tenseleyflow/shithub / 1073b56

Browse files

web/orgs/billing_webhook: drop stale Stripe events; touch last_event_at after apply

Authored by mfwolffe <wolffemf@dukes.jmu.edu>
SHA
1073b56093103f8f1e499d49d4738c3c0ee4562a
Parents
28e7461
Tree
5233709

1 changed file

StatusFile+-
M internal/web/handlers/orgs/billing_webhook.go 85 11
internal/web/handlers/orgs/billing_webhook.gomodified
@@ -140,8 +140,14 @@ func (h *Handlers) applyStripeCheckoutCompleted(ctx context.Context, event strip
140140
 		return err
141141
 	}
142142
 	h.recordWebhookSubject(ctx, event.ID, principal)
143
-	_, err = orgbilling.SetStripeCustomerForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, principal, customerID)
144
-	return err
143
+	if stale, err := h.checkStaleEvent(ctx, event, principal); err != nil || stale {
144
+		return err
145
+	}
146
+	if _, err := orgbilling.SetStripeCustomerForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, principal, customerID); err != nil {
147
+		return err
148
+	}
149
+	h.touchLastEventAt(ctx, event, principal)
150
+	return nil
145151
 }
146152
147153
 // resolvePrincipalFromCheckout walks the resolution chain for a
@@ -186,6 +192,9 @@ func (h *Handlers) applyStripeSubscriptionEvent(ctx context.Context, event strip
186192
 		return err
187193
 	}
188194
 	h.recordWebhookSubject(ctx, event.ID, principal)
195
+	if stale, err := h.checkStaleEvent(ctx, event, principal); err != nil || stale {
196
+		return err
197
+	}
189198
 	// PRO08 D3: if the principal already has a different Stripe
190199
 	// subscription on file, refuse to overwrite it. A second sub
191200
 	// for the same customer (e.g., an operator created one manually
@@ -218,12 +227,15 @@ func (h *Handlers) applyStripeSubscriptionEvent(ctx context.Context, event strip
218227
 		return err
219228
 	}
220229
 	if status == orgbilling.SubscriptionStatusCanceled || string(event.Type) == "customer.subscription.deleted" {
221
-		_, err := orgbilling.MarkCanceledForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, principal, event.ID)
222
-		return err
230
+		if _, err := orgbilling.MarkCanceledForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, principal, event.ID); err != nil {
231
+			return err
232
+		}
233
+		h.touchLastEventAt(ctx, event, principal)
234
+		return nil
223235
 	}
224236
 	itemID := stripeSubscriptionItemID(sub.Items)
225237
 	periodStart, periodEnd := stripeSubscriptionPeriod(sub.Items)
226
-	_, err = orgbilling.ApplySubscriptionSnapshotForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, orgbilling.PrincipalSubscriptionSnapshot{
238
+	if _, err := orgbilling.ApplySubscriptionSnapshotForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, orgbilling.PrincipalSubscriptionSnapshot{
227239
 		Principal:                principal,
228240
 		Status:                   status,
229241
 		StripeSubscriptionID:     strings.TrimSpace(sub.ID),
@@ -234,8 +246,11 @@ func (h *Handlers) applyStripeSubscriptionEvent(ctx context.Context, event strip
234246
 		TrialEnd:                 unixTime(sub.TrialEnd),
235247
 		CanceledAt:               unixTime(sub.CanceledAt),
236248
 		LastWebhookEventID:       event.ID,
237
-	})
238
-	return err
249
+	}); err != nil {
250
+		return err
251
+	}
252
+	h.touchLastEventAt(ctx, event, principal)
253
+	return nil
239254
 }
240255
241256
 // resolvePrincipalFromSubscription walks the same chain as the
@@ -375,6 +390,9 @@ func (h *Handlers) applyStripeInvoiceEvent(ctx context.Context, event stripeapi.
375390
 		return err
376391
 	}
377392
 	h.recordWebhookSubject(ctx, event.ID, principalState.Principal)
393
+	if stale, err := h.checkStaleEvent(ctx, event, principalState.Principal); err != nil || stale {
394
+		return err
395
+	}
378396
 	status, err := stripeInvoiceStatus(inv.Status)
379397
 	if err != nil {
380398
 		return err
@@ -402,14 +420,17 @@ func (h *Handlers) applyStripeInvoiceEvent(ctx context.Context, event stripeapi.
402420
 	switch string(event.Type) {
403421
 	case "invoice.payment_failed":
404422
 		graceUntil := time.Now().UTC().Add(h.d.BillingGracePeriod)
405
-		_, err := orgbilling.MarkPastDueForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, principalState.Principal, graceUntil, event.ID)
406
-		return err
423
+		if _, err := orgbilling.MarkPastDueForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, principalState.Principal, graceUntil, event.ID); err != nil {
424
+			return err
425
+		}
407426
 	case "invoice.payment_succeeded":
408427
 		if principalState.SubscriptionStatus != orgbilling.SubscriptionStatusCanceled {
409
-			_, err := orgbilling.MarkPaymentSucceededForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, principalState.Principal, event.ID)
410
-			return err
428
+			if _, err := orgbilling.MarkPaymentSucceededForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, principalState.Principal, event.ID); err != nil {
429
+				return err
430
+			}
411431
 		}
412432
 	}
433
+	h.touchLastEventAt(ctx, event, principalState.Principal)
413434
 	return nil
414435
 }
415436
@@ -564,6 +585,59 @@ func unixTime(ts int64) time.Time {
564585
 	return time.Unix(ts, 0).UTC()
565586
 }
566587
588
+// checkStaleEvent compares the incoming Stripe event's `created`
589
+// timestamp to the principal's persisted last_event_at. Returns
590
+// stale=true when the event is older than the last applied event,
591
+// in which case the caller should return nil (the parent webhook
592
+// handler logs MarkProcessed and Stripe stops retrying). Returns
593
+// err only when the staleness query itself errored.
594
+//
595
+// PRO08 D4. Stripe doesn't guarantee delivery order across retries;
596
+// without this guard a stale subscription.updated[active] arriving
597
+// after a fresh subscription.updated[canceled] would re-activate the
598
+// principal.
599
+func (h *Handlers) checkStaleEvent(ctx context.Context, event stripeapi.Event, p orgbilling.Principal) (bool, error) {
600
+	if err := p.Validate(); err != nil {
601
+		return false, nil
602
+	}
603
+	eventAt := unixTime(event.Created)
604
+	if eventAt.IsZero() {
605
+		// No timestamp on event — can't make a staleness judgment.
606
+		return false, nil
607
+	}
608
+	stale, err := orgbilling.IsBillingEventStaleForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, p, eventAt)
609
+	if err != nil {
610
+		h.d.Logger.WarnContext(ctx, "org billing: stale-event check failed",
611
+			"event_id", event.ID, "principal", p.String(), "error", err)
612
+		return false, nil
613
+	}
614
+	if stale {
615
+		h.d.Logger.InfoContext(ctx, "org billing: dropping stale Stripe event",
616
+			"event_id", event.ID,
617
+			"event_type", event.Type,
618
+			"event_created", eventAt,
619
+			"principal", p.String())
620
+	}
621
+	return stale, nil
622
+}
623
+
624
+// touchLastEventAt updates the principal's last_event_at after a
625
+// successful apply. Logs and continues on error — this is auxiliary
626
+// to the load-bearing state mutation.
627
+func (h *Handlers) touchLastEventAt(ctx context.Context, event stripeapi.Event, p orgbilling.Principal) {
628
+	if err := p.Validate(); err != nil {
629
+		return
630
+	}
631
+	eventAt := unixTime(event.Created)
632
+	if eventAt.IsZero() {
633
+		return
634
+	}
635
+	if err := orgbilling.TouchBillingLastEventAtForPrincipal(ctx, orgbilling.Deps{Pool: h.d.Pool}, p, eventAt); err != nil {
636
+		h.d.Logger.WarnContext(ctx, "org billing: touch last_event_at failed",
637
+			"event_id", event.ID, "principal", p.String(), "error", err)
638
+	}
639
+}
640
+
567641
 // recordWebhookSubject persists the resolved principal on the receipt
568642
 // row so failed events keep their audit trail. Logs and continues on
569643
 // error — the subject is auxiliary; the state-mutation path is the