refactor(subscribe): integrate Privy authentication for checkout sessions

hooks/useSubscribeClick.ts

@@ -1,20 +1,26 @@
+import { usePrivy } from "@privy-io/react-auth";
 import { useUserProvider } from "@/providers/UserProvder";
 import { usePaymentProvider } from "@/providers/PaymentProvider";
 import createClientPortalSession from "@/lib/stripe/createClientPortalSession";
 import createClientCheckoutSession from "@/lib/stripe/createClientCheckoutSession";
 
 const useSubscribeClick = () => {
+  const { getAccessToken } = usePrivy();
   const { userData } = useUserProvider();
   const { isSubscribed } = usePaymentProvider();
 
-  const handleClick = () => {
+  const handleClick = async () => {
     if (!userData?.account_id) return;
 
     if (isSubscribed) {
-      createClientPortalSession(userData.account_id);
+      void createClientPortalSession(userData.account_id);
       return;
     }
-    createClientCheckoutSession(userData.account_id);
+
+    const accessToken = await getAccessToken();
+    if (!accessToken) return;
+
+    void createClientCheckoutSession(accessToken, window.location.href);
   };
 
   return {

lib/stripe/__tests__/createClientCheckoutSession.test.ts

@@ -0,0 +1,71 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import createClientCheckoutSession from "../createClientCheckoutSession";
+import { getClientApiBaseUrl } from "@/lib/api/getClientApiBaseUrl";
+
+vi.mock("@/lib/api/getClientApiBaseUrl", () => ({
+  getClientApiBaseUrl: vi.fn(),
+}));
+
+describe("createClientCheckoutSession", () => {
+  const mockOpen = vi.fn();
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    vi.mocked(getClientApiBaseUrl).mockReturnValue("https://api.recoupable.com");
+    vi.stubGlobal("window", { open: mockOpen } as unknown as Window);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  it("POSTs only successUrl to recoup-api with Bearer auth and opens checkout url", async () => {
+    global.fetch = vi.fn().mockResolvedValue({
+      ok: true,
+      json: vi.fn().mockResolvedValue({
+        id: "cs_test_1",
+        url: "https://checkout.stripe.com/test",
+      }),
+    }) as unknown as typeof fetch;
+
+    await createClientCheckoutSession(
+      "privy-token",
+      "https://chat.recoupable.com/billing",
+    );
+
+    expect(fetch).toHaveBeenCalledWith(
+      "https://api.recoupable.com/api/subscriptions/sessions",
+      expect.objectContaining({
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: "Bearer privy-token",
+        },
+      }),
+    );
+    const init = vi.mocked(fetch).mock.calls[0][1] as RequestInit;
+    expect(JSON.parse(String(init.body))).toEqual({
+      successUrl: "https://chat.recoupable.com/billing",
+    });
+    expect(mockOpen).toHaveBeenCalledWith(
+      "https://checkout.stripe.com/test",
+      "_blank",
+      "noopener,noreferrer",
+    );
+  });
+
+  it("does not open a window and returns error when response is not ok", async () => {
+    global.fetch = vi.fn().mockResolvedValue({
+      ok: false,
+      status: 401,
+      json: vi.fn().mockResolvedValue({ error: "Unauthorized" }),
+    }) as unknown as typeof fetch;
+
+    const result = await createClientCheckoutSession("bad-token", "https://ex.com");
+
+    expect(mockOpen).not.toHaveBeenCalled();
+    expect(result).toEqual({ error: expect.any(Error) });
+  });
+});

lib/stripe/createClientCheckoutSession.ts

@@ -1,19 +1,35 @@
-const createClientCheckoutSession = async (accountId: string) => {
+import { getClientApiBaseUrl } from "@/lib/api/getClientApiBaseUrl";
+
+const createClientCheckoutSession = async (
+  accessToken: string,
+  successUrl: string,
+) => {
   try {
-    const response = await fetch(`/api/stripe/session/create`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
+    const response = await fetch(
+      `${getClientApiBaseUrl()}/api/subscriptions/sessions`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${accessToken}`,
+        },
+        body: JSON.stringify({ successUrl }),
       },
-      body: JSON.stringify({
-        accountId,
-        successUrl: `${window.location.href}`,
-      }),
-    });
+    );
+
+    const data = (await response.json()) as {
+      id?: string;
+      url?: string;
+      error?: string;
+    };
+
+    if (!response.ok || typeof data.url !== "string") {
+      throw new Error(data.error || "Failed to create checkout session");
+    }
 
-    const data = await response.json();
-    window.open(data.data.url, "__blank");
+    window.open(data.url, "_blank", "noopener,noreferrer");
   } catch (error) {
+    console.error("Error creating checkout session:", error);
     return { error };
   }
 };