From 2baca238b2f9d78459131e6296c37c7f655bee6a Mon Sep 17 00:00:00 2001
From: Phillip Thelen <phillip@thelen.space>
Date: Tue, 9 Jun 2026 13:57:40 +0200
Subject: [PATCH] check that purchase token is also the same

---
 website/server/libs/payments/google.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/server/libs/payments/google.js b/website/server/libs/payments/google.js
index 35806bd6e9..fff772a23b 100644
--- a/website/server/libs/payments/google.js
+++ b/website/server/libs/payments/google.js
@@ -164,7 +164,7 @@ api.subscribe = async function subscribe (
   let existingSub;
   if (user && user.isSubscribed()) {
     existingSub = shared.content.subscriptionBlocks[user.purchased.plan.planId];
-    if (existingSub === sub) {
+    if (existingSub === sub && user.purchased.plan.customerId === token) {
       throw new NotAuthorized(this.constants.RESPONSE_ALREADY_USED);
     }
   }