🐛 Fixed paid checkout returning to homepage instead of originating page

ref https://linear.app/ghost/issue/PLA-86
ref #28369

- checkoutPlan() already derived a contextual cancelUrl from window.location but had no equivalent fallback for successUrl, so the standard signup/upgrade callers omitted it and the backend fell back to the site-root default — landing paid members on the homepage after Stripe Checkout instead of the article they just unlocked
- mirrors the existing cancelUrl logic and continueGiftCheckout(), which already does this for gift flows
- backend sanitizeReturnUrl() already enforces same-origin, so the contextual URL flows through safely with no server change needed

Author: 9larsons

apps/portal/src/utils/api.js

@@ -493,6 +493,11 @@ function setupGhostApi({siteUrl = window.location.origin, apiUrl, apiKey}) {
             const identity = await api.member.identity();
             const url = endpointFor({type: 'members', resource: 'create-stripe-checkout-session'});
 
+            if (!successUrl) {
+                const checkoutSuccessUrl = window.location.href.startsWith(siteUrlObj.href) ? new URL(window.location.href) : new URL(siteUrl);
+                checkoutSuccessUrl.searchParams.set('stripe', 'success');
+                successUrl = checkoutSuccessUrl.href;
+            }
             if (!cancelUrl) {
                 const checkoutCancelUrl = window.location.href.startsWith(siteUrlObj.href) ? new URL(window.location.href) : new URL(siteUrl);
                 checkoutCancelUrl.searchParams.set('stripe', 'cancel');

apps/portal/test/api.test.js

@@ -227,3 +227,91 @@ describe('Portal API member checkout', () => {
         });
     });
 });
+
+describe('Portal API plan checkout', () => {
+    let originalLocation;
+
+    const mockCheckoutFetch = () => {
+        vi.spyOn(window, 'fetch').mockImplementation((url) => {
+            if (url.includes('/members/api/session/')) {
+                return Promise.resolve(new Response('identity-token', {status: 200}));
+            }
+
+            return Promise.resolve(new Response(JSON.stringify({
+                url: 'https://checkout.stripe.com/plan-session'
+            }), {
+                status: 200,
+                headers: {
+                    'Content-Type': 'application/json'
+                }
+            }));
+        });
+    };
+
+    const lastCheckoutBody = () => {
+        const call = window.fetch.mock.calls.find(([url]) => url.includes('/members/api/create-stripe-checkout-session/'));
+        return JSON.parse(call[1].body);
+    };
+
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        originalLocation = window.location;
+        delete window.location;
+        window.location = {
+            href: 'https://example.com/paid-article/',
+            assign: vi.fn()
+        };
+    });
+
+    afterEach(() => {
+        window.location = originalLocation;
+    });
+
+    test('derives a contextual successUrl from the current page when none is supplied', async () => {
+        const ghostApi = setupGhostApi({siteUrl: 'https://example.com'});
+        mockCheckoutFetch();
+
+        await ghostApi.member.checkoutPlan({
+            plan: 'price_123',
+            tierId: 'tier_123',
+            cadence: 'month'
+        });
+
+        const body = lastCheckoutBody();
+        expect(body.successUrl).toBe('https://example.com/paid-article/?stripe=success');
+        expect(body.cancelUrl).toBe('https://example.com/paid-article/?stripe=cancel');
+    });
+
+    test('falls back to the site root when the current page is off-site', async () => {
+        window.location.href = 'https://evil.example.org/phishing/';
+        const ghostApi = setupGhostApi({siteUrl: 'https://example.com'});
+        mockCheckoutFetch();
+
+        await ghostApi.member.checkoutPlan({
+            plan: 'price_123',
+            tierId: 'tier_123',
+            cadence: 'month'
+        });
+
+        const body = lastCheckoutBody();
+        expect(body.successUrl).toBe('https://example.com/?stripe=success');
+        expect(body.cancelUrl).toBe('https://example.com/?stripe=cancel');
+    });
+
+    test('preserves an explicitly supplied successUrl', async () => {
+        const ghostApi = setupGhostApi({siteUrl: 'https://example.com'});
+        mockCheckoutFetch();
+
+        await ghostApi.member.checkoutPlan({
+            plan: 'price_123',
+            tierId: 'tier_123',
+            cadence: 'month',
+            successUrl: 'https://example.com/custom-welcome/',
+            cancelUrl: 'https://example.com/custom-cancel/'
+        });
+
+        const body = lastCheckoutBody();
+        expect(body.successUrl).toBe('https://example.com/custom-welcome/');
+        expect(body.cancelUrl).toBe('https://example.com/custom-cancel/');
+    });
+});