Function POST

web/src/app/api/stripe/buy-credits/route.ts:25–236

(req: NextRequest)

})

export async function POST(req: NextRequest) {
  const session = await getServerSession(authOptions)
  if (!session?.user?.id || !session?.user?.email) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }
  const userId = session.user.id
  const _userEmail = session.user.email

  let data
  try {
    data = await req.json()
    const validation = buyCreditsSchema.safeParse(data)
    if (!validation.success) {
      return NextResponse.json(
        { error: 'Invalid input', issues: validation.error.issues },
        { status: 400 },
      )
    }
    data = validation.data
  } catch (error) {
    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })
  }

  const { credits } = data

  try {
    const user = await db.query.user.findFirst({
      where: eq(schema.user.id, userId),
      columns: { stripe_customer_id: true, banned: true },
    })

    if (user?.banned) {
      logger.warn({ userId }, 'Banned user attempted to purchase credits')
      return NextResponse.json(
        { error: 'Your account has been suspended. Please contact support.' },
        { status: 403 },
      )
    }

    if (!user?.stripe_customer_id) {
      logger.error(
        { userId },
        'User attempting to buy credits has no Stripe customer ID.',
      )
      return NextResponse.json(
        { error: 'Stripe customer not found.' },
        { status: 400 },
      )
    }

    const centsPerCredit = 1
    const amountInCents = convertCreditsToUsdCents(credits, centsPerCredit)

    if (amountInCents <= 0) {
      logger.error(
        { userId, credits, centsPerCredit },
        'Calculated zero or negative amount in cents for credit purchase.',
      )