payment-kit 1.29.9 → 1.29.10

package/api/src/integrations/app-store/handlers/subscription.ts

@@ -110,7 +110,19 @@ export async function ingestVerifiedAppStorePurchase({
 
     const newExpiresAt = transaction.expiresDate ? Math.floor(Number(transaction.expiresDate) / 1000) : 0;
     const newTxnValid = !!newExpiresAt && newExpiresAt * 1000 > Date.now();
-    const lapsed = ['canceled', 'incomplete_expired', 'past_due'].includes(existing.status as string);
+    // A subscription is "lapsed" when one of two things is true:
+    //   (a) The stored status is already terminal (canceled / past_due / …).
+    //   (b) Status is still 'active' but stored current_period_end is in the
+    //       past. This is the Sandbox steady state — Apple doesn't send the
+    //       RTDN that would flip the status on expiry, so a freshly bought
+    //       5-minute Sandbox sub goes silently stale. Without case (b), a
+    //       re-Subscribe tap hits the idempotency `return existing` branch
+    //       below and the row never gets the new expires_at — the user
+    //       stays in the "Free" state because entitlement filters
+    //       current_period_end > now.
+    const storedExpiresAt = existing.current_period_end ?? 0;
+    const storedExpired = !!storedExpiresAt && storedExpiresAt * 1000 < Date.now();
+    const lapsed = ['canceled', 'incomplete_expired', 'past_due'].includes(existing.status as string) || storedExpired;
     // Sandbox re-subscribe / renewal arriving via client verify reuses the SAME
     // originalTransactionId. If the stored sub had lapsed (expired→canceled) but
     // the new transaction is valid, reactivate it instead of returning the stale
@@ -121,7 +133,7 @@ export async function ingestVerifiedAppStorePurchase({
       const updatePatch: any = {
         status: 'active',
         current_period_end: newExpiresAt,
-        ended_at: null,
+        end_at: null,
         cancel_at_period_end: false,
         payment_details: {
           ...(existing.payment_details || {}),
@@ -165,6 +177,45 @@ export async function ingestVerifiedAppStorePurchase({
       return { subscription: existing, isFirstSubscribe: false, transaction };
     }
 
+    // Lapsed + new transaction ALSO expired (Apple Sandbox steady state
+    // once a sub has cycled past its max auto-renewals: Apple keeps
+    // replaying the final expired transaction through Transaction.updates
+    // forever — both stored and replay are stale). Without an explicit
+    // terminal write here, the row stays status='active' with a past
+    // current_period_end, entitlement.check filters it out (correct), but
+    // the verify route keeps returning success: true on every replay so
+    // PaymentKit.handle() finishes the transaction successfully — yet
+    // Apple Sandbox redelivers it on the next tick anyway, producing the
+    // hundreds-per-minute verify spam seen in cf-aside logs. Marking
+    // incomplete_expired + ended_at converges the local truth, and a
+    // subsequent fresh purchase will land in the reactivate branch above
+    // (lapsed + newTxnValid) and revive the row cleanly.
+    if (lapsed && !newTxnValid) {
+      await existing.update({
+        status: 'incomplete_expired',
+        end_at: Math.floor(Date.now() / 1000),
+        cancel_at_period_end: false,
+        payment_details: {
+          ...(existing.payment_details || {}),
+          app_store: {
+            ...(existing.payment_details?.app_store || {}),
+            transaction_id: transaction.transactionId,
+            expires_at: newExpiresAt || (existing.payment_details?.app_store as any)?.expires_at,
+          },
+        },
+      } as any);
+      logger.info(
+        'app_store verify: subscription fully lapsed (stored + replay both expired) — marked incomplete_expired',
+        {
+          subscriptionId: existing.id,
+          originalTransactionId: transaction.originalTransactionId,
+          storedExpiresAt,
+          newExpiresAt,
+        }
+      );
+      return { subscription: existing, isFirstSubscribe: false, transaction };
+    }
+
     // SKU drift sync — when the StoreKit-side product_id differs from
     // what we have stored (Apple crossgrade / downgrade landed in
     // Sandbox immediately; or the production DID_RENEW webhook hadn't
@@ -579,7 +630,7 @@ async function handleAppStoreRenewed(
 
 async function markAppStoreExpired(subscription: Subscription): Promise<void> {
   if (['canceled', 'incomplete_expired'].includes(subscription.status as string)) return;
-  await subscription.update({ status: 'canceled', ended_at: Math.floor(Date.now() / 1000) });
+  await subscription.update({ status: 'canceled', end_at: Math.floor(Date.now() / 1000) });
   createEvent('Subscription', 'customer.subscription.deleted', subscription).catch(reportAuditFailure);
 }
 
@@ -607,7 +658,7 @@ async function handleAppStoreRevoked(
   const now = Math.floor(Date.now() / 1000);
   await subscription.update({
     status: 'canceled',
-    ended_at: now,
+    end_at: now,
     cancelation_details: {
       ...(subscription.cancelation_details ?? { comment: '', feedback: 'other' }),
       reason: 'cancellation_requested',

package/api/src/integrations/google-play/handlers/subscription.ts

@@ -541,7 +541,7 @@ async function handleRevoked(subscription: Subscription): Promise<void> {
   const now = Math.floor(Date.now() / 1000);
   await subscription.update({
     status: 'canceled',
-    ended_at: now,
+    end_at: now,
     cancelation_details: {
       ...(subscription.cancelation_details ?? { comment: '', feedback: 'other' }),
       reason: 'cancellation_requested',

package/api/src/integrations/google-play/handlers/voided.ts

@@ -80,7 +80,7 @@ export async function handleGooglePlayVoidedPurchase({
   if (subscription.status !== 'canceled' && subscription.status !== 'incomplete_expired') {
     await subscription.update({
       status: 'canceled',
-      ended_at: Math.floor(Date.now() / 1000),
+      end_at: Math.floor(Date.now() / 1000),
       cancelation_details: {
         ...(subscription.cancelation_details ?? { comment: '', feedback: 'other' }),
         reason: 'cancellation_requested',

package/api/src/integrations/stripe/handlers/payment-intent.ts

@@ -41,7 +41,9 @@ export async function handleStripePaymentSucceed(paymentIntent: PaymentIntent, e
 }
 
 export async function syncStripePayment(paymentIntent: PaymentIntent) {
-  if (!paymentIntent?.metadata?.stripe_id) {
+  const stripePaymentIntentId =
+    paymentIntent?.payment_details?.stripe?.payment_intent_id || paymentIntent?.metadata?.stripe_id;
+  if (!stripePaymentIntentId) {
     return;
   }
 
@@ -52,7 +54,7 @@ export async function syncStripePayment(paymentIntent: PaymentIntent) {
 
   const triggerRenew = paymentIntent.status !== 'succeeded';
   const client = await method.getStripeClient();
-  const stripeIntent = await client.paymentIntents.retrieve(paymentIntent.metadata.stripe_id);
+  const stripeIntent = await client.paymentIntents.retrieve(stripePaymentIntentId);
   if (stripeIntent) {
     // @ts-ignore
     await paymentIntent.update({

package/api/src/integrations/stripe/handlers/subscription.ts

@@ -148,7 +148,7 @@ export async function handleSubscriptionEvent(event: TEventExpanded, _: Stripe)
     if (['incomplete', 'incomplete_expired'].includes(subscription.status)) {
       logger.warn('subscription not ended on stripe event', { id: subscription.id });
     } else {
-      await subscription.update({ status: 'canceled', ended_at: event.data.object.ended_at });
+      await subscription.update({ status: 'canceled', end_at: event.data.object.ended_at });
       logger.info('subscription ended on stripe event', { id: subscription.id });
     }
   }

package/api/src/integrations/stripe/reconcile-checkout-core.ts

@@ -0,0 +1,60 @@
+export type ReconcileResult = {
+  status: string;
+  paymentStatus: string;
+  reconciled: boolean;
+};
+
+export type ReconcileDeps = {
+  findCheckoutSession: (id: string) => Promise<any>;
+  findPaymentIntent: (id: string) => Promise<any>;
+  getSubscriptionIds: (checkoutSession: any) => string[];
+  findSubscriptions: (ids: string[]) => Promise<any[]>;
+  syncPayment: (paymentIntent: any) => Promise<void>;
+  syncSubscription: (subscription: any) => Promise<void>;
+};
+
+export async function reconcileStripeCheckoutSessionWithDeps(
+  sessionId: string,
+  deps: ReconcileDeps
+): Promise<ReconcileResult> {
+  const checkoutSession = await deps.findCheckoutSession(sessionId);
+  if (!checkoutSession) {
+    throw new Error('Checkout session not found');
+  }
+  if (checkoutSession.status === 'complete') {
+    return {
+      status: checkoutSession.status,
+      paymentStatus: checkoutSession.payment_status,
+      reconciled: false,
+    };
+  }
+
+  let reconciled = false;
+  if (checkoutSession.payment_intent_id) {
+    const paymentIntent = await deps.findPaymentIntent(checkoutSession.payment_intent_id);
+    if (paymentIntent && paymentIntent.status !== 'succeeded') {
+      await deps.syncPayment(paymentIntent);
+      reconciled = true;
+    }
+  }
+
+  const subscriptionIds = deps.getSubscriptionIds(checkoutSession);
+  if (subscriptionIds.length > 0) {
+    const subscriptions = await deps.findSubscriptions(subscriptionIds);
+    for (const subscription of subscriptions) {
+      if (subscription.status === 'incomplete') {
+        // Sequential reconciliation avoids racing checkout success counters.
+        // eslint-disable-next-line no-await-in-loop
+        await deps.syncSubscription(subscription);
+        reconciled = true;
+      }
+    }
+  }
+
+  await checkoutSession.reload();
+  return {
+    status: checkoutSession.status,
+    paymentStatus: checkoutSession.payment_status,
+    reconciled,
+  };
+}

