Antigravity で Next.js + Supabase + Stripe のサブスク基盤を組む — 任せた範囲と手で書いた範囲

# AGENTS.md
 
## このプロジェクトの前提
@docs/architecture.md
@docs/db-schema.md
 
## 決済に関する規約
@docs/rules/payment.md
 
## 生成時の制約
- API ルートは app/api/**/route.ts に置いてください
- Supabase へのサーバー側アクセスは service role キーを使うこと
- app/api/webhooks/ 配下は自動生成の対象外とします

create table public.subscriptions (
  user_id                uuid primary key references auth.users (id) on delete cascade,
  stripe_customer_id     text        not null,
  stripe_subscription_id text        not null unique,
  price_id               text        not null,
  status                 text        not null,
  current_period_end     timestamptz not null,
  cancel_at_period_end   boolean     not null default false,
  updated_at             timestamptz not null default now()
);
 
alter table public.subscriptions enable row level security;
 
-- 読み取りのみ本人に開放する。書き込みポリシーは意図的に作らない
create policy "read own subscription"
  on public.subscriptions
  for select
  using (auth.uid() = user_id);

create or replace function public.has_active_subscription(uid uuid)
returns boolean
language sql
stable
as $$
  select exists (
    select 1
      from public.subscriptions
     where user_id = uid
       and status in ('active', 'trialing')
       and current_period_end > now()
  );
$$;

// app/api/checkout/route.ts
import { NextRequest, NextResponse } from "next/server";
import Stripe from "stripe";
 
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
 
export async function POST(req: NextRequest) {
  const { userId, priceId, customerId } = await req.json();
  const origin = req.headers.get("origin") ?? process.env.NEXT_PUBLIC_SITE_URL!;
 
  const session = await stripe.checkout.sessions.create({
    mode: "subscription",
    customer: customerId,
    line_items: [{ price: priceId, quantity: 1 }],
    success_url: `${origin}/account?checkout=success`,
    cancel_url: `${origin}/pricing`,
    client_reference_id: userId,
    metadata: { user_id: userId },
    // ここを忘れると customer.subscription.* イベントに user_id が乗りません
    subscription_data: {
      metadata: { user_id: userId },
    },
  });
 
  return NextResponse.json({ url: session.url });
}

// app/api/webhooks/stripe/route.ts
import { NextRequest, NextResponse } from "next/server";
import Stripe from "stripe";
import { createClient } from "@supabase/supabase-js";
 
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
 
const admin = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.SUPABASE_SERVICE_ROLE_KEY!,
  { auth: { persistSession: false } }
);
 
export async function POST(req: NextRequest) {
  const signature = req.headers.get("stripe-signature");
  if (!signature) {
    return NextResponse.json({ error: "missing signature" }, { status: 400 });
  }
 
  // 生のボディをそのまま渡す。json() で受けると検証に失敗します
  const rawBody = await req.text();
 
  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(
      rawBody,
      signature,
      process.env.STRIPE_WEBHOOK_SECRET!
    );
  } catch (err) {
    console.error("[stripe] signature verification failed", err);
    return NextResponse.json({ error: "invalid signature" }, { status: 400 });
  }
 
  // 主キー衝突を「処理済み」の判定に使う（アプリ側でロックを持たない）
  const { error: claimError } = await admin
    .from("processed_stripe_events")
    .insert({ event_id: event.id, type: event.type });
 
  if (claimError) {
    if (claimError.code === "23505") {
      return NextResponse.json({ received: true, duplicate: true });
    }
    console.error("[stripe] claim failed", claimError);
    return NextResponse.json({ error: "claim failed" }, { status: 500 });
  }
 
  try {
    await applyEvent(event);
  } catch (err) {
    // 失敗したら記録を戻し、Stripe のリトライで再処理させる
    await admin
      .from("processed_stripe_events")
      .delete()
      .eq("event_id", event.id);
    console.error("[stripe] handler failed", event.type, err);
    return NextResponse.json({ error: "handler failed" }, { status: 500 });
  }
 
  return NextResponse.json({ received: true });
}

create table public.processed_stripe_events (
  event_id    text primary key,
  type        text        not null,
  received_at timestamptz not null default now()
);

async function applyEvent(event: Stripe.Event) {
  switch (event.type) {
    case "checkout.session.completed": {
      const session = event.data.object as Stripe.Checkout.Session;
      if (!session.subscription) return;
      const sub = await stripe.subscriptions.retrieve(
        session.subscription as string
      );
      await upsert(sub);
      return;
    }
    case "customer.subscription.updated":
    case "customer.subscription.deleted": {
      await upsert(event.data.object as Stripe.Subscription);
      return;
    }
    default:
      return;
  }
}
 
async function upsert(sub: Stripe.Subscription) {
  const userId = sub.metadata?.user_id;
  if (!userId) throw new Error(`missing user_id on ${sub.id}`);
 
  const { error } = await admin.from("subscriptions").upsert(
    {
      user_id: userId,
      stripe_customer_id: sub.customer as string,
      stripe_subscription_id: sub.id,
      price_id: sub.items.data[0]?.price.id ?? "",
      status: sub.status,
      current_period_end: new Date(
        sub.items.data[0].current_period_end * 1000
      ).toISOString(),
      cancel_at_period_end: sub.cancel_at_period_end,
      updated_at: new Date().toISOString(),
    },
    { onConflict: "user_id" }
  );
 
  if (error) throw error;
}