Validation: Issue #368 — GET /checkout/first-payment endpoint
Ticket
Forgejo: basketball-api#368 — board item #874
Shipped:
GET /checkout/first-payment?token={contract_token} endpoint that looks up a signed Player, calculates the prorated fee, creates a Stripe Customer + Order + Checkout Session with setup_future_usage=off_session, and returns a 307 redirect to Stripe's hosted checkout.Environment
Prod cluster, basketball-api namespace, pod basketball-api-5c4b9bcc-vvfsx.
Checks
| # | Criterion | How to Verify | Result | Evidence |
|---|---|---|---|---|
| 1 | Valid signed token returns 307 redirect to Stripe | curl via requests from inside pod with Creed Draney's token | PASS | <code>status=307 location=https://checkout.stripe.com/c/pay/cs_live_a111EvXNootmgMVN8SvBR8ej8OaxDYcolQnwgG</code> |
| 2 | Second valid signed token returns 307 to different Stripe session | curl with Test Queens Player (id=187) token | PASS | <code>status=307 location=https://checkout.stripe.com/c/pay/cs_live_a1SCuabUOoDnwxsficFgIaA4ysBTyoCXyQggc7</code> |
| 3 | Proration formula correct: $200 → $165, $180 → $150, $160 → $135, $100 → $85 | Dry-run over all 32 signed players, compute prorated amount per player | PASS | All 32 amounts match formula <code>round(fee*25/30/5)*5</code> |
| 4 | Stripe Customer created with off_session setup | Inspect checkout session metadata + payment_intent_data in checkout.py source | PASS | Code at checkout.py sets <code>payment_intent_data={"setup_future_usage": "off_session"}</code> |
| 5 | Duplicate order prevention returns 409 | Checked code path in routes/checkout.py — existing pending/paid order triggers HTTPException 409 | PASS | Verified duplicate of Creed's order raised 409 during blast-readiness tests |
| 6 | Order row created with correct amount, product_id, stripe session id | Queried Order table after live test hits during token verification | PASS | 2 pending orders created (Creed id=23 + Test Queens id=24), $16500 cents each, stripe_checkout_session_id populated, cleaned up post-test |
Verdict
PASS — endpoint works end-to-end. Both token tests returned live Stripe checkout URLs with valid
cs_live_* session IDs. Card-save-for-recurring (setup_future_usage=off_session) verified in source.Discovered Issues
- Hitting the endpoint to verify token links creates pending Orders that can block real parents from paying. Cleanup required after token verification. Documented as a procedural note, not a code bug.