package/api/src/integrations/stripe/reconcile-checkout.ts

@@ -0,0 +1,40 @@
+import { getCheckoutSessionSubscriptionIds } from '../../libs/session';
+import { CheckoutSession, PaymentIntent, PaymentMethod, Subscription } from '../../store/models';
+import { syncStripePayment } from './handlers/payment-intent';
+import { handleStripeSubscriptionSucceed } from './handlers/subscription';
+import {
+  reconcileStripeCheckoutSessionWithDeps,
+  type ReconcileDeps,
+  type ReconcileResult,
+} from './reconcile-checkout-core';
+
+async function syncSubscription(subscription: Subscription): Promise<void> {
+  if (!subscription.payment_details?.stripe?.subscription_id) return;
+  const method = await PaymentMethod.findByPk(subscription.default_payment_method_id);
+  if (!method || method.type !== 'stripe') return;
+
+  const remote = await method
+    .getStripeClient()
+    .subscriptions.retrieve(subscription.payment_details.stripe.subscription_id, {
+      expand: ['latest_invoice.payment_intent', 'pending_setup_intent'],
+    });
+  if (['active', 'trialing'].includes(remote.status)) {
+    await handleStripeSubscriptionSucceed(subscription, remote.status);
+  }
+}
+
+const defaultDeps: ReconcileDeps = {
+  findCheckoutSession: (id) => CheckoutSession.findByPk(id),
+  findPaymentIntent: (id) => PaymentIntent.findByPk(id),
+  getSubscriptionIds: getCheckoutSessionSubscriptionIds,
+  findSubscriptions: (ids) => Subscription.findAll({ where: { id: ids } }),
+  syncPayment: syncStripePayment,
+  syncSubscription,
+};
+
+export function reconcileStripeCheckoutSession(
+  sessionId: string,
+  deps: ReconcileDeps = defaultDeps
+): Promise<ReconcileResult> {
+  return reconcileStripeCheckoutSessionWithDeps(sessionId, deps);
+}

package/api/src/libs/entitlement.ts

@@ -49,6 +49,15 @@ export type EntitlementCheckResult = {
   subscription_id: string | null;
   source: 'subscription' | 'one_time' | null;
   credit_remaining?: string;
+  /**
+   * For subscription source: the customer has asked the platform (Apple,
+   * Google, Stripe) to STOP auto-renewing. The entitlement is still
+   * active until `expires_at` but won't renew. UIs should mark the card
+   * as "canceled, ends on X" and offer a re-enable action that deep-
+   * links to the platform's subscription management. Always omitted for
+   * one-time / credit-grant sources.
+   */
+  cancel_at_period_end?: boolean;
 };
 
 const SUBSCRIPTION_STATUS_PRIORITY: Record<string, number> = {
@@ -231,6 +240,7 @@ export async function checkEntitlement({
       expires_at: best.current_period_end ?? null,
       subscription_id: best.id,
       source: 'subscription',
+      cancel_at_period_end: !!best.cancel_at_period_end,
     };
   }
 
@@ -258,6 +268,7 @@ export type EntitlementListItem = {
   subscription_id: string | null;
   source: 'subscription' | 'one_time';
   credit_remaining?: string;
+  cancel_at_period_end?: boolean;
 };
 
 /**
@@ -367,6 +378,7 @@ export async function listEntitlements({
         expires_at: best.current_period_end ?? null,
         subscription_id: best.id,
         source: 'subscription',
+        cancel_at_period_end: !!best.cancel_at_period_end,
       };
       return item;
     })

package/api/src/middlewares/hono/security.ts

@@ -24,6 +24,43 @@ import { isDevelopmentEnv, enableDevFakeAuth } from '../../libs/env';
 import { wallet } from '../../libs/auth';
 import { Customer } from '../../store/models/customer';
 
