Summary

QA found that visiting /app/checkout/?plan=hobby while unauthenticated
landed at a LIVE-mode Razorpay subscription page (sub_Sv96Mt2n8nnDYL).
A stale localStorage JWT was passing the App-level AuthGate, so the SPA
short-circuited into a real Razorpay create-subscription call.
BUG-P111 (P0 critical).

Plus three sibling bugs from the same QA session:

• BUG-P013 (P1): /login dropped the plan context, losing the funnel after signin.
• BUG-P088 (P1): razorpay_configured defaulted to TRUE when the API omitted the flag — clicking upgrade hit a 502 from Razorpay because recurring is not enabled on the prod account (per CLAUDE.md memory project_razorpay_recurring_not_enabled.md).
• BUG-P121/P122 (P1): a future caching regression of sub_* shortlinks would survive logout without a dedicated purge.

Fixes

1. CheckoutPage gains a second-layer auth gate that re-checks getToken() on mount before any createCheckout call. On miss → window.location.assign('/login?next=<encoded path>'). Preserves plan + frequency so post-signin returns the user to the same checkout.
2. CheckoutPage handles the new 503 billing_misconfigured envelope (from the companion api PR's server-side guard) the same way as billing_not_configured — friendly fallback panel, no live Razorpay URL.
3. CheckoutPage registers a logout hook that purges every localStorage key under CHECKOUT_CACHE_KEY_PREFIX. The page does NOT cache sub_* today; the prefix + purge guarantee is the defensive belt against any future caching regression.
4. LoginPage honors ?next=<encoded path> from the query string, falling back to loc.state.from then /app. Only relative same-origin paths are honoured — /login?next=https://evil.com and protocol-relative //evil.com both fall back to /app to defeat open-redirect phishing.
5. mapBillingState flips razorpay_configured ?? true → ?? false. When the API doesn't say, hide the upgrade button. Honest copy beats a button that 502s.

Surface checklist (rule 22)

Tests added

All 1069 vitest tests pass (76 files):

• TestCheckoutPage_UnauthRedirectsToLogin
• TestCheckoutPage_PreservesNextParam
• TestCheckoutPage_PreservesFrequencyMonthlyWhenOnlyPlan
• TestCheckoutPage_FlipsToUnauthOnMidFlight401
• TestCheckoutPage_ClearsCachedSubOnLogout (clearCheckoutCache suite)
• TestCheckoutPage_RendersFallbackOn503BillingMisconfigured (BUG-P112 server-side guard handshake)
• TestLoginPage_HonorsNextRoundTripsToCheckout (BUG-P013)
• TestLoginPage_RejectsAbsoluteEvilCom (open-redirect)
• TestLoginPage_RejectsProtocolRelativeNext (open-redirect)
• TestFetchBilling_DefaultsRazorpayConfiguredFalse (BUG-P088 fail-closed)

Live verification (rule 14)

Queued for after merge & GH Pages deploy. Per brief:

• curl https://instanode.dev/app/checkout/?plan=hobby | grep -c "rzp_live" should be 0.
• Unauth navigation lands at /login?next=/app/checkout?... (Chrome MCP screenshot to follow).
• curl /api/v1/billing/checkout response includes traffic_env (verified via companion api PR).

Risk

The auth-gate change adds a redundant pre-flight check that the App-level AuthGate already covers for the no-token case — but the brief is specifically about the stale-JWT case where the App gate passes and the server 401s. Mid-flight 401 path tagged unauthenticated. Logged-in upgrade flow tests still pass (the redirect happens BEFORE the auth gate in the effect, and the existing getToken() returns 'test-token' by default in the test mock).

🤖 Generated with Claude Code