You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
C2 — Dead code removal: removed showAlreadyActiveDialog method, alreadyActiveDialog / alreadyActivePortalUrl state, and the 409 dialog template block from billing.subscriptions.component.vue. Confirmed zero production callers (the live 409 handling is self-contained in billing.pricing.view.vue). Dropped Suite 9 from unit tests — those 5 tests called the method directly, bypassing the real flow (fake coverage). i18n keys retained as they are still used by billing.pricing.view.vue.
C3 — meterError surface: wired meterError from useMeter() into both consumers' setup() returns (billing.subscriptions.component.vue and billing.usageBar.component.vue). Renders a closable v-alert[type=warning] above the meter section in the subscriptions component when polling fails. Added billing.meter.error.refreshFailed i18n keys (en + fr). Added new Suite 9 (3 tests) covering render when error is set, suppression when null, and dismiss by setting meterError = null. usageBar exposes meterError in its return but defers the UI to the parent subscriptions alert (no duplicate indicator — bar lives adjacent to subscriptions component).
Test plan
All 74 unit tests in billing.subscriptions.component.unit.tests.js pass (was 79, Suite 9 swapped: 5 dead removed, 3 real added)
Full coverage suite: 1452 tests pass, coverage unchanged (99.06% stmts)
Build: npm run build clean
Lint: npm run lint clean
Summary by CodeRabbit
New Features
Usage meter error alerts: failed refresh attempts now display as dismissible warning notifications
Subscription statuses: expanded to support "paused" and "unpaid" states with localized status labels
Bug Fixes
Polling behavior: improved stability and cleanup during component unmounting
Stripe redirects: enhanced URL validation for billing portal and checkout links
Localization
French translations: corrected spelling, accents, and billing terminology throughout
@PierreBrisorgueil has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 22 seconds before requesting another review.
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.
⌛ How to resolve this issue?
After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.
We recommend that you space out your commits to avoid hitting the rate limit.
🚦 How do rate limits work?
CodeRabbit enforces hourly rate limits for each developer per organization.
Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.
The PR enhances the billing module with error handling visibility, extended subscription statuses, polling cleanup hardening, and Stripe URL validation. It adds shared meterError state to display meter refresh failures; extends subscription statuses to include paused and unpaid with corresponding i18n and icon mappings; introduces a pollAborted flag to prevent polling after component unmount; implements validateStripeUrl to whitelist Stripe redirect destinations; and updates French i18n with corrected diacritics.
Changes
Billing Module Enhancements
Layer / File(s)
Summary
Error State & Composable src/modules/billing/composables/billing.useMeter.js
Introduces module-scoped shared meterError Ref; safeRefresh now clears stale errors, logs failures, and stores errors into meterError. Initial fetchMissingMeterData failures also recorded to meterError; error cleared on final consumer unmount.
New validateStripeUrl(url) function validates protocol (https:), parses URL, and enforces whitelist of allowed hostnames (checkout.stripe.com, billing.stripe.com); returns normalized URL or throws with specific error messages.
English: added billing.meter.error.refreshFailed and billing.subscriptions.status.paused/unpaid. French: corrected diacritics/accents throughout (e.g., "Répartition", "Quota épuisé", "Illimité") and added missing status translations.
Subscription Status Mapping src/modules/billing/components/billing.subscriptions.component.vue
Extended subscriptionStatusMeta, subscriptionStatusIcon, and subscriptionStatusAction to handle paused (reactivate action) and unpaid (update payment method action) states with i18n labels and Font Awesome icons. Removed "409 already-active" dialog and backing showAlreadyActiveDialog method.
Added meterError warning v-alert in template with closable behavior; wired meterError from useMeter() into component state.
Meter Usage Component src/modules/billing/components/billing.usageBar.component.vue
Extracted and exposed meterError from useMeter() in component setup; updated JSDoc return type.
Store Integration src/modules/billing/stores/billing.store.js, src/modules/billing/views/billing.pricing.view.vue
openPortal and createExtrasCheckout now use validateStripeUrl for redirect target validation instead of manual URL parsing and protocol checks; invalid/off-whitelist URLs throw errors. billing.pricing.view applies validation to both main checkout and already-active portal URLs.
