chore(chat): migrate POST /api/stripe/{session,portal}/create by arpitgupta1214 · Pull Request #1726 · recoupable/chat

arpitgupta1214 · 2026-05-01T14:07:12Z

Repoints `createClientCheckoutSession` at `POST ${getClientApiBaseUrl()}/api/subscriptions/sessions` and `createClientPortalSession` at `POST ${getClientApiBaseUrl()}/api/subscriptions/portal-sessions` (both authenticated with the Privy access token). Deletes the two local routes and the `createSession` / `createBillingPortalSession` helpers that only existed to back them. (Group 4 of the chat→api migration plan.)

Will only merge once api parity PR api#499 lands.

Test plan

`npx tsc --noEmit` shows no new errors (only pre-existing Spotify/UIMessage drift)
Click "Subscribe" on the Sidebar Unlock-Pro card — checkout window opens
Click "Manage Subscription" on the user dropdown when subscribed — billing portal opens

Repoints createClientCheckoutSession at POST ${getClientApiBaseUrl()}/api/subscriptions/sessions and createClientPortalSession at POST ${getClientApiBaseUrl()}/api/subscriptions/portal-sessions, both authenticated with the Privy access token. Drops accountId from the request body — api derives it from validateAuthContext. Deletes the two local routes and the createSession / createBillingPortalSession helpers that only existed to back them. (Group 4 of the chat→api migration plan.)

vercel · 2026-05-01T14:07:17Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
chat	Ready	Preview	May 9, 2026 2:31pm

coderabbitai · 2026-05-01T14:07:19Z

Warning

Rate limit exceeded

@arpitgupta1214 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 48 minutes and 32 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5a7900ea-ed14-4fe3-bea7-08653222b7ba

📥 Commits

Reviewing files that changed from the base of the PR and between 9e94db1 and 4fac492.

📒 Files selected for processing (3)

hooks/useSubscribeClick.ts
lib/stripe/createClientCheckoutSession.ts
lib/stripe/createClientPortalSession.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch migrate/stripe-group4

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cubic-dev-ai

2 issues found across 7 files

Confidence score: 3/5

There is a concrete security risk in lib/stripe/createClientPortalSession.ts: opening with _blank without noopener/noreferrer can enable reverse-tabnabbing, so this carries meaningful user-impact risk.
lib/stripe/createClientCheckoutSession.ts uses __blank instead of _blank in window.open, which is a lower-severity behavior bug but could cause inconsistent new-tab behavior.
Given the high-confidence security finding (6/10) plus a secondary navigation issue, this has some merge risk and is worth fixing before or immediately after merge.
Pay close attention to lib/stripe/createClientPortalSession.ts and lib/stripe/createClientCheckoutSession.ts - tab-opening behavior needs security and correctness adjustments.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="lib/stripe/createClientCheckoutSession.ts">

<violation number="1" location="lib/stripe/createClientCheckoutSession.ts:25">
P2: Use `_blank` instead of `__blank` in `window.open` to ensure standard new-tab behavior.</violation>
</file>

<file name="lib/stripe/createClientPortalSession.ts">

<violation number="1" location="lib/stripe/createClientPortalSession.ts:25">
P2: Opening a new tab with `_blank` without `noopener`/`noreferrer` introduces a reverse-tabnabbing risk.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

Per CHAT_API_MIGRATION_FINDINGS REST cleanup, the dedicated endpoints land at the REST-aligned paths: /api/subscriptions/sessions -> /api/stripe/checkout-sessions /api/subscriptions/portal-sessions -> /api/stripe/portal-sessions

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6ceebb47cf

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-05-01T14:18:41Z

-      headers: {
-        "Content-Type": "application/json",
+    const response = await fetch(
+      `${getClientApiBaseUrl()}/api/subscriptions/sessions`,


Point Stripe migration at renamed API routes

The new checkout caller is still targeting /api/subscriptions/sessions, but the paired API migration (recoupable/api#499, commit a326a8b) renames these endpoints to /api/stripe/checkout-sessions and /api/stripe/portal-sessions; with that backend in place this request path returns 404, so clicking Subscribe/Billing can no longer open Stripe. Please update this URL (and the matching portal caller) to the renamed route set so chat and api stay in parity.

