-
Notifications
You must be signed in to change notification settings - Fork 1.1k
fix: hide watermark for pro users #989
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -108,6 +108,10 @@ type VideoWithOrganization = typeof videos.$inferSelect & { | |||||||||||
| sharedOrganizations?: { id: string; name: string }[]; | ||||||||||||
| password?: string | null; | ||||||||||||
| hasPassword?: boolean; | ||||||||||||
| owner?: { | ||||||||||||
| stripeSubscriptionStatus: string | null; | ||||||||||||
| thirdPartyStripeSubscriptionId: string | null; | ||||||||||||
| } | null; | ||||||||||||
| }; | ||||||||||||
|
|
||||||||||||
| const ALLOWED_REFERRERS = [ | ||||||||||||
|
|
@@ -288,9 +292,15 @@ export default async function ShareVideoPage(props: Props) { | |||||||||||
| sharedOrganization: { | ||||||||||||
| organizationId: sharedVideos.organizationId, | ||||||||||||
| }, | ||||||||||||
| owner: { | ||||||||||||
| stripeSubscriptionStatus: users.stripeSubscriptionStatus, | ||||||||||||
| thirdPartyStripeSubscriptionId: | ||||||||||||
| users.thirdPartyStripeSubscriptionId, | ||||||||||||
| }, | ||||||||||||
|
Comment on lines
+295
to
+299
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Select a computed pro flag; avoid leaking subscription IDs/status. Replace the nested - owner: {
- stripeSubscriptionStatus: users.stripeSubscriptionStatus,
- thirdPartyStripeSubscriptionId:
- users.thirdPartyStripeSubscriptionId,
- },
+ ownerIsPro: sql<number>`IF(
+ ${users.stripeSubscriptionStatus} IN ('active','trialing')
+ OR ${users.thirdPartyStripeSubscriptionId} IS NOT NULL,
+ 1, 0
+ )`,Also applies to: 303-303 |
||||||||||||
| }) | ||||||||||||
| .from(videos) | ||||||||||||
| .leftJoin(sharedVideos, eq(videos.id, sharedVideos.videoId)) | ||||||||||||
| .leftJoin(users, eq(videos.ownerId, users.id)) | ||||||||||||
| .where(eq(videos.id, videoId)), | ||||||||||||
| ).pipe(Policy.withPublicPolicy(videosPolicy.canView(videoId))); | ||||||||||||
|
|
||||||||||||
|
|
@@ -340,6 +350,10 @@ async function AuthorizedContent({ | |||||||||||
| video: Omit<InferSelectModel<typeof videos>, "folderId" | "password"> & { | ||||||||||||
| sharedOrganization: { organizationId: string } | null; | ||||||||||||
| hasPassword: number; | ||||||||||||
| owner: { | ||||||||||||
| stripeSubscriptionStatus: string | null; | ||||||||||||
| thirdPartyStripeSubscriptionId: string | null; | ||||||||||||
| } | null; | ||||||||||||
|
Comment on lines
+353
to
+356
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Align prop type with boolean flag to prevent client exposure. - owner: {
- stripeSubscriptionStatus: string | null;
- thirdPartyStripeSubscriptionId: string | null;
- } | null;
+ ownerIsPro: number;Note: This remains numeric here because it comes from SQL; convert to boolean before passing to client props (see prior comment). 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||
| }; | ||||||||||||
| searchParams: { [key: string]: string | string[] | undefined }; | ||||||||||||
| }) { | ||||||||||||
|
|
@@ -437,6 +451,10 @@ async function AuthorizedContent({ | |||||||||||
| id: videos.id, | ||||||||||||
| name: videos.name, | ||||||||||||
| ownerId: videos.ownerId, | ||||||||||||
| owner: { | ||||||||||||
| stripeSubscriptionStatus: users.stripeSubscriptionStatus, | ||||||||||||
| thirdPartyStripeSubscriptionId: users.thirdPartyStripeSubscriptionId, | ||||||||||||
| }, | ||||||||||||
|
Comment on lines
+454
to
+457
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion Mirror the computed flag in the post-transcription refresh query. - owner: {
- stripeSubscriptionStatus: users.stripeSubscriptionStatus,
- thirdPartyStripeSubscriptionId: users.thirdPartyStripeSubscriptionId,
- },
+ ownerIsPro: sql<number>`IF(
+ ${users.stripeSubscriptionStatus} IN ('active','trialing')
+ OR ${users.thirdPartyStripeSubscriptionId} IS NOT NULL,
+ 1, 0
+ )`,Also applies to: 480-480 🤖 Prompt for AI Agents |
||||||||||||
| createdAt: videos.createdAt, | ||||||||||||
| updatedAt: videos.updatedAt, | ||||||||||||
| awsRegion: videos.awsRegion, | ||||||||||||
|
|
@@ -459,6 +477,7 @@ async function AuthorizedContent({ | |||||||||||
| }) | ||||||||||||
| .from(videos) | ||||||||||||
| .leftJoin(sharedVideos, eq(videos.id, sharedVideos.videoId)) | ||||||||||||
| .leftJoin(users, eq(videos.ownerId, users.id)) | ||||||||||||
| .where(eq(videos.id, videoId)) | ||||||||||||
| .execute(); | ||||||||||||
|
|
||||||||||||
|
|
||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Verification agent
🧩 Analysis chain
Block PII: don’t serialize subscription identifiers to the client; expose only a boolean.
These fields flow into Share/ShareHeader (client). Sending
thirdPartyStripeSubscriptionId(and even the raw status string) publicly is unnecessary for watermark gating and is sensitive. Compute a server-side boolean and pass that instead.Apply:
Also convert the numeric SQL flag to boolean at construction time (outside this hunk): in the object built at Lines 666-674, add
ownerIsPro: video.ownerIsPro === 1,.Run to find downstream usages to update to the boolean flag:
🏁 Script executed:
Length of output: 233
🏁 Script executed:
Length of output: 27
🏁 Script executed:
Length of output: 12969
Block PII: replace raw subscription fields with a boolean ownerIsPro everywhere
.select(...)at lines 296–300), add:stripeSubscriptionStatusandthirdPartyStripeSubscriptionId, including but not limited to:• apps/web/app/s/[videoId]/Share.tsx
• apps/web/app/s/[videoId]/_components/ShareVideo.tsx
• apps/web/utils/flags.ts (FeatureFlagUser)
• Any
.select({ …, stripeSubscriptionStatus, thirdPartyStripeSubscriptionId })and runtime checks in apps/web/actions and apps/web/app/api🤖 Prompt for AI Agents