@better-auth/stripe 1.8.0-beta.3 → 1.8.0-beta.5

package/dist/client.d.mts

@@ -1,4 +1,4 @@
-import { l as StripePlan, n as stripe } from "./index-BDmSmcUM.mjs";
+import { l as StripePlan, n as stripe } from "./index-C_aP9Dqi.mjs";
 //#region src/error-codes.d.ts
 export declare const STRIPE_ERROR_CODES: {
   UNAUTHORIZED: import("better-auth").RawError<"UNAUTHORIZED">;

package/dist/client.mjs

@@ -1,4 +1,4 @@
-import { n as STRIPE_ERROR_CODES, t as PACKAGE_VERSION } from "./version-CSLu0Cqn.mjs";
+import { n as STRIPE_ERROR_CODES, t as PACKAGE_VERSION } from "./version-CiZy3Q2W.mjs";
 //#region src/client.ts
 const stripeClient = (options) => {
 	return {

package/dist/{index-BDmSmcUM.d.mts → index-C_aP9Dqi.d.mts}

@@ -12,18 +12,22 @@ declare const subscriptions: {
       referenceId: {
         type: "string";
         required: true;
+        input: false;
       };
       stripeCustomerId: {
         type: "string";
         required: false;
+        input: false;
       };
       stripeSubscriptionId: {
         type: "string";
         required: false;
+        input: false;
       };
       status: {
         type: "string";
         defaultValue: string;
+        input: false;
       };
       periodStart: {
         type: "date";
@@ -69,6 +73,7 @@ declare const subscriptions: {
       stripeScheduleId: {
         type: "string";
         required: false;
+        input: false;
       };
     };
   };
@@ -79,6 +84,7 @@ declare const user: {
       stripeCustomerId: {
         type: "string";
         required: false;
+        input: false;
       };
     };
   };
@@ -89,6 +95,7 @@ declare const organization: {
       stripeCustomerId: {
         type: "string";
         required: false;
+        input: false;
       };
     };
   };
@@ -597,6 +604,7 @@ declare const stripe: <O extends StripeOptions>(options: O) => {
         session: StripeCtxSession;
       }>> | import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         referenceId: string;
+        customerType: CustomerType;
       }>> | import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>)[];
     }, {
       url: string;
@@ -684,6 +692,7 @@ declare const stripe: <O extends StripeOptions>(options: O) => {
         session: StripeCtxSession;
       }>> | import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         referenceId: string;
+        customerType: CustomerType;
       }>> | import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>)[];
     }, {
       url: string;
@@ -756,6 +765,7 @@ declare const stripe: <O extends StripeOptions>(options: O) => {
         session: StripeCtxSession;
       }>> | import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         referenceId: string;
+        customerType: CustomerType;
       }>>)[];
     }, Stripe.Response<Stripe.Subscription>>;
     listActiveSubscriptions: import("better-call").StrictEndpoint<"/subscription/list", {
@@ -824,6 +834,7 @@ declare const stripe: <O extends StripeOptions>(options: O) => {
         session: StripeCtxSession;
       }>> | import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         referenceId: string;
+        customerType: CustomerType;
       }>>)[];
     }, {
       limits: Record<string, unknown> | undefined;
@@ -849,7 +860,10 @@ declare const stripe: <O extends StripeOptions>(options: O) => {
     }[]>;
     subscriptionSuccess: import("better-call").StrictEndpoint<"/subscription/success", {
       method: "GET";
-      query: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
+      query: import("zod").ZodOptional<import("zod").ZodObject<{
+        callbackURL: import("zod").ZodOptional<import("zod").ZodString>;
+        checkoutSessionId: import("zod").ZodOptional<import("zod").ZodString>;
+      }, import("zod/v4/core").$strip>>;
       metadata: {
         openapi: {
           operationId: string;
@@ -926,6 +940,7 @@ declare const stripe: <O extends StripeOptions>(options: O) => {
         session: StripeCtxSession;
       }>> | import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         referenceId: string;
+        customerType: CustomerType;
       }>> | import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>)[];
     }, {
       url: string;
@@ -952,6 +967,7 @@ declare const stripe: <O extends StripeOptions>(options: O) => {
         stripeCustomerId: {
           type: "string";
           required: false;
+          input: false;
         };
       };
     };
@@ -967,18 +983,22 @@ declare const stripe: <O extends StripeOptions>(options: O) => {
         referenceId: {
           type: "string";
           required: true;
+          input: false;
         };
         stripeCustomerId: {
           type: "string";
           required: false;
+          input: false;
         };
         stripeSubscriptionId: {
           type: "string";
           required: false;
+          input: false;
         };
         status: {
           type: "string";
           defaultValue: string;
+          input: false;
         };
         periodStart: {
           type: "date";
@@ -1024,6 +1044,7 @@ declare const stripe: <O extends StripeOptions>(options: O) => {
         stripeScheduleId: {
           type: "string";
           required: false;
+          input: false;
         };
       };
     };
@@ -1035,6 +1056,7 @@ declare const stripe: <O extends StripeOptions>(options: O) => {
         stripeCustomerId: {
           type: "string";
           required: false;
+          input: false;
         };
       };
     };

