PR Custody

feat(apollo): dashboard-authed payments endpoints (checkout + billing portal)

@anshugarg15checks n/achecks…fix/dashboard-payments-migration → production2 files · +360 −0review: @sohamganatrareview: @kaavee315updated 2w ago

GitHub

▸Description

What & why

The public /api/v3/payments/{session,manage-subscription} routes use getAuthRouter() + API_AUTH.COOKIE. After the WorkOS AuthKit migration killed the browser cookie, the dashboard's calls 401 (Auth_NoAuthProvided) — "Please use valid API key" on Get Started and Manage Billing. Same root cause and fix as the already-merged connected-accounts / projects / org / team-members migration.

Changes

New dashboard-authed duplicates under /api/internal-dashboard/payments/:

File	Stripe action
`payments/session.ts`	checkout session
`payments/manage-subscription.ts`	billing portal session

getDashboardRouter() + getDashboardOrgAuthInfo(c) (reads x-org-id) → org + member email from verified dashboard membership, exactly like org/api_key/regenerate.
ADMIN-only gate (role !== UserRole.ADMIN → 403).
Stripe orchestration is duplicated from the public handlers (it lives inline there, not in a lib fn) to avoid touching live billing code — no drift in behavior.
The dashboard backend has no browser origin, so success/cancel/return URLs come from the request body. manage-subscription gains an optional return_url; both fall back to the dashboard FE URL.

Pairs with

composio_dashboard PR (tRPC payments router + UI repoint).

🤖 Generated with Claude Code

loading diff…