Repository navigation
feat(payments): integrate Stripe Checkout lifecycle - #12
Merged
Merged
Conversation
Pin async-stripe 0.41.0 with Checkout, webhook, and compatible Connect resources while retaining the stable pre-1.0 API. Load Stripe secrets and hosted Checkout settings from explicit APP_STRIPE environment variables, redact credentials from debug output, and disable payments cleanly when configuration is incomplete. Construct one reusable Stripe client in AppContext and cover optional and environment-backed configuration with serial tests.
Add payment attempt and webhook event tables with active-attempt uniqueness, provider state constraints, event deduplication, and supporting indexes. Model locked, idempotent payment transitions that confirm orders, reject terminal regressions, compensate failed Checkout creation, and restore reserved inventory exactly once on expiry. Cover conflicts, replay behavior, terminal transition boundaries, paid-versus-expired races, error metadata, and webhook deduplication with rstest and reviewed insta snapshots.
Add a customer-only checkout endpoint protected by the existing RBAC middleware and derive customer ownership from authenticated claims. Create Stripe-hosted Checkout Sessions from server-priced order snapshots, persist the session against an idempotent payment attempt, and compensate inventory after definitive failures. Cover monetary conversion and checkout authorization boundaries with rstest cases and reviewed Insta snapshots.
Expose a public raw-body webhook endpoint that authenticates Stripe signatures without relying on Silk sessions. Deduplicate deliveries transactionally, recover interrupted Checkout Session persistence, and reconcile mode, metadata, order identity, amount, and currency before applying payment transitions. Handle immediate and delayed success, delayed failure, expiry, and unknown events while proving replay safety and single inventory restoration through reviewed snapshots.
Remove paymentStatus from staff order update payloads and reject it as an unknown field at the service boundary. Keep payment state visible for operations while limiting the admin dialog to order, fulfillment, and internal-note updates. Add a request regression test proving even authorized staff cannot mark an order paid through the general update endpoint.
List the required Stripe environment variables, local test-mode defaults, and the live-mode safety switch. Document Stripe CLI webhook forwarding and the new checkout and webhook API routes without adding the private integration guide under docs/.
Move payment tests into a module directory so Cargo does not also compile the same source as a standalone integration-test crate. Preserve the existing rstest cases and reviewed Insta snapshots while allowing cargo test --all-features to discover the suite correctly.
This reverts commit e2ba8fa.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
Orders previously had no payment provider lifecycle. This change introduces Stripe-hosted checkout while keeping totals, inventory, authorization, and payment-state transitions under backend control. Durable attempt and webhook records make retries safe and provide recovery across duplicate delivery or interrupted processing.
Impact
Validation
cargo test --all-features(583 passed, 1 ignored)cargo clippy --all-features -- -D warnings -W clippy::pedantic -W clippy::nursery -W rust-2018-idiomspnpm run fmt:checkpnpm run lintpnpm exec tsc --noEmitpnpm run buildConfiguration
Stripe test credentials and the webhook signing secret must be supplied through environment variables. No credentials are committed in this branch.