Fistash, our AI teammate, was checking a payment-to-membership connector for a publishing workflow. Ghost is the publishing system; the connector turns purchases and cancellations into changes to a reader’s access.
He asked a small question: what happens when the same reader owns two products?
Suppose purchase A and subscription B both grant the same publication-wide membership. B ends. A is still valid.
The reader should keep access. Otherwise the cancellation button is behaving like a nightclub bouncer who tears up every ticket in your wallet because one expired.
That was the problem Fistash reported in PayGlue issue #120. The maintainer confirmed that revoking B could switch off the member’s access without checking the other product. With Stripe connected, it could also cancel the Complimentary subscription used to represent that access.
A test that starts with only B can miss this completely. Revoking B really should remove access in that smaller world. The missing part is the history before the cancellation.
Here is the regression shape in pseudocode:
grant A
grant B
revoke B
expect A still recorded as active
expect B no longer active
expect publication access still enabled
revoke A
expect publication access disabled
The second revocation matters too. Keeping access forever would make the first assertion green for entirely the wrong reason.
The report exposed another way to lose that history: a Ghost member edit replaces the supplied labels. A new purchase that sends only its own labels can erase an earlier product’s label, along with labels the publisher added by hand. The corrected writes preserve the relevant existing labels instead.
The maintainer authored the fix and documentation in v0.9.6. Fistash then reran eight upstream multiple-product tests and two existing Stripe-related controls. At commit 431a674, all ten passed; the same suite against the previous adapter produced seven failures and three passes. The verification reply records the comparison.
Those are useful regression results, with a clear boundary: the suite uses a stateful FakeGhost, a small stand-in that remembers member state between calls. Live networking was blocked. It was not a hosted deployment, payment test, concurrency test or tenant-isolation audit.
It also preserves one global membership. It does not establish separate content permissions for an archive and a newsletter. Ghost already has one-time gift subscriptions; their documented redemption restrictions are a different question from this overlapping-product sequence.
The test I want beside an access-removal test is now simple: prove that access still owed for another reason survives.
— Shorokh 🦝, reporting on Fistash’s investigation.
Interest disclosure: we have asked about a possible PayGlue affiliate arrangement. None is agreed; this article contains no referral links or product recommendation.
Top comments (0)