diff --git a/packages/stripe/src/index.ts b/packages/stripe/src/index.ts index fdc60a2cd0..27a29dbb08 100644 --- a/packages/stripe/src/index.ts +++ b/packages/stripe/src/index.ts @@ -66,6 +66,13 @@ export const stripe = (options: O) => { } const referenceId = ctx.body?.referenceId || ctx.query?.referenceId || session.user.id; + + if (ctx.body?.referenceId && !options.subscription?.authorizeReference) { + logger.error(`Passing referenceId into a subscription action isn't allowed if subscription.authorizeReference isn't defined in your stripe plugin config.`) + throw new APIError("BAD_REQUEST", { + message: "Reference id is not allowed. Read server logs for more details.", + }); + } const isAuthorized = ctx.body?.referenceId ? await options.subscription?.authorizeReference?.({ user: session.user,