Scope new subscription checkout to the active organization

[basriakkaya]

Summary

• scope existing-membership lookup in POST /api/subscribe to the authenticated active organization
• retain the existing single-organization fallback for legacy sessions
• reject ambiguous checkout creation when a session has no active organization and the user belongs to multiple organizations
• add regression tests for active-organization checkout and the ambiguous fallback

Root cause

The new-subscription route ignored the organizationId already returned by getUserIDAndPro. It listed all active memberships and selected data[0], so WorkOS API ordering could choose a different organization than the one active in the application.

The selected organization controls the Stripe customer, Checkout metadata, subscription metadata, and eventual entitlement assignment.

Impact

For multi-organization administrators, new Checkout sessions now target the organization selected in the authenticated session. Ambiguous legacy sessions fail safely instead of potentially attaching a paid subscription to the wrong organization.

Validation

• pnpm exec jest app/api/subscribe/__tests__/route.test.ts --runInBand --no-watchman — 14 tests passed
• ESLint on both changed files
• Prettier on both changed files
• git diff --check

[vercel]

@basriakkaya is attempting to deploy a commit to the HackerAI Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 788e2f00-1a6f-42a7-8be7-ea190714c8fd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ross0x01]

Thank you @basriakkaya — I preserved your commit and attribution in upstream replacement PR #1107, then added the stale-active-organization safeguard and stable recovery code needed before deployment. I’ll close this draft once #1107 has passed preview/CI/CodeRabbit and is merged.

[ross0x01]

Merged via upstream replacement #1107 as 8c0f0cf, with your contribution credited in the squash commit. Closing this draft as superseded — thank you @basriakkaya.