better_auth-stripe 0.2.1 → 0.6.2

data/lib/better_auth/stripe/client_adapter.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "stripe"
+
+module BetterAuth
+  module Stripe
+    class ClientAdapter
+      attr_reader :customers, :checkout, :billing_portal, :subscriptions, :prices, :subscription_schedules, :webhooks
+
+      def initialize(api_key)
+        client = ::Stripe::StripeClient.new(api_key)
+        @customers = ResourceAdapter.new(client.v1.customers)
+        @checkout = NamespaceAdapter.new(sessions: ResourceAdapter.new(client.v1.checkout.sessions))
+        @billing_portal = NamespaceAdapter.new(sessions: ResourceAdapter.new(client.v1.billing_portal.sessions))
+        @subscriptions = ResourceAdapter.new(client.v1.subscriptions)
+        @prices = ResourceAdapter.new(client.v1.prices)
+        @subscription_schedules = ResourceAdapter.new(client.v1.subscription_schedules)
+        @webhooks = WebhooksAdapter.new
+      end
+    end
+
+    class NamespaceAdapter
+      def initialize(resources)
+        resources.each do |name, resource|
+          instance_variable_set(:"@#{name}", resource)
+          self.class.attr_reader(name) unless respond_to?(name)
+        end
+      end
+    end
+
+    class ResourceAdapter
+      def initialize(resource)
+        @resource = resource
+      end
+
+      def create(params = {}, options = nil)
+        options ? @resource.create(params || {}, options) : @resource.create(params || {})
+      end
+
+      def list(params = {})
+        @resource.list(params || {})
+      end
+
+      def search(params = {})
+        @resource.search(params || {})
+      end
+
+      def retrieve(id)
+        @resource.retrieve(id)
+      end
+
+      def update(id, params = {})
+        @resource.update(id, params || {})
+      end
+
+      def release(id)
+        @resource.release(id)
+      end
+    end
+
+    class WebhooksAdapter
+      def construct_event(payload, signature, secret)
+        ::Stripe::Webhook.construct_event(payload, signature, secret)
+      end
+
+      def construct_event_async(payload, signature, secret)
+        construct_event(payload, signature, secret)
+      end
+    end
+  end
+end

data/lib/better_auth/stripe/error_codes.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Stripe
+    remove_const(:ERROR_CODES) if const_defined?(:ERROR_CODES, false)
+
+    ERROR_CODES = {
+      "UNAUTHORIZED" => "Unauthorized access",
+      "EMAIL_VERIFICATION_REQUIRED" => "Email verification required",
+      "SUBSCRIPTION_NOT_FOUND" => "Subscription not found",
+      "SUBSCRIPTION_PLAN_NOT_FOUND" => "Subscription plan not found",
+      "ALREADY_SUBSCRIBED_PLAN" => "You're already subscribed to this plan",
+      "REFERENCE_ID_NOT_ALLOWED" => "Reference id is not allowed",
+      "CUSTOMER_NOT_FOUND" => "Stripe customer not found for this user",
+      "UNABLE_TO_CREATE_CUSTOMER" => "Unable to create customer",
+      "UNABLE_TO_CREATE_BILLING_PORTAL" => "Unable to create billing portal session",
+      "ORGANIZATION_NOT_FOUND" => "Organization not found",
+      "ORGANIZATION_SUBSCRIPTION_NOT_ENABLED" => "Organization subscription is not enabled",
+      "AUTHORIZE_REFERENCE_REQUIRED" => "Organization subscriptions require authorizeReference callback to be configured",
+      "ORGANIZATION_HAS_ACTIVE_SUBSCRIPTION" => "Cannot delete organization with active subscription",
+      "ORGANIZATION_REFERENCE_ID_REQUIRED" => "Reference ID is required. Provide referenceId or set activeOrganizationId in session",
