fix(data-warehouse): validate nested Stripe resources via parent endpoint

[danielcarletti]

Problem

Follow-up to #56795. Customers report seeing the toast

Stripe credentials lack permissions for CustomerPaymentMethod
Stripe credentials lack permissions for CustomerBalanceTransaction

every time they toggle the sync method on one of those tables, even when their restricted key has the correct scopes. The actual sync also doesn't kick off — the validation error fires before the worker is dispatched.

validate_credentials filters its resources_to_check list by the table name and falls through to a " does not exist" branch when nothing matches. The two Customer* tables are nested under /v1/customers/:id and were never added to that list (they can't be listed without a parent customer ID), so the filter always produces an empty list and the fake permission error fires every single time.

Changes

posthog/temporal/data_imports/sources/stripe/stripe.py

• Add a NESTED_RESOURCE_PROXIES map (CustomerBalanceTransaction → Customer, CustomerPaymentMethod → Customer) and resolve the table name through it before filtering. Validation now hits the parent's list endpoint, which covers the customer scope they all share.
• The nested resources may still need additional scopes at actual sync time (e.g. rak_payment_method_read for /v1/customers/:id/payment_methods); those will surface with a real 403 from the sync run rather than a misleading toast at setup.

How did you test this code?

I'm an agent. I ran the following automated tests:

New tests:

• test_validate_credentials_nested_resource_validates_via_parent — parametrized over both CustomerBalanceTransaction and CustomerPaymentMethod. Asserts that validation hits customers.list and returns True instead of raising.
• test_validate_credentials_nested_resource_surfaces_parent_permission_error — parametrized similarly. Asserts that a 403 on the parent Customer endpoint is reported as a Customer permission gap rather than the nested table name, so the customer sees the actual scope they need to grant.

Regression coverage:

• posthog/temporal/tests/data_imports/stripe/test_stripe_source.py — full file: 19 passed.

Manual tests:

• It works now for both schemas:

Publish to changelog?

no

🤖 Agent context

Authored by Claude (Opus 4.7) via Claude Code. Direct follow-up to #56795 surfaced by user feedback after that PR landed. Human review required before merge.

[greptile-apps]

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
posthog/temporal/data_imports/sources/stripe/stripe.py:367-370
**Module-level constant**

`NESTED_RESOURCE_PROXIES` is a static dict with no dependency on the function arguments or the `client` object, so it is reconstructed on every call to `validate_credentials`. Moving it to module scope is the conventional Python approach and keeps the function body focused on logic.

```suggestion
NESTED_RESOURCE_PROXIES: dict[str, str] = {
    CUSTOMER_BALANCE_TRANSACTION_RESOURCE_NAME: CUSTOMER_RESOURCE_NAME,
    CUSTOMER_PAYMENT_METHOD_RESOURCE_NAME: CUSTOMER_RESOURCE_NAME,
}
```

_{Reviews (1): Last reviewed commit: "fix(data-warehouse): validate nested Str..." | Re-trigger Greptile}

[estefaniarabadan]

question: if we get an error, this is gonna fall back to the nested resource instead of the parent. wouldn't this produce the error we are trying to avoid:
Stripe credentials lack permissions for CustomerPaymentMethod
?

[danielcarletti]

This is a good idea. I've updated the error message to include the parent as well, which is the actionable path (the permission that users can actually grant). Now it looks like this: Stripe credentials lack permissions for CustomerPaymentMethod (Customer).

Tried to keep it concise, do you think it is clear enough for the user to figure it out?

[estefaniarabadan]

I have the feeling this is not gonna work, the build_resources method does client.customer.list, and if you execute this locally:

import stripe
c = stripe.StripeClient('sk_test_fake')
a = c.customers.list
b = c.customers.list
id(a) == id(b)
False
a is b
False

you'll see that since you create a new object (same as you are doing for each nested resource) is not gonna match, so the parent_name = flat_method_to_name[id(entry.parent.method)] is gonna keyerror at runtime.

ask claude why tests are passing and:
Tests pass because MagicMock caches child attribute access (mock.customers.list always returns the same object), masking the issue.

[danielcarletti]

Ok, fixed and retested. This lookup is simpler now and it works. Tested locally, I see actionable messages and if the permissions are correct, then the sync actually runs.

[danielcarletti]

Example:

[estefaniarabadan]

nit pick: we could add the rest of the stuf, like json_body and the rest of stuff

[danielcarletti]

This exception shows up in the toast notification, I'd rather keep it small. It shows the clear error anyway, so I believe this is good

[estefaniarabadan]

nit pick: repo's CLAUDE.md says "default to writing no comments" and "explain why, not what.", there are a bunch of descriptive comments around

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-05-06 13:36 UTC	Run
prod-us	✅ Deployed	2026-05-06 14:02 UTC	Run
prod-eu	✅ Deployed	2026-05-06 14:01 UTC	Run