Comprehensive admin + user dashboards (production-ready)

lib/billing/webhooks/stripe.ts

@@ -2,7 +2,12 @@ import type Stripe from "stripe";
 import { stripe } from "../stripe";
 import { upsertSubscription } from "../subscription";
 import { planFromStripePrice } from "../catalog";
-import type { PlanKey } from "../plans";
+import { PLAN_ORDER, type PlanKey } from "../plans";
+
+/** Narrow attacker-influenceable metadata to a known PlanKey, else null. */
+function planFromMetadata(value?: string | null): PlanKey | null {
+  return value && (PLAN_ORDER as string[]).includes(value) ? (value as PlanKey) : null;
+}
 
 function normalizeStatus(status: Stripe.Subscription.Status): string {
   switch (status) {
@@ -23,9 +28,11 @@ async function syncStripeSubscription(
   const item = sub.items.data[0];
   const priceId = item?.price?.id;
   const mapped = priceId ? planFromStripePrice(priceId) : null;
-  const plan = ((metadata?.plan as PlanKey) || mapped?.plan || "free") as PlanKey;
+  // metadata.plan is attacker-influenceable; only honour it if it's a known plan.
+  // The price-mapping fallback (derived from the real Stripe price) is preferred.
+  const plan: PlanKey = planFromMetadata(metadata?.plan) ?? mapped?.plan ?? "free";
   const referenceId = metadata?.subjectId || sub.metadata?.subjectId;
-  if (!referenceId) {
+  if (!referenceId || referenceId.trim() === "") {
     console.warn("[stripe] subscription without subjectId metadata, skipping", sub.id);
     return;
   }