Skip to content

Admin Manage Subscriptions page with pause, resume, and cancel actions - #1444

Merged
ardalis merged 8 commits into
mainfrom
worktree-admin-manage-subscriptions
Jul 27, 2026
Merged

Admin Manage Subscriptions page with pause, resume, and cancel actions#1444
ardalis merged 8 commits into
mainfrom
worktree-admin-manage-subscriptions

Conversation

@ardalis

@ardalis ardalis commented Jul 27, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • Adds ISubscriptionHandlerService with billable subscription listing, pause/resume, and cancel (at period end or immediately) operations against Stripe
  • Adds StripeSubscriptionDto and AutoMapper profile for mapping Stripe subscriptions
  • Adds admin Manage Subscriptions page listing billable subscriptions with pause, resume, and cancel actions
  • Fixes XSS, loop, and webhook findings from code review of the new page

Test plan

  • dotnet build — 0 warnings, 0 errors
  • dotnet test — 232 passed, 0 failed (Tests: 75, UnitTests: 154, FunctionalTests: 3)
  • Manual: verify Manage Subscriptions page as admin against Stripe test data

🤖 Generated with Claude Code

ardalis and others added 8 commits July 26, 2026 08:16
- Create ISubscriptionHandlerService interface with ListBillableAsync method
- Implement StripeSubscriptionHandlerService with pagination and customer expansion
- Filter subscriptions to only billable statuses (active, past_due, trialing, unpaid)
- Exclude canceled subscriptions from results
- Register service in DI container
- Add comprehensive unit tests covering filtering and expansion behavior

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Implements CancelAtPeriodEndAsync and CancelImmediatelyAsync on StripeSubscriptionHandlerService. CancelAtPeriodEndAsync sets CancelAtPeriodEnd=true to defer cancellation until the subscription's current billing period ends. CancelImmediatelyAsync calls Stripe's cancel endpoint to immediately terminate the subscription.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Implement web-layer DTO and AutoMapper profile for mapping Stripe.Subscription objects to StripeSubscriptionDto. The profile handles nested property extraction (customer email, plan details, pricing) and null-conditional chaining for optional fields. Stripe amounts in cents are converted to decimal dollars via division by 100.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Strengthen test to verify subscriptions are ordered by CustomerEmail then Id,
and to assert mapped fields end-to-end. Test now provides subscriptions in
non-sorted order with same-email pair to exercise ThenBy tie-break logic.
Would fail if OrderBy/ThenBy calls were removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Implement POST handlers for subscription actions (pause, resume, cancel at period
end, cancel immediately) on the Manage Subscriptions admin page. Add action
buttons to the UI with confirmation dialogs. Add the Manage Subscriptions link
to the admin menu. Includes test class for handlers (discovery issue pending).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Remove member-controlled data (CustomerEmail, subscription Id) from
  onsubmit confirm() JS strings in ManageSubscriptions/Index.cshtml.
  Razor HTML-encoding is decoded by the HTML parser before the JS
  engine sees it, so a literal apostrophe (e.g. o'brien@example.com)
  reached the JS string context, silently skipping confirmation
  (including for irreversible Cancel Now) or enabling stored XSS in
  the admin session. Confirm messages are now static.
- Fix CustomerSubscriptionUpdatedWebHook comparing stripeEvent.Type
  against EventTypes.CustomerUpdated ("customer.updated") instead of
  EventTypes.CustomerSubscriptionUpdated ("customer.subscription.updated"),
  which made the endpoint reject every real event it receives with an
  uncaught 500.
- Harden StripeSubscriptionHandlerService.ListBillableAsync's pagination
  loop against an infinite loop if Stripe ever returns HasMore=true with
  an empty Data page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@ardalis
ardalis merged commit ef29b0a into main Jul 27, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant