Sonarly Claude Code
e8dabf7755
https://sonarly.com/issue/4334?type=bug The `createDirectSubscription` method throws a `BillingException` when a customer already has a non-canceled subscription, but nothing upstream prevents the user from reaching this code path when that condition is true. Fix: ## Root Cause A TOCTOU (Time-Of-Check-Time-Of-Use) race condition in the `createDirectSubscription` flow: the frontend checks `onboardingStatus === PLAN_REQUIRED` (no subscriptions exist), but by the time the user clicks "Continue" a subscription may already have been created (e.g. a prior request succeeded but the response was lost, or a double-click). The guard added in commit `65f0a5bb18` prevented a database unique-constraint crash but replaced it with a user-facing `BillingException` instead of handling the duplicate-request case idempotently. ## Fix In `createDirectSubscription`, change the existing-subscription guard from **throwing an exception** to **returning `successUrl` idempotently**. If the customer already has a non-canceled subscription, the desired end-state (an active subscription + redirect to success) is already satisfied — we just return the success URL, exactly as the method would have done after creating it fresh. ```typescript file=packages/twenty-server/src/engine/core-modules/billing/services/billing-portal.workspace-service.ts lines=106-115 if ( isNonEmptyArray(customer?.billingSubscriptions) && customer.billingSubscriptions.some( (subscription) => subscription.status !== SubscriptionStatus.Canceled, ) ) { // Subscription already exists (e.g. race condition / duplicate request). // Return successUrl idempotently instead of throwing a user-facing error. return successUrl; } ``` This makes `createDirectSubscription` consistent with the `computeCheckoutSessionURL` path (which uses Stripe checkout sessions and is inherently idempotent). The change is a 1-line replacement in a single file; no other layers need to be touched because the caller already handles the returned URL correctly.
The #1 Open-Source CRM
🌐 Website · 📚 Documentation · 
Roadmap · 
Discord · 
Figma
Installation
See: 🚀 Self-hosting 🖥️ Local Setup
Why Twenty
We built Twenty for three reasons:
CRMs are too expensive, and users are trapped. Companies use locked-in customer data to hike prices. It shouldn't be that way.
A fresh start is required to build a better experience. We can learn from past mistakes and craft a cohesive experience inspired by new UX patterns from tools like Notion, Airtable or Linear.
We believe in Open-source and community. Hundreds of developers are already building Twenty together. Once we have plugin capabilities, a whole ecosystem will grow around it.
What You Can Do With Twenty
Please feel free to flag any specific needs you have by creating an issue.
Below are a few features we have implemented to date:
- Personalize layouts with filters, sort, group by, kanban and table views
- Customize your objects and fields
- Create and manage permissions with custom roles
- Automate workflow with triggers and actions
- Emails, calendar events, files, and more
Personalize layouts with filters, sort, group by, kanban and table views
Customize your objects and fields
Create and manage permissions with custom roles
Automate workflow with triggers and actions
Emails, calendar events, files, and more
Stack
- TypeScript
- Nx
- NestJS, with BullMQ, PostgreSQL, Redis
- React, with Jotai, Emotion and Lingui
Thanks
Thanks to these amazing services that we use and recommend for UI testing (Chromatic), code review (Greptile), catching bugs (Sentry) and translating (Crowdin).
Join the Community
- Star the repo
- Subscribe to releases (watch -> custom -> releases)
- Follow us on Twitter or LinkedIn
- Join our Discord
- Improve translations on Crowdin
- Contributions are, of course, most welcome!