package/dist/index.d.mts

@@ -1,2 +1,2 @@
-import { a as CheckoutSessionLocale, c as StripeOptions, d as SubscriptionOptions, f as WithActiveOrganizationId, i as CheckoutSessionLineItem, l as StripePlan, n as stripe, o as CustomerType, p as WithStripeCustomerId, r as AuthorizeReferenceAction, s as StripeCtxSession, t as StripePlugin, u as Subscription } from "./index-BDmSmcUM.mjs";
+import { a as CheckoutSessionLocale, c as StripeOptions, d as SubscriptionOptions, f as WithActiveOrganizationId, i as CheckoutSessionLineItem, l as StripePlan, n as stripe, o as CustomerType, p as WithStripeCustomerId, r as AuthorizeReferenceAction, s as StripeCtxSession, t as StripePlugin, u as Subscription } from "./index-C_aP9Dqi.mjs";
 export { type AuthorizeReferenceAction, type CheckoutSessionLineItem, type CheckoutSessionLocale, type CustomerType, type StripeCtxSession, type StripeOptions, type StripePlan, StripePlugin, type Subscription, type SubscriptionOptions, type WithActiveOrganizationId, type WithStripeCustomerId, stripe };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { n as STRIPE_ERROR_CODES, t as PACKAGE_VERSION } from "./version-CSLu0Cqn.mjs";
+import { n as STRIPE_ERROR_CODES, t as PACKAGE_VERSION } from "./version-CiZy3Q2W.mjs";
 import { APIError, HIDE_METADATA } from "better-auth";
 import { defu } from "defu";
 import { createAuthEndpoint, createAuthMiddleware } from "@better-auth/core/api";
@@ -152,31 +152,58 @@ async function resolvePlanItem(options, items) {
 * @internal
 */
 async function findReferenceByStripeCustomerId(ctx, options, stripeCustomerId) {
-	if (options.organization?.enabled) {
-		const org = await ctx.context.adapter.findOne({
-			model: "organization",
-			where: [{
-				field: "stripeCustomerId",
-				value: stripeCustomerId
-			}]
-		});
-		if (org) return {
+	const findCandidates = (model) => ctx.context.adapter.findMany({
+		model,
+		where: [{
+			field: "stripeCustomerId",
+			value: stripeCustomerId
+		}],
+		limit: 2
+	});
+	const orgs = options.organization?.enabled ? await findCandidates("organization") : [];
+	const users = await findCandidates("user");
+	if (orgs.length + users.length < 2) {
+		if (orgs[0]) return {
 			customerType: "organization",
-			referenceId: org.id
+			referenceId: orgs[0].id
+		};
+		if (users[0]) return {
+			customerType: "user",
+			referenceId: users[0].id
 		};
+		return null;
 	}
-	const user = await ctx.context.adapter.findOne({
-		model: "user",
+	const customer = await options.stripeClient.customers.retrieve(stripeCustomerId);
+	const { customerType, userId, organizationId } = customerMetadata.get(customer.deleted ? null : customer.metadata);
+	const namesOwner = customerType === "user" || customerType === "organization";
+	const referenceId = customerType === "organization" ? organizationId : userId;
+	if (!namesOwner || !referenceId) {
+		ctx.context.logger.warn(`Stripe webhook warning: Multiple records share stripeCustomerId ${stripeCustomerId} and the customer does not identify its owner`);
+		return null;
+	}
+	const mismatch = `Stripe webhook warning: The owner recorded on Stripe customer ${stripeCustomerId} does not hold that customer id`;
+	if (customerType === "organization" && !options.organization?.enabled) {
+		ctx.context.logger.warn(mismatch);
+		return null;
+	}
+	const record = await ctx.context.adapter.findOne({
+		model: customerType,
 		where: [{
 			field: "stripeCustomerId",
 			value: stripeCustomerId
+		}, {
+			field: "id",
+			value: referenceId
 		}]
 	});
-	if (user) return {
-		customerType: "user",
-		referenceId: user.id
+	if (!record) {
+		ctx.context.logger.warn(mismatch);
+		return null;
+	}
+	return {
+		customerType,
+		referenceId: record.id
 	};
-	return null;
 }
 async function onCheckoutSessionCompleted(ctx, options, event) {
 	try {
@@ -487,10 +514,16 @@ const referenceMiddleware = (options, action) => createAuthMiddleware(async (ctx
 			referenceId,
 			action
 		}, ctx)) throw APIError$1.from("UNAUTHORIZED", STRIPE_ERROR_CODES.UNAUTHORIZED);
-		return { referenceId };
+		return {
+			referenceId,
+			customerType
+		};
 	}
 	const referenceId = explicitReferenceId || ctxSession.user.id;
-	if (!explicitReferenceId || explicitReferenceId === ctxSession.user.id) return { referenceId };
+	if (!explicitReferenceId || explicitReferenceId === ctxSession.user.id) return {
+		referenceId,
+		customerType: "user"
+	};
 	if (!subscriptionOptions.authorizeReference) {
 		ctx.context.logger.error(`Passing referenceId into a subscription action isn't allowed if subscription.authorizeReference isn't defined in your stripe plugin config.`);
 		throw APIError$1.from("BAD_REQUEST", STRIPE_ERROR_CODES.REFERENCE_ID_NOT_ALLOWED);
@@ -501,7 +534,10 @@ const referenceMiddleware = (options, action) => createAuthMiddleware(async (ctx
 		referenceId,
 		action
 	}, ctx)) throw APIError$1.from("UNAUTHORIZED", STRIPE_ERROR_CODES.UNAUTHORIZED);
-	return { referenceId };
+	return {
+		referenceId,
+		customerType: "user"
+	};
 });
 //#endregion
 //#region src/routes.ts
@@ -652,7 +688,7 @@ const upgradeSubscription = (options) => {
 		]
 	}, async (ctx) => {
 		const { user, session } = ctx.context.session;
-		const customerType = ctx.body.customerType || "user";
+		const customerType = ctx.context.customerType;
 		const referenceId = ctx.context.referenceId;
 		if (!user.emailVerified && subscriptionOptions.requireEmailVerification) throw APIError$1.from("BAD_REQUEST", STRIPE_ERROR_CODES.EMAIL_VERIFICATION_REQUIRED);
 		const plan = await getPlanByName(options, ctx.body.plan);
@@ -1384,23 +1420,33 @@ const listActiveSubscriptions = (options) => {
 		return ctx.json(subs);
 	});
 };
-const subscriptionSuccessQuerySchema = z.record(z.string(), z.any()).optional();
+const subscriptionSuccessQuerySchema = z.object({
+	callbackURL: z.string().optional(),
+	checkoutSessionId: z.string().optional()
+}).optional();
+/**
+* Fill the Stripe "{CHECKOUT_SESSION_ID}" template variable in callbackURL.
+* @see https://docs.stripe.com/payments/checkout/custom-success-page?payment-ui=stripe-hosted#modify-the-success-url
+*/
+function fillCheckoutSessionId(callbackURL, checkoutSessionId) {
+	return callbackURL.replaceAll("{CHECKOUT_SESSION_ID}", checkoutSessionId);
+}
 const subscriptionSuccess = (options) => {
 	const client = options.stripeClient;
 	return createAuthEndpoint("/subscription/success", {
 		method: "GET",
 		query: subscriptionSuccessQuerySchema,
 		metadata: { openapi: { operationId: "handleSubscriptionSuccess" } },
-		use: [originCheck((ctx) => ctx.query.callbackURL)]
+		use: [originCheck((ctx) => {
+			const { callbackURL, checkoutSessionId } = ctx.query ?? {};
+			if (!callbackURL || !checkoutSessionId) return callbackURL;
+			return [callbackURL, fillCheckoutSessionId(callbackURL, checkoutSessionId)];
+		})]
 	}, async (ctx) => {
 		let callbackURL = ctx.query?.callbackURL || "/";
 		if (!await getSessionFromCtx(ctx)) throw ctx.redirect(getUrl(ctx, callbackURL));
 		if (!ctx.query?.checkoutSessionId) throw ctx.redirect(getUrl(ctx, callbackURL));
-		/**
-		* Replace the Stripe {CHECKOUT_SESSION_ID} template variable in callbackURL.
-		* @see https://docs.stripe.com/payments/checkout/custom-success-page?payment-ui=stripe-hosted#modify-the-success-url
-		*/
-		callbackURL = callbackURL.replaceAll("{CHECKOUT_SESSION_ID}", ctx.query.checkoutSessionId);
+		callbackURL = fillCheckoutSessionId(callbackURL, ctx.query.checkoutSessionId);
 		const checkoutSession = await client.checkout.sessions.retrieve(ctx.query.checkoutSessionId).catch((error) => {
 			ctx.context.logger.error("Error retrieving checkout session from Stripe", error);
 			return null;
@@ -1501,7 +1547,7 @@ const createBillingPortal = (options) => {
 		]
 	}, async (ctx) => {
 		const { user } = ctx.context.session;
-		const customerType = ctx.body.customerType || "user";
+		const customerType = ctx.context.customerType;
 		const referenceId = ctx.context.referenceId;
 		let customerId;
 		if (customerType === "organization") {
@@ -1608,19 +1654,23 @@ const subscriptions = { subscription: { fields: {
 	},
 	referenceId: {
 		type: "string",
-		required: true
+		required: true,
+		input: false
 	},
 	stripeCustomerId: {
 		type: "string",
-		required: false
+		required: false,
+		input: false
 	},
 	stripeSubscriptionId: {
 		type: "string",
-		required: false
+		required: false,
+		input: false
 	},
 	status: {
 		type: "string",
-		defaultValue: "incomplete"
+		defaultValue: "incomplete",
+		input: false
 	},
 	periodStart: {
 		type: "date",
@@ -1665,16 +1715,19 @@ const subscriptions = { subscription: { fields: {
 	},
 	stripeScheduleId: {
 		type: "string",
-		required: false
+		required: false,
+		input: false
 	}
 } } };
 const user = { user: { fields: { stripeCustomerId: {
 	type: "string",
-	required: false
+	required: false,
+	input: false
 } } } };
 const organization = { organization: { fields: { stripeCustomerId: {
 	type: "string",
-	required: false
+	required: false,
+	input: false
 } } } };
 const getSchema = (options) => {
 	let baseSchema = {};

