feat: Dodo Payments integration + entitlement engine & webhook pipeline#2024
feat: Dodo Payments integration + entitlement engine & webhook pipeline#2024
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
SebastienMelki
changed the title
Progress Update — Dodo Payments Integration@koala73 Here's where we're at across the phases: Completed Phases (14–17)
Key fixes in latest push
Up Next
Let me know if you want me to adjust anything or if you have questions! |
|
One thought on the access model discussion — I've been thinking about where the real value sits in this project. The panel rendering, correlation logic, and map overlays are engineering work but they're reproducible. Anyone with the same data sources could build a similar UI. What's genuinely hard to replicate is the curated data pipeline itself: 42+ sources today, 20+ health sources evaluated and ready to integrate, each with different auth models, formats, refresh cadences, deduplication requirements, and freshness guarantees. That's the moat. Gating panel access behind subscription tiers is one model, but it means charging users for what is essentially a rendering layer over freely available public data. An alternative worth considering: keep the app fully open source with all panels accessible, and monetize the curated data feeds themselves via API access. The consumers for that are different and arguably higher value: other dashboard builders, research institutions, newsrooms, government analysts, fintech platforms. Pricing by feed tier, call volume, or SLA. This doesn't conflict with the AGPL3 license or the open source commitment. The app stays free and open. The data curation, normalization, and reliability guarantees become the product. Not trying to derail the billing work already in progress, just raising it as a complementary angle worth discussing as the health data expansion takes shape. |
|
First, intros:
Second: On this PR:
My current thoughts on monetization on https://worldmonitor.app/pro - but am not blocked by them, trying to validate Multiple access paths I'm thinking about:
On the actual discussion :
The "data fetching pipeline" is not the "value proposition" in my opinion, the pipeline is the moat, but the product is the synthesis layer on top. Thoughts ? |
Code Review Fixes — All Items Addressed@koala73 Pushed fixes for all review items. Synced with main (clean merge, no conflicts). 20/20 tests pass, vite build clean. P0 (Critical)Identity bridge — Premium panel gating — All premium gates now check API plans — Gateway entitlement enforcement infrastructure is ready ( P1 (Important)Fail-closed entitlements — Env var hygiene — Test suite fixed — P2
P3
What's left
|
Security audit + hardening pass (Phase 18) — @koala73Ran a thorough 4-agent parallel code review on all Phase 18 billing code. Found and fixed 6 critical, 3 high, 8 medium, and 4 low issues. All tests still pass (26/26 vitest, typecheck clean). What was fixed (uncommitted, will push shortly)Critical — auth + payment correctness:
High — production safety:
Medium — correctness + completeness:
What needs testing before mergeThese can't be verified without a live Dodo test-mode subscription. Need to test after auth is merged (PR #1812): 1. End-to-end subscription flow
2. Billing portal
3. Plan change
4. Payment failure + recovery
5. Subscription expiry
6. Webhook retry resilience
7. Auth gating (post #1812)
What's NOT changing
The manual test checklist at |
|
@koala73 All 6 review items addressed — pushed `ff07cf07`. P0 — Dev/prod identity leak (convex/lib/auth.ts, subscriptionHelpers.ts)
P0 — Gateway tier-gating for Dodo users (server/gateway.ts, server/_shared/auth-session.ts)
P1 — Browser identity bridge (src/services/user-identity.ts)
P2 — Frontend premium access (src/App.ts)
P2 — Dodo SDK module-scope capture (convex/lib/dodo.ts, convex/payments/billing.ts)
Tests: All passing — webhook test payloads updated to use 🤖 Generated with Claude Code |
koala73
left a comment
koala73
left a comment
There was a problem hiding this comment.
Code Review — Final Consolidated
Overall: REQUEST_CHANGES — 1 P0, 2 P1 must be fixed before merge.
P0 — Broken access control on public Convex billing functions
Files: convex/payments/billing.ts:49,140,177 · convex/lib/auth.ts:22 · convex/convex.config.ts:6
Because betterAuth is still not registered in convex.config.ts, ctx.auth.getUserIdentity() always returns null in production. resolveUserId(ctx) returns null and all three public billing functions fall through to args.userId:
const authedUserId = await resolveUserId(ctx); // → null in prod
const userId = authedUserId ?? args.userId; // → attacker-controlledAny unauthenticated caller with the public Convex URL can:
- Read any user's subscription via
getSubscriptionForUser - Create a customer portal session for any
userIdviagetCustomerPortalUrl(leaks billing details) - Change any user's plan via
changePlan
Required fix: Remove userId from public args on all three functions. Use requireUserId(ctx) with no fallback:
export const getSubscriptionForUser = query({
args: {},
handler: async (ctx) => {
const userId = await requireUserId(ctx); // throws if unauthenticated
// ...