Test Coverage src/modules/billing/tests/billing.stripeRedirect.unit.tests.js
New test suite for validateStripeUrl: validates whitelisted HTTPS hosts, normalizes query parameters, rejects empty/null/undefined/non-string inputs, relative/protocol-relative URLs, non-HTTPS schemes, and non-whitelisted hosts.
Added paused/unpaid status test cases with i18n label assertions; replaced "409 dialog" tests with meterError alert render/clear tests; added pollAborted unmount cleanup verification. useMeter tests verify meterError initialization, failure transitions, recovery after transient failures, and presence on returned object.
Store & Action Tests src/modules/billing/tests/billing.store.unit.tests.js
Updated expected error messages for non-HTTPS URLs to unified Stripe URL must use HTTPS text.
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related issues
pierreb-devkit/Vue#4078: Directly addresses all code-level improvements in this PR (paused/unpaid status handling, Stripe URL whitelist validation, shared meterError state, pollAborted flag, French diacritics correction).
Possibly related PRs
pierreb-devkit/Vue#3726: Modifies the same billing.store portal/checkout redirect logic (openPortal/createExtrasCheckout URL validation).
pierreb-devkit/Vue#4037: Introduces the initial useMeter implementation that this PR extends with shared meterError and error handling improvements.
pierreb-devkit/Vue#4079: Makes overlapping changes to the same billing files—shared meterError in useMeter, paused/unpaid status handling, pollAborted logic, and validateStripeUrl integration.
The title directly and concisely summarizes the two main changes: surfacing meterError alert and removing dead showAlreadyActiveDialog method, matching the PR's core objectives.
Description check
✅ Passed
The description covers the two key changes (C2 and C3), includes justification, test plan with pass/fail criteria, and addresses most template sections including validation steps and guardrails.
Docstring Coverage
✅ Passed
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check
✅ Passed
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
✅ Passed
Check skipped because no linked issues were found for this pull request.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
✨ Finishing Touches🧪 Generate unit tests (beta)
Create PR with unit tests
Commit unit tests in branch feat/billing-meter-error-surface
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR improves the billing UX and security by (1) surfacing useMeter() refresh failures to the user via a warning alert, and (2) centralizing Stripe redirect URL validation (HTTPS + hostname allowlist) while removing dead 409-dialog code from the subscriptions component.
Changes:
Added validateStripeUrl() helper and replaced ad-hoc URL parsing in billing store + pricing view redirects.
Introduced shared meterError in useMeter() and exposed it to billing UI consumers; added a warning v-alert in BillingSubscriptionsComponent.
Removed dead showAlreadyActiveDialog + related state/template, and updated unit tests + i18n keys (including new status labels).
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/modules/billing/components/billing.subscriptions.component.vue`:
- Around line 199-211: The meter error alert is showing for non-meter
deployments because meterError is set even when meterMode is false; in the
template change the v-alert to only render when both meterMode and meterError
are true (use v-if="meterMode && meterError"), and in setup prevent useMeter({
pollIntervalMs: 0 }) and the fetchMissingMeterData call from running unless
meterMode is truthy (wrap the useMeter invocation and any call to
fetchMissingMeterData in an if (meterMode) check) so meter-related logic only
runs for meter-enabled deployments.
- Around line 495-496: Update the Font Awesome icon names returned for
this.subscriptionStatus: replace 'fa-pause-circle' with the FA6+ canonical
'fa-circle-pause' for the 'paused' case, and replace 'fa-exclamation-triangle'
with 'fa-triangle-exclamation' for the 'unpaid' case so the computed/method that
maps this.subscriptionStatus to icon classes (the clauses checking
this.subscriptionStatus === 'paused' and === 'unpaid') uses the same FA6+ naming
as the other icons (e.g., 'fa-circle-check').
In `@src/modules/billing/composables/billing.useMeter.js`:
- Line 11: The module-level sharedMeterError (const sharedMeterError) is being
unconditionally reset on each useMeter() consumer mount which wipes errors for
other components; remove the unconditional clear of sharedMeterError/meterError
performed during useMeter() initialization (the pre-clear around where
meterError is assigned), rely on safeRefresh and the initial-fetch catch to
manage error lifecycle, and add a unit test in billing.useMeter.unit.tests.js
that mounts a second consumer after setting sharedMeterError to assert the error
is preserved across mounts.