package/dist/{version-CSLu0Cqn.mjs → version-CiZy3Q2W.mjs}

@@ -30,6 +30,6 @@ const STRIPE_ERROR_CODES = defineErrorCodes({
 });
 //#endregion
 //#region src/version.ts
-const PACKAGE_VERSION = "1.8.0-beta.3";
+const PACKAGE_VERSION = "1.8.0-beta.5";
 //#endregion
 export { STRIPE_ERROR_CODES as n, PACKAGE_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/stripe",
-  "version": "1.8.0-beta.3",
+  "version": "1.8.0-beta.5",
   "description": "Stripe plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -55,17 +55,17 @@
     "zod": "^4.5.4"
   },
   "devDependencies": {
-    "better-call": "1.4.4",
+    "better-call": "1.4.5",
     "stripe": "^23.0.0",
     "tsdown": "0.23.1",
-    "@better-auth/core": "1.8.0-beta.3",
-    "better-auth": "1.8.0-beta.3"
+    "@better-auth/core": "1.8.0-beta.5",
+    "better-auth": "1.8.0-beta.5"
   },
   "peerDependencies": {
-    "better-call": "1.4.4",
+    "better-call": "1.4.5",
     "stripe": "^18 || ^19 || ^20 || ^21 || ^22 || ^23",
-    "@better-auth/core": "^1.8.0-beta.3",
-    "better-auth": "^1.8.0-beta.3"
+    "@better-auth/core": "^1.8.0-beta.5",
+    "better-auth": "^1.8.0-beta.5"
   },
   "scripts": {
     "build": "tsdown",