fix(billing): only reconcile Pro on checkout return, match strictly by user id

Reconciling against Dodo on every account-page load — combined with an
email-based subscription match — let unrelated/new accounts resolve to an
active subscription and get flipped to Pro. Now reconcile only when returning
from a successful checkout (?upgrade=success) and match strictly by the
keyloom_user_id stamped into checkout metadata. The webhook keeps state in
sync for everything else.

Author: sankalpaacharya

apps/web/app/account/page.tsx

@@ -11,16 +11,25 @@ import { AccountClient } from "./account-client";
 // Always fresh — keys/usage change per request.
 export const dynamic = "force-dynamic";
 
-export default async function AccountPage() {
+export default async function AccountPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ upgrade?: string }>;
+}) {
   // No `ensureSignedIn` here — that redirects during render and tries to set the
   // PKCE cookie (forbidden in render). Instead send signed-out users to the
   // sign-in route handler, which can set it.
   const { user } = await withAuth();
   if (!user) redirect("/api/auth/signin");
   await ensureAccount(user.id, user.email);
-  // Verify-on-return: ask Dodo if they've subscribed and flip to Pro right away,
-  // so a successful payment shows up without waiting on a webhook.
-  await reconcileProFromDodo(user.id, user.email);
+  // Verify-on-return: ONLY when the user is returning from a successful Dodo
+  // checkout (`?upgrade=success`). Running this on every load made unrelated
+  // accounts resolve to an active Dodo subscription and get flipped to Pro.
+  // Routine logins must never reconcile — the webhook keeps state in sync.
+  const { upgrade } = await searchParams;
+  if (upgrade === "success") {
+    await reconcileProFromDodo(user.id, user.email);
+  }
 
   const [subscription, keys] = await Promise.all([
     getSubscription(user.id),

apps/web/lib/billing.ts

@@ -82,8 +82,13 @@ export type ActiveDodoSubscription = {
 /**
  * Asks Dodo directly whether this user currently has an active/trialing
  * subscription. Used to reconcile account state on page load WITHOUT waiting for
- * a webhook (verify-on-return). Matches by the keyloom_user_id we stamp into
- * checkout metadata, falling back to the customer email.
+ * a webhook (verify-on-return). Matches STRICTLY by the keyloom_user_id we stamp
+ * into checkout metadata at `createProCheckout` time.
+ *
+ * We deliberately do NOT fall back to matching the customer email: emails are
+ * not unique to a keyloom account (shared/test emails, re-used addresses) and
+ * an email-based match would let one subscription upgrade unrelated accounts to
+ * Pro. Identity comes only from the id we control.
  */
 export async function findActiveDodoSubscription(opts: {
   userId: string;
@@ -97,11 +102,8 @@ export async function findActiveDodoSubscription(opts: {
     data?: DodoSubscription[];
   };
   const items = res.items ?? res.data ?? [];
-  const email = opts.email.toLowerCase();
   const mine = items.filter(
-    (s) =>
-      s.metadata?.keyloom_user_id === opts.userId ||
-      s.customer?.email?.toLowerCase() === email,
+    (s) => !!opts.userId && s.metadata?.keyloom_user_id === opts.userId,
   );
   const active = mine.find(
     (s) => s.status === "active" || s.status === "trialing",