In `@src/modules/billing/lib/stripeRedirect.js`:
- Around line 19-36: The validateStripeUrl function currently accepts URLs with
embedded credentials (e.g., parsed.username/parsed.password) which should be
rejected; update validateStripeUrl to throw an error when parsed.username or
parsed.password are non-empty (e.g., "Stripe URL must not contain credentials"),
keep existing checks for protocol and ALLOWED_HOSTS, and add a unit test in
billing.stripeRedirect.unit.tests.js that verifies URLs like
"https://attacker@checkout.stripe.com/..." are rejected.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
Push a commit to this branch (recommended)
Create a new PR with the fixes
ℹ️ Review info⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 7f4b3892-533c-4574-bfcd-2d5a6325e764
📥 Commits
Reviewing files that changed from the base of the PR and between 646859d and 208a0d0.
The reason will be displayed to describe this comment to others. Learn more.
⚠️ Potential issue | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Font Awesome 7 icon names fa-circle-pause fa-triangle-exclamation canonical class names
💡 Result:
In Font Awesome 7, the canonical CSS class names for the specified icons are fa-circle-pause and fa-triangle-exclamation. These are used with style prefixes like fa-solid (e.g., <i class="fas fa-circle-pause"></i>).[1][2][3][4][5][6] Font Awesome 7 is the current version as of 2026, with official pages at fontawesome.com/icons/circle-pause and fontawesome.com/icons/exclamation-triangle (noting the slug matches circle-pause, while display may vary).[7][8] These classes have been consistent from version 6 to 7, as confirmed by multiple technical references linking Font Awesome 6/7 CDNs and class usage.[2][5][6]
Update icon names to Font Awesome 6+ canonical form.
Lines 495–496 use Font Awesome 5 names that are inconsistent with the rest of the file and incompatible with Font Awesome 7.2.0. The canonical FA 6+ names are fa-circle-pause and fa-triangle-exclamation:
Line
Current
Expected
495
fa-pause-circle
fa-circle-pause
496
fa-exclamation-triangle
fa-triangle-exclamation
This matches the naming used for other icons in the file (e.g., fa-circle-check, fa-triangle-exclamation, fa-circle-exclamation) and ensures rendering works in FA 7.
Proposed fix
- if (this.subscriptionStatus === 'paused') return 'fa-solid fa-pause-circle';- if (this.subscriptionStatus === 'unpaid') return 'fa-solid fa-exclamation-triangle';+ if (this.subscriptionStatus === 'paused') return 'fa-solid fa-circle-pause';+ if (this.subscriptionStatus === 'unpaid') return 'fa-solid fa-triangle-exclamation';
📝 Committable suggestion
‼️IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
if (this.subscriptionStatus === 'paused') return 'fa-solid fa-pause-circle';
if (this.subscriptionStatus === 'unpaid') return 'fa-solid fa-exclamation-triangle';
if (this.subscriptionStatus === 'paused') return 'fa-solid fa-circle-pause';
if (this.subscriptionStatus === 'unpaid') return 'fa-solid fa-triangle-exclamation';
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/modules/billing/components/billing.subscriptions.component.vue` around
lines 495 - 496, Update the Font Awesome icon names returned for
this.subscriptionStatus: replace 'fa-pause-circle' with the FA6+ canonical
'fa-circle-pause' for the 'paused' case, and replace 'fa-exclamation-triangle'
with 'fa-triangle-exclamation' for the 'unpaid' case so the computed/method that
maps this.subscriptionStatus to icon classes (the clauses checking
this.subscriptionStatus === 'paused' and === 'unpaid') uses the same FA6+ naming
as the other icons (e.g., 'fa-circle-check').
The reason will be displayed to describe this comment to others. Learn more.
⚠️ Potential issue | 🟠 Major | ⚡ Quick win
Shared meterError is wiped on every new consumer mount.
Because meterError aliases the module-scope sharedMeterError, the unconditional reset on Line 148 runs every time any component calls useMeter() in setup(). This PR wires meterError into both billing.subscriptions.component.vue and billing.usageBar.component.vue, and the usage bar can render inside the subscriptions view — when the second consumer mounts, it instantly clears any error the first consumer (or the polling loop) just surfaced, hiding the new warning v-alert until the next 30s poll cycle re-captures the failure. The same hazard applies to remounts during route changes.
safeRefresh already clears stale errors before each poll, and the initial-fetch catch on Line 149 only writes on failure, so the pre-clear here is redundant in addition to being racy.
