From 8f62f2f0cf7e3579f26da2a1ff95e26c09fa323f Mon Sep 17 00:00:00 2001
From: ht <hikmet@texmart.com>
Date: Sun, 6 Sep 2026 17:56:07 +0300
Subject: [PATCH] restrict Stripe webhook plan ids

---
 server/index.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/index.js b/server/index.js
index 4fb7abf..7442cad 100644
--- a/server/index.js
+++ b/server/index.js
@@ -1321,7 +1321,8 @@ const server = http.createServer(async (req, res) => {
             const rawEmail = o.client_reference_id || o.customer_email || o.metadata?.email || '';
             const email = typeof rawEmail === 'string' ? rawEmail.trim().toLowerCase() : '';
             const rawPlanId = o.metadata?.planId;
-            const planId = typeof rawPlanId === 'string' && rawPlanId.trim() ? rawPlanId.trim() : 'pro';
+            const candidatePlan = typeof rawPlanId === 'string' ? rawPlanId.trim() : '';
+            const planId = ['pro', 'kurumsal'].includes(candidatePlan) ? candidatePlan : 'pro';
             if (email) {
               store.setPlan(email, {
                 plan: planId, kaynak: 'stripe',