We engineer
web applications that last.

// ✅ HARDENED PRODUCTION TYPESCRIPT (app/actions/checkout.ts)
"use server";
import { auth } from "@/lib/auth";
import { stripe } from "@/lib/stripe";
import { db } from "@/lib/db";
import { z } from "zod";

const CheckoutSchema = z.object({
  planId: z.string().uuid(),
});

export async function createCheckoutSession(formData: unknown) {
  const session = await auth();
  if (!session?.user?.id) throw new Error("Unauthorized");

  const { planId } = CheckoutSchema.parse(formData);

  // ✅ Server-side execution, encrypted secrets & atomic DB record
  const checkout = await stripe.checkout.sessions.create({
    customer: session.user.stripeCustomerId,
    line_items: [{ price: planId, quantity: 1 }],
    mode: "subscription",
    success_url: `${process.env.APP_URL}/dashboard?success=true`,
  });

  return { url: checkout.url };
}