🛠️ Proposed fix — drop the unconditional clear on every consumer mount
Add a test in billing.useMeter.unit.tests.js that mounts a second consumer after meterError is set and asserts it is preserved.
Also applies to: 62-62, 148-152
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/modules/billing/composables/billing.useMeter.js` at line 11, The
module-level sharedMeterError (const sharedMeterError) is being unconditionally
reset on each useMeter() consumer mount which wipes errors for other components;
remove the unconditional clear of sharedMeterError/meterError performed during
useMeter() initialization (the pre-clear around where meterError is assigned),
rely on safeRefresh and the initial-fetch catch to manage error lifecycle, and
add a unit test in billing.useMeter.unit.tests.js that mounts a second consumer
after setting sharedMeterError to assert the error is preserved across mounts.
The reason will be displayed to describe this comment to others. Learn more.
⚠️ Potential issue | 🟡 Minor | ⚡ Quick win
Reject URLs containing embedded credentials.
validateStripeUrl does not inspect parsed.username / parsed.password. A URL like https://attacker@checkout.stripe.com/... parses with hostname checkout.stripe.com and currently passes validation. Stripe never returns redirect URLs with credentials; rejecting them tightens the helper to match its stated security purpose.
🛡️ Proposed hardening
if (!ALLOWED_HOSTS.includes(parsed.hostname)) {
throw new Error(`Stripe URL host not allowed: ${parsed.hostname}`);
}
+ if (parsed.username || parsed.password) {+ throw new Error('Stripe URL must not contain credentials');+ }
return parsed.toString();
Add a matching test in billing.stripeRedirect.unit.tests.js.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/modules/billing/lib/stripeRedirect.js` around lines 19 - 36, The
validateStripeUrl function currently accepts URLs with embedded credentials
(e.g., parsed.username/parsed.password) which should be rejected; update
validateStripeUrl to throw an error when parsed.username or parsed.password are
non-empty (e.g., "Stripe URL must not contain credentials"), keep existing
checks for protocol and ALLOWED_HOSTS, and add a unit test in
billing.stripeRedirect.unit.tests.js that verifies URLs like
"https://attacker@checkout.stripe.com/..." are rejected.
✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.51%. Comparing base (dd62b3d) to head (4c580c9). ⚠️ Report is 1 commits behind head on master.
…iptions
- Surface meterError ref from useMeter via v-alert gated to meterMode
template (no rendering in legacy mode)
- a11y: aria-live=polite on the alert
- i18n key billing.meter.error.refreshFailed (en.js only)
- Remove dead showAlreadyActiveDialog method, dialog template, state,
and Suite 9 tests from subscriptions component (real 409 flow lives
in billing.pricing.view.vue)
Stale review on commit 208a0d0 — branch was reset hard to master and redone clean (commit 4c580c9, Opus). Current HEAD has only the 2 intended fixes, all CI green including CodeRabbit re-review SUCCESS.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Summary
showAlreadyActiveDialogmethod,alreadyActiveDialog/alreadyActivePortalUrlstate, and the 409 dialog template block frombilling.subscriptions.component.vue. Confirmed zero production callers (the live 409 handling is self-contained inbilling.pricing.view.vue). Dropped Suite 9 from unit tests — those 5 tests called the method directly, bypassing the real flow (fake coverage). i18n keys retained as they are still used bybilling.pricing.view.vue.meterErrorfromuseMeter()into both consumers'setup()returns (billing.subscriptions.component.vueandbilling.usageBar.component.vue). Renders a closablev-alert[type=warning]above the meter section in the subscriptions component when polling fails. Addedbilling.meter.error.refreshFailedi18n keys (en + fr). Added new Suite 9 (3 tests) covering render when error is set, suppression when null, and dismiss by settingmeterError = null. usageBar exposesmeterErrorin its return but defers the UI to the parent subscriptions alert (no duplicate indicator — bar lives adjacent to subscriptions component).Test plan
billing.subscriptions.component.unit.tests.jspass (was 79, Suite 9 swapped: 5 dead removed, 3 real added)npm run buildcleannpm run lintcleanSummary by CodeRabbit
New Features
Bug Fixes
Localization