+      "SUBSCRIPTION_NOT_ACTIVE" => "Subscription is not active",
+      "SUBSCRIPTION_NOT_SCHEDULED_FOR_CANCELLATION" => "Subscription is not scheduled for cancellation",
+      "STRIPE_SIGNATURE_NOT_FOUND" => "Stripe signature not found",
+      "STRIPE_WEBHOOK_SECRET_NOT_FOUND" => "Stripe webhook secret not found",
+      "FAILED_TO_CONSTRUCT_STRIPE_EVENT" => "Failed to construct Stripe event",
+      "STRIPE_WEBHOOK_ERROR" => "Stripe webhook error",
+      "INVALID_CUSTOMER_TYPE" => "Customer type must be either user or organization",
+      "INVALID_REQUEST_BODY" => "Invalid request body"
+    }.freeze
+  end
+end

data/lib/better_auth/stripe/hooks.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Stripe
+    module Hooks
+      module_function
+
+      def handle_event(ctx, event)
+        event = BetterAuth::Plugins.normalize_hash(event)
+        type = event[:type].to_s
+        case type
+        when "checkout.session.completed"
+          on_checkout_completed(ctx, event)
+        when "customer.subscription.created"
+          on_subscription_created(ctx, event)
+        when "customer.subscription.updated"
+          on_subscription_updated(ctx, event)
+        when "customer.subscription.deleted"
+          on_subscription_deleted(ctx, event)
+        end
+        config = stripe_config(ctx)
+        config[:on_event]&.call(event)
+      end
+
+      def on_checkout_completed(ctx, event)
+        config = stripe_config(ctx)
+        object = BetterAuth::Plugins.normalize_hash(event.dig(:data, :object) || {})
+        return if object[:mode] == "setup" || !config.dig(:subscription, :enabled)
+
+        stripe_subscription = BetterAuth::Stripe::Utils.client(config).subscriptions.retrieve(object[:subscription])
+        resolved = BetterAuth::Stripe::Utils.resolve_plan_item(config, stripe_subscription)
+        return unless resolved
+
+        item = resolved.fetch(:item)
+        plan = resolved.fetch(:plan)
+        metadata = BetterAuth::Plugins.normalize_hash(object[:metadata] || {})
+        reference_id = object[:client_reference_id] || metadata[:reference_id]
+        subscription_id = metadata[:subscription_id]
+        return unless plan && reference_id && subscription_id
+
+        update = BetterAuth::Stripe::Utils.subscription_state(stripe_subscription, include_status: true).merge(
+          plan: plan[:name].to_s.downcase,
+          stripeSubscriptionId: object[:subscription],
+          seats: BetterAuth::Stripe::Utils.resolve_quantity(stripe_subscription, item, plan),
+          trialStart: BetterAuth::Stripe::Utils.time(BetterAuth::Stripe::Utils.fetch(stripe_subscription, "trial_start")),
+          trialEnd: BetterAuth::Stripe::Utils.time(BetterAuth::Stripe::Utils.fetch(stripe_subscription, "trial_end"))
+        ).compact
+        db_subscription = ctx.context.adapter.update(model: "subscription", where: [{field: "id", value: subscription_id}], update: update)
+        plan.dig(:free_trial, :on_trial_start)&.call(db_subscription) if db_subscription && update[:trialStart]
+        callback = config.dig(:subscription, :on_subscription_complete)
+        callback&.call({event: event, subscription: db_subscription, stripeSubscription: stripe_subscription, stripe_subscription: stripe_subscription, plan: plan}, ctx)
+      end
+
+      def on_subscription_created(ctx, event)
+        config = stripe_config(ctx)
+        object = BetterAuth::Plugins.normalize_hash(event.dig(:data, :object) || {})
+        customer_id = object[:customer].to_s
+        return if customer_id.empty?
