feat(kilo-pass): disallow duplicate card fingerprints across Kilo Pass subscriptions by jrf0110 · Pull Request #3309 · Kilo-Org/cloud

jrf0110 · 2026-05-18T17:46:16Z

Summary

Enforce that a single credit card fingerprint can be attached to at most one active Kilo Pass subscription across all Kilo users at any time. This blocks a fraud vector where multiple accounts purchase Kilo Pass using the same physical card.

What's new

findActiveKiloPassByCardFingerprint helper in apps/web/src/lib/stripe.ts — queries payment methods for a matching fingerprint on a different user, then checks whether that user has an active Kilo Pass subscription.
checkDuplicateCardFingerprintGate in apps/web/src/lib/kilo-pass/card-fingerprint-gate.ts — runs in the invoice.paid webhook handler after the Stripe charge succeeds. If a duplicate is found: cancels the subscription on Stripe, refunds the invoice, writes an audit log, and sends a customer-facing email notification.
DuplicateCardSubscriptionCanceled audit log action — added to the KiloPassAuditLogAction enum for tracking duplicate-card cancellations.
Email notification — new kiloPassDuplicateCardCanceled template and sendKiloPassDuplicateCardCanceledEmail sender function, using transactional_email_log for idempotent dedup.
App Store / Google Play path skipped — the gate only runs in the Stripe invoice.paid path. Store purchases have their own subscription model (appAccountToken) and don't go through Stripe invoices. A code comment documents this.

Edge cases handled

Same user re-subscribing with the same card → NOT blocked (excluded by excludingUserId).
Other user has ended Kilo Pass with same fingerprint → NOT blocked (query pivots off active subscription status).
No fingerprint available → gate passes open (fails open rather than blocking legitimate purchases).
Race condition / webhook replay → email dedup via transactional_email_log unique index; audit logs are idempotent via the existing Stripe event ID tracking.

Verification

Manually ran through the flow and made sure that duplicate card users got their sub canceled and account blocked:

Visual Changes

N/A

Reviewer Notes

The gate fires in stripe-handlers-invoice-paid.ts after the subscription upsert but before credit issuance — if blocked, the subscription row is marked canceled with ended_at set, and no credits are issued.
The findActiveKiloPassByCardFingerprint query joins payment_methods to kilo_pass_subscriptions, filtering for active subscriptions (not in canceled/unpaid/incomplete_expired, and ended_at IS NULL).
Migration 0135_duplicate_card_gate.sql adds the DuplicateCardSubscriptionCanceled enum value to the check constraint.

kilo-code-bot · 2026-05-18T17:52:54Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental commit adds only migration 0150_typical_scorpion.sql, which extends the kilo_pass_audit_log.action CHECK constraint to include 'duplicate_card_subscription_canceled' — following the exact same drop-and-re-add pattern already established in migration 0125. All previously identified issues remain resolved.

Resolved Issues

File	Line	Issue	Status
`apps/web/src/lib/kilo-pass/card-fingerprint-gate.ts`	273	`transactional_email_log` marker inserted but never cleaned up when `user?.google_user_email` is falsy	✅ Fixed in `d4ebe65`
`apps/web/src/lib/kilo-pass/stripe-handlers-invoice-paid.ts`	520	Blocked subscription still triggers an affiliate sale event	✅ Fixed in `d8fc024`
`apps/web/src/lib/stripe.ts`	N/A	Raw SQL `NOT IN` string instead of Drizzle's `notInArray`	✅ Fixed in `d46cf5f`
`apps/web/src/lib/kilo-pass/card-fingerprint-gate.ts`	N/A	`dbOrTx` not threaded through `checkDuplicateCardFingerprint`	✅ Fixed
`apps/web/src/lib/kilo-pass/card-fingerprint-gate.ts`	N/A	FK violation: audit log and user-blocking run inside gate with `dbOrTx` param	✅ Fixed in `a6e71caf5` — moved into handler `tx`

Files Reviewed (14 files)

apps/web/src/emails/kiloPassDuplicateCardCanceled.html — clean
apps/web/src/lib/email.ts — clean
apps/web/src/lib/kilo-pass/card-fingerprint-gate.ts — clean; gate now purely handles Stripe API calls; DB writes moved to handler
apps/web/src/lib/kilo-pass/card-fingerprint-gate.test.ts — clean; covers block, no-overwrite, re-sub same user, ended-sub, no-fingerprint, email dedup, and race-condition cases
apps/web/src/lib/kilo-pass/stripe-handlers-invoice-paid.ts — clean; audit log, user-blocking, and subscription cancellation all within tx; failure audit wrapped in try-catch; blockedEmailParams correctly gated before email send
packages/db/src/schema-types.ts — clean
packages/db/src/schema.test.ts — clean
packages/db/src/migrations/0148_worthless_aaron_stack.sql — clean
packages/db/src/migrations/meta/0148_snapshot.json — generated, skipped
packages/db/src/migrations/meta/_journal.json — generated, skipped
packages/db/src/schema.ts (via grep) — blocked_at uses mode: 'string'; new Date().toISOString() matches convention
apps/web/src/lib/user/index.ts (via grep) — softDeleteUser sets blocked_reason = 'soft-deleted at ...'; no GDPR concern
apps/web/src/lib/stripe.ts (via grep) — notInArray used correctly; no raw SQL
packages/db/src/migrations/0150_typical_scorpion.sql — clean; extends kilo_pass_audit_log.action CHECK constraint to include 'duplicate_card_subscription_canceled'; follows the same drop-and-re-add pattern established in migration 0125; generated snapshot/journal skipped

_{Reviewed by claude-sonnet-4.6 · 607,768 tokens}

_{Review guidance: REVIEW.md from base branch main}

jrf0110 · 2026-05-28T20:50:05Z

Alright new requirement - we're also going to block the user that tried to buy a kilo pass with a duplicate credit card

jrf0110 · 2026-05-28T20:52:27Z

Also, now that #3526 is merged, we need to make sure this PR properly supersedes that work

jrf0110 · 2026-05-28T21:02:55Z

Implemented in commit 3360519. When the card fingerprint gate detects a duplicate card, the offending user's account is now blocked (blocked_reason = 'kilo_pass_duplicate_card', blocked_at set to current timestamp). This follows the same pattern as cancel-and-refund.ts — if the user is already blocked (blocked_reason IS NOT NULL), the existing block is preserved. The auth middleware already enforces blocked users at sign-in and API access points, so no additional enforcement code is needed.

jrf0110 · 2026-05-28T21:03:15Z

Rebased onto main (which now includes PR #3526). The rebase was clean — no conflicts. The two features are complementary and work correctly together:

PR feat(kilo-pass): guard welcome promo by payment fingerprint #3526 (welcome-promo fingerprint guard): prevents the introductory 50% promo from being claimed more than once per payment fingerprint. Operates at the promo/bonus level.
This PR (card fingerprint gate): blocks duplicate card usage entirely — cancels the subscription, refunds the invoice, blocks the user, sends notification email.

When this PR's gate triggers (duplicate card detected), the subscription is canceled before the issuance/promo code runs, so #3526's welcome-promo logic is never reached for that invoice. When the gate does not trigger, #3526's code correctly applies the welcome-promo guard as before. No additional integration work was needed.

…erprint-gate test

…sByCardFingerprint to card-fingerprint-gate

…transaction-safe audit logs

… lookups on db

…mail_log markers persist

…arker persists

…for blockedGateResult

…e invoice.id

…otInArray - Return blockedEmailParams from db.transaction instead of mutating outer variable, fixing tsgo narrowing the type to 'never' because it doesn't track mutations across async closures. - Replace raw sql`NOT IN` with Drizzle's notInArray for type safety.

…te blocks subscription

…erge conflict markers The 0141_snapshot.json had unresolved merge conflict markers from a previous rebase. Deleted branch-local migration files and regenerated a clean migration (0142) using pnpm drizzle generate.

Rename branch migration from 0142 to 0143 since main added 0142_dashing_blue_marvel. Restore main's 0142 snapshot and journal, regenerate clean migration.

When user.google_user_email is falsy in maybeSendDuplicateCardCanceledEmail, the transactional_email_log marker was left in the DB permanently. This suppressed future email sends even if the user later acquired an email. Now the marker is deleted before returning, consistent with the error-path cleanup logic.

…gers When the card fingerprint gate detects a duplicate card across users, the offending user's account is now blocked (blocked_reason set to 'kilo_pass_duplicate_card') in addition to the existing cancel + refund. Does not overwrite an existing blocked_reason. Follows the same pattern as cancel-and-refund.ts.

… to fix FK violation The checkDuplicateCardFingerprintGate function was passing dbOrTx through a parameter to appendKiloPassAuditLog, but the FK constraint on kilo_pass_audit_log.kilo_pass_subscription_id was being violated inside the transaction. Move the audit log insert and user-blocking update into the handler where tx is used directly. Also fix the catch block to omit kiloPassSubscriptionId when the transaction may have rolled back, and wrap the failure audit log in a try-catch so it doesn't mask the original error.

…d check constraint

kilo-code-bot Bot reviewed May 18, 2026

View reviewed changes

Comment thread apps/web/src/lib/kilo-pass/card-fingerprint-gate.ts Outdated

Comment thread apps/web/src/lib/stripe.ts Outdated

Comment thread apps/web/src/lib/kilo-pass/card-fingerprint-gate.ts

kilo-code-bot Bot reviewed May 18, 2026

View reviewed changes

Comment thread apps/web/src/lib/kilo-pass/card-fingerprint-gate.ts Outdated

jrf0110 force-pushed the gt/toast/d0f06aec branch 7 times, most recently from 5de2b4e to 1321cfb Compare May 22, 2026 13:40

kilo-code-bot Bot reviewed May 22, 2026

View reviewed changes

Comment thread apps/web/src/lib/kilo-pass/stripe-handlers-invoice-paid.ts

jrf0110 force-pushed the gt/toast/d0f06aec branch 7 times, most recently from c239e62 to a9590f5 Compare May 28, 2026 15:27

kilo-code-bot Bot reviewed May 28, 2026

View reviewed changes

Comment thread apps/web/src/lib/kilo-pass/card-fingerprint-gate.ts Outdated

jrf0110 force-pushed the gt/toast/d0f06aec branch from 24d6ed3 to 3360519 Compare May 28, 2026 21:02

jrf0110 force-pushed the gt/toast/d0f06aec branch from 6d7d4a5 to 76a3274 Compare May 29, 2026 11:07

jrf0110 added 5 commits May 29, 2026 19:12

feat(kilo-pass): add card fingerprint gate for Kilo Pass subscriptions

fbe841a

fix(kilo-pass): remove unused imports and fix formatting in card-fing…

5bb42ba

…erprint-gate test

fix(kilo-pass): break circular dependency by moving findActiveKiloPas…

4317bbe

…sByCardFingerprint to card-fingerprint-gate

fix(kilo-pass): pass dbOrTx to checkDuplicateCardFingerprintGate for …

ef06413

…transaction-safe audit logs

fix(kilo-pass): only use dbOrTx for audit log, keep email/fingerprint…

ed6447b

… lookups on db

jrf0110 added 15 commits May 29, 2026 19:12

fix(kilo-pass): mock email sender in card-fingerprint-gate tests so e…

330a0f6

…mail_log markers persist

fix(kilo-pass): simplify email mock to fix TS2698 spread type error

a820eb6

fix(kilo-pass): move email notification after transaction commit so m…

c947bcc

…arker persists

fix(kilo-pass): use invoice.id instead of gateResult.stripeInvoiceId …

a88a90a

…for blockedGateResult

fix(kilo-pass): rename blockedGateResult to blockedEmailParams and us…

a3d902e

…e invoice.id

fix(kilo-pass): regenerate migration after rebase onto main

05674e1

fix(kilo-pass): regenerate migration after rebase onto main

800aef6

fix(kilo-pass): clear affiliate sale context when card fingerprint ga…

d8fc024

…te blocks subscription

fix(kilo-pass): regenerate migration after rebase onto main

60f7bdd

Rename branch migration from 0142 to 0143 since main added 0142_dashing_blue_marvel. Restore main's 0142 snapshot and journal, regenerate clean migration.

fix(kilo-pass): regenerate migration after rebase onto main

aec6a1b

style(kilo-pass): fix oxfmt formatting in card-fingerprint-gate.ts

b861118

jrf0110 force-pushed the gt/toast/d0f06aec branch from 76a3274 to b861118 Compare May 29, 2026 19:14

jeanduplessis approved these changes May 29, 2026

View reviewed changes

jrf0110 added 3 commits May 29, 2026 19:48

style(kilo-pass): fix oxfmt formatting

86a5fd8

fix(kilo-pass): add migration for duplicate_card_subscription_cancele…

8e5c91f

…d check constraint

jrf0110 merged commit 3703027 into main May 29, 2026
49 checks passed

jrf0110 deleted the gt/toast/d0f06aec branch May 29, 2026 20:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(kilo-pass): disallow duplicate card fingerprints across Kilo Pass subscriptions#3309

feat(kilo-pass): disallow duplicate card fingerprints across Kilo Pass subscriptions#3309
jrf0110 merged 23 commits into
mainfrom
gt/toast/d0f06aec

jrf0110 commented May 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented May 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jrf0110 commented May 28, 2026

Uh oh!

jrf0110 commented May 28, 2026

Uh oh!

jrf0110 commented May 28, 2026

Uh oh!

jrf0110 commented May 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jrf0110 commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's new

Edge cases handled

Verification

Visual Changes

Reviewer Notes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kilo-code-bot Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Executive Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jrf0110 commented May 28, 2026

Uh oh!

jrf0110 commented May 28, 2026

Uh oh!

jrf0110 commented May 28, 2026

Uh oh!

jrf0110 commented May 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jrf0110 commented May 18, 2026 •

edited

Loading

kilo-code-bot Bot commented May 18, 2026 •

edited

Loading