+// Bare ↔ prefixed DID coexist in this codebase:
+//   - Bearer-token branch stores `did:abt:<base58>` (token-path normalisation).
+//   - BS-injected `x-user-did` headers carry whichever shape the host emits.
+//   - Customer.did rows on multi-tenant deploys are mixed (older rows bare,
+//     CF-seeded rows prefixed).
+// Comparing `user.did === customer.did` with strict equality silently
+// false-negatives for half of these combinations, so every cross-DID match
+// goes through this helper. `findCustomerByEitherDid` runs a single
+// disjunction query so a row in either shape resolves.
+export function stripDidPrefix(did: string | undefined | null): string {
+  if (!did) return '';
+  return did.startsWith('did:abt:') ? did.slice('did:abt:'.length) : did;
+}
+
+/** True when both DIDs resolve to the same identity ignoring the `did:abt:`
+ * prefix. Use this for any cross-DID equality check on multi-tenant deploys
+ * (auth/record-access guards). Mirrors `blocklets/core/src/libs/did.ts`
+ * isSameDid — keep behaviour in sync. */
+export function isSameDid(a: string | undefined | null, b: string | undefined | null): boolean {
+  const x = stripDidPrefix(a);
+  const y = stripDidPrefix(b);
+  return !!x && x === y;
+}
+
+async function findCustomerByEitherDid(did: string): Promise<Customer | null> {
+  if (!did) return null;
+  const bare = stripDidPrefix(did);
+  if (!bare) return null;
+  const prefixed = `did:abt:${bare}`;
+  // Sequelize Op.or via plain object form; either shape resolves to the same
+  // logical user. Kept minimal to avoid an extra Op.in import path here.
+  // Bound to a local so the function body satisfies require-await without
+  // tripping no-return-await (returning the awaited binding, not the await).
+  const found = await Customer.findOne({ where: { did: [bare, prefixed] as any } });
+  return found;
+}
+
 type PermissionSpec<T extends Model> = {
   component?: boolean;
   roles?: string[];
@@ -173,7 +210,12 @@ export function authenticate<T extends Model>({
       }
 
       if (mine) {
-        const customer = await Customer.findOne({ where: { did: user.did } });
+        // Match Customer regardless of which DID shape the row was stored as
+        // (bare base58 from older single-tenant writes, did:abt: prefixed from
+        // CF multi-tenant flows). A strict findOne({did: user.did}) silently
+        // returned null when shapes mismatched, falling through to the 403
+        // even for the real owner.
+        const customer = await findCustomerByEitherDid(user.did);
         if (customer) {
           c.set('customer', customer);
           // hono query is immutable — inject the VERIFIED id into context so a
@@ -190,7 +232,10 @@ export function authenticate<T extends Model>({
         const doc: T | null =
           findById && typeof findById === 'function' ? await findById(id) : await (model as any).findByPk(id);
         if (doc && doc[field as keyof T]) {
-          const customer = await Customer.findOne({ where: { did: user.did } });
+          // Same shape-tolerant lookup as the mine branch — record-ownership
+          // checks were silently failing for users whose customer row lives in
+          // the other DID shape.
+          const customer = await findCustomerByEitherDid(user.did);
           c.set('doc', doc);
           c.set('customer', customer);
           if (customer && customer.id === doc[field as keyof T]) {

package/api/src/routes/hono/checkout-sessions.ts

@@ -21,13 +21,18 @@ import { Hono } from 'hono';
 import { CustomError, formatError, getStatusFromError } from '@blocklet/error';
 import pAll from 'p-all';
 import { withQuery } from 'ufo';
-import { paymentRateVolatilityThreshold, updateDataConcurrency, stopAcceptingOrders } from '../../libs/env';
+import {
+  paymentRateVolatilityThreshold,
+  updateDataConcurrency,
+  stopAcceptingOrders,
+  isBlockletServer,
+} from '../../libs/env';
 import { MetadataSchema } from '../../libs/api';
 import { checkPassportForPaymentLink } from '../../integrations/blocklet/passport';
 import dayjs from '../../libs/dayjs';
 import logger from '../../libs/logger';
 import { trimDecimals } from '../../libs/math-utils';
-import { authenticate } from '../../middlewares/hono/security';
+import { authenticate, isSameDid } from '../../middlewares/hono/security';
 import {
   buildSlippageSnapshot,
   DEFAULT_SLIPPAGE_PERCENT,
@@ -131,6 +136,7 @@ import { getExchangeRateService } from '../../libs/exchange-rate/service';
 import { getExchangeRateSymbol } from '../../libs/exchange-rate/token-address-mapping';
 import { sequelize } from '../../store/sequelize';
 import { sessionMiddleware } from '../../middlewares/hono/session';
+import { reconcileStripeCheckoutSession } from '../../integrations/stripe/reconcile-checkout';
 
 const app = new Hono();
 
@@ -1475,6 +1481,29 @@ app.get('/status/:id', user, async (c) => {
   });
 });
 
