatalogSubscriptions[0];
         if (conflicting.stripeSubscriptionId) {
-          const stripe = await getStripeForAccount({ tenancy: auth.tenancy });
+          const stripe = await getStripeForAccount({ tenancy });
           await stripe.subscriptions.cancel(conflicting.stripeSubscriptionId);
         } else if (conflicting.id) {
           await prisma.subscription.update({
             where: {
               tenancyId_id: {
-                tenancyId: auth.tenancy.id,
+                tenancyId: tenancy.id,
                 id: conflicting.id,
               },
             },
@@ -83,7 +84,7 @@ export const POST = createSmartRouteHandler({
 
       await prisma.subscription.create({
         data: {
-          tenancyId: auth.tenancy.id,
+          tenancyId: tenancy.id,
           customerId: data.customerId,
           customerType: typedToUppercase(data.product.customerType),
           status: "active",
@@ -99,7 +100,7 @@ export const POST = createSmartRouteHandler({
       });
     }
     await purchaseUrlVerificationCodeHandler.revokeCode({
-      tenancy: auth.tenancy,
+      tenancy,
       id: codeId,
     });
 

diff --git a/apps/backend/src/app/api/latest/payments/purchases/validate-code/route.ts b/apps/backend/src/app/api/latest/payments/purchases/validate-code/route.ts
@@ -39,6 +39,7 @@ export const POST = createSmartRouteHandler({
         product_id: yupString().defined(),
         display_name: yupString().defined(),
       }).defined()).defined(),
+      test_mode: yupBoolean().defined(),
     }).defined(),
   }),
   async handler({ body }) {
@@ -102,6 +103,7 @@ export const POST = createSmartRouteHandler({
         project_id: tenancy.project.id,
         already_bought_non_stackable: alreadyBoughtNonStackable,
         conflicting_products: conflictingCatalogProducts,
+        test_mode: tenancy.config.payments.testMode === true,
       },
     };
   },

diff --git a/apps/backend/src/lib/payments.tsx b/apps/backend/src/lib/payments.tsx
@@ -31,9 +31,12 @@ export async function ensureProductIdOrInlineProduct(
   }
   if (productId) {
     const product = getOrUndefined(tenancy.config.payments.products, productId);
-    if (!product || (product.serverOnly && accessType === "client")) {
+    if (!product) {
       throw new KnownErrors.ProductDoesNotExist(productId, accessType);
     }
+    if (product.serverOnly && accessType === "client") {
+      throw new StatusError(400, "This product is marked as server-only and cannot be accessed client side!");
+    }
     return product;
   } else {
     if (!inlineProduct) {

diff --git a/...shboard/src/app/(main)/(protected)/projects/[projectId]/payments/products/item-dialog.tsx b/...shboard/src/app/(main)/(protected)/projects/[projectId]/payments/products/item-dialog.tsx
@@ -91,7 +91,8 @@ export function ItemDialog({
               id="item-id"
               value={itemId}
               onChange={(e) => {
-                setItemId(e.target.value);
+                const nextValue = e.target.value.toLowerCase();
+                setItemId(nextValue);
                 if (errors.itemId) {
                   setErrors(prev => {
                     const newErrors = { ...prev };