},
});Until PR #1812 merges, these endpoints must either be kept internal or return a clear "not yet available" error rather than accepting caller-supplied identity.
P1 — No reliable identity bridge for brand-new purchasers — webhook retries forever
Files: src/services/user-identity.ts:22 · convex/payments/checkout.ts:29 · convex/payments/subscriptionHelpers.ts:147,262
For a new web user (no wm-pro-key, no Clerk auth), getUserId() returns null, so createCheckout emits no metadata.wm_user_id.
When Dodo fires subscription.active, webhook resolveUserId() tries:
metadata.wm_user_id— absentcustomerstable lookup — no row yet (created insidehandleSubscriptionActive, after identity resolution)isDevDeployment→ false → throws
Mutation throws, Convex rolls back, Dodo retries. Nothing changes between retries — this loops indefinitely for every new purchaser. The tests don't catch this because they always pre-seed wm_user_id or a customer row.
Required fix: Generate a stable anonymous ID on first visit and always pass it as wm_user_id:
// src/services/user-identity.ts
const ANON_KEY = 'wm-anon-id';
export function getOrCreateAnonId(): string {
try {
let id = localStorage.getItem(ANON_KEY);
if (!id) { id = crypto.randomUUID(); localStorage.setItem(ANON_KEY, id); }
return id;
} catch { return crypto.randomUUID(); }
}
export function getUserId(): string | null {
try { return localStorage.getItem(LEGACY_PRO_KEY) || getOrCreateAnonId(); }
catch { return null; }
}This guarantees createCheckout always has a wm_user_id, breaking the retry loop. Anon IDs can be linked to real accounts once Clerk auth lands.
P1 — Entitlement reload loop on every page load for existing premium users
Files: src/app/panel-layout.ts:94,141 · src/services/entitlements.ts:51
onEntitlementChange fires immediately for late subscribers when currentState !== null. The callback calls shouldUnlockPremium(), which checks not just Convex state but also WORLDMONITOR_API_KEY and isProUser() (localStorage).
For any existing premium user (API key or wm-pro-key present), shouldUnlockPremium() is already true before Convex connects. When the first Convex snapshot arrives, the callback fires → window.location.reload() → repeat. The wasEntitled guard is insufficient because shouldUnlockPremium() includes legacy signals.
Required fix: Skip the initial snapshot and guard on Convex entitlement state only:
let _skipInitialSnapshot = true;
onEntitlementChange(() => {
if (_skipInitialSnapshot) {
_skipInitialSnapshot = false;
return; // ignore the immediate first-fire
}
// Only reload on a real Convex entitlement transition
if (isEntitled()) {
console.log('[entitlements] Subscription activated — reloading');
window.location.reload();
}
});Confirmed Clean
getDodoApi().checkout(...args)wrapper — preserves method context correctlynew Request(request, { body: request.body })— safe given OPTIONS returns before any body reads- Unrelated infra additions (DDoS/traffic anomaly endpoints) not reviewed
|
@koala73 — all three items from your review are addressed in 63db64a: P0 — Broken access control on public billing functions ✅
P1 — Identity bridge for new purchasers ✅
P1 — Entitlement reload loop ✅
Let me know if anything else needs adjustment. |
koala73
left a comment
koala73
left a comment
There was a problem hiding this comment.
Follow-up Review — 2 P1s Remaining
The P0 access control fix is correctly implemented. Two P1 issues remain before merge.
P1 — Authenticated billing flow is not wired end-to-end: getSubscriptionForUser, getCustomerPortalUrl, and changePlan will always throw in a normal browser session
Files: convex/payments/billing.ts:44,130,168 · src/services/convex-client.ts:24 · src/services/billing.ts:35
billing.ts correctly replaced the IDOR-prone args.userId fallback with requireUserId(ctx). But requireUserId calls ctx.auth.getUserIdentity(), which only returns a non-null identity when the Convex connection carries an authenticated JWT. The ConvexClient created in convex-client.ts is initialized bare — no setAuth(), no Clerk token, nothing:
client = new CC(convexUrl); // no auth token wiredOn any real browser session, ctx.auth.getUserIdentity() returns null, CONVEX_IS_DEV is false, so requireUserId throws "Authentication required". This means:
getSubscriptionForUser(onUpdatein billing service): query throws → subscription watch silently broken,currentSubscriptionstaysnull, payment failure banner never showsgetCustomerPortalUrl: action throws → "Manage Billing" button opens fallbackcustomer.dodopayments.comfor every user, not their actual portalchangePlan: action throws → plan changes silently fail
The billing UI introduced in this PR is essentially disabled for all real users. The fallbacks mask this so it won't crash, but the feature doesn't work.