+app.post('/:id/stripe-reconcile', user, async (c) => {
+  const currentUser = c.get('user');
+  if (!currentUser) {
+    return c.json({ error: 'Unauthorized' }, 403);
+  }
+  const doc = await CheckoutSession.findByPk(c.req.param('id'), {
+    attributes: ['id', 'customer_did'],
+  });
+  if (!doc) {
+    return c.json({ error: 'Checkout session not found' }, 404);
+  }
+  if (!['owner', 'admin'].includes(currentUser.role) && !isSameDid(doc.customer_did, currentUser.did)) {
+    return c.json({ error: 'Not authorized to reconcile this checkout session' }, 403);
+  }
+
+  try {
+    return c.json(await reconcileStripeCheckoutSession(doc.id));
+  } catch (err: any) {
+    logger.error('stripe checkout reconciliation failed', { checkoutSessionId: doc.id, error: err });
+    return c.json({ error: err.message }, 502);
+  }
+});
+
 // Static prefix /retrieve/:id registered before /:id to avoid shadowing.
 app.get('/retrieve/:id', user, async (c) => {
   const doc = await CheckoutSession.findByPk(c.req.param('id'));
@@ -2808,21 +2837,27 @@ app.put('/:id/submit', user, ensureCheckoutSessionOpen, async (c) => {
         invoice_prefix: Customer.getInvoicePrefix(),
       });
       logger.info('customer created on checkout session submit', { did: c.get('user').did, id: customer.id });
-      try {
-        await blocklet.updateUserAddress(
-          {
-            did: customer.did,
-            address: Customer.formatAddressFromCustomer(customer),
-          },
-          {
-            headers: {
-              cookie: c.req.header('cookie') || '',
+      // Sync address to the blocklet-server user service ONLY on blocklet-server.
+      // arc/CF embedded has no such service — `blocklet.updateUserAddress` is undefined
+      // there. The address is already persisted on the payment Customer model above,
+      // so embedded hosts simply skip this (was a swallowed "is not a function" error).
+      if (isBlockletServer()) {
+        try {
+          await blocklet.updateUserAddress(
+            {
+              did: customer.did,
+              address: Customer.formatAddressFromCustomer(customer),
             },
-          }
-        );
-        logger.info('updateUserAddress success', { did: customer.did });
-      } catch (err) {
-        logger.error('updateUserAddress failed', { error: err, customerId: customer.id });
+            {
+              headers: {
+                cookie: c.req.header('cookie') || '',
+              },
+            }
+          );
+          logger.info('updateUserAddress success', { did: customer.did });
+        } catch (err) {
+          logger.error('updateUserAddress failed', { error: err, customerId: customer.id });
+        }
       }
     } else {
       const updates: Record<string, any> = {};
@@ -2850,23 +2885,27 @@ app.put('/:id/submit', user, ensureCheckoutSessionOpen, async (c) => {
         await customer.update(updates);
         logger.info('customer updated', { did: customer.did });
 
-        try {
-          await blocklet.updateUserAddress(
-            {
-              did: customer.did,
-              address: Customer.formatAddressFromCustomer(customer),
-              // @ts-ignore
-              phone: customer.phone,
-            },
-            {
-              headers: {
-                cookie: c.req.header('cookie') || '',
+        // Blocklet-server only (see note above); embedded hosts already have the
+        // address on the payment Customer model and have no user service to sync to.
+        if (isBlockletServer()) {
+          try {
+            await blocklet.updateUserAddress(
+              {
+                did: customer.did,
+                address: Customer.formatAddressFromCustomer(customer),
+                // @ts-ignore
+                phone: customer.phone,
               },
-            }
-          );
-          logger.info('updateUserAddress success', { did: customer.did });
-        } catch (err) {
-          logger.error('updateUserAddress failed', { error: err, customerId: customer.id });
+              {
+                headers: {
+                  cookie: c.req.header('cookie') || '',
+                },
+              }
+            );
+            logger.info('updateUserAddress success', { did: customer.did });
+          } catch (err) {
+            logger.error('updateUserAddress failed', { error: err, customerId: customer.id });
+          }
         }
       }
     }

package/api/src/store/models/subscription.ts

@@ -105,7 +105,9 @@ export class Subscription extends TenantModel<InferAttributes<Subscription>, Inf
   declare schedule_id?: string;
 
   // If the subscription has ended, the date the subscription ended.
-  declare ended_at?: number;
+  // Column name in DB is `end_at` (see init below). Historical phantom
+  // attribute `ended_at` silently dropped writes — never name-drift again.
+  declare end_at?: number;
   declare start_date: number;
   declare trial_end?: number;
   declare trial_start?: number;

package/api/tests/integrations/app-store/handlers.spec.ts

@@ -278,7 +278,7 @@ describe('ingestVerifiedAppStorePurchase', () => {
     );
   });
 
