Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Potential Bug: trial_ends_at not updated in webhook due to mass assignment protection #1712

Closed
woodjme opened this issue Aug 28, 2024 · 1 comment · Fixed by #1713
Closed

Comments

@woodjme
Copy link

woodjme commented Aug 28, 2024

Cashier Stripe Version

15.4

Laravel Version

11.9

PHP Version

8.3.9

Database Driver & Version

No response

Description

Hi there,

I believe I've encountered a potential bug related to how the trial_ends_at attribute is handled during webhook processing for subscription creation.

Issue Description

In the SubscriptionCreated webhook handler, the following code attempts to set the trial_ends_at attribute to null:

// Terminate the billable's generic trial if it exists...
if (! is_null($user->trial_ends_at)) {
$user->update(['trial_ends_at' => null]);
}
}

However, unless trial_ends_at is included in the $fillable array of the billable model, this update will silently fail due to Laravel's mass assignment protection. This behavior is not documented, and developers may not realize that trial_ends_at needs to be included in $fillable for this update to succeed.

Expected Behavior

  • Laravel Cashier should update the trial_ends_at attribute successfully without requiring additional configuration or at least document this requirement.

Steps To Reproduce

My scenario:

  • The billable model is on a Team
  • Create a new trial for Team (without a payment method)
  • Create a subscription using Stripe Checkout
  • A new subscription starts but $team->onGenericTrial() still returns true
@driesvints
Copy link
Member

Thanks for reporting this. I sent in a PR that should prevent this one: #1713

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants