Repository navigation
Agent: Harden payment endpoint authorization and state transitions - #30
Merged
Merged
Conversation
…or#27) Enforce a single payment access policy on all checkout endpoints (initiate/confirm/return/cancel): an authenticated submitter may act only on their own submission, and an anonymous public-form submitter needs a short-lived, unguessable, session-bound checkout credential issued when the form post enters pending_payment. Guessed numeric IDs now get a non-disclosing 404. - Initiation is idempotent per attempt: repeated GETs reuse the single open PaymentRecord and its stable idempotency key (forwarded to Stripe's PaymentIntent.create) under a row lock, so retries cannot create uncontrolled attempts or duplicate charges. A legitimate retry after cancel/failure starts a fresh key. - Confirm/return are restricted to the originating open attempt and valid lifecycle states; provider results are verified and applied without ever rolling a locked (completed/refunded) record backward. - Cancellation is a CSRF-protected POST-only action scoped to pending_payment submissions; it cancels only open attempts and can never revert a completed/submitted/approved submission to draft. Templates now use POST forms for the cancel action. - Stripe webhooks fail closed: events are rejected (HTTP 400) when STRIPE_WEBHOOK_SECRET is unset or the signature is invalid. The provider interface requires the same authenticated-event guarantee from all providers via the new WebhookVerificationError. Replayed or out-of-order events create no duplicate workflow tasks. - Regression tests cover anonymous/stranger/owner/anonymous-checkout access, guessed IDs, GET vs POST, repeated requests, missing/invalid webhook signatures, replay protection, and cancellation after completion. Docs updated for the required webhook secret and the new checkout/idempotency behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #27
Agent-generated change from a maintainer-labeled issue. Review the diff and CI results before merging. Close the issue only when its acceptance criteria are complete.
DigitalOcean session:
django-forms-public-issue-27-39052230442.