CVE-2026-34154

@@ -27,15 +27,17 @@ def create
       end
 
       case event[:type]
-      when "checkout.session.completed"
+      when "checkout.session.completed", "checkout.session.async_payment_succeeded"
         checkout_session = event[:data][:object]
 
+        return head :ok if checkout_session[:status] != "complete"
+        return head :ok if checkout_session[:payment_status] != "paid"
+
         if SiteSetting.discourse_subscriptions_enable_verbose_logging
-          Rails.logger.warn("checkout.session.completed data: #{checkout_session}")
+          Rails.logger.warn("#{event[:type]} data: #{checkout_session}")
         end
-        email = checkout_session[:customer_email]
 
-        return head :ok if checkout_session[:status] != "complete"
+        email = checkout_session[:customer_email]
         return render_json_error "email not found" if !email
 
         if checkout_session[:customer].nil?

@@ -191,6 +191,16 @@
           expect(response.status).to eq 200
         end
       end
+
+      it "does not create records or add the user to the group when payment_status is not paid" do
+        unpaid_data = checkout_session_completed_data.deep_dup
+        unpaid_data[:object][:payment_status] = "unpaid"
+        event = { type: "checkout.session.completed", data: unpaid_data }
+        ::Stripe::Webhook.stubs(:construct_event).returns(event)
+
+        expect { post "/s/hooks.json" }.not_to change { user.groups.count }
+        expect(response.status).to eq(200)
+      end
     end
 
     describe "checkout.session.completed with bad data" do
@@ -369,5 +379,61 @@
         expect(response.status).to eq 200
       end
     end
+
+    describe "checkout.session.async_payment_succeeded" do
+      before do
+        event = {
+          type: "checkout.session.async_payment_succeeded",
+          data: checkout_session_completed_data,
+        }
+        ::Stripe::Webhook.stubs(:construct_event).returns(event)
+        ::Stripe::Checkout::Session
+          .stubs(:list_line_items)
+          .with(
+            checkout_session_completed_data[:object][:id],
+            { limit: 1 },
+            DiscourseSubscriptions::Stripe.request_opts,
+          )
+          .returns(list_line_items_data)
+        ::Stripe::Subscription
+          .stubs(:update)
+          .with(
+            checkout_session_completed_data[:object][:subscription],
+            { metadata: { user_id: user.id, username: user.username } },
+            DiscourseSubscriptions::Stripe.request_opts,
+          )
+          .returns(
+            {
+              id: checkout_session_completed_data[:object][:subscription],
+              object: "subscription",
+              metadata: {
+                user_id: user.id.to_s,
+                username: user.username,
+              },
+            },
+          )
+      end
+
+      it "creates customer and subscription records and adds the user to the group" do
+        post "/s/hooks.json"
+
+        expect(response.status).to eq(200)
+        expect(user.groups).to include(group)
+
+        expect(
+          DiscourseSubscriptions::Customer.exists?(
+            user_id: user.id,
+            customer_id: customer.customer_id,
+            product_id: "prod_PhB6IpGhEX14Hi",
+          ),
+        ).to eq(true)
+        expect(
+          DiscourseSubscriptions::Subscription.exists?(
+            customer_id: DiscourseSubscriptions::Customer.last.id,
+            external_id: "sub_1P9b7iEYXaQnncSh3H3G9d2Y",
+          ),
+        ).to eq(true)
+      end
+    end
   end
 end