Scope subscription checkout to a valid active organization

[ross0x01]

Supersedes #1095 while preserving @basriakkaya's original commit and attribution.

What changed

• scope subscription checkout to the active organization from the authenticated session
• reject ambiguous multi-organization checkout when no organization is active
• reject stale active-organization sessions instead of creating a new organization/customer checkout
• return the stable organization_selection_required code for client recovery
• retain admin/owner billing authorization checks

Validation

• focused Jest: 15/15 passed
• full Jest: 362 suites, 3,711 tests passed
• ESLint passed for changed files
• TypeScript typecheck passed
• Prettier and git diff --check passed

No visual QA is required because this is an API-only billing and authorization change. Manual preview verification will cover active-org and stale-org checkout behavior.

Summary by CodeRabbit

• New Features

  • Added organization-aware subscription checkout.
  • Users with multiple memberships must select an organization before checkout.
  • Checkout uses the selected organization’s membership and billing details.

• Bug Fixes

  • Prevented checkout or customer creation when organization selection is invalid or membership is inactive.
  • Added clear conflict responses for unresolved organization selection.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hackerai	Ready	Preview	Aug 14, 2026 11:36pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: afb685e1-c8ea-4300-b9ef-9472b5dd88a7

📥 Commits

Reviewing files that changed from the base of the PR and between f28f77b and a82de01.

📒 Files selected for processing (2)

• app/api/subscribe/__tests__/route.test.ts
• app/api/subscribe/route.ts

---

📝 Walkthrough

Walkthrough

The subscription route now validates the authenticated organization membership before checkout creation. It rejects ambiguous organization selection and stale active-organization memberships with HTTP 409 responses. Tests cover valid checkout metadata and rejected checkout flows.

Changes

Organization-scoped subscription checkout

Layer / File(s)	Summary
Membership selection and validation app/api/subscribe/route.ts	The route uses organizationId from the authenticated session, filters memberships by organization, and returns organization_selection_required when selection is missing or invalid.
Checkout organization coverage app/api/subscribe/__tests__/route.test.ts	Tests verify organization-scoped checkout creation, organization metadata, ambiguous membership rejection, and stale membership rejection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to a82de

The change scopes subscription checkout to the authenticated active organization and adds explicit handling for ambiguous or stale organization sessions; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• hackerai-tech/hackerai#1093: Updates organization-scoped billing behavior in subscription-details flows.
• hackerai-tech/hackerai#1099: Updates organization-scoped billing behavior and active-organization validation in the subscription route.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: restricting subscription checkout to a valid active organization.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-subscribe-active-org

---

_{Comment @coderabbitai help to get the list of available commands.}