
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
@todesktop/shared
Advanced tools
Most of the code for coordinating Stripe subscriptions can be found in `plans.ts`. Conceptually, we organize subscriptions as follows:
Most of the code for coordinating Stripe subscriptions can be found in
plans.ts. Conceptually, we organize subscriptions as follows:
Price captures the ID information of a Stripe Price and it's current
status:
inactive means that the price should no longer be used (but may have been
used previously).active means that the price should be used going forward.Product maps to what is shown in Stripe's
Product Catalogue UI.
These help use organize the dev and prod versions of a Product, as well as
their underlying productId and priceIds.Plan is a collection of Products, organized by their tier (basic,
legacy_pro, pro, scale).Each Plan also specifies the eligiblePlanTiers that it accepts for validation
purposes. E.g. the basic plan specifies
['basic', 'legacy_pro', 'pro', 'scale'] in its eligiblePlanTiers field,
meaning that Products belonging within any of those tiers would satisfy
validation requirements. Similarly, the basic plan specifies ['scale'] in its
tiers field, meaning that only Products belonging to the scale Plans
would satisfy validation.
Before adding a new price, you'll first need to identify the Stripe Stripe Product that the price should be added to.
Once you've added a new price to the product in Stripe's live and test mode,
then you can come back and add it to the relevant product in plans.ts.
For example, these are the dev and prod records for the legacy enterprise product:
const legacyEnterpriseDev = createProduct('prod_Hc9PMnHUmHvOlw', {
monthly_700: createPrice('price_1H2v6JIewCKA2h0IgUwsuctb', 'active'),
});
const legacyEnterpriseProd = createProduct('prod_GuGGWeMQ3SCuE9', {
monthly_700: createPrice('plan_GuGICX6nRtDthN', 'active'),
});
If you added a new Stripe price to this product that is billed yearly for $10,000, then you would add update the products as follows:
const legacyEnterpriseDev = createProduct('prod_Hc9PMnHUmHvOlw', {
monthly_700: createPrice('price_1H2v6JIewCKA2h0IgUwsuctb', 'active'),
yearly_10000: createPrice('...', 'active'),
});
const legacyEnterpriseProd = createProduct('prod_GuGGWeMQ3SCuE9', {
monthly_700: createPrice('plan_GuGICX6nRtDthN', 'active'),
yearly_10000: createPrice('...', 'active'),
});
ToDesktop's subscription flow needs to support both CLI and ToDesktop Builder customers. To achieve this, we dynamically create/load billing portals based on whether the customer is a CLI or ToDesktop Builder user, whether the customer needs to Upgrade or Update their plan, and whether the environment is in prod or dev.
This leaves us with 8 unique customer portal configurations:
Each configuration specifies the products and prices (with an active status)
that should be displayed when a user navigates to the customer billing portal.
The web app and desktop app then only need to specify the PortalConfigKey when
creating a checkout session from the client:
// begin a CLI upgrade customer portal session
await createCustomerPortalSession({
configuration: PortalConfigKey.CLIUpgradeProd,
flowData: {
type: 'subscription_update',
subscription_update: { subscription: subscription.id },
},
});
If you have updated the products that are used by any of the portal
configurations, then you'll also need to increase the PORTAL_VERSION constant
by 1. This will ensure that the portals are rebuilt to use the latest products
and prices. This happens in createCustomerPortalSession in the web app.
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.