Skip to content

fix: address review feedback on PR #259 — Stripe PaymentIntent + CI security fixes - #1

Open
laurentketterle-hub wants to merge 8 commits into
chfr19820610-cell:masterfrom
laurentketterle-hub:fix/259-changes-requested
Open

fix: address review feedback on PR #259 — Stripe PaymentIntent + CI security fixes#1
laurentketterle-hub wants to merge 8 commits into
chfr19820610-cell:masterfrom
laurentketterle-hub:fix/259-changes-requested

Conversation

@laurentketterle-hub

Copy link
Copy Markdown

@chfr19820610-cell Changes requested addressed:

  • fix(stripe): single mint, amount validation, real refund events with idempotent reversal, timestamp recency, atomic persistence
  • test: add dedup persistence + RecordStripeSettlement unit tests
  • test: add unit tests for Stripe webhook signature verification and status mapping
  • fix(ci): resolve govulncheck GO-2026-5970 (x/text v0.39.0) + npm audit high severity (nanoid, postcss)

CI is clean. Ready for re-review and merge.

chfr19820610-cell and others added 8 commits July 18, 2026 19:56
- Webhook handler with Stripe-Signature verification
- Payment intent event mapping (succeeded/failed/refunded)
- MRG credit minting + ledger proof on settlement
- Store persistence for Stripe payments
…atus mapping

- parseStripeSignatureHeader: valid, multi-sig, missing/invalid ts/sig
- verifyStripeWebhookSignature: correct/wrong sig, dev skip, prod require
- stripeWebhookPaymentFromEvent: succeeded/failed/refunded/unsupported
  edge cases: missing ID, wrong status, non-USD, zero amount, fallback
- Integration: missing header 401, bad sig 401, full settlement flow
- Deduplication: replay same event returns duplicate=true
- Failed/refunded webhooks update project PaymentStatus
- TestStripeWebhook_DedupPersistenceAcrossReload: end-to-end test proving
  dedup map survives save → close → reopen (JSON state persistence)
- TestRecordStripeSettlement_EmptyEventID
- TestRecordStripeSettlement_EmptyPaymentIntentID
- TestRecordStripeSettlement_UnknownStatus
- TestRecordStripeSettlement_FailedDedup
- TestRecordStripeSettlement_RefundedDedup

All existing tests continue to pass.
…fund events with idempotent reversal, timestamp recency, atomic persistence
@laurentketterle-hub

Copy link
Copy Markdown
Author

✅ This PR is ready to merge — CI is green, no changes requested. Please review and merge. On-chain settlement ready.

/claim 0x954dB727f224dAabe4F87E799843C2bB62dfd26C

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants