如何通过PayPal订阅API查询用户订阅状态（JavaScript非Node.js）

Hey there, let's walk through how to tackle this in a non-Node.js JavaScript environment (like the browser) using PayPal's Subscriptions API. I'll break it down step by step:

Prerequisites #

First, make sure you have these handy:

• A PayPal REST API app (you can create this in the PayPal Developer Dashboard) with your Client ID (keep your Client Secret secure—more on that later).
• The unique subscription_id for the user's subscription (you should store this in your database when the user first signs up for a subscription).
• Ensure your domain is added to PayPal's CORS allowed list (this prevents browser cross-origin errors when making API calls).

1. Get a PayPal Access Token #

Before you can fetch subscription data, you need an access token to authenticate with PayPal's API. Important note: Never expose your Client Secret directly in frontend code—this will let attackers impersonate your account. Instead, create a simple backend endpoint that handles this token request, and have your frontend call your own endpoint to get the token.

Here's what the token request would look like (if you're handling it via a backend proxy, or for testing purposes only in a secure environment):

async function fetchPayPalAccessToken(clientId, clientSecret) {
  const encodedCredentials = btoa(`${clientId}:${clientSecret}`);
  const response = await fetch('https://api-m.paypal.com/v1/oauth2/token', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Authorization': `Basic ${encodedCredentials}`
    },
    body: 'grant_type=client_credentials'
  });

  if (!response.ok) {
    throw new Error(`Token request failed: ${response.statusText}`);
  }

  const data = await response.json();
  return data.access_token;
}

2. Fetch the Subscription's Current Status #

Once you have the access token, you can pull the subscription details to get its status and cancellation timestamp (if applicable):

async function getSubscriptionDetails(subscriptionId, accessToken) {
  const response = await fetch(`https://api-m.paypal.com/v1/billing/subscriptions/${subscriptionId}`, {
    method: 'GET',
    headers: {
      'Authorization': `Bearer ${accessToken}`,
      'Content-Type': 'application/json'
    }
  });

  if (!response.ok) {
    throw new Error(`Failed to fetch subscription: ${response.statusText}`);
  }

  const subscription = await response.json();
  return {
    currentStatus: subscription.status, // Possible values: ACTIVE, CANCELLED, SUSPENDED, EXPIRED, etc.
    cancellationTime: subscription.status === 'CANCELLED' ? subscription.update_time : null
  };
}

PayPal's API returns a status field that tells you the current state of the subscription. If it's CANCELLED, the update_time field will show when the cancellation happened.

3. Check if the Subscription was Cancelled in a Specific Timeframe #

Next, write a helper function to verify if the cancellation occurred within your target window:

function isCancelledInTimeWindow(cancellationTime, windowStart, windowEnd) {
  if (!cancellationTime) return false;

  const cancelDate = new Date(cancellationTime);
  const startDate = new Date(windowStart);
  const endDate = new Date(windowEnd);

  return cancelDate >= startDate && cancelDate <= endDate;
}

You can pass ISO 8601 strings (like '2024-01-01T00:00:00Z') or Date objects for the window start/end.

4. Restrict Features Based on the Result #

Put it all together to control access to your app's features:

async function manageUserAccess(subscriptionId, checkWindowStart, checkWindowEnd) {
  try {
    // In production, replace this with a call to your backend endpoint to get the token
    const accessToken = await fetchPayPalAccessToken('YOUR_CLIENT_ID', 'YOUR_CLIENT_SECRET');
    const { currentStatus, cancellationTime } = await getSubscriptionDetails(subscriptionId, accessToken);

    if (currentStatus === 'CANCELLED' && isCancelledInTimeWindow(cancellationTime, checkWindowStart, checkWindowEnd)) {
      // Subscription was cancelled in the target window—restrict features
      console.log('Restricting premium access');
      // Example UI change: Hide a premium feature button
      document.getElementById('premium-dashboard').style.display = 'none';
      document.getElementById('access-restricted-message').style.display = 'block';
    } else {
      // Subscription is active or was cancelled outside the window—allow full access
      console.log('Granting full access');
      document.getElementById('premium-dashboard').style.display = 'block';
      document.getElementById('access-restricted-message').style.display = 'none';
    }
  } catch (error) {
    console.error('Error checking subscription status:', error);
    // Fallback: Default to restricted access if there's an API error
    document.getElementById('access-restricted-message').style.display = 'block';
  }
}

// Example usage: Check if the subscription was cancelled between Jan 1 and Dec 31, 2024
manageUserAccess(
  'USER_SUBSCRIPTION_ID_FROM_YOUR_DB',
  '2024-01-01T00:00:00Z',
  '2024-12-31T23:59:59Z'
);

Critical Security Reminders #

• Never expose your Client Secret in frontend code: Always use a backend proxy to handle token requests and API calls to PayPal. Frontend code is publicly visible, so exposing secrets puts your PayPal account at risk.
• Validate permissions on the backend: Frontend checks are for UX only. When a user tries to access a restricted feature (like a paid API endpoint), your backend should re-verify the subscription status with PayPal to prevent tampering.

内容的提问来源于stack exchange，提问作者Omer Ozhan