Add Stripe Webhooks
subject · add-stripe-webhooks · commit 7d3a91
- ✓Webhook endpoint verifies
Stripe-Signaturebefore any handler runs. - ✓Duplicate event delivery does not create duplicate records.
- ✓Failed signature check returns
400, not500. - ✓Webhook secret is read from environment, not hardcoded.
- ✓Migration adds
idempotency_keywith a unique constraint. - ✓Existing checkout and billing portal flows pass without modification.
+ 15 more sealed
- Risk · scopeSignature verification uses direct string comparison — timing-safe equality is not enforced.
- Debt · scopeNo retry mechanism for failed event processing — transient database errors will drop events silently.
- Obs. · monitorHandler is 340 lines with a switch that will grow with every new event type.