fix: missing Subscription.planKey migration breaks post-payment role …

[HadiSaaibi]

Description

• Fixes schema drift: planKey exists on the Subscription model in schema.prisma but no migration creates the column (only 0_init creates the table, without it).
• Causes every POST /billing/confirm call to fail inside BillingService.confirmSession() at subscription.upsert() (PrismaClientKnownRequestError: column "planKey" does not exist), so the endpoint 500s and org_admin is never granted post-payment new users are stuck with an "unknown" role after registering and paying.
• Adds migration 20260701204011_add_subscription_plan_key (ALTER TABLE "Subscription" ADD COLUMN "planKey" TEXT;) to bring the schema back in sync.

Steps to QA

• Run npx turbo run db:deploy
• Register a new user and complete Stripe test checkout (card 4242 4242 4242 4242)
• Confirm the dashboard shows role org_admin instead of unknown

Screenshots

pre fix

post fix

Summary by CodeRabbit

• New Features

  • Subscription data now includes a plan identifier (planKey), enabling more accurate plan tracking and display.

• Bug Fixes

  • Improved dependency setup behavior by adjusting script allowance for specific packages, helping ensure required build and native components are handled more reliably during installation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 359431b9-b9e5-4267-a0d4-7a4dd97b7287

📥 Commits

Reviewing files that changed from the base of the PR and between 8d17a6d and eba6f33.

📒 Files selected for processing (1)

• package.json

🚧 Files skipped from review as they are similar to previous changes (1)

• package.json

---

📝 Walkthrough

Walkthrough

This PR adds an allowScripts configuration block to package.json and includes a Prisma migration that adds a planKey TEXT column to the Subscription table.

Changes

Package config and database migration

Layer / File(s)	Summary
npm allowScripts configuration package.json	Adds a top-level allowScripts object after overrides, enabling lifecycle scripts for @prisma/engines, @scarf/scarf, esbuild, prisma, sharp, and unrs-resolver.
Subscription planKey migration packages/database/prisma/migrations/20260701204011_add_subscription_plan_key/migration.sql	Adds a new planKey TEXT column to the Subscription table via ALTER TABLE ... ADD COLUMN.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main fix: adding the missing Subscription.planKey migration that was breaking post-payment role assignment.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/subscription-plankey-migration

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 32: The package approvals currently allow `@scarf/scarf`@1.4.0, which has a
postinstall hook that can send install-time telemetry. Remove this approval from
the relevant package policy so the install script is denied unless this behavior
is explicitly intended, and keep the change localized to the approval entry in
package.json.
- Around line 30-36: The install-script policy in package.json is only advisory
under npm@11.6.2, so unapproved dependency scripts can still run during npm ci.
Update the CI/install flow to hard-enforce the approved script list by adding a
verification step before or during install, or switch to an installer/npm
version that blocks disallowed scripts. Use the existing allowScripts policy in
package.json as the source of truth and ensure the enforcement is applied in the
CI path that runs npm ci.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: dfa80da4-ea92-4b72-a92d-782a44ca53ca

📥 Commits

Reviewing files that changed from the base of the PR and between 14882ab and 8d17a6d.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• package.json
• packages/database/prisma/migrations/20260701204011_add_subscription_plan_key/migration.sql