mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-08-29 12:17:00 +00:00
Evan JarrettandClaude Opus 5
12c55ed560
Webhook delivery was neither idempotent nor order-safe, and every failure
returned 400, which Stripe does not retry. A transient DB or hold error
therefore dropped a subscription change silently and permanently.
- New stripe_processed_events table: event_id as primary key dedups
redelivery, and event_created per customer drops stale out-of-order
deliveries.
- HandleWebhook distinguishes ErrWebhookSignature (400, no retry) from
ErrWebhookProcessing (500, Stripe redelivers). The event handlers
return errors instead of swallowing them. ErrBillingDisabled maps to
400: the route is mounted but billing is off, so redelivery can never
succeed and Stripe should stop rather than retry to exhaustion.
- Refuse to boot when billing is enabled with an empty
STRIPE_WEBHOOK_SECRET. Stripe HMACs with the empty key, so an
attacker can reproduce the signature and the endpoint is forgeable.
- UpdateCrewTierOnAllHolds retries each hold (3 attempts, linear
backoff, 5s per request) and returns a joined error so the webhook
can fail and let Stripe redeliver.
The fan-out contacts holds concurrently rather than in sequence. Serially,
one unreachable hold burns the caller's entire 10s budget on its own
retries (3 x 5s plus backoff) and the holds after it are never contacted;
because Stripe redelivers in the same order, a persistently-down first
hold means the rest are never updated at all.
On the hold, the signature-validated sub claim is now the source of truth
for updateCrewTier: a mismatched body userDid is rejected with 403 rather
than retargeting the grant to another DID. "Not crew on this hold" is a
200 no-op, since the appview fans updates out to every managed hold and a
subscriber is not crew everywhere.
That no-op has to be told apart from a storage failure. GetCrewMember
collapsed both into one generic error, so a CAR-store failure read as
"not a member", answered 200, and let the appview record the event as
processed — losing the tier grant permanently, which is exactly the
failure mode this commit exists to prevent. Missing records now carry an
ErrCrewMemberNotFound sentinel, and anything else returns 500 so Stripe
redelivers.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
57 lines
2.2 KiB
Go
57 lines
2.2 KiB
Go
//go:build billing
|
|
|
|
package billing
|
|
|
|
// Stripe webhook event types the appview subscribes to.
|
|
//
|
|
// When adding or removing an entry here, update four places:
|
|
// 1. The switch in HandleWebhook (billing.go)
|
|
// 2. The SubscribedEvents slice below
|
|
// 3. The Stripe Dashboard endpoint subscription list
|
|
// 4. docs/BILLING.md "Webhook Events" table
|
|
const (
|
|
// EventCheckoutSessionCompleted fires when a customer finishes Stripe Checkout.
|
|
// No-op handler: customer.subscription.created does the actual tier work.
|
|
EventCheckoutSessionCompleted = "checkout.session.completed"
|
|
|
|
// EventSubscriptionCreated fires on initial subscription creation.
|
|
EventSubscriptionCreated = "customer.subscription.created"
|
|
|
|
// EventSubscriptionUpdated fires on plan change, renewal, status transition.
|
|
// Workhorse event: covers active→past_due, past_due→unpaid, resumes, plan
|
|
// upgrades/downgrades, etc.
|
|
EventSubscriptionUpdated = "customer.subscription.updated"
|
|
|
|
// EventSubscriptionDeleted fires when the subscription is fully canceled.
|
|
EventSubscriptionDeleted = "customer.subscription.deleted"
|
|
|
|
// EventSubscriptionPaused fires when a trial ended without a payment method.
|
|
EventSubscriptionPaused = "customer.subscription.paused"
|
|
|
|
// EventSubscriptionResumed fires when a paused subscription resumes.
|
|
EventSubscriptionResumed = "customer.subscription.resumed"
|
|
|
|
// EventInvoicePaymentFailed fires when a card declines (initial or renewal).
|
|
// Logged only. Stripe Smart Retries handle retries and email the customer.
|
|
// Tier stays put; subscription.updated handles past_due/unpaid transitions.
|
|
EventInvoicePaymentFailed = "invoice.payment_failed"
|
|
|
|
// EventChargeDisputeCreated fires when a chargeback is opened.
|
|
// Logged only. Stripe emails the account owner about disputes by default.
|
|
EventChargeDisputeCreated = "charge.dispute.created"
|
|
)
|
|
|
|
// SubscribedEvents is the full set of events that must be enabled on the
|
|
// Stripe Dashboard webhook endpoint. Use this when configuring a new endpoint
|
|
// or auditing an existing one.
|
|
var SubscribedEvents = []string{
|
|
EventCheckoutSessionCompleted,
|
|
EventSubscriptionCreated,
|
|
EventSubscriptionUpdated,
|
|
EventSubscriptionDeleted,
|
|
EventSubscriptionPaused,
|
|
EventSubscriptionResumed,
|
|
EventInvoicePaymentFailed,
|
|
EventChargeDisputeCreated,
|
|
}
|