feat(payments): let clients see their subscription tier by Priyanshubhartistm · Pull Request #926 · cameri/nostream

Priyanshubhartistm · 2026-10-21T21:00:54Z

Description

Builds on the subscription lifecycle (#909). Nothing changes unless payments.enabled is true and payments.subscriptionPlans is non-empty.

NIP-11: the plans are advertised under fees.subscription, one entry per plan with amount in msats, unit, and period in seconds (the standard NIP-11 shape), plus id, which is what a client sends as planId to POST /invoices, and description when the plan has one. limitation.restricted_writes is now true when plans are in use, since a subscription is what lets a pubkey write even without an admission fee.
GET /subscriptions/status?pubkey=<hex or npub> returns the pubkey's planId, status, active, currentPeriodEnd and accessEndsAt (ISO dates, null when it never ends). active is judged from the dates, as the write gate does, so grace counts and a lapsed subscription the sweep has not reached yet does not. A pubkey with no subscription gets nulls and active: false. It answers 400 for an invalid pubkey and 404 while plans are off, and is counted against limits.invoice.rateLimits under its own key.
CONFIGURATION.md describes both.

Related Issue

Closes #925

Motivation and Context

The endpoint is public, like /admissions/check/:pubkey, and only reports what the relay already enforces for that pubkey.

Signed-off-by: Priyanshubhartistm <bhartipriyanshustm@gmail.com>

changeset-bot · 2026-10-21T21:00:59Z

🦋 Changeset detected

Latest commit: e34f566

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

greptile-apps · 2026-10-21T21:05:24Z

Confidence Score: 4/5

[Medium impact] The PR adds public subscription details to two client-facing relay paths.

Add CORS headers before merging so browser clients on other sites can use the new endpoint.

Findings

Browser clients cannot read subscriptions ▶
Uppercase npubs are rejected ▶

Summary

The PR advertises subscription plans in NIP-11 and adds a public endpoint for subscription status.

NIP-11 lists subscription plans and marks writes as restricted.
Clients can check a pubkey’s subscription status and access dates.

Diagram

sequenceDiagram
  participant Client
  participant Relay
  participant Repository
  Client->>Relay: "GET /subscriptions/status?pubkey=..."
  Relay->>Relay: Check limits, plans, and pubkey
  Relay->>Repository: findByPubkey(pubkey)
  Repository-->>Relay: Subscription or no row
  Relay->>Relay: Calculate access and end dates
  Relay-->>Client: Plan, status, active, and dates

_{Reviews (4) · Last reviewed commit: "Merge branch 'main' into feat/subscripti..." · Reviewed by Greptile}

coveralls · 2026-10-21T21:07:08Z

Coverage Report for CI Build 40026647273

Warning

No base build found for commit c40e570 on main.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 75.627%

Details

Patch coverage: 2 uncovered changes across 2 files (81 of 83 lines covered, 97.59%).

Uncovered Changes

File	Changed	Covered	%
src/controllers/subscriptions/get-subscription-status-controller.ts	52	51	98.08%
src/factories/controllers/get-subscription-status-controller-factory.ts	7	6	85.71%
Total (6 files)	83	81	97.59%

Coverage Regressions

Requires a base build to compare against. How to fix this →

Coverage Stats


Relevant Lines:	11366
Covered Lines:	8984
Line Coverage:	79.04%
Relevant Branches:	5895
Covered Branches:	4070
Branch Coverage:	69.04%
Branches in Coverage %:	Yes
Coverage Strength:	801.12 hits per line

💛 - Coveralls

…e not 32 bytes Signed-off-by: Priyanshubhartistm <bhartipriyanshustm@gmail.com>

greptile-apps · 2026-10-23T20:50:49Z

+      return raw
+    }
+
+    if (/^npub1/.test(raw)) {


Uppercase npubs are rejected

A valid all-uppercase NPUB1... gets a 400 response because parsePubkey checks the prefix with a case-sensitive regex. Clients using this encoding cannot check their subscription, even though fromNpub already supports it. Make the prefix check case-insensitive and add an endpoint test for an uppercase npub.

Suggested change

if (/^npub1/.test(raw)) {

if (/^npub1/i.test(raw)) {

cameri · 2026-10-23T21:04:08Z

@Priyanshubhartistm Let's please fix the issue flagged by Greptile

greptile-apps · 2026-10-23T21:28:53Z

+        }
+      : { pubkey, planId: null, status: null, active: false, currentPeriodEnd: null, accessEndsAt: null }
+
+    response.status(200).setHeader('content-type', 'application/json; charset=utf8').send(body)


Browser clients cannot read subscriptions

/subscriptions/status returns no Access-Control-Allow-Origin header, and neither the app nor the router adds one. Browser clients hosted on another site therefore cannot read the response or show the user's subscription tier, even when the request succeeds. Add CORS headers to this public endpoint, including its error responses.

feat(payments): let clients see their subscription tier

c9c8ebb

Signed-off-by: Priyanshubhartistm <bhartipriyanshustm@gmail.com>

greptile-apps Bot reviewed Oct 21, 2026

View reviewed changes

Comment thread src/controllers/subscriptions/get-subscription-status-controller.ts Outdated

Comment thread src/controllers/subscriptions/get-subscription-status-controller.ts Outdated

Comment thread CONFIGURATION.md Outdated

fix(payments): report the real end of access and reject npubs that ar…

0aa7c8c

…e not 32 bytes Signed-off-by: Priyanshubhartistm <bhartipriyanshustm@gmail.com>

greptile-apps Bot approved these changes Oct 22, 2026

View reviewed changes

cameri approved these changes Oct 23, 2026

View reviewed changes

Merge branch 'main' into feat/subscription-client-status

b7fbf8d

greptile-apps Bot reviewed Oct 23, 2026

View reviewed changes

Merge branch 'main' into feat/subscription-client-status

e34f566

greptile-apps Bot reviewed Oct 23, 2026

View reviewed changes

Navigation Menu

Repository navigation

feat(payments): let clients see their subscription tier - #926

feat(payments): let clients see their subscription tier#926
Priyanshubhartistm wants to merge 4 commits into
cameri:mainfrom
Priyanshubhartistm:feat/subscription-client-status

Priyanshubhartistm commented Oct 21, 2026

Uh oh!

changeset-bot Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Oct 21, 2026 •

edited

Loading

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coveralls commented Oct 21, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot Oct 23, 2026

Uh oh!

cameri commented Oct 23, 2026

Uh oh!

greptile-apps Bot Oct 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Priyanshubhartistm commented Oct 21, 2026

Description

Related Issue

Motivation and Context

Uh oh!

changeset-bot Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

greptile-apps Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Findings

Summary

Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coveralls commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 40026647273

Coverage: 75.627%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

greptile-apps Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

cameri commented Oct 23, 2026

Uh oh!

greptile-apps Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

changeset-bot Bot commented Oct 21, 2026 •

edited

Loading

greptile-apps Bot commented Oct 21, 2026 •

edited

Loading

coveralls commented Oct 21, 2026 •

edited

Loading