+-----------------------------------------------------------------------------------------+
|                                 THE VIBE-CODED DEBT SPIRAL                              |
+-----------------------------------------------------------------------------------------+
|                                                                                         |
|   [ Prompt Iterations ] ---> [ 50+ New npm Libs ] ---> [ No DB Indexes / Unbounded ORM] |
|             |                                                         |                 |
|             v                                                         v                 |
|   [ Fragmented Domain Logic ]                               [ Connection Exhaustion ]   |
|             |                                                         |                 |
|             v                                                         v                 |
|   [ Tenant Data Leaks ] <--- [ Bypassed DB Constraints ] <--- [ Silent 500s / Lockups]  |
|                                                                                         |
+-----------------------------------------------------------------------------------------+

// app/api/billing/subscribe/route.ts
// VIBE-CODED: No input sanitization, race conditions, missing idempotency, leaking tenant isolation

import { NextResponse } from 'next/server';
import { PrismaClient } from '@prisma/client';
import Stripe from 'stripe';

const prisma = new PrismaClient(); // BUG: New client instance on every serverless invocation
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

export async function POST(req: Request) {
  try {
    const body = await req.json();
    const { userId, planId, paymentMethodId } = body;

    // Security Flaw: Relies on client-supplied userId without session validation
    const user = await prisma.user.findUnique({ where: { id: userId } });
    
    // Performance Flaw: Unbounded query without index
    const existingSub = await prisma.subscription.findFirst({
      where: { userId: user?.id, status: 'ACTIVE' }
    });

    if (existingSub) {
      return NextResponse.json({ error: 'Already subscribed' }, { status: 400 });
    }

    // Bug: External network call not wrapped in transactional idempotency
    const customer = await stripe.customers.create({
      email: user?.email,
      payment_method: paymentMethodId,
    });

    const sub = await prisma.subscription.create({
      data: {
        userId: user!.id,
        stripeCustomerId: customer.id,
        planId: planId,
        status: 'ACTIVE',
      }
    });

    return NextResponse.json({ success: true, subscriptionId: sub.id });
  } catch (err: any) {
    // Bug: Exposes raw database and internal errors to client
    return NextResponse.json({ error: err.message }, { status: 500 });
  }
}

// src/modules/billing/controllers/subscribe.controller.ts
// PRODUCTION-READY: Validated schemas, connection pooling, tenant boundaries, atomic execution

import { z } from 'zod';
import { db } from '@/infrastructure/database/pool';
import { stripeClient } from '@/infrastructure/external/stripe';
import { getAuthenticatedSession } from '@/core/auth/session';
import { AppError } from '@/core/errors/AppError';
import type { Request, Response } from 'express';

const SubscribeSchema = z.object({
  planId: z.enum(['tier_pro_monthly', 'tier_scale_monthly']),
  paymentMethodId: z.string().startsWith('pm_'),
  idempotencyKey: z.string().uuid(),
});

export async function handleSubscribe(req: Request, res: Response) {
  // 1. Enforce strict session context (No client-spoofed identities)
  const session = await getAuthenticatedSession(req);
  const input = SubscribeSchema.parse(req.body);

  // 2. Atomic Database Transaction with Tenant Context Guard
  const result = await db.transaction(async (tx) => {
    // Set PostgreSQL Local Context for RLS policies
    await tx.raw('SELECT set_config(\'app.current_tenant_id\', ?, true)', [session.tenantId]);

    // Verify subscription status using row-level locking to prevent race-condition double billing
    const [activeSub] = await tx('subscriptions')
      .where({ tenant_id: session.tenantId, status: 'ACTIVE' } // Enforces tenant boundary
      .forUpdate()
      .select('id');

    if (activeSub) {
      throw new AppError(409, 'ACTIVE_SUBSCRIPTION_EXISTS', 'Tenant already has an active tier.');
    }

    // 3. Deterministic external call with strict Idempotency Key
    const stripeSub = await stripeClient.subscriptions.create(
      {
        customer: session.stripeCustomerId,
        items: [{ price: input.planId }],
        default_payment_method: input.paymentMethodId,
        metadata: { tenantId: session.tenantId, userId: session.userId },
      },
      { idempotencyKey: `sub_<span class="inline-math px-1"><span class="katex-error" title="ParseError: KaTeX parse error: Expected group after &#x27;_&#x27; at position 19: …ssion.tenantId}_̲" style="color:#cc0000">{session.tenantId}_</span></span>{input.idempotencyKey}` }
    );

    // 4. Persist internal state within the transaction
    const [record] = await tx('subscriptions').insert({
      tenant_id: session.tenantId,
      stripe_subscription_id: stripeSub.id,
      plan_id: input.planId,
      status: 'ACTIVE',
      created_at: new Date(),
    }).returning('*');

    return record;
  });

  return res.status(201).json({ success: true, data: { subscriptionId: result.id } });
}

+-----------------------------------------------------------------------------------+
|                         CLEAN MODULAR MONOLITH ARCHITECTURE                       |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  [ HTTP Request ] --> [ Auth & Tenant Context Middleware ]                         |
|                                    |                                              |
|                                    v                                              |
|                      [ Zod Contract Validation Layer ]                            |
|                                    |                                              |
|         +--------------------------+--------------------------+                  |
|         |                                                     |                   |
|         v                                                     v                   |
|  [ Billing Domain ]                                  [ AI Inference Domain ]      |
|  - Strict Idempotency                                - Token-Budget Rate Limiter  |
|  - Stripe Webhooks                                   - Deterministic State Engine |
|         |                                                     |                   |
|         +--------------------------+--------------------------+                  |
|                                    |                                              |
|                                    v                                              |
|               [ PostgreSQL + Connection Pooler (PgBouncer) ]                     |
|               - Row-Level Security (RLS) Multi-Tenant Guard                       |
|               - Strict Foreign Key Constraints & Migrations                       |
|                                                                                   |
+-----------------------------------------------------------------------------------+