[dev] [Marfuen] mariano/dustin-fix

[github-actions]

This is an automated pull request to merge mariano/dustin-fix into dev.
It was created by the [Auto Pull Request] action.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
app	Ready	Preview	Comment	Dec 11, 2025 8:29pm
portal	Ready	Preview	Comment	Dec 11, 2025 8:29pm

[cursor]

PR Summary

Adds Stripe-based domain checks to auto-approve org access and limits the onboarding skip button to @trycomp.ai users.

• Access/Upgrade Flow:
  • In app/(app)/upgrade/[orgId]/page.tsx, auto-approve hasAccess when the user’s email domain is trycomp.ai or matches an active Stripe customer (via isDomainActiveStripeCustomer).
• Onboarding:
  • In PostPaymentOnboarding.tsx, replace local-env skip logic with canSkipOnboarding limited to @trycomp.ai emails.
• Stripe Integration:
  • Add lib/stripe.ts with extractDomain, findStripeCustomerByDomain, and isDomainActiveStripeCustomer; initialize Stripe client.
• Environment:
  • Add STRIPE_SECRET_KEY to server env schema and runtime in env.mjs.
• Dependencies:
  • Add stripe package to apps/app/package.json.

^{Written by Cursor Bugbot for commit b07561b. This will update automatically on new commits. Configure here.}

[graphite-app]

Graphite Automations

"Auto-assign PRs to Author" took an action on this PR • (12/11/25)

1 reviewer was added to this PR based on Mariano Fuentes's automation.

[cursor]

Bug: Domain-based access grants for common email providers

The auto-approval logic in isDomainActiveStripeCustomer grants access based solely on matching the user's email domain with any Stripe customer's email domain. This means users with common email domains like gmail.com, yahoo.com, or outlook.com could gain unauthorized access to any organization they're a member of, if any existing Stripe customer uses the same email provider. The domain check doesn't verify the user actually belongs to the paying organization, only that someone with the same email domain has an active subscription somewhere.

Additional Locations (1)

• apps/app/src/lib/stripe.ts#L53-L103