pal-e-docs

Validation: basketball-api #473 first-payment 409 fix

validation-basketball-api-473-2026-04-13 Doc

active validation
Project

Validation: basketball-api #473

Verdict

PASS — 2026-04-13 22:08 UTC

Ticket

  • Issue: forgejo_admin/basketball-api#473
  • PR: forgejo_admin/basketball-api#474 (merged as 0f5016a)
  • Supporting PR: forgejo_admin/basketball-api#476 (ruff fix, required to unblock push pipeline)
  • Deploy commit: 44aef6d (contains both #473 and #476)

Environment

  • Cluster/namespace: prod / basketball-api
  • Pod: basketball-api-5cc695df4b-wcvmh
  • Image: harbor.tail5b443a.ts.net/basketball-api/api:44aef6d564b843ab3f186061907b47f3f93c9edf
  • ArgoCD revision: f158456

Evidence

  1. Pipeline: Woodpecker #487 push to main. build-and-push: success. update-kustomize-tag: success. Test step failed on 2 pre-existing issues unrelated to this fix.
  2. Image tag propagated: kubectl get pods -n basketball-api — image tag matches 44aef6d, status Running, 0 restarts.
  3. ArgoCD: Synced and Healthy, revision f158456 (the kustomize tag update commit).
  4. Smoke test: GET /docs returns 200.
  5. Fix validation — Mateus (order 26): Pre-fix state: order 26 stale pending from 2026-04-11 19:32. After hit: order 26 status=canceled, new order 73 status=pending created 2026-04-13 22:07.
  6. Fix validation — Vince (order 27): Direct 307 redirect test. Response: 307 → https://checkout.stripe.com/c/pay/cs_live_a1ndg8GTdAB...
  7. Gmail send path: Test first-payment email sent to draneylucas@gmail.com, Gmail message ID 19d8927a07cd9e82.

Discovered Scope

  • GmailOAuthTokenExpired alert is firing but Gmail client works (file-based token valid). Alert metric is based on file age, not auth validity — false positive. To be addressed in pal-e-platform#290 observability ticket.
  • Forgejo squash-merge via API did not fire Woodpecker push webhook for PR #474 but did for PR #476. Root cause not identified. Merging #476 piggy-backed the #474 deploy.
  • Pre-existing test failures on main: test_send_first_payment_email (subject mismatch) and test_migration_file_exists (missing migration 041). Separate tickets.
  • Two sibling checkout functions share the same stale-pending vulnerability pattern (flagged in ticket scope review). Not yet exploited in prod but worth a ticket.

Next Steps

  • Lucas manual test of the payment link on phone
  • Do NOT re-blast the first-payment email until Lucas confirms the flow end-to-end on a real device
  • After confirmation, consider re-blast to stuck parents only (Mateus, Vince, Sarah, Jaxon, Jahzmyn)