Skip to content

fix(billing): billing UX hardening — paused/unpaid status, Stripe host whitelist, useMeter errors, poll abort flag, FR diacritics #4078

Closed

Description

@PierreBrisorgueil

Problem

Audit of the billing module surfaced 5 high/medium UX reliability issues:

  1. paused and unpaid subscription statuses fall through to default grey chip with no action button — user silently stuck
  2. Stripe redirect URLs validated only for HTTPS, no host whitelist — malicious/misconfigured API response could redirect off-Stripe
  3. useMeter silent .catch(() => {}) on refresh and initial fetch — errors swallowed, no visibility
  4. Checkout poll (pollSubscription) has no abort flag — recursive setTimeout chain continues for one tick after beforeUnmount
  5. All French diacritics stripped from billing lang/fr.js — rendering broken for FR locale users

Expected behaviour

  • paused → warning chip + Reactivate CTA; unpaid → error chip + Update payment method CTA
  • All Stripe redirect URLs validated against hostname whitelist (checkout.stripe.com, billing.stripe.com)
  • useMeter errors logged and exposed via reactive meterError ref
  • Poll aborted cleanly when component unmounts
  • All French strings render correctly with proper accents

Activity

  1. added a commit that references this issue on May 4, 2026
    dd62b3d
  2. added a commit that references this issue on May 5, 2026
    26105f1
  3. added a commit that references this issue on Jun 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions