From 6c211e58f5517bfba271e472c87503682fe0c042 Mon Sep 17 00:00:00 2001
From: Pedro Castro <pedro@cal.com>
Date: Mon, 13 Apr 2026 23:00:28 -0300
Subject: [PATCH] fix: verify checkout session metadata in team upgrade
 endpoint

---
 apps/web/app/api/teams/[team]/upgrade/route.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/apps/web/app/api/teams/[team]/upgrade/route.ts b/apps/web/app/api/teams/[team]/upgrade/route.ts
index b5182c51f6abe3..3b1c86dc884915 100644
--- a/apps/web/app/api/teams/[team]/upgrade/route.ts
+++ b/apps/web/app/api/teams/[team]/upgrade/route.ts
@@ -45,6 +45,12 @@ async function getHandler(req: NextRequest, { params }: { params: Promise<Params
       throw new HttpError({ statusCode: 402, message: "Payment required" });
     }
 
+    // Not all sessions carry "teamId": API v2 uses "pendingPaymentTeamId" and legacy sessions predate it.
+    const sessionTeamId = checkoutSession.metadata?.teamId;
+    if (sessionTeamId && Number(sessionTeamId) !== id) {
+      throw new HttpError({ statusCode: 400, message: "Checkout session does not match team" });
+    }
+
     let team = await prisma.team.findFirst({
       where: { metadata: { path: ["paymentId"], equals: checkoutSession.id } },
     });