Function POST

web/src/app/api/stripe/create-subscription/route.ts:17–116

(req: NextRequest)

import { logger } from '@/util/logger'

export async function POST(req: NextRequest) {
  const session = await getServerSession(authOptions)
  if (!session?.user?.id) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  const userId = session.user.id

  const body = await req.json().catch(() => null)
  const rawTier = Number(body?.tier)
  if (!rawTier || !(rawTier in SUBSCRIPTION_TIERS)) {
    return NextResponse.json(
      { error: `Invalid tier. Must be one of: ${Object.keys(SUBSCRIPTION_TIERS).join(', ')}.` },
      { status: 400 },
    )
  }
  const tier = rawTier as SubscriptionTierPrice

  const priceId = getPriceIdFromTier(tier)
  if (!priceId) {
    return NextResponse.json(
      { error: 'Subscription tier not available' },
      { status: 503 },
    )
  }

  const user = await db.query.user.findFirst({
    where: eq(schema.user.id, userId),
    columns: { stripe_customer_id: true, banned: true },
  })

  if (user?.banned) {
    logger.warn({ userId }, 'Banned user attempted to create subscription')
    return NextResponse.json(
      { error: 'Your account has been suspended. Please contact support.' },
      { status: 403 },
    )
  }

  if (!user?.stripe_customer_id) {
    return NextResponse.json(
      { error: 'Stripe customer not found.' },
      { status: 400 },
    )
  }

  const existing = await getActiveSubscription({ userId, logger })
  if (existing) {
    return NextResponse.json(
      { error: 'You already have an active subscription.' },
      { status: 409 },
    )
  }

  try {
    const checkoutSession = await stripeServer.checkout.sessions.create({
      customer: user.stripe_customer_id,
      mode: 'subscription',