+
+        metadata = BetterAuth::Plugins.normalize_hash(object[:metadata] || {})
+        existing = if metadata[:subscription_id]
+          ctx.context.adapter.find_one(model: "subscription", where: [{field: "id", value: metadata[:subscription_id]}])
+        else
+          ctx.context.adapter.find_one(model: "subscription", where: [{field: "stripeSubscriptionId", value: object[:id]}])
+        end
+        return if existing
+
+        reference = BetterAuth::Stripe::Middleware.reference_by_customer(ctx, config, customer_id) || ((metadata[:reference_id] && metadata[:plan]) ? {reference_id: metadata[:reference_id], customer_type: metadata[:customer_type] || "user"} : nil)
+        return unless reference
+
+        resolved = BetterAuth::Stripe::Utils.resolve_plan_item(config, object)
+        return unless resolved
+
+        item = resolved.fetch(:item)
+        plan = resolved[:plan] || (metadata[:plan] && BetterAuth::Stripe::Utils.plan_by_name(config, metadata[:plan]))
+        return unless plan
+
+        created = ctx.context.adapter.create(
+          model: "subscription",
+          data: BetterAuth::Stripe::Utils.subscription_state(object, include_status: true).merge(
+            referenceId: reference.fetch(:reference_id),
+            stripeCustomerId: customer_id,
+            stripeSubscriptionId: object[:id],
+            plan: plan[:name].to_s.downcase,
+            seats: BetterAuth::Stripe::Utils.resolve_quantity(object, item, plan),
+            limits: plan[:limits]
+          ).compact
+        )
+        config.dig(:subscription, :on_subscription_created)&.call({event: event, subscription: created, stripeSubscription: object, stripe_subscription: object, plan: plan})
+      end
+
+      def on_subscription_updated(ctx, event)
+        config = stripe_config(ctx)
+        object = BetterAuth::Plugins.normalize_hash(event.dig(:data, :object) || {})
+        resolved = BetterAuth::Stripe::Utils.resolve_plan_item(config, object)
+        return unless resolved
+
+        item = resolved.fetch(:item)
+        metadata = BetterAuth::Plugins.normalize_hash(object[:metadata] || {})
+        subscription = if metadata[:subscription_id]
+          ctx.context.adapter.find_one(model: "subscription", where: [{field: "id", value: metadata[:subscription_id]}])
+        else
+          ctx.context.adapter.find_one(model: "subscription", where: [{field: "stripeSubscriptionId", value: object[:id]}])
+        end
+        unless subscription
+          candidates = ctx.context.adapter.find_many(model: "subscription", where: [{field: "stripeCustomerId", value: object[:customer]}])
+          subscription = if candidates.length > 1
+            candidates.find { |entry| BetterAuth::Stripe::Utils.active_or_trialing?(entry) }
+          else
+            candidates.first
+          end
+        end
+        return unless subscription
+
+        plan = resolved[:plan]
+        was_pending = BetterAuth::Stripe::Utils.pending_cancel?(subscription)
+        update = BetterAuth::Stripe::Utils.subscription_state(object, include_status: true, compact: false).merge(
+          stripeSubscriptionId: object[:id],
+          seats: BetterAuth::Stripe::Utils.resolve_quantity(object, item, plan)
+        )
+        update[:plan] = plan[:name].to_s.downcase if plan
+        update[:limits] = plan[:limits] if plan&.key?(:limits)
+        updated = ctx.context.adapter.update(model: "subscription", where: [{field: "id", value: subscription.fetch("id")}], update: update)
+        if object[:status] == "active" && BetterAuth::Stripe::Utils.stripe_pending_cancel?(object) && !was_pending
+          config.dig(:subscription, :on_subscription_cancel)&.call({event: event, subscription: subscription, stripeSubscription: object, stripe_subscription: object, cancellationDetails: object[:cancellation_details], cancellation_details: object[:cancellation_details]})
+        end
+        config.dig(:subscription, :on_subscription_update)&.call({event: event, subscription: updated || subscription})
+        if plan && subscription["status"] == "trialing" && object[:status] == "active"
+          plan.dig(:free_trial, :on_trial_end)&.call({subscription: subscription}, ctx)
+        end
+        if plan && subscription["status"] == "trialing" && object[:status] == "incomplete_expired"
+          plan.dig(:free_trial, :on_trial_expired)&.call(subscription, ctx)
+        end
+      end
+
+      def on_subscription_deleted(ctx, event)
+        config = stripe_config(ctx)
+        object = BetterAuth::Plugins.normalize_hash(event.dig(:data, :object) || {})
+        subscription = ctx.context.adapter.find_one(model: "subscription", where: [{field: "stripeSubscriptionId", value: object[:id]}])
+        return unless subscription
+
+        ctx.context.adapter.update(model: "subscription", where: [{field: "id", value: subscription.fetch("id")}], update: BetterAuth::Stripe::Utils.subscription_state(object, include_status: false, compact: false).merge(status: "canceled", stripeScheduleId: nil))
+        config.dig(:subscription, :on_subscription_deleted)&.call({event: event, subscription: subscription, stripeSubscription: object, stripe_subscription: object})
+      end
+
+      def stripe_config(ctx)
+        ctx.context.options.plugins.find { |plugin| plugin.id == "stripe" }&.options || {}
+      end
+    end
+  end
+end

data/lib/better_auth/stripe/metadata.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Stripe
+    module Metadata
+      UNSAFE_KEYS = %w[__proto__ constructor prototype].freeze
+
+      module_function
+
+      def merge(internal, *user_metadata)
+        user_metadata.compact
+          .reduce({}) do |acc, entry|
+            next acc unless entry.respond_to?(:each)
+
+            acc.merge(entry.each_with_object({}) do |(key, value), result|
+              metadata_key = metadata_key(key)
+              result[metadata_key] = value unless UNSAFE_KEYS.include?(metadata_key)
+            end)
+          end
+          .merge(internal.transform_keys { |key| metadata_key(key) })
+      end
+
+      def customer_set(internal_fields, *user_metadata)
+        merge(internal_fields, *user_metadata)
+      end
+
+      def customer_get(metadata)
+        {
+          userId: metadata_fetch(metadata, "userId"),
+          organizationId: metadata_fetch(metadata, "organizationId"),
+          customerType: metadata_fetch(metadata, "customerType")
+        }
+      end
+
+      def subscription_set(internal_fields, *user_metadata)
+        merge(internal_fields, *user_metadata)
+      end
+
+      def subscription_get(metadata)
+        {
+          userId: metadata_fetch(metadata, "userId"),
+          subscriptionId: metadata_fetch(metadata, "subscriptionId"),
+          referenceId: metadata_fetch(metadata, "referenceId")
+        }
+      end
+
+      def metadata_key(key)
+        case BetterAuth::Plugins.normalize_key(key)
+        when :user_id then "userId"
+        when :organization_id then "organizationId"
+        when :customer_type then "customerType"
+        when :subscription_id then "subscriptionId"
+        when :reference_id then "referenceId"
+        else
+          key.to_s
+        end
+      end
+
+      def metadata_fetch(metadata, key)
+        return nil unless metadata.respond_to?(:[])
+
+        metadata[key] || metadata[key.to_sym] || metadata[BetterAuth::Plugins.normalize_key(key)] || metadata[BetterAuth::Plugins.normalize_key(key).to_s]
+      end
+
+      def deep_merge(base, override)
+        BetterAuth::Plugins.normalize_hash(base).merge(BetterAuth::Plugins.normalize_hash(override)) do |_key, old, new|
+          if old.is_a?(Hash) && new.is_a?(Hash)
+            deep_merge(old, new)
+          else
+            new
+          end
+        end
+      end
+
+      def stringify_keys(value)
+        return value unless value.is_a?(Hash)
+
+        value.each_with_object({}) do |(key, object), result|
+          result[key.to_s] = object
+          result[key.to_sym] = object
+        end
+      end
+    end
+  end
+end

data/lib/better_auth/stripe/middleware.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Stripe
+    module Middleware
+      module_function
+
+      def reference_id!(_ctx, session, customer_type, explicit_reference_id, config)
+        return explicit_reference_id || session.fetch(:user).fetch("id") unless customer_type == "organization"
+        raise APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("ORGANIZATION_SUBSCRIPTION_NOT_ENABLED")) unless config.dig(:organization, :enabled)
+
+        reference_id = explicit_reference_id || session.fetch(:session)["activeOrganizationId"]
+        raise APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("ORGANIZATION_REFERENCE_ID_REQUIRED")) if reference_id.to_s.empty?
