From c78a659554e713a62b4641ac0b3ff5946e6d6d00 Mon Sep 17 00:00:00 2001
From: Gilad Resisi <giladresisi@gmail.com>
Date: Wed, 1 Jul 2026 17:51:07 +0700
Subject: [PATCH 1/2] fix(admin): don't hit Stripe for admin-granted
 subscriptions

Admin-granted subscriptions store the user id in Organization.paymentId (not a
real `cus_...` customer), so every billing path that fed paymentId to Stripe
threw "No such customer". Guard them all to skip Stripe when there is no real
`cus_` customer:

- getCharges returns no charges for any non-`cus_` paymentId.
- prorate returns a zero price (it fires on billing-page load per plan card,
  which was the main source of error logs).
- checkDiscount / applyDiscount return false (no coupon to offer/apply).
- finishTrial returns early (nothing to finish).
- /billing/portal, /billing/cancel and /billing/cancel-subscription reject with
  a clean 400 instead of a Stripe error (the UI also hides their buttons).

Also on the display side: /self exposes `hasStripeCustomer` (paymentId starts
with `cus_`), and the billing page only renders the "Update Payment Method /
Invoices History" button (which opens the Stripe billing portal) when it is
true. Admin-granted and never-subscribed orgs have no real customer, so the
button is hidden and the portal is never reached.

Validated by impersonating an admin-granted account (paymentId = user id): the
billing page now loads with no Stripe error logs (previously flooded by the
per-plan prorate call), and the Update Payment Method button is hidden. A real
`cus_` subscriber still sees the button and the portal opens normally.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../src/api/routes/billing.controller.ts      | 22 +++++++++++++++
 .../src/api/routes/users.controller.ts        |  5 ++++
 .../billing/main.billing.component.tsx        | 14 +++++-----
 .../src/services/stripe.service.ts            | 27 ++++++++++++++++++-
 4 files changed, 61 insertions(+), 7 deletions(-)

diff --git a/apps/backend/src/api/routes/billing.controller.ts b/apps/backend/src/api/routes/billing.controller.ts
index dd6686b158..98a2b378df 100644
--- a/apps/backend/src/api/routes/billing.controller.ts
+++ b/apps/backend/src/api/routes/billing.controller.ts
@@ -96,6 +96,12 @@ export class BillingController {
 
   @Get('/portal')
   async modifyPayment(@GetOrgFromRequest() org: Organization) {
+    // Admin-granted/never-subscribed orgs have no real `cus_...` customer, so
+    // there is no Stripe billing portal to open (the UI hides the button; this
+    // guards the endpoint against a "No such customer" Stripe error).
+    if (!org.paymentId?.startsWith('cus_')) {
+      throw new HttpException('No Stripe customer for this organization', 400);
+    }
     const customer = await this._stripeService.getCustomerByOrganizationId(
       org.id
     );
@@ -116,6 +122,13 @@ export class BillingController {
     @GetUserFromRequest() user: User,
     @Body() body: { feedback: string }
   ) {
+    // An admin-granted subscription has no Stripe subscription to cancel (its
+    // paymentId is the user id, not a `cus_...` customer). The UI hides the
+    // self-service cancel button for these; removal is an admin-only action.
+    if (!org.paymentId?.startsWith('cus_')) {
+      throw new HttpException('No Stripe subscription to cancel', 400);
+    }
+
     await this._notificationService.sendEmail(
       process.env.EMAIL_FROM_ADDRESS,
       'Subscription Cancelled',
@@ -168,6 +181,15 @@ export class BillingController {
       throw new HttpException('Unauthorized', 400);
     }
 
+    // Admin-granted subscriptions have no Stripe subscription to cancel; the
+    // admin panel hides this and offers "Remove Subscription" instead.
+    if (!org.paymentId?.startsWith('cus_')) {
+      throw new HttpException(
+        'Admin-granted subscription; use remove-subscription instead',
+        400
+      );
+    }
+
     return this._stripeService.cancelSubscription(org.id);
   }
 