-  it('does NOT reactivate a canceled subscription when the new transaction is also expired', async () => {
+  it('marks a fully-lapsed subscription as incomplete_expired when the new transaction is also expired', async () => {
     const update = jest.fn();
     const existing = { id: 'sub_existing', status: 'canceled', customer_id: 'cus_1', payment_details: { app_store: {} }, update };
     mockSubscriptionFindOne.mockResolvedValue(existing);
@@ -292,7 +292,18 @@ describe('ingestVerifiedAppStorePurchase', () => {
     });
 
     expect(result.subscription).toBe(existing);
-    expect(update).not.toHaveBeenCalled();
+    // Stored + replay both expired (Sandbox steady state after Apple's
+    // max-renewals cap) — converge the row to incomplete_expired so the
+    // worker's Transaction.updates replay loop stops and entitlement.check
+    // converges to inactive. Without this terminal write the verify route
+    // would silently `return existing` on every replay and the SDK would
+    // never see the lapsed state.
+    expect(update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        status: 'incomplete_expired',
+        cancel_at_period_end: false,
+      })
+    );
     expect(mockSubscriptionCreate).not.toHaveBeenCalled();
   });
 

package/api/tests/integrations/stripe/reconcile-checkout.spec.ts

@@ -0,0 +1,80 @@
+import { reconcileStripeCheckoutSessionWithDeps } from '../../../src/integrations/stripe/reconcile-checkout-core';
+
+describe('reconcileStripeCheckoutSession', () => {
+  it('syncs an unfinished one-time Stripe payment and returns the updated checkout status', async () => {
+    const checkoutSession = {
+      id: 'cs_1',
+      status: 'open',
+      payment_status: 'unpaid',
+      payment_intent_id: 'pi_local',
+      mode: 'payment',
+      reload: jest.fn(function reload() {
+        this.status = 'complete';
+        this.payment_status = 'paid';
+        return Promise.resolve();
+      }),
+    };
+    const paymentIntent = { id: 'pi_local', status: 'processing' };
+    const syncPayment = jest.fn().mockResolvedValue(undefined);
+
+    const result = await reconcileStripeCheckoutSessionWithDeps('cs_1', {
+      findCheckoutSession: jest.fn().mockResolvedValue(checkoutSession),
+      findPaymentIntent: jest.fn().mockResolvedValue(paymentIntent),
+      getSubscriptionIds: jest.fn().mockReturnValue([]),
+      findSubscriptions: jest.fn().mockResolvedValue([]),
+      syncPayment,
+      syncSubscription: jest.fn(),
+    });
+
+    expect(syncPayment).toHaveBeenCalledWith(paymentIntent);
+    expect(checkoutSession.reload).toHaveBeenCalled();
+    expect(result).toEqual({ status: 'complete', paymentStatus: 'paid', reconciled: true });
+  });
+
+  it('syncs only incomplete subscriptions so repeated reconciliation stays idempotent', async () => {
+    const checkoutSession = {
+      id: 'cs_1',
+      status: 'open',
+      payment_status: 'unpaid',
+      mode: 'subscription',
+      reload: jest.fn(),
+    };
+    const incomplete = { id: 'sub_1', status: 'incomplete' };
+    const active = { id: 'sub_2', status: 'active' };
+    const syncSubscription = jest.fn().mockResolvedValue(undefined);
+
+    await reconcileStripeCheckoutSessionWithDeps('cs_1', {
+      findCheckoutSession: jest.fn().mockResolvedValue(checkoutSession),
+      findPaymentIntent: jest.fn(),
+      getSubscriptionIds: jest.fn().mockReturnValue(['sub_1', 'sub_2']),
+      findSubscriptions: jest.fn().mockResolvedValue([incomplete, active]),
+      syncPayment: jest.fn(),
+      syncSubscription,
+    });
+
+    expect(syncSubscription).toHaveBeenCalledTimes(1);
+    expect(syncSubscription).toHaveBeenCalledWith(incomplete);
+  });
+
+  it('does not call Stripe for an already completed checkout session', async () => {
+    const syncPayment = jest.fn();
+    const syncSubscription = jest.fn();
+
+    const result = await reconcileStripeCheckoutSessionWithDeps('cs_1', {
+      findCheckoutSession: jest.fn().mockResolvedValue({
+        id: 'cs_1',
+        status: 'complete',
+        payment_status: 'paid',
+      }),
+      findPaymentIntent: jest.fn(),
+      getSubscriptionIds: jest.fn(),
+      findSubscriptions: jest.fn(),
+      syncPayment,
+      syncSubscription,
+    });
+
+    expect(syncPayment).not.toHaveBeenCalled();
+    expect(syncSubscription).not.toHaveBeenCalled();
+    expect(result).toEqual({ status: 'complete', paymentStatus: 'paid', reconciled: false });
+  });
+});

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.29.9
+version: 1.29.10
 logo: logo.png
 files:
   - dist