+
+        reference_id
+      end
+
+      def authorize_reference!(ctx, session, reference_id, action, customer_type, subscription_options, explicit: false)
+        callback = subscription_options[:authorize_reference]
+        if customer_type == "organization"
+          raise APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("AUTHORIZE_REFERENCE_REQUIRED")) unless callback
+        elsif !explicit || reference_id == session.fetch(:user).fetch("id")
+          return
+        elsif !callback
+          raise APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("REFERENCE_ID_NOT_ALLOWED"))
+        end
+
+        allowed = callback.call({user: session.fetch(:user), session: session.fetch(:session), referenceId: reference_id, reference_id: reference_id, action: action}, ctx)
+        raise APIError.new("UNAUTHORIZED", message: BetterAuth::Stripe::ERROR_CODES.fetch("UNAUTHORIZED")) unless allowed
+      end
+
+      def customer_type!(source)
+        body = BetterAuth::Plugins.normalize_hash(source || {})
+        customer_type = (body[:customer_type] || "user").to_s
+        raise APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("INVALID_CUSTOMER_TYPE")) unless BetterAuth::Stripe::Types::CUSTOMER_TYPES.include?(customer_type)
+
+        customer_type
+      end
+
+      def reference_by_customer(ctx, config, customer_id)
+        if config.dig(:organization, :enabled)
+          org = ctx.context.adapter.find_one(model: "organization", where: [{field: "stripeCustomerId", value: customer_id}])
+          return {customer_type: "organization", reference_id: org.fetch("id")} if org
+        end
+        user = ctx.context.adapter.find_one(model: "user", where: [{field: "stripeCustomerId", value: customer_id}])
+        return {customer_type: "user", reference_id: user.fetch("id")} if user
+
+        nil
+      end
+    end
+  end
+end

data/lib/better_auth/stripe/organization_hooks.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Stripe
+    module OrganizationHooks
+      module_function
+
+      def hooks(config)
+        return {} unless config.dig(:organization, :enabled)
+
+        {
+          after_update_organization: lambda do |data, _ctx|
+            organization = data[:organization] || data["organization"]
+            next unless organization && organization["stripeCustomerId"]
+
+            customer = BetterAuth::Stripe::Utils.client(config).customers.retrieve(organization["stripeCustomerId"])
+            next if BetterAuth::Stripe::Utils.fetch(customer, "deleted")
+            next if BetterAuth::Stripe::Utils.fetch(customer, "name") == organization["name"]
+
+            BetterAuth::Stripe::Utils.client(config).customers.update(organization["stripeCustomerId"], name: organization["name"])
+          rescue
+            nil
+          end,
+          before_delete_organization: lambda do |data, _ctx|
+            organization = data[:organization] || data["organization"]
+            next unless organization && organization["stripeCustomerId"]
+
+            subscriptions = BetterAuth::Stripe::Utils.client(config).subscriptions.list(customer: organization["stripeCustomerId"], status: "all", limit: 100)
+            active = Array(BetterAuth::Stripe::Utils.fetch(subscriptions, "data")).any? do |subscription|
+              !%w[canceled incomplete incomplete_expired].include?(BetterAuth::Stripe::Utils.fetch(subscription, "status").to_s)
+            end
+            raise APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("ORGANIZATION_HAS_ACTIVE_SUBSCRIPTION")) if active
+          end,
+          after_add_member: ->(data, ctx) { sync_seats(config, data, ctx) },
+          after_remove_member: ->(data, ctx) { sync_seats(config, data, ctx) },
+          after_accept_invitation: ->(data, ctx) { sync_seats(config, data, ctx) }
+        }
+      end
+
+      def sync_seats(config, data, ctx)
+        organization = data[:organization] || data["organization"]
+        return unless config.dig(:subscription, :enabled) && organization && organization["stripeCustomerId"]
+
+        member_count = ctx.context.adapter.count(model: "member", where: [{field: "organizationId", value: organization.fetch("id")}])
+        seat_plans = BetterAuth::Stripe::Utils.plans(config).select { |plan| plan[:seat_price_id] }
+        return if seat_plans.empty?