diff --git a/apps/backend/src/api/routes/users.controller.ts b/apps/backend/src/api/routes/users.controller.ts
index 98e888d72c..623604aaf3 100644
--- a/apps/backend/src/api/routes/users.controller.ts
+++ b/apps/backend/src/api/routes/users.controller.ts
@@ -128,6 +128,11 @@ export class UsersController {
         ? false
         : organization?.isTrailing,
       allowTrial: organization?.allowTrial,
+      // A real Stripe customer has a `cus_...` paymentId. Admin-granted
+      // subscriptions store the user id there instead, and never-subscribed
+      // orgs have none, so gate billing-portal UI on this to avoid calling
+      // Stripe with a non-existent customer ("No such customer").
+      hasStripeCustomer: !!organization?.paymentId?.startsWith('cus_'),
       streakSince: organization?.streakSince || null,
       publicApi:
         // @ts-ignore
diff --git a/apps/frontend/src/components/billing/main.billing.component.tsx b/apps/frontend/src/components/billing/main.billing.component.tsx
index 1d8d05b6bd..d889895443 100644
--- a/apps/frontend/src/components/billing/main.billing.component.tsx
+++ b/apps/frontend/src/components/billing/main.billing.component.tsx
@@ -539,12 +539,14 @@ export const MainBillingComponent: FC<{
       </div>
       {!!subscription?.id && (
         <div className="flex justify-center mt-[20px] gap-[10px]">
-          <Button onClick={updatePayment}>
-            {t(
-              'update_payment_method_invoices_history',
-              'Update Payment Method / Invoices History'
-            )}
-          </Button>
+          {!!(user as any)?.hasStripeCustomer && (
+            <Button onClick={updatePayment}>
+              {t(
+                'update_payment_method_invoices_history',
+                'Update Payment Method / Invoices History'
+              )}
+            </Button>
+          )}
           {isGeneral && !subscription?.cancelAt && (
             <Button
               className="bg-red-500"
diff --git a/libraries/nestjs-libraries/src/services/stripe.service.ts b/libraries/nestjs-libraries/src/services/stripe.service.ts
index 35facc6c2c..065f6433b9 100644
--- a/libraries/nestjs-libraries/src/services/stripe.service.ts
+++ b/libraries/nestjs-libraries/src/services/stripe.service.ts
@@ -202,6 +202,12 @@ export class StripeService {
 
   async prorate(organizationId: string, body: BillingSubscribeDto) {
     const org = await this._organizationService.getOrgById(organizationId);
+    // Admin-granted subscriptions store the user id in paymentId (not a real
+    // `cus_...` customer); there is nothing to prorate against and Stripe would
+    // throw "No such customer", so return a zero price without calling it.
+    if (org?.paymentId && !org.paymentId.startsWith('cus_')) {
+      return { price: 0 };
+    }
     const customer = await this.createOrGetCustomer(org!);
     const priceData = pricing[body.billing];
     const allProducts = await stripe.products.list({
@@ -541,6 +547,11 @@ export class StripeService {
   }
 
   async finishTrial(paymentId: string) {
+    // No real Stripe customer (admin-granted or never-subscribed) → nothing to
+    // finish; skip the call that would throw "No such customer".
+    if (!paymentId?.startsWith('cus_')) {
+      return;
+    }
     const list = (
       await stripe.subscriptions.list({
         customer: paymentId,
@@ -557,6 +568,12 @@ export class StripeService {
       return false;
     }
 
+    // No real Stripe customer (admin-granted or never-subscribed) → no discount
+    // to offer; skip the call that would throw "No such customer".
+    if (!customer?.startsWith('cus_')) {
+      return false;
+    }
+
     const list = await stripe.charges.list({
       customer,
       limit: 1,
@@ -592,6 +609,11 @@ export class StripeService {
   }
 
   async applyDiscount(customer: string) {
+    // No real Stripe customer (admin-granted or never-subscribed) → nothing to
+    // apply a discount to; skip the call that would throw "No such customer".
+    if (!customer?.startsWith('cus_')) {
+      return false;
+    }
     const check = this.checkDiscount(customer);
     if (!check) {
       return false;
@@ -844,7 +866,10 @@ export class StripeService {
 
   async getCharges(organizationId: string) {
     const org = await this._organizationService.getOrgById(organizationId);
-    if (!org?.paymentId) {
+    // Only real Stripe customers have charges. Admin-granted subscriptions
+    // store the user id in `paymentId` (not a `cus_...` customer), so calling
+    // Stripe for them just throws "No such customer".
+    if (!org?.paymentId || !org.paymentId.startsWith('cus_')) {
       return [];
     }
 

From bb0b81f666b6e1d9e02674d7d9ff14d886d45edd Mon Sep 17 00:00:00 2001
From: Gilad Resisi <giladresisi@gmail.com>
Date: Tue, 14 Jul 2026 19:30:48 +0700
Subject: [PATCH 2/2] fix(billing): await checkDiscount before applying a
 discount

checkDiscount returned a pending Promise (always truthy), so the
eligibility guard in applyDiscount never fired: any cus_ customer
hitting POST /billing/apply-discount got the retention coupon
unconditionally, and customers with no active subscription crashed
on currentUserSubscription.data.id.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 libraries/nestjs-libraries/src/services/stripe.service.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libraries/nestjs-libraries/src/services/stripe.service.ts b/libraries/nestjs-libraries/src/services/stripe.service.ts
index 065f6433b9..79d89db357 100644
--- a/libraries/nestjs-libraries/src/services/stripe.service.ts
+++ b/libraries/nestjs-libraries/src/services/stripe.service.ts
@@ -614,7 +614,7 @@ export class StripeService {
     if (!customer?.startsWith('cus_')) {
       return false;
     }
-    const check = this.checkDiscount(customer);
+    const check = await this.checkDiscount(customer);
     if (!check) {
       return false;
     }