Comprehensive admin + user dashboards (production-ready)

lib/billing/webhooks/paypal.ts

@@ -1,6 +1,7 @@
+import { z } from "zod";
 import { upsertSubscription } from "../subscription";
 import { planFromPaypalPlan } from "../catalog";
-import type { PlanKey } from "../plans";
+import { PLAN_ORDER, type PlanKey } from "../plans";
 
 interface PaypalResource {
   id?: string;
@@ -14,15 +15,30 @@ interface PaypalEvent {
   resource: PaypalResource;
 }
 
+// custom_id is attacker-influenceable JSON; validate it strictly and never trust
+// it to default to a paid plan.
+const customSchema = z.object({
+  subjectId: z.string().min(1),
+  subjectType: z.enum(["user", "organization"]),
+  plan: z.enum(PLAN_ORDER as [PlanKey, ...PlanKey[]]),
+});
+
 function parseCustom(
   custom?: string
 ): { subjectId: string; subjectType: "user" | "organization"; plan: PlanKey } | null {
   if (!custom) return null;
+  let raw: unknown;
   try {
-    return JSON.parse(custom);
+    raw = JSON.parse(custom);
   } catch {
     return null;
   }
+  const parsed = customSchema.safeParse(raw);
+  if (!parsed.success) {
+    console.warn("[paypal] invalid custom_id payload, skipping");
+    return null;
+  }
+  return parsed.data;
 }
 
 async function sync(resource: PaypalResource, status: string) {

lib/billing/webhooks/stripe.ts

@@ -2,7 +2,12 @@ import type Stripe from "stripe";
 import { stripe } from "../stripe";
 import { upsertSubscription } from "../subscription";
 import { planFromStripePrice } from "../catalog";
-import type { PlanKey } from "../plans";
+import { PLAN_ORDER, type PlanKey } from "../plans";
+
+/** Narrow attacker-influenceable metadata to a known PlanKey, else null. */
+function planFromMetadata(value?: string | null): PlanKey | null {
+  return value && (PLAN_ORDER as string[]).includes(value) ? (value as PlanKey) : null;
+}
 
 function normalizeStatus(status: Stripe.Subscription.Status): string {
   switch (status) {
@@ -23,9 +28,11 @@ async function syncStripeSubscription(
   const item = sub.items.data[0];
   const priceId = item?.price?.id;
   const mapped = priceId ? planFromStripePrice(priceId) : null;
-  const plan = ((metadata?.plan as PlanKey) || mapped?.plan || "free") as PlanKey;
+  // metadata.plan is attacker-influenceable; only honour it if it's a known plan.
+  // The price-mapping fallback (derived from the real Stripe price) is preferred.
+  const plan: PlanKey = planFromMetadata(metadata?.plan) ?? mapped?.plan ?? "free";
   const referenceId = metadata?.subjectId || sub.metadata?.subjectId;
-  if (!referenceId) {
+  if (!referenceId || referenceId.trim() === "") {
     console.warn("[stripe] subscription without subjectId metadata, skipping", sub.id);
     return;
   }