+
+        subscription = ctx.context.adapter.find_many(model: "subscription", where: [{field: "referenceId", value: organization.fetch("id")}]).find { |entry| BetterAuth::Stripe::Utils.active_or_trialing?(entry) }
+        return unless subscription && subscription["stripeSubscriptionId"]
+
+        plan = seat_plans.find { |entry| entry[:name].to_s.downcase == subscription["plan"].to_s.downcase }
+        return unless plan
+
+        stripe_subscription = BetterAuth::Stripe::Utils.client(config).subscriptions.retrieve(subscription["stripeSubscriptionId"])
+        return unless BetterAuth::Stripe::Utils.active_or_trialing?(stripe_subscription)
+
+        items = Array(BetterAuth::Stripe::Utils.fetch(BetterAuth::Stripe::Utils.fetch(stripe_subscription, "items") || {}, "data"))
+        seat_item = items.find { |item| BetterAuth::Stripe::Utils.fetch(BetterAuth::Stripe::Utils.fetch(item, "price") || {}, "id") == plan[:seat_price_id] }
+        return if seat_item && BetterAuth::Stripe::Utils.fetch(seat_item, "quantity").to_i == member_count.to_i
+
+        update_items = if seat_item
+          [{id: BetterAuth::Stripe::Utils.fetch(seat_item, "id"), quantity: member_count}]
+        else
+          [{price: plan[:seat_price_id], quantity: member_count}]
+        end
+        BetterAuth::Stripe::Utils.client(config).subscriptions.update(subscription["stripeSubscriptionId"], items: update_items, proration_behavior: plan[:proration_behavior] || "create_prorations")
+        ctx.context.adapter.update(model: "subscription", where: [{field: "id", value: subscription.fetch("id")}], update: {seats: member_count})
+      rescue
+        nil
+      end
+    end
+  end
+end

data/lib/better_auth/stripe/plugin_factory.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "securerandom"
+
+module BetterAuth
+  module Stripe
+    module PluginFactory
+      module_function
+
+      def build(options = {})
+        config = BetterAuth::Plugins.normalize_hash(options)
+        BetterAuth::Plugin.new(
+          id: "stripe",
+          version: BetterAuth::Stripe::VERSION,
+          init: ->(ctx) { {context: {schema: BetterAuth::Schema.auth_tables(ctx.options)}} },
+          schema: BetterAuth::Stripe::Schema.schema(config),
+          endpoints: BetterAuth::Stripe::Routes.endpoints(config),
+          error_codes: BetterAuth::Stripe::ERROR_CODES,
+          options: config.merge(database_hooks: database_hooks(config), organization_hooks: BetterAuth::Stripe::OrganizationHooks.hooks(config))
+        )
+      end
+
+      def database_hooks(config)
+        return {} unless config[:create_customer_on_sign_up]
+
+        {
+          user: {
+            create: {
+              before: lambda do |data, hook_ctx|
+                next unless data["email"] && !data["stripeCustomerId"]
+
+                data["id"] ||= SecureRandom.hex(16)
+                customer = BetterAuth::Plugins.stripe_find_or_create_user_customer(config, data, nil, hook_ctx)
+                {data: {id: data["id"], stripeCustomerId: BetterAuth::Stripe::Utils.id(customer)}}
+              rescue
+                nil
+              end
+            },
+            update: {
+              after: lambda do |user, _ctx|
+                next unless user && user["stripeCustomerId"]
+
+                customer = BetterAuth::Stripe::Utils.client(config).customers.retrieve(user["stripeCustomerId"])
+                next if BetterAuth::Stripe::Utils.fetch(customer, "deleted")
+                next if BetterAuth::Stripe::Utils.fetch(customer, "email") == user["email"]
+
+                BetterAuth::Stripe::Utils.client(config).customers.update(user["stripeCustomerId"], email: user["email"])
+              rescue
+                nil
+              end
+            }
+          }
+        }
