Add strict Stripe checkout guard via env flag

backend/services/subscription/stripe_service.py

@@ -16,6 +16,10 @@ REQUIRED_STRIPE_PLAN_KEYS = {
 }
 
 
+def _is_truthy_env(var_name: str) -> bool:
+    return os.getenv(var_name, "").strip().lower() in {"1", "true", "yes", "on"}
+
+
 def _detect_stripe_mode() -> str:
     configured_mode = os.getenv("STRIPE_MODE", "").strip().lower()
     if configured_mode in {"test", "live"}:
@@ -98,7 +102,16 @@ class StripeService:
         self.db = db
         self.api_key = os.getenv("STRIPE_SECRET_KEY")
         self.webhook_secret = os.getenv("STRIPE_WEBHOOK_SECRET")
+        self.require_stripe_checkout = _is_truthy_env("REQUIRE_STRIPE_CHECKOUT")
         if not self.api_key:
+            if self.require_stripe_checkout:
+                raise HTTPException(
+                    status_code=500,
+                    detail=(
+                        "REQUIRE_STRIPE_CHECKOUT=true but STRIPE_SECRET_KEY is missing. "
+                        "Configure STRIPE_SECRET_KEY to enable Stripe checkout."
+                    ),
+                )
             logger.warning("STRIPE_SECRET_KEY is not set. Stripe integration will not work.")
         else:
             stripe.api_key = self.api_key

frontend/src/components/Pricing/PricingPage.tsx

@@ -52,6 +52,10 @@ export interface SubscriptionPlan {
 }
 
 const PricingPage: React.FC = () => {
+  const requireStripeCheckout = ['1', 'true', 'yes', 'on'].includes(
+    (process.env.REACT_APP_REQUIRE_STRIPE_CHECKOUT || '').toLowerCase()
+  );
+  const stripePublishableKey = process.env.REACT_APP_STRIPE_PUBLISHABLE_KEY;
   const navigate = useNavigate();
   const [plans, setPlans] = useState<SubscriptionPlan[]>([]);
   const [loading, setLoading] = useState(true);
@@ -72,39 +76,6 @@ const PricingPage: React.FC = () => {
     fetchPlans();
   }, []);
 
-  const isPodcastOnlyDemoMode = () => {
-    const appMode = (localStorage.getItem('app_mode') || '').toLowerCase();
-    const demoMode = (localStorage.getItem('demo_mode') || '').toLowerCase();
-    const podcastOnlyDemoMode = (localStorage.getItem('podcast_only_demo_mode') || '').toLowerCase();
-    const envAppMode = (process.env.REACT_APP_APP_MODE || '').toLowerCase();
-    const envDemoMode = (process.env.REACT_APP_DEMO_MODE || '').toLowerCase();
-
-    return (
-      podcastOnlyDemoMode === 'true' ||
-      appMode === 'podcast-only' ||
-      demoMode === 'podcast-only' ||
-      envAppMode === 'podcast-only' ||
-      envDemoMode === 'podcast-only'
-    );
-  };
-
-  const redirectAfterSubscription = () => {
-    // In podcast-only demo mode, always force users into podcast flow.
-    // Never send demo users to onboarding.
-    if (isPodcastOnlyDemoMode()) {
-      navigate('/podcast-maker');
-      return;
-    }
-
-    // Full mode keeps existing onboarding redirect behavior.
-    const onboardingComplete = localStorage.getItem('onboarding_complete') === 'true';
-    if (onboardingComplete) {
-      navigate('/dashboard');
-    } else {
-      navigate('/onboarding');
-    }
-  };
-
   const fetchPlans = async () => {
     try {
       setLoading(true);
@@ -166,7 +137,14 @@ const PricingPage: React.FC = () => {
         // Refresh subscription status
         window.dispatchEvent(new CustomEvent('subscription-updated'));
 
-        redirectAfterSubscription();
+        // After subscription, check if onboarding is complete
+        // If not complete, redirect to onboarding; otherwise to dashboard
+        const onboardingComplete = localStorage.getItem('onboarding_complete') === 'true';
+        if (onboardingComplete) {
+          navigate('/dashboard');
+        } else {
+          navigate('/onboarding');
+        }
       } catch (err) {
         console.error('Error subscribing:', err);
         setError('Failed to process subscription');
@@ -199,7 +177,7 @@ const PricingPage: React.FC = () => {
       const userId = localStorage.getItem('user_id') || 'anonymous';
 
       // Check if Stripe is configured
-      if (process.env.REACT_APP_STRIPE_PUBLISHABLE_KEY) {
+      if (stripePublishableKey) {
         console.log('[PricingPage] Initiating Stripe Checkout');
 
         const response = await apiClient.post('/api/subscription/create-checkout-session', {
@@ -213,6 +191,14 @@ const PricingPage: React.FC = () => {
           window.location.href = response.data.url;
           return;
         }
+
+        if (requireStripeCheckout) {
+          throw new Error('Stripe checkout is required but checkout URL was not returned.');
+        }
+      } else if (requireStripeCheckout) {
+        throw new Error(
+          'Stripe checkout is required but REACT_APP_STRIPE_PUBLISHABLE_KEY is not configured.'
+        );
       }
 
       console.log('[PricingPage] Making legacy subscription API call:', {
@@ -266,13 +252,10 @@ const PricingPage: React.FC = () => {
       setTimeout(() => {
         clearInterval(countdownInterval);
         
-        // In podcast-only demo mode, always route users to podcast flow.
-        if (isPodcastOnlyDemoMode()) {
-          navigate('/podcast-maker');
-        } else {
-          const onboardingComplete = localStorage.getItem('onboarding_complete') === 'true';
-
-          if (onboardingComplete) {
+        // After subscription, check if onboarding is complete
+        // If not complete, redirect to onboarding; otherwise to dashboard
+        const onboardingComplete = localStorage.getItem('onboarding_complete') === 'true';
+        if (onboardingComplete) {
           // Restore navigation state (path, phase, tool) if available
           const navState = restoreNavigationState();
           
@@ -295,13 +278,13 @@ const PricingPage: React.FC = () => {
             }
           }
         } else {
-            navigate('/onboarding');
-          }
+          navigate('/onboarding');
         }
       }, 3000);
     } catch (err) {
       console.error('Error subscribing:', err);
-      setError('Failed to process subscription');
+      const errorMessage = err instanceof Error ? err.message : 'Failed to process subscription';
+      setError(errorMessage);
       setSuccessSnackbar({ open: false, message: '', countdown: 0 });
     } finally {
       setSubscribing(false);