Useful? React with 👍 / 👎.

cubic-dev-ai

2 issues found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="lib/stripe/createClientCheckoutSession.ts">

<violation number="1" location="lib/stripe/createClientCheckoutSession.ts:6">
P1: Checkout session creation is calling the wrong migrated endpoint path (`/api/stripe/checkout-sessions` instead of `/api/subscriptions/sessions`), which can break opening Stripe checkout.</violation>
</file>

<file name="lib/stripe/createClientPortalSession.ts">

<violation number="1" location="lib/stripe/createClientPortalSession.ts:6">
P1: The endpoint was changed to the old `/api/stripe/portal-sessions` route, but this migration requires `/api/subscriptions/portal-sessions`, so portal session creation can fail.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai · 2026-05-01T14:21:28Z

-      headers: {
-        "Content-Type": "application/json",
+    const response = await fetch(
+      `${getClientApiBaseUrl()}/api/stripe/portal-sessions`,


P1: The endpoint was changed to the old /api/stripe/portal-sessions route, but this migration requires /api/subscriptions/portal-sessions, so portal session creation can fail.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At lib/stripe/createClientPortalSession.ts, line 6: <comment>The endpoint was changed to the old `/api/stripe/portal-sessions` route, but this migration requires `/api/subscriptions/portal-sessions`, so portal session creation can fail.</comment> <file context> @@ -3,7 +3,7 @@ import { getClientApiBaseUrl } from "@/lib/api/getClientApiBaseUrl"; try { const response = await fetch( - `${getClientApiBaseUrl()}/api/subscriptions/portal-sessions`, + `${getClientApiBaseUrl()}/api/stripe/portal-sessions`, { method: "POST", </file context>

Suggested change

`${getClientApiBaseUrl()}/api/stripe/portal-sessions`,

`${getClientApiBaseUrl()}/api/subscriptions/portal-sessions`,

Resolves overlap with #1729 (which landed local /api/subscriptions/portal helper updates on test concurrently). Keeps the better error handling and noopener,noreferrer security flags from test, but points at the migration-doc-aligned /api/stripe/{checkout,portal}-sessions paths. Drops a duplicate getAccessToken declaration in useSubscribeClick.

arpitgupta1214 · 2026-05-09T14:59:00Z

Closing alongside api#499 — chat-side Group 4 cutover already shipped to chat/test via separate PRs (chat callers point at /api/subscriptions/{sessions,portal} with Bearer auth; local stripe routes deleted). This PR's only remaining value was a URL rename, which we're deferring.

arpitgupta1214 requested a review from sweetmantech as a code owner May 1, 2026 14:07

vercel Bot deployed to Preview – chat May 1, 2026 14:09 View deployment

cubic-dev-ai Bot reviewed May 1, 2026

View reviewed changes

Comment thread lib/stripe/createClientCheckoutSession.ts Outdated

Comment thread lib/stripe/createClientPortalSession.ts Outdated

chatgpt-codex-connector Bot reviewed May 1, 2026

View reviewed changes

vercel Bot deployed to Preview – chat May 1, 2026 14:19 View deployment

cubic-dev-ai Bot reviewed May 1, 2026

View reviewed changes

vercel Bot deployed to Preview – chat May 9, 2026 14:31 View deployment

arpitgupta1214 closed this May 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(chat): migrate POST /api/stripe/{session,portal}/create#1726

chore(chat): migrate POST /api/stripe/{session,portal}/create#1726
arpitgupta1214 wants to merge 3 commits intotestfrom
migrate/stripe-group4

arpitgupta1214 commented May 1, 2026

Uh oh!

vercel Bot commented May 1, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 1, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 1, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

cubic-dev-ai Bot May 1, 2026

Uh oh!

arpitgupta1214 commented May 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	`${getClientApiBaseUrl()}/api/stripe/portal-sessions`,
	`${getClientApiBaseUrl()}/api/subscriptions/portal-sessions`,

Conversation

arpitgupta1214 commented May 1, 2026

Test plan

Uh oh!

vercel Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented May 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 1, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot May 1, 2026

Choose a reason for hiding this comment

Uh oh!

arpitgupta1214 commented May 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented May 1, 2026 •

edited

Loading

coderabbitai Bot commented May 1, 2026 •

edited

Loading