+      end
+    end
+  end
+end

data/lib/better_auth/stripe/routes/cancel_subscription.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Stripe
+    module Routes
+      module CancelSubscription
+        module_function
+
+        def endpoint(config)
+          BetterAuth::Endpoint.new(path: "/subscription/cancel", method: "POST") do |ctx|
+            session = BetterAuth::Routes.current_session(ctx)
+            body = BetterAuth::Plugins.normalize_hash(ctx.body)
+            customer_type = BetterAuth::Plugins.stripe_customer_type!(body)
+            reference_id = BetterAuth::Plugins.stripe_reference_id!(ctx, session, customer_type, body[:reference_id], config)
+            BetterAuth::Plugins.stripe_authorize_reference!(ctx, session, reference_id, "cancel-subscription", customer_type, BetterAuth::Plugins.stripe_subscription_options(config), explicit: body.key?(:reference_id))
+            subscription = BetterAuth::Plugins.stripe_find_subscription_for_action(ctx, reference_id, body[:subscription_id], active_only: true)
+            raise BetterAuth::APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("SUBSCRIPTION_NOT_FOUND")) unless subscription && subscription["stripeCustomerId"]
+
+            active = BetterAuth::Plugins.stripe_active_subscriptions(config, subscription["stripeCustomerId"])
+            if active.empty?
+              ctx.context.adapter.delete_many(model: "subscription", where: [{field: "referenceId", value: reference_id}])
+              raise BetterAuth::APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("SUBSCRIPTION_NOT_FOUND"))
+            end
+            stripe_subscription = active.find { |entry| BetterAuth::Plugins.stripe_fetch(entry, "id") == subscription["stripeSubscriptionId"] }
+            raise BetterAuth::APIError.new("BAD_REQUEST", message: BetterAuth::Stripe::ERROR_CODES.fetch("SUBSCRIPTION_NOT_FOUND")) unless stripe_subscription
+
+            portal = BetterAuth::Plugins.stripe_client(config).billing_portal.sessions.create(
+              customer: subscription["stripeCustomerId"],
+              return_url: BetterAuth::Plugins.stripe_url(ctx, "#{ctx.context.base_url}/subscription/cancel/callback?callbackURL=#{Rack::Utils.escape(body[:return_url] || "/")}&subscriptionId=#{Rack::Utils.escape(subscription.fetch("id"))}"),
+              flow_data: {type: "subscription_cancel", subscription_cancel: {subscription: BetterAuth::Plugins.stripe_fetch(stripe_subscription, "id")}}
+            )
+            ctx.json(BetterAuth::Plugins.stripe_stringify_keys(portal).merge(redirect: BetterAuth::Plugins.stripe_redirect?(body)))
+          rescue BetterAuth::APIError
+            raise
+          rescue => error
+            if error.message.include?("already set to be canceled") && subscription && !BetterAuth::Plugins.stripe_pending_cancel?(subscription)
+              stripe_sub = BetterAuth::Plugins.stripe_client(config).subscriptions.retrieve(subscription["stripeSubscriptionId"])
+              ctx.context.adapter.update(model: "subscription", where: [{field: "id", value: subscription.fetch("id")}], update: BetterAuth::Plugins.stripe_subscription_state(stripe_sub, include_status: false))
+            end
+            raise BetterAuth::APIError.new("BAD_REQUEST", message: error.message)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/better_auth/stripe/routes/cancel_subscription_callback.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Stripe
+    module Routes
+      module CancelSubscriptionCallback
+        module_function
+
+        def endpoint(config)
+          BetterAuth::Endpoint.new(path: "/subscription/cancel/callback", method: "GET") do |ctx|
+            query = BetterAuth::Plugins.normalize_hash(ctx.query)
+            callback = query[:callback_url] || "/"
