Jun 28 - Implement payment functions (Stripe)

app/__init__.py

@@ -161,6 +161,30 @@ def create_app(config_name='default'):
             pass
         return {'tenant_branding': None}
 
+    @app.context_processor
+    def inject_billing_context():
+        """MT-8: push billing state into every template."""
+        try:
+            from flask import g
+            billing_warning    = getattr(g, 'billing_warning', None)
+            tenant             = getattr(g, 'tenant', None)
+            subscription_status = tenant.subscription_status if tenant else None
+            trial_ends_at      = tenant.trial_ends_at if tenant else None
+            return {
+                'billing_enabled':      app.config.get('BILLING_ENABLED', False),
+                'billing_warning':      billing_warning,
+                'subscription_status':  subscription_status,
+                'trial_ends_at':        trial_ends_at,
+            }
+        except Exception:
+            pass
+        return {
+            'billing_enabled':     False,
+            'billing_warning':     None,
+            'subscription_status': None,
+            'trial_ends_at':       None,
+        }
+
     os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)
 
     from app.routes import auth, dashboard, inspections, templates, reports, facilities
@@ -174,6 +198,7 @@ def create_app(config_name='default'):
     from app.routes import broadcast       # Admin broadcast messages
     from app.routes import devices         # Admin device management
     from app.routes import tenant_settings  # MT-7 — tenant self-service
+    from app.billing import bp as billing_bp  # MT-8 — Stripe billing
 
     app.register_blueprint(auth.bp)
     app.register_blueprint(dashboard.bp)
@@ -191,6 +216,11 @@ def create_app(config_name='default'):
     app.register_blueprint(broadcast.bp)
     app.register_blueprint(devices.bp)
     app.register_blueprint(tenant_settings.bp)
+    # Billing blueprint is CSRF-exempt: /billing/webhook receives raw POST from
+    # Stripe and cannot carry a CSRF token. Subscribe/portal are GET redirects
+    # which Flask-WTF does not protect anyway (CSRF only applies to unsafe methods).
+    csrf.exempt(billing_bp)
+    app.register_blueprint(billing_bp)
 
     # ── Mobile API (Phase 7 / Phase A / Phase B / Phase C) ───────────────────
     # The /api/v1 blueprint group uses JWT Bearer tokens — no CSRF cookies needed.