Enhancements to the Subscriptions Plugin

Development
6

Have updated the repo with the following changes/fixes. I am now ready to install and use it on my production site.

Summary of Stability & Security Enhancements

1. Modern Stripe Checkout Integration The plugin has been updated to use the modern, redirect-based Stripe Checkout flow.

  • What this means: Instead of an on-page credit card form, users are now sent to a secure, Stripe-hosted page to complete their payment.
  • Why it’s better: This is Stripe’s recommended approach. It improves security, reduces your site’s PCI compliance burden, and provides a better user experience with support for methods like Apple Pay and Google Pay.

2. Rock-Solid Repurchase Logic The logic that prevents users from re-buying a product they already have an active subscription for has been completely overhauled.

  • The Fix: We’ve added the product_id to each local subscription record. The check is now a simple, lightning-fast query against your local database with zero external API calls, making it 100% reliable.
  • The Result: A user with an active subscription (recurring or time-limited) will now be correctly blocked from repurchasing that same product until it expires.

3. Data Integrity on All Dashboards The user billing page and the admin subscriptions dashboard have been fixed to ensure they always show accurate, real-time data.

  • The Fix: Both pages now fetch the latest status and renewal/expiry dates for every subscription directly from the payment provider (Stripe).
  • The Result: What you see in the admin panel will always perfectly match what the user sees, and both will reflect the true state of the subscription in Stripe. The bugs showing “N/A” for plan details or incorrect “active” statuses are resolved.

4. Robust Webhook & Job Processing

  • No More Duplicate Subscriptions: The webhook handler has been fixed to correctly handle the sequence of events from Stripe, ensuring one transaction creates exactly one subscription record.
  • Reliable Expiry Job: The daily background job that expires one-time plans has been hardened. It now correctly sets the required API key and will expire a subscription even if the original plan was deleted from Stripe, ensuring your group permissions are always accurate.