mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-09-25 03:34:14 +00:00
Evan JarrettandClaude Opus 5
12c55ed560
Webhook delivery was neither idempotent nor order-safe, and every failure
returned 400, which Stripe does not retry. A transient DB or hold error
therefore dropped a subscription change silently and permanently.
- New stripe_processed_events table: event_id as primary key dedups
redelivery, and event_created per customer drops stale out-of-order
deliveries.
- HandleWebhook distinguishes ErrWebhookSignature (400, no retry) from
ErrWebhookProcessing (500, Stripe redelivers). The event handlers
return errors instead of swallowing them. ErrBillingDisabled maps to
400: the route is mounted but billing is off, so redelivery can never
succeed and Stripe should stop rather than retry to exhaustion.
- Refuse to boot when billing is enabled with an empty
STRIPE_WEBHOOK_SECRET. Stripe HMACs with the empty key, so an
attacker can reproduce the signature and the endpoint is forgeable.
- UpdateCrewTierOnAllHolds retries each hold (3 attempts, linear
backoff, 5s per request) and returns a joined error so the webhook
can fail and let Stripe redeliver.
The fan-out contacts holds concurrently rather than in sequence. Serially,
one unreachable hold burns the caller's entire 10s budget on its own
retries (3 x 5s plus backoff) and the holds after it are never contacted;
because Stripe redelivers in the same order, a persistently-down first
hold means the rest are never updated at all.
On the hold, the signature-validated sub claim is now the source of truth
for updateCrewTier: a mismatched body userDid is rejected with 403 rather
than retargeting the grant to another DID. "Not crew on this hold" is a
200 no-op, since the appview fans updates out to every managed hold and a
subscriber is not crew everywhere.
That no-op has to be told apart from a storage failure. GetCrewMember
collapsed both into one generic error, so a CAR-store failure read as
"not a member", answered 200, and let the appview record the event as
processed — losing the tier grant permanently, which is exactly the
failure mode this commit exists to prevent. Missing records now carry an
ErrCrewMemberNotFound sentinel, and anything else returns 500 so Stripe
redelivers.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
92 lines
2.4 KiB
Go
92 lines
2.4 KiB
Go
package db
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestStripeProcessedEvents_DedupAndOrdering(t *testing.T) {
|
|
safeName := strings.ReplaceAll(t.Name(), "/", "_")
|
|
d, err := InitDB(fmt.Sprintf("file:%s?mode=memory&cache=shared", safeName), LibsqlConfig{})
|
|
if err != nil {
|
|
t.Fatalf("init db: %v", err)
|
|
}
|
|
d.SetMaxOpenConns(1)
|
|
defer d.Close()
|
|
|
|
// Fresh DB: nothing seen, no latest timestamp.
|
|
seen, err := StripeEventSeen(d, "evt_1")
|
|
if err != nil {
|
|
t.Fatalf("seen empty: %v", err)
|
|
}
|
|
if seen {
|
|
t.Fatal("evt_1 should not be seen on a fresh DB")
|
|
}
|
|
|
|
latest, err := LatestStripeEventCreatedForCustomer(d, "cus_a")
|
|
if err != nil {
|
|
t.Fatalf("latest empty: %v", err)
|
|
}
|
|
if latest != 0 {
|
|
t.Errorf("latest = %d, want 0", latest)
|
|
}
|
|
|
|
// Record an event, then it should be seen and bump the customer's latest.
|
|
if err := RecordStripeEvent(d, "evt_1", "cus_a", 1000); err != nil {
|
|
t.Fatalf("record evt_1: %v", err)
|
|
}
|
|
seen, err = StripeEventSeen(d, "evt_1")
|
|
if err != nil {
|
|
t.Fatalf("seen evt_1: %v", err)
|
|
}
|
|
if !seen {
|
|
t.Fatal("evt_1 should be seen after recording")
|
|
}
|
|
latest, err = LatestStripeEventCreatedForCustomer(d, "cus_a")
|
|
if err != nil {
|
|
t.Fatalf("latest cus_a: %v", err)
|
|
}
|
|
if latest != 1000 {
|
|
t.Errorf("latest = %d, want 1000", latest)
|
|
}
|
|
|
|
// Duplicate record (webhook redelivery) is a no-op, not an error.
|
|
if err := RecordStripeEvent(d, "evt_1", "cus_a", 1000); err != nil {
|
|
t.Fatalf("duplicate record should not error: %v", err)
|
|
}
|
|
|
|
// A newer event raises the latest; ordering uses MAX, not insertion order.
|
|
if err := RecordStripeEvent(d, "evt_3", "cus_a", 3000); err != nil {
|
|
t.Fatalf("record evt_3: %v", err)
|
|
}
|
|
if err := RecordStripeEvent(d, "evt_2", "cus_a", 2000); err != nil {
|
|
t.Fatalf("record evt_2: %v", err)
|
|
}
|
|
latest, err = LatestStripeEventCreatedForCustomer(d, "cus_a")
|
|
if err != nil {
|
|
t.Fatalf("latest after more: %v", err)
|
|
}
|
|
if latest != 3000 {
|
|
t.Errorf("latest = %d, want 3000", latest)
|
|
}
|
|
|
|
// Latest is scoped per customer.
|
|
latest, err = LatestStripeEventCreatedForCustomer(d, "cus_b")
|
|
if err != nil {
|
|
t.Fatalf("latest cus_b: %v", err)
|
|
}
|
|
if latest != 0 {
|
|
t.Errorf("cus_b latest = %d, want 0", latest)
|
|
}
|
|
|
|
// Empty customer id short-circuits to 0.
|
|
latest, err = LatestStripeEventCreatedForCustomer(d, "")
|
|
if err != nil {
|
|
t.Fatalf("latest empty customer: %v", err)
|
|
}
|
|
if latest != 0 {
|
|
t.Errorf("empty-customer latest = %d, want 0", latest)
|
|
}
|
|
}
|