[simonhamp]

MobilePricing::createCheckoutSession didn't check for an existing subscription. The pricing page hides the button from Ultra subscribers, but anyone could log out and enter their own email in the purchase modal. That opens a new Stripe Checkout with promotion codes enabled. If they paid, say with a Black Friday code, they'd end up with a second default subscription billing alongside the first.

The method now returns early when the user has an active subscription that isn't comped. It logs a warning and redirects to the dashboard, or to login if they came through the logged-out modal. Both pages already show session('message').

Things to check:

• Comped subscribers still go through checkout, and their comped sub is cancelled as before.
• Subscriptions that are cancelled but still in their grace period count as active, so those users are blocked. They can resume from the dashboard.
• The logged-out redirect tells whoever typed the email that the account has an active subscription. That's a small leak, so say if you'd prefer vaguer wording.
• This doesn't cover the Stripe billing portal. Whether it accepts promotion codes on existing subscriptions depends on the portal settings in Stripe, which I haven't looked at.

There are three new tests in MobilePricingTest.

🤖 Generated with Claude Code