Add custom create_checkout_session options (like success_url) to credit pack purchases

[yshmarov]

with **options now you can pass additional params to the checkout session.

session = credit_pack.create_checkout_session(
  current_organization,
  allow_promotion_codes: true,
  success_url: organization_credits_url(current_organization),
  cancel_url: organization_credits_url(current_organization)
)

fixes #3

---

Note

Adds flexible checkout customization while preserving fulfillment safety and backward compatibility.

• Update create_checkout_session(user, **options) to pass through common Stripe options (success_url, cancel_url, allow_promotion_codes, locale, customer_email, etc.)
• Safely merge custom metadata and payment_intent_data[:metadata] with base_metadata; base fields take precedence
• Strip protected params (mode, line_items) to prevent overriding; always uses mode: "payment" and pack-defined line items
• Avoid mutating caller-provided hashes by duping payment_intent_data
• Extensive tests cover option passthrough, metadata precedence, protected parameters, edge cases (nil/empty options), non-mutation, and backward compatibility

^{Written by Cursor Bugbot for commit ca3ab89. This will update automatically on new commits. Configure here.}

[onurozer]

@rameerez any chance you can merge this? It allows specifying a success_url (among other params) when creating a checkout session. Thanks!

[rameerez]

Thanks for the PR @yshmarov!

I asked Claude to make sure this wouldn't break anything and it came up with this:

What was added

1. Safe metadata merging and parameter protection

The original **options splat could allow accidental override of critical data needed for credit fulfillment. The improved implementation:

• Merges metadata instead of replacing it - custom metadata is added while base_metadata (purchase_type, pack_name, credits, etc.) is always preserved
• Protects critical parameters - mode and line_items cannot be overridden (they're stripped from options before passing through)
• Handles payment_intent_data specially - its metadata is also merged to preserve fulfillment data

2. Comprehensive test coverage

Added 17 new tests covering:

• ✅ Pass-through options (success_url, cancel_url, allow_promotion_codes, locale, customer_email, etc.)
• ✅ Metadata merging (custom + base preserved)
• ✅ payment_intent_data metadata merging
• ✅ Protected parameters cannot be overridden
• ✅ Backward compatibility
• ✅ Edge cases (nil values, empty hashes)

Usage example

# All these options work safely:
session = credit_pack.create_checkout_session(current_user,
  success_url: credits_url,
  cancel_url: pricing_url,
  allow_promotion_codes: true,
  locale: I18n.locale,
  metadata: { organization_id: org.id }  # Merged with base_metadata
)

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[rameerez]

Merged and shipped in v0.2.1 🎉 @onurozer @yshmarov