chore: update-usage-limit-subscription#3
Conversation
WalkthroughAuthentication is moved to session-based per-request handling: static Flowglad instances were replaced by a factory that accepts a customerExternalId, API routes now extract user IDs from auth sessions, and the README was simplified while dependencies were updated. Changes
Sequence DiagramsequenceDiagram
participant Client
participant API as Next.js API Route
participant Auth as auth.api
participant Session as Session Store
participant Flowglad as FlowgladServer (per-request)
Client->>API: HTTP request (GET/POST)
API->>Auth: auth.api.getSession(headers)
Auth->>Session: lookup session
Session-->>Auth: session (user)
Auth-->>API: session with user
alt user.id present
API->>API: extract user.id as customerExternalId
API->>Flowglad: flowglad(customerExternalId) // create client
Flowglad->>Auth: getCustomerDetails(headers)
Auth->>Session: lookup session
Session-->>Auth: user details (email, name)
Auth-->>Flowglad: return {email, name}
API->>Flowglad: perform billing/usage operations
Flowglad-->>API: operation result
API-->>Client: 200 + result
else no user
API-->>Client: 401 Unauthorized
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🔇 Additional comments (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
usage-limit-subscription/README.md (1)
83-89: Update the localhost URL to match the configured port.The dev server is configured to run on port 3001 in
package.json, but this documentation still references port 3000.### 5. Start Development Server ```bash bun dev-Open http://localhost:3000 to see the application.
+Open http://localhost:3001 to see the application.</blockquote></details> <details> <summary>usage-limit-subscription/src/app/api/usage-events/route.ts (1)</summary><blockquote> `103-122`: **`usageMeterId` is extracted and validated but not passed to `createUsageEvent()`.** The code extracts `usageMeterId` at line 104 and validates its presence (lines 106-113), but it's never passed to `createUsageEvent()` at line 117. Other examples in the codebase (generation-based-subscription and tiered-usage-gated-subscription) pass `usageMeterId` to this API call, indicating the parameter should be included here as well. Either add `usageMeterId` to the `createUsageEvent()` call, or remove the extraction and validation if it's no longer required by the API. </blockquote></details> </blockquote></details>🧹 Nitpick comments (2)
usage-limit-subscription/src/app/api/flowglad/[...path]/route.ts (1)
6-18: Unusedreqparameter and potential request context issue.The
reqparameter ingetCustomerExternalIdis unused - instead,headers()fromnext/headersis called directly. This works in Node.js runtime but consider whether passing headers fromreqwould be more explicit and avoid potential issues with request context in edge scenarios.Also verify that the
flowgladfactory function integrates correctly withnextRouteHandler. The factory expects acustomerExternalIdstring, so ensurenextRouteHandlercalls it with the value returned bygetCustomerExternalId.export const { GET, POST } = nextRouteHandler({ flowglad, - getCustomerExternalId: async (req) => { + getCustomerExternalId: async () => { const session = await auth.api.getSession({ headers: await headers(), });usage-limit-subscription/src/lib/flowglad.ts (1)
8-20: Consider the redundant session fetching.When this factory is used, the session is often fetched twice: once by the caller to obtain
customerExternalId, and again insidegetCustomerDetails. While this may be by design (the callback could be called lazily), consider whether the session could be passed in or cached to reduce redundant auth calls.📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
usage-limit-subscription/bun.lockis excluded by!**/*.lock📒 Files selected for processing (5)
usage-limit-subscription/README.md(3 hunks)usage-limit-subscription/package.json(3 hunks)usage-limit-subscription/src/app/api/flowglad/[...path]/route.ts(1 hunks)usage-limit-subscription/src/app/api/usage-events/route.ts(2 hunks)usage-limit-subscription/src/lib/flowglad.ts(1 hunks)🧰 Additional context used
🧬 Code graph analysis (1)
usage-limit-subscription/src/app/api/usage-events/route.ts (1)
usage-limit-subscription/src/lib/flowglad.ts (1)
flowglad(5-23)🔇 Additional comments (7)
usage-limit-subscription/README.md (1)
48-53: Documentation simplification looks good.The removal of yalc-related prerequisites and the streamlined setup flow align well with the dependency updates in package.json.
usage-limit-subscription/src/app/api/usage-events/route.ts (2)
53-61: Authentication flow implemented correctly.The session-based authentication properly retrieves the user ID and returns a 401 response for unauthenticated requests. This aligns well with the factory pattern in
flowglad.ts.
48-51: Transaction ID generation is acceptable for idempotency.The combination of timestamp and random string provides sufficient uniqueness for idempotency purposes. No security concern here as this is not used for authentication or authorization.
usage-limit-subscription/src/app/api/flowglad/[...path]/route.ts (1)
13-15: Thrown error may not produce a proper HTTP response.Throwing a generic
ErrorinsidegetCustomerExternalIdmay not result in a structured HTTP 401 response to the client. Verify thatnextRouteHandlerfrom@flowglad/nextjs/servercatches this error and converts it to an appropriate HTTP response.usage-limit-subscription/src/lib/flowglad.ts (2)
5-23: Factory pattern implementation looks correct.The per-request factory pattern properly encapsulates the FlowgladServer configuration with session-based customer details.
17-20: Empty string fallbacks may cause downstream issues.If
nameisundefined, empty strings are returned. Verify that the Flowglad API handles empty strings gracefully, especially forusage-limit-subscription/package.json (1)
38-38: Verify production-readiness of theflowgladpackage.The package only has version 0.0.1 published with no updates or newer releases. While the
^0.0.1constraint is safe for pre-1.0 packages, the lack of development activity and single-version release history suggests this package may not be production-ready. Confirm this dependency aligns with your stability requirements.
| "preinstall": "bunx --bun only-allow bun", | ||
| "scripts": { | ||
| "dev": "next dev", | ||
| "dev": "next dev -p 3001", |
There was a problem hiding this comment.
Port change noted.
The dev server now runs on port 3001. Note that the README at line 89 still references http://localhost:3000 - this should be updated to port 3001 for consistency.
🤖 Prompt for AI Agents
In usage-limit-subscription/package.json around line 12 the dev script changed
the Next.js dev server to port 3001; update the README (line 89) to reference
http://localhost:3001 instead of http://localhost:3000 to keep documentation
consistent — open usage-limit-subscription/README.md, change the URL at line 89
(and any other occurrences of :3000) to :3001, save and run a quick search to
ensure no other docs or examples still point to port 3000.
2 participants
Making changes to the usage-limit-subscription example project that reflect recent changes to the sdk
Summary by CodeRabbit
Release Notes
Documentation
Dependencies
Improvements
✏️ Tip: You can customize this high-level summary in your review settings.