karim/RAPPORT-HOST
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: Platzhalter-Keys nicht als echt werten + Crash-Schutz

Browse Source 
- env.js: '…CHANGE-ME'-Platzhalter aus .env.example zählen als NICHT gesetzt.
  Vorher galt sk_test_CHANGE-ME als echter Stripe-Key → echter API-Call mit
  ungültigem Key → 401 → unhandledRejection → Server-Crash.
- billing.js: /checkout in try/catch → 502 statt Empty-Reply/Crash.
- index.js: globaler Express-Error-Handler + unhandledRejection-Guard, damit
  ein einzelner async-Fehler nie den ganzen Prozess killt.

E2E verifiziert (Mock): register→checkout→instance, idempotent (1 sub/1 inst),
401 bei falschem PW, Server lebt nach allen Requests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
karim
2026-05-30 15:49:47 +02:00
parent 6290475ea3
commit 4b96e1a6b0
3 changed files with 46 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/routes/billing.js
+29 -24
View File
@@ -50,31 +50,36 @@ billingRouter.post("/checkout", requireAuth, async (req, res) => {
const plan = getPlan(req.body?.planId);
if (!plan) return res.status(400).json({ error: "Unbekannter Plan." });
// ── MOCK: sofort freischalten ──────────────────────────────────────────────
if (!stripeEnabled) {
await fulfill({
accountId: req.account.id,
plan,
stripeCustomerId: "mock_cus_" + req.account.id,
stripeSubscriptionId: "mock_sub_" + req.account.id + "_" + plan.id,
status: "active",
periodEnd: new Date(Date.now() + 30 * 864e5),
});
return res.json({ mock: true, url: `${env.publicBaseUrl}/dashboard?provisioned=1` });
}
try {
// ── MOCK: sofort freischalten ────────────────────────────────────────────
if (!stripeEnabled) {
await fulfill({
accountId: req.account.id,
plan,
stripeCustomerId: "mock_cus_" + req.account.id,
stripeSubscriptionId: "mock_sub_" + req.account.id + "_" + plan.id,
status: "active",
periodEnd: new Date(Date.now() + 30 * 864e5),
});
return res.json({ mock: true, url: `${env.publicBaseUrl}/dashboard?provisioned=1` });
}
// ── Stripe-Checkout-Session ────────────────────────────────────────────────
if (!plan.stripePriceId) return res.status(500).json({ error: "Kein Stripe-Price für diesen Plan konfiguriert." });
const session = await stripe.checkout.sessions.create({
mode: "subscription",
line_items: [{ price: plan.stripePriceId, quantity: 1 }],
customer_email: req.account.email,
client_reference_id: req.account.id,
metadata: { accountId: req.account.id, planId: plan.id },
success_url: `${env.publicBaseUrl}/dashboard?provisioned=1`,
cancel_url: `${env.publicBaseUrl}/plans?canceled=1`,
});
res.json({ url: session.url });
// ── Stripe-Checkout-Session ──────────────────────────────────────────────
if (!plan.stripePriceId) return res.status(500).json({ error: "Kein Stripe-Price für diesen Plan konfiguriert." });
const session = await stripe.checkout.sessions.create({
mode: "subscription",
line_items: [{ price: plan.stripePriceId, quantity: 1 }],
customer_email: req.account.email,
client_reference_id: req.account.id,
metadata: { accountId: req.account.id, planId: plan.id },
success_url: `${env.publicBaseUrl}/dashboard?provisioned=1`,
cancel_url: `${env.publicBaseUrl}/plans?canceled=1`,
});
res.json({ url: session.url });
} catch (err) {
console.error("checkout fehlgeschlagen:", err.message);
res.status(502).json({ error: "Checkout fehlgeschlagen: " + err.message });
}
});
// Stripe-Webhook. Braucht RAW Body (Signaturprüfung) — in index.js so verdrahtet.