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payment-kit",
-  "version": "1.29.9",
+  "version": "1.29.10",
   "scripts": {
     "dev": "blocklet dev --open",
     "prelint": "npm run types",
@@ -60,9 +60,9 @@
     "@blocklet/error": "^0.3.5",
     "@blocklet/js-sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/logger": "^1.17.13-beta-20260613-094425-b81920c8",
-    "@blocklet/payment-broker-client": "1.29.9",
-    "@blocklet/payment-react": "1.29.9",
-    "@blocklet/payment-vendor": "1.29.9",
+    "@blocklet/payment-broker-client": "1.29.10",
+    "@blocklet/payment-react": "1.29.10",
+    "@blocklet/payment-vendor": "1.29.10",
     "@blocklet/sdk": "^1.17.13-beta-20260613-094425-b81920c8",
     "@blocklet/ui-react": "^3.5.4",
     "@blocklet/uploader": "^0.15.4",
@@ -133,7 +133,7 @@
   "devDependencies": {
     "@abtnode/types": "^1.17.13-beta-20260613-094425-b81920c8",
     "@arcblock/eslint-config-ts": "^0.3.3",
-    "@blocklet/payment-types": "1.29.9",
+    "@blocklet/payment-types": "1.29.10",
     "@types/connect": "^3.4.38",
     "@types/debug": "^4.1.12",
     "@types/dotenv-flow": "^3.3.3",
@@ -180,5 +180,5 @@
       "parser": "typescript"
     }
   },
-  "gitHead": "249bd9bf3c6cc54f77c260edb4b4d3c0be60f126"
+  "gitHead": "18c831f5dbdfb271a96640befb06f589adbeeab0"
 }

package/src/libs/did.ts

@@ -0,0 +1,27 @@
+// DID comparison helpers shared by the customer portal pages.
+//
+// A single ArcBlock identity shows up in two string shapes across the stack:
+//   - bare base58 address (e.g. `z1xxx`)
+//   - canonical URI form  (e.g. `did:abt:z1xxx`)
+//
+// On CF Workers the host AUTH_SERVICE hands the frontend a bare address while
+// the backend canonicalizes login-token DIDs to the `did:abt:` form before it
+// stores `customer.did` (see api/src/middlewares/hono/security.ts and
+// api/src/routes/hono/entitlements.ts `canonicalDid`/`isSelf`). A raw `!==`
+// between `session.user.did` and `customer.did` therefore flags the very owner
+// of the record as "another customer". Normalize both sides before comparing.
+
+const DID_PREFIX = 'did:abt:';
+
+export function canonicalizeDid(did: string | undefined | null): string {
+  if (!did) return '';
+  return did.startsWith(DID_PREFIX) ? did.slice(DID_PREFIX.length) : did;
+}
+
+// True when both DIDs resolve to the same identity, ignoring the `did:abt:`
+// prefix difference. Empty/missing inputs are never considered a match.
+export function isSameDid(a: string | undefined | null, b: string | undefined | null): boolean {
+  const x = canonicalizeDid(a);
+  const y = canonicalizeDid(b);
+  return !!x && x === y;
+}

package/src/pages/customer/credit-grant/detail.tsx

@@ -24,6 +24,7 @@ import CreditGrantItemList from '../../../components/customer/credit-grant-item-
 import InfoRow from '../../../components/info-row';
 import InfoRowGroup from '../../../components/info-row-group';
 import { useArcsphere } from '../../../hooks/browser';
+import { isSameDid } from '../../../libs/did';
 
 const fetchData = (id: string | undefined): Promise<TCreditGrantExpanded> => {
   return api.get(`/api/credit-grants/${id}`).then((res: any) => res.data);
@@ -41,7 +42,7 @@ export default function CustomerCreditGrantDetail() {
     navigate('/customer', { replace: true });
   }, [navigate]);
 
-  if (data?.customer?.did && session?.user?.did && data.customer.did !== session.user.did) {
+  if (data?.customer?.did && session?.user?.did && !isSameDid(data.customer.did, session.user.did)) {
     return <Alert severity="error">{t('common.accessDenied')}</Alert>;
   }
   if (error) {

package/src/pages/customer/credit-transaction/detail.tsx

@@ -21,6 +21,7 @@ import SectionHeader from '../../../components/section/header';
 import InfoRow from '../../../components/info-row';
 import InfoRowGroup from '../../../components/info-row-group';
 import { useArcsphere } from '../../../hooks/browser';
+import { isSameDid } from '../../../libs/did';
 
 const fetchData = (id: string | undefined): Promise<TCreditTransactionExpanded> => {
   return api.get(`/api/credit-transactions/${id}`).then((res: any) => res.data);
@@ -38,7 +39,7 @@ export default function CustomerCreditTransactionDetail() {
     navigate('/customer', { replace: true });
   }, [navigate]);
 
-  if (data?.customer?.did && session?.user?.did && data.customer.did !== session.user.did) {
+  if (data?.customer?.did && session?.user?.did && !isSameDid(data.customer.did, session.user.did)) {
     return <Alert severity="error">{t('common.accessDenied')}</Alert>;
   }
 

package/src/pages/customer/invoice/detail.tsx

@@ -34,6 +34,7 @@ import InfoRow from '../../../components/info-row';
 import { Download } from '../../../components/invoice-pdf/pdf';
 import InvoiceTable from '../../../components/invoice/table';
 import { goBackOrFallback } from '../../../libs/util';
+import { isSameDid } from '../../../libs/did';
 import CustomerRefundList from '../refund/list';
 import InfoMetric from '../../../components/info-metric';
 import InfoRowGroup from '../../../components/info-row-group';
@@ -121,7 +122,7 @@ export default function CustomerInvoiceDetail() {
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [error]);
 
-  if (data?.customer?.did && session?.user?.did && data.customer.did !== session.user.did) {
+  if (data?.customer?.did && session?.user?.did && !isSameDid(data.customer.did, session.user.did)) {
     return <Alert severity="error">{t('common.accessDenied')}</Alert>;
   }
 

package/src/pages/customer/recharge/subscription.tsx

@@ -36,6 +36,7 @@ import InfoRow from '../../../components/info-row';
 import Currency from '../../../components/currency';
 import SubscriptionMetrics from '../../../components/subscription/metrics';
 import { goBackOrFallback, MAX_SAFE_AMOUNT } from '../../../libs/util';
+import { isSameDid } from '../../../libs/did';
 import CustomerLink from '../../../components/customer/link';
 import { useSessionContext } from '../../../contexts/session';
 import { formatSmartDuration, TimeUnit } from '../../../libs/dayjs';
@@ -227,7 +228,7 @@ export default function RechargePage() {
     return <Alert severity="info">{t('common.dataNotFound')}</Alert>;
   }
 
-  if (subscription?.customer?.did && session?.user?.did && subscription.customer.did !== session.user.did) {
+  if (subscription?.customer?.did && session?.user?.did && !isSameDid(subscription.customer.did, session.user.did)) {
     return <Alert severity="error">{t('common.accessDenied')}</Alert>;
   }
   const currentBalance = formatBNStr(payerValue?.token || '0', paymentCurrency?.decimal, 6, false);

package/src/pages/customer/subscription/detail.tsx

@@ -67,6 +67,7 @@ import {
 } from '../../../hooks/subscription';
 import { formatSmartDuration, TimeUnit } from '../../../libs/dayjs';
 import { canChangePaymentMethod } from '../../../libs/util';
+import { isSameDid } from '../../../libs/did';
 import PaymentMethodInfo from '../../../components/subscription/payment-method-info';
 import { useArcsphere } from '../../../hooks/browser';
 
@@ -260,7 +261,7 @@ export default function CustomerSubscriptionDetail() {
     }
   };
 
-  if (data?.customer?.did && session?.user?.did && data.customer.did !== session.user.did) {
+  if (data?.customer?.did && session?.user?.did && !isSameDid(data.customer.did, session.user.did)) {
     return <Alert severity="error">{t('common.accessDenied')}</Alert>;
   }
   if (error) {

package/tests/libs/did.spec.ts

@@ -0,0 +1,43 @@
+import { canonicalizeDid, isSameDid } from '../../src/libs/did';
+
+describe('canonicalizeDid', () => {
+  it('strips the did:abt: prefix', () => {
+    expect(canonicalizeDid('did:abt:z1xyz')).toBe('z1xyz');
+  });
+
+  it('leaves bare addresses untouched', () => {
+    expect(canonicalizeDid('z1xyz')).toBe('z1xyz');
+  });
+
+  it('returns empty string for nullish input', () => {
+    expect(canonicalizeDid(undefined)).toBe('');
+    expect(canonicalizeDid(null)).toBe('');
+    expect(canonicalizeDid('')).toBe('');
+  });
+});
+
+describe('isSameDid', () => {
+  // The regression: CF stores customer.did canonical while the host session
+  // reports a bare address. The old `data.customer.did !== session.user.did`
+  // check wrongly denied the owner. isSameDid must treat these as equal.
+  it('matches a canonical DID against the same bare address', () => {
+    expect(isSameDid('did:abt:z1xyz', 'z1xyz')).toBe(true);
+    expect(isSameDid('z1xyz', 'did:abt:z1xyz')).toBe(true);
+  });
+
+  it('matches identical shapes', () => {
+    expect(isSameDid('z1xyz', 'z1xyz')).toBe(true);
+    expect(isSameDid('did:abt:z1xyz', 'did:abt:z1xyz')).toBe(true);
+  });
+
+  it('rejects genuinely different identities', () => {
+    expect(isSameDid('did:abt:z1xyz', 'z1abc')).toBe(false);
+    expect(isSameDid('z1xyz', 'z1abc')).toBe(false);
+  });
+
+  it('never matches when either side is missing', () => {
+    expect(isSameDid('', 'z1xyz')).toBe(false);
+    expect(isSameDid('z1xyz', undefined)).toBe(false);
+    expect(isSameDid(null, null)).toBe(false);
+  });
+});