feat: drop outdated session (#14373)

#### PR Dependency Tree


* **PR #14373** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added client version tracking and validation to ensure application
compatibility across authentication flows and sessions.
* Enhanced OAuth authentication with improved version handling during
sign-in and refresh operations.

* **Bug Fixes**
* Improved payment callback URL handling with safer defaults for
redirect links.

* **Tests**
* Expanded test coverage for client version enforcement and session
management.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/backend/server/src/plugins/payment/manager/selfhost.ts

@@ -87,7 +87,7 @@ export class SelfhostTeamSubscriptionManager extends SubscriptionManager {
       return { allow_promotion_codes: true };
     })();
 
-    let successUrl = this.url.link(params.successCallbackLink);
+    let successUrl = this.url.safeLink(params.successCallbackLink || '/');
     // stripe only accept unescaped '{CHECKOUT_SESSION_ID}' as query
     successUrl = this.url.addSimpleQuery(
       successUrl,

packages/backend/server/src/plugins/payment/manager/user.ts

@@ -204,7 +204,7 @@ export class UserSubscriptionManager extends SubscriptionManager {
       ],
       ...mode,
       ...discounts,
-      success_url: this.url.link(params.successCallbackLink),
+      success_url: this.url.safeLink(params.successCallbackLink || '/'),
     });
   }
 

packages/backend/server/src/plugins/payment/manager/workspace.ts

@@ -120,7 +120,7 @@ export class WorkspaceSubscriptionManager extends SubscriptionManager {
         },
       },
       ...discounts,
-      success_url: this.url.link(params.successCallbackLink),
+      success_url: this.url.safeLink(params.successCallbackLink || '/'),
     });
   }