Repository navigation
fix(billing): recover paid checkout without relying on browser return - #1
Merged
Merged
Conversation
inity13
marked this pull request as ready for review
October 20, 2026 08:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hosted billing previously provisioned keys only on the buyer success-page return, ignored paid completion webhooks and acknowledged transient handler failures. The released fix validates current paid Stripe session/customer/subscription/configured-price identity, provisions or recovers the matching entitlement and returns retryable failures. Existing mapped keys also recover after a legitimate configured-plan change.
Retry hardening uses stable-secret domain-separated HMAC keys, partial-write recovery and terminal revocation checks. Signatures have bounded timestamp drift and multiple-v1 support. KV remains eventually consistent; instantaneous global revocation, secret rotation and legacy duplicate-key migration are not claimed. Keep the existing STRIPE_WEBHOOK_SECRET stable. The success URL remains key recovery; no automatic email service or delivery guarantee was added.
Validation completed after initial draft: fresh complete Git clone, Node22/Python3.12 workflow replay, both source syntax checks, 47 Node tests, one pytest bridge and bundle build all passed. Exact reviewed-head hosted-billing CI succeeded. Independent synthetic fault/concurrency/identity and signed-route probes passed across the four repositories. No live order, charge, checkout or email was created.
Released 2026-10-20 using unchanged production configuration: deployment 49e475d0-7d46-4df9-ae60-785c1f886379, source 2717b92. Public/immutable static checks passed (14); homepage200, webhookGET405, missing-session400 and independent MCP initialize/tools/list checks passed. Public variable values/types, existing secret bindings/representations, KV namespace, compatibility and domains were preserved. No Stripe events, secrets, prices or financial settings changed. Existing destination events remain subscription.updated/deleted. Success recovery and lifecycle/signature hardening are live; checkout completion provisioning requires separately reviewed addition of completed/async success events.
Normally marked ready and merged without bypass as 7631e7f. Merged full tree bd47ed1650e6cc54379a40a80dba30c0514dd3e1 is identical to reviewed/deployed source. Initial source-only draft limitations were resolved by the completed fresh-clone replay, actual CI and authorized production release; operational limitations above remain.