Required fix: Wire the Clerk JWT into the ConvexClient once auth lands. Until then, either keep these three functions as internal (not callable from the browser), or revert billing.ts back to accepting userId from args and keep getSubscriptionForUser as a client-observable query (the pattern used by entitlements.ts/getEntitlementsForUser which still works fine because it takes userId as a public arg).
P1 — Anonymous ID purchase has no account-claim path: paid users can be permanently locked out on browser change or storage clear
Files: src/services/user-identity.ts:24 · convex/payments/checkout.ts:21 · convex/payments/subscriptionHelpers.ts:147,262
The anon ID fix correctly solves the "new purchase has no wm_user_id" webhook retry loop. But it introduces a different problem: the subscription, customer, and entitlement rows in Convex are now permanently keyed to a crypto.randomUUID() that only lives in this browser's localStorage.
If the user:
- Switches to another browser or device
- Clears storage / uses private browsing
- Later creates a real account (post Clerk auth)
- Has their browser data wiped
…there is no path to claim or migrate their subscription to the new identity. Dodo has the subscription linked to dodoCustomerId, and Convex has the subscription linked to a stale wm-anon-id UUID. The user paid but the app shows them as free forever.
This is acceptable as a temporary explicit stub only if:
- The PR description and a code comment explicitly document the limitation and the migration plan
- A follow-up issue exists for the claim/migration path (anon ID → real auth ID linkage)
- The Clerk auth integration is not far behind (otherwise real users will hit this)
If those conditions aren't met, this should be revisited before shipping to real paying customers. The minimal safe version is to also store the wm-anon-id alongside the subscription in a way that allows a future "claim this purchase" flow (e.g., a claimSubscription(anonId) mutation that reassigns rows once a real auth identity is established).
|
@koala73 Both P1s from your follow-up review addressed in 280aa2b. P1 — Billing flow wired end-to-end for browser sessions ✅Reverted const authedUserId = await resolveUserId(ctx);
const userId = authedUserId ?? args.userId;When Clerk JWT is wired into Frontend
Subscription watch, portal URLs, and plan changes all work for browser users now. P1 — Anonymous ID claim path ✅Conditions met:
Also in this commit:
🤖 Generated with Claude Code |
koala73
left a comment
koala73
left a comment
There was a problem hiding this comment.
Follow-up Review — 1 P0, 1 P1, 1 P2 Remaining
Tests and typecheck pass. Three issues on the latest commit.
P0 — Billing access control hole re-opened
Files: convex/payments/billing.ts:44,135,167
The fix reverted requireUserId back to the same resolveUserId(ctx) ?? args.userId pattern that was the original P0. All three public billing functions (getSubscriptionForUser, getCustomerPortalUrl, changePlan) now again accept a caller-supplied userId and fall through to it when unauthenticated:
const authedUserId = await resolveUserId(ctx); // → null in prod (no Clerk wired)
const userId = authedUserId ?? args.userId; // → attacker-controlledAny unauthenticated caller with the public Convex deployment URL can still read subscription state, create a customer portal session, or change plans for any userId they supply.
The underlying tension is real — requireUserId breaks the browser flow because ConvexClient has no auth token. But reopening the IDOR is not the right resolution. The correct fix is one of:
Option A (recommended for this PR): Keep getSubscriptionForUser accepting userId as a public arg (matching getEntitlementsForUser — safe, read-only), but make getCustomerPortalUrl and changePlan internal mutations (internalAction) callable only from server-side or scheduled functions, not directly from the browser. These two are the dangerous write paths.
Option B: Ship getCustomerPortalUrl and changePlan as stubs that return a "not yet available" error. Wire them properly once Clerk auth lands.
The read query (getSubscriptionForUser) can safely accept userId — reading your own subscription is low-risk, and getEntitlementsForUser follows the same pattern. The write actions are what need to be locked.
P1 — claimSubscription has no client call site: anon ID recovery path is scaffolded but not shipped
Files: convex/payments/billing.ts:220 · src/services/user-identity.ts:14
claimSubscription is correctly implemented server-side, but there is no call site under src/. The comment in user-identity.ts documents the limitation accurately — storage clear or device change still permanently loses the subscription. The scaffolding exists but the feature is not wired.
This is acceptable if explicitly noted in the PR as a known limitation shipped intentionally, with a linked follow-up issue for the client-side wiring. The comment references #2078 — if that issue exists and the team accepts the temporary risk, this can be downgraded to advisory. If #2078 doesn't exist yet, please create it and link it here before merge.
P2 — claimSubscription merge logic uses wrong comparison and misses Redis cache invalidation
Files: convex/payments/billing.ts:245 · convex/payments/cacheActions.ts:25 · server/_shared/entitlement-check.ts:93
Wrong merge heuristic: The comment says "keep the higher-tier entitlement" but the code compares validUntil dates:
// Comment: "Keep the higher-tier entitlement"
if (entitlement.validUntil > existingEntitlement.validUntil) { // ← picks LATER date, not higher tierA user on pro_monthly (tier 1, renews in 15 days) who claims against an existing api_starter (tier 2, renews in 10 days) would be downgraded to pro_monthly because it has the later validUntil. Fix: compare features.tier first, break ties with validUntil.
Missing Redis cache invalidation: After patching Convex rows, the anon ID's Redis cache entry (entitlements:{anonId}) is not cleared, and the real user's new entitlement is not synced. After a claim:
entitlements:{anonId}stays in Redis for up to 1 hour — any process that reads via the old anon key gets stale paid dataentitlements:{realUserId}is not written — gateway entitlement checks fall back to Convex until next TTL refresh
Fix: after the Convex patches, schedule syncEntitlementCache for realUserId and call deleteRedisKey(entitlements:${anonId}, true) to clear the stale anon entry.
|
@koala73 All 3 items from your third review addressed in 2ffd844. P0 — Billing write actions locked down ✅
Frontend behavior:
Both will be promoted to public actions with P1 — claimSubscription client call site ✅ (advisory)Issue #2078 exists and is linked in the code comment. The limitation is explicitly documented in P2 — claimSubscription logic fixed ✅Tier-first comparison: Entitlement merge now compares Redis cache invalidation: After reassigning Convex rows, the mutation now schedules:
Added 🤖 Generated with Claude Code |
SebastienMelki
force-pushed
the
dodo_payments
branch
from
4b2b6b7 to
801a0bb
Compare
|
@koala73 Branch is rebased on latest main, all conflicts resolved. What's left to get this merged? |
…e unused imports Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
koala73
removed
the
Not Ready to Merge
- Bound and parallelize claimSubscription reads with Promise.all (4x queries -> single round trip; .collect() -> .take() to cap memory) - Add returnUrl allowlist validation in createCheckout to prevent open redirect - Make openBillingPortal return Promise<string | null> for agent-native callers - Extend isCallerPremium with Dodo entitlement tier check (tier >= 1 is premium, unifying Clerk role:pro and Dodo subscriber as two signals for the same gate) - Call resetEntitlementState() on sign-out to prevent entitlement state leakage across sessions (destroyEntitlementSubscription preserves state for reconnects; resetEntitlementState is the explicit sign-out nullifier) - Merge handlePaymentEvent + handleRefundEvent -> handlePaymentOrRefundEvent (type inferred from event prefix; eliminates duplicate resolveUserId call) - Remove _testCheckEntitlement DI export from entitlement-check.ts; inline _checkEntitlementCore into checkEntitlement; tests now mock getCachedJson - Collapse 4 duplicate dispute status tests into test.each - Fix stale entitlement variable name in claimSubscription return value
|
Thank you @SebastienMelki |
|
I contributed to the commodity variant, I really hope I don't have to pay to access it guys |
same i'm standing by to see where all this goes. |
4 participants
Summary
Integrates Dodo Payments as the billing provider for WorldMonitor, covering the foundation layer (Phases 14-16). This adds a full subscription-to-entitlement pipeline: webhook ingestion, idempotent event processing, config-driven feature flags, API gateway enforcement, and frontend panel gating.
What's done (Phases 14-16)
Phase 14 — Foundation & Schema
@dodopayments/convexcomponent and registered it inconvex.config.tssubscriptions,webhookEvents,entitlements,productPlanMappings,customers,invoices)convex/lib/auth.ts) + env helper (convex/lib/env.ts)Phase 15 — Webhook Pipeline
/dodo/webhookwith HMAC-SHA256 signature verificationeventId, dispatches to typed handlerssubscription.created,subscription.updated,subscription.cancelled,subscription.expiredand morePLAN_FEATURESmap)Phase 16 — Entitlement Engine
PLAN_FEATURESmap with tier levels per feature flagentitlements:getForUserfor reactive entitlement lookupsserver/_shared/entitlement-check.ts) — enforces entitlements on protected routes with Redis fast-path + Convex fallbacksrc/services/entitlements.ts) — reactive ConvexClient subscription, panel gating inpanel-layout.tsWhat's left (Phases 17-18)
Architecture
Notes
resolveUserIdinconvex/lib/auth.ts) pending Auth integration from PR feat(auth): integrate clerk.dev #1812PLAN_FEATURESconfig is the single source of truth for what each plan unlocks — adding a new feature flag is a one-line changeeventId+ status guards)Files changed
26 files, ~2700 lines added across
convex/,server/, andsrc/.@koala73 — Would appreciate a look at the schema design and the entitlement config map shape. Happy to walk through the webhook flow if helpful.
🤖 Generated with Claude Code