fix(billing): validate priceId against allowlist and sanitize quantity at checkout endpoints (#2222) - #2237

Resolves #2222
Linear: CAP-804

Summary

priceId and quantity were previously passed from untrusted client requests directly to stripe.checkout.sessions.create across guest-checkout, subscribe, and desktop POST /subscribe. This permitted arbitrary Stripe price IDs to be submitted.

Changes

1. Allowlist Helpers (packages/utils/src/constants/plans.ts):
   • Added VALID_STRIPE_PLAN_PRICE_IDS containing official Pro subscription plan price IDs.
   • Added isValidStripePlanPriceId(priceId, environment?) validator.
2. Endpoint Validation:
   • apps/web/app/api/settings/billing/guest-checkout/route.ts: Validates priceId and bounds quantity to [1, 1000].
   • apps/web/app/api/settings/billing/subscribe/route.ts: Validates priceId and bounds quantity to [1, 1000].
   • apps/web/app/api/desktop/[...route]/root.ts: Refined Zod schema on priceId via isValidStripePlanPriceId.
3. Automated Tests:
   • Added apps/web/__tests__/unit/subscribe-checkout.test.ts verifying allowlist enforcement.
   • Extended apps/web/__tests__/unit/mobile-checkout.test.ts verifying rejection of arbitrary price IDs with HTTP 400.

Verification

• vitest run __tests__/unit/subscribe-checkout.test.ts __tests__/unit/mobile-checkout.test.ts: 11/11 passed
• Biome formatted.

Greptile Summary

This PR adds a shared Stripe Pro-price allowlist, applies it to guest, authenticated web, and desktop checkout endpoints, normalizes web checkout quantities, and adds allowlist-focused unit coverage.

• Arbitrary Stripe price IDs are now rejected before checkout-session creation.
• Quantity validation limits Stripe checkout quantities to integer values from 1 through 1000, defaulting invalid values to 1.
• Environment-specific Stripe validation remains incomplete because the endpoints accept known IDs from both test and live modes.
• Guest checkout analytics still reports the raw quantity rather than the normalized value sent to Stripe.

Confidence Score: 4/5

The PR should not merge until checkout validation is restricted to the active Stripe environment; the guest analytics discrepancy is lower-impact but should also be corrected.

Known opposite-environment price IDs pass all three new validators and then fail during Stripe session creation, so the intended input validation remains incomplete and can produce failed checkouts and server errors. Guest checkout additionally records quantities that can differ from those actually submitted to Stripe.

Files Needing Attention: packages/utils/src/constants/plans.ts; apps/web/app/api/settings/billing/guest-checkout/route.ts; apps/web/app/api/settings/billing/subscribe/route.ts; apps/web/app/api/desktop/[...route]/root.ts

Important Files Changed

### Issue 1
packages/utils/src/constants/plans.ts:33
**Cross-environment prices pass validation**

The fallback allowlist accepts both test and live price IDs, and all three checkout endpoints call it without specifying the deployment environment. A production request containing a known development price ID therefore passes validation before Stripe rejects it against the live secret key, causing checkout to fail with a server error. Development and preview deployments have the inverse problem. Please validate against the deployment-specific price IDs.

### Issue 2
apps/web/app/api/settings/billing/guest-checkout/route.ts:57
**Analytics records unsafe quantity**

Stripe receives `safeQuantity`, but the `guest_checkout_started` event records `quantity || 1`. For inputs such as `-5`, `1.5`, `"abc"`, or `2000`, billing uses 1 while analytics records the invalid raw value. This makes checkout telemetry disagree with the session that was actually created.

```suggestion
					quantity: safeQuantity,
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(billing): validate priceId against a..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.