+            unless query[:subscription_id]
+              raise ctx.redirect(BetterAuth::Plugins.stripe_url(ctx, callback))
+            end
+            session = BetterAuth::Routes.current_session(ctx, allow_nil: true)
+            raise ctx.redirect(BetterAuth::Plugins.stripe_url(ctx, callback)) unless session
+
+            subscription = ctx.context.adapter.find_one(model: "subscription", where: [{field: "id", value: query[:subscription_id]}])
+            if subscription && !BetterAuth::Plugins.stripe_pending_cancel?(subscription) && subscription["stripeCustomerId"]
+              current = BetterAuth::Plugins.stripe_active_subscriptions(config || {}, subscription["stripeCustomerId"]).find { |entry| BetterAuth::Plugins.stripe_fetch(entry, "id") == subscription["stripeSubscriptionId"] }
+              if current && BetterAuth::Plugins.stripe_stripe_pending_cancel?(current)
+                ctx.context.adapter.update(model: "subscription", where: [{field: "id", value: subscription.fetch("id")}], update: BetterAuth::Plugins.stripe_subscription_state(current, include_status: true))
+                BetterAuth::Plugins.stripe_subscription_options(config || {})[:on_subscription_cancel]&.call({subscription: subscription, stripeSubscription: current, stripe_subscription: current, cancellationDetails: BetterAuth::Plugins.stripe_fetch(current, "cancellation_details"), cancellation_details: BetterAuth::Plugins.stripe_fetch(current, "cancellation_details"), event: nil})
+              end
+            end
+            raise ctx.redirect(BetterAuth::Plugins.stripe_url(ctx, callback))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/better_auth/stripe/routes/create_billing_portal.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Stripe
+    module Routes
+      module CreateBillingPortal
+        module_function
+
+        def endpoint(config)
+          BetterAuth::Endpoint.new(path: "/subscription/billing-portal", method: "POST") do |ctx|
+            session = BetterAuth::Routes.current_session(ctx)
+            body = BetterAuth::Plugins.normalize_hash(ctx.body)
+            customer_type = BetterAuth::Plugins.stripe_customer_type!(body)
+            reference_id = BetterAuth::Plugins.stripe_reference_id!(ctx, session, customer_type, body[:reference_id], config)
+            BetterAuth::Plugins.stripe_authorize_reference!(ctx, session, reference_id, "billing-portal", customer_type, BetterAuth::Plugins.stripe_subscription_options(config), explicit: body.key?(:reference_id))
+            customer_id = if customer_type == "organization"
+              org = ctx.context.adapter.find_one(model: "organization", where: [{field: "id", value: reference_id}])
+              org&.fetch("stripeCustomerId", nil) || BetterAuth::Plugins.stripe_active_subscription(ctx, reference_id)&.fetch("stripeCustomerId", nil)
+            else
+              session.fetch(:user)["stripeCustomerId"] || BetterAuth::Plugins.stripe_active_subscription(ctx, reference_id)&.fetch("stripeCustomerId", nil)
+            end
+            raise BetterAuth::APIError.new("NOT_FOUND", message: BetterAuth::Stripe::ERROR_CODES.fetch("CUSTOMER_NOT_FOUND")) unless customer_id
+
+            portal = BetterAuth::Plugins.stripe_client(config).billing_portal.sessions.create(customer: customer_id, return_url: BetterAuth::Plugins.stripe_url(ctx, body[:return_url] || "/"), locale: body[:locale])
+            ctx.json(BetterAuth::Plugins.stripe_stringify_keys(portal).merge(redirect: BetterAuth::Plugins.stripe_redirect?(body)))
+          rescue BetterAuth::APIError
+            raise
+          rescue
+            raise BetterAuth::APIError.new("INTERNAL_SERVER_ERROR", message: BetterAuth::Stripe::ERROR_CODES.fetch("UNABLE_TO_CREATE_BILLING_PORTAL"))
+          end
+        end
+      end
+    end
+  end
+end