Validation: Stripe Checkout + webhook
Verdict: PARTIAL
Ticket
Issue #11 — Stripe Checkout session creation + webhook handler for payment confirmation. Board item #797.
Environment
Code review of repo at
~/twitch-2k-wager/. Runtime blocked — STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET not configured in dev overlay.Checks
| # | Criterion | How Verified | Result | Evidence |
|---|---|---|---|---|
| 1 | stripe.ts exists with Checkout session creation | File read | PASS | 165 lines. createCheckoutSession() uses inline price_data (no pre-created Products). Three tiers: Bronze $15 (1500c), Silver $30 (3000c), Gold $45 (4500c). Metadata includes game_id, challenger_twitch_id, tier, wager_type, marcus_cut_pct. Success/cancel URLs point to /game/{id}. |
| 2 | POST /api/checkout endpoint exists | File read | PASS | src/routes/api/checkout/+server.ts — 78 lines. Validates tier, twitch_id, twitch_username, email. Upserts challenger, creates game record, creates Stripe session, creates payment record. Returns checkout_url, game_id, session_id. |
| 3 | POST /api/webhooks/stripe endpoint exists | File read | PASS | src/routes/api/webhooks/stripe/+server.ts — 209 lines. Handles checkout.session.completed (payment -> completed, game -> paid) and account.updated (Connect onboarding completion, triggers pending payout transfers). Signature verification via Stripe SDK. Idempotent handling. |
| 4 | Tier cards visible on landing page | Playwright DOM snapshot | PASS | Bronze/Silver/Gold cards with buy-in, match, and winner-takes amounts. Silver has "Most Popular" badge. |
| 5 | Input validation on checkout endpoint | Code review | PASS | Validates: required fields (tier, twitch_id, twitch_username, email), email format regex, tier in VALID_TIERS [15,30,45]. Returns 400 with descriptive error messages. |
| 6 | Webhook signature verification | Code review | PASS | verifyWebhookSignature() uses stripe.webhooks.constructEvent(). Rejects missing stripe-signature header (400). Logs verification failures. |
| 7 | Test files exist | Filesystem check | PASS | src/lib/__tests__/stripe.test.ts, src/routes/api/checkout/__tests__/checkout.test.ts, src/routes/api/webhooks/stripe/__tests__/webhook.test.ts all present. |
| 8 | Runtime checkout flow | N/A | BLOCKED | Cannot test — STRIPE_SECRET_KEY not configured. Stripe client throws at module load without key. |
Regression Check
Landing page tier cards render correctly. Stripe module failure is isolated — does not affect page load (lazy import only triggered by API calls).
Discovered Issues
No code bugs. Runtime validation requires STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET env vars. Tracked by existing issue #21.