Superminaren/hackerspace.sh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: fix ARCHITECTURE limitation #2 (Stripe IS integrated) + HANDOFF pass-53 (F4, 26 integration tests)

Browse Source
This commit is contained in:
Moheeb Zara
2026-05-19 13:26:46 -07:00
parent b56ef4e47c
commit ee7f59f1f4
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HANDOFF.md
+4 -1
View File
@@ -21,7 +21,10 @@ The concrete prod risk flagged in the pass-52 assessment — signup/cancel possi
### State
- **PUSHED** (run 26122719148, success, no-op runtime — prod / = 200). Harness is on origin for CI/contributors. Audited the harness itself: verified it self-skips all 21 / exits 0 with no DB (never blocks CI) and the default `pnpm test` (532/26) does not pick up `integration/`.
- **F3 extension (commit 42f6509):** `integration/billing-idempotency.test.ts` — stripe_webhook_events PK replay protection, member_billing UNIQUE onConflict upsert, notifications UNIQUE + ON CONFLICT DO NOTHING. **21 integration tests** total, all green on real Postgres. Non-runtime; held local (rides next deploy) or push as desired.
- Backlog now: deferred SECURITY DEFINER status-gate (own session, rationale in pass-52); owner product question (forms attribution); ARCHITECTURE limitation #2 doc drift ("Stripe not integrated" — stale). Natural next: webhook *route*-level integration (signed event → handler), more server-action paths; or owner provisioning + end-to-end spine validation.
- **F4 (commit b56ef4e):** `integration/stripe-webhook.test.ts` — the Stripe webhook ROUTE HANDLER end-to-end (real sig verify good/bad/missing, vault secret+config resolution, stripe_webhook_events replay idempotency, applySubscription→billing/status, D5 out-of-order guard proven e2e). Invokes the actual POST against local Supabase with Stripe-signed `customer.subscription.updated` events (no network, no payments enum). **26 integration tests** total, 5 files, all green. The harness now covers every risky thing shipped this session: 045 RPCs+concurrency, 042 constraint, 043/044 RLS+trigger, billing/notification idempotency, AND the webhook wiring where the Phase-3 P0s + D5 lived.
- Doc drift fixed: ARCHITECTURE limitation #2 now reflects Stripe is integrated.
- Finding (for future invoice.paid webhook test): the LOCAL DB's `payment_platform` enum lacks 'stripe' — schema.sql's wrapped `CREATE TYPE` skips on an existing type; only migration 040's `ALTER TYPE ADD VALUE` adds it. The harness setup would need to apply 040 before testing the `invoice.paid` (payments-insert) path. Avoided here by using `subscription.updated`.
- Backlog now: deferred SECURITY DEFINER status-gate (own session, rationale in pass-52); owner product question (forms attribution). Natural next: more server-action path coverage in the harness; or owner provisioning + end-to-end spine validation (the shipped≠proven gap).
---