Skip to content

fix(billing): prevent Plus demotion on duplicate checkout expiry - #28

Draft
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-bug-identification-7676
Draft

cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-bug-identification-7676

Conversation

@cursor

@cursor cursor Bot commented Oct 8, 2026

Copy link
Copy Markdown
Contributor

Bug and impact

An workspace already on Plus (active_plus) could call POST /v1/billing/checkout. beginCheckout unconditionally set subscription.state to checkout_pending. When that second Xendit session expired, applyVerifiedPaymentEvent treated it like an abandoned first-time checkout and downgraded the workspace to free, revoking Plus without a real renewal failure.

Root cause

Fix

  • Reject new checkout when subscription is active_plus or grace_period (409).
  • On renewal_failed with checkout_pending, if entitlement is still active_plus or grace_period, restore the subscription row from entitlement instead of downgrading to free.

Validation

  • vitest run packages/db/src/platform.test.ts — 15 passed (includes new regression tests).
Open in Web View Automation 

beginCheckout must not overwrite active_plus or grace_period with
checkout_pending. When an abandoned checkout session expires, restore the
subscription from authoritative entitlement state instead of downgrading
paying customers to free.

Co-Authored-By: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: drferdiiskandar <drferdiiskandar@sentrahai.com>
@vercel

vercel Bot commented Oct 8, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
sentrabot-site Skipped Skipped Oct 8, 2026 11:17am UTC

Request Review

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

status check only

Open in Web View Automation 

Sent by Cursor Automation: Find critical bugs

This branch was previously deployed

1 inactive deployment
Preview — 00ac35e0 Deployed Oct 8, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant