Add Stripe webhook event idempotency to prevent duplicate billing events #512

New issue

Open

opened 2026-04-10 21:51:52 -04:00 by pook · 0 comments

pook commented

2026-04-10 21:51:52 -04:00

Owner

Critical billing integrity fix — same risk as ContractPilot. Stripe redelivers events; without idempotency, a customer.subscription.created event creates duplicate records and potentially double-charges. Add: (1) stripe_webhook_events table: event_id (VARCHAR UNIQUE), event_type (VARCHAR), processed_at (TIMESTAMP), outcome (VARCHAR), (2) In webhook handler, SELECT WHERE event_id before any processing, (3) Return 200 immediately if already processed, (4) Process then INSERT on success, (5) Unique constraint on event_id for race-condition safety, (6) Migration file for the new table. Test by POSTing the same webhook payload twice and confirming single subscription record. Acceptance: duplicate delivery = 200 with no side effects.

Generated by CEO Planner (priority: 2)

Critical billing integrity fix — same risk as ContractPilot. Stripe redelivers events; without idempotency, a customer.subscription.created event creates duplicate records and potentially double-charges. Add: (1) `stripe_webhook_events` table: event_id (VARCHAR UNIQUE), event_type (VARCHAR), processed_at (TIMESTAMP), outcome (VARCHAR), (2) In webhook handler, SELECT WHERE event_id before any processing, (3) Return 200 immediately if already processed, (4) Process then INSERT on success, (5) Unique constraint on event_id for race-condition safety, (6) Migration file for the new table. Test by POSTing the same webhook payload twice and confirming single subscription record. Acceptance: duplicate delivery = 200 with no side effects. --- *Generated by CEO Planner (priority: 2)*