Skip to content

fix: prevent payment intent creation for unauthenticated user - #3462

Merged
stalniy merged 1 commit into
mainfrom
fix/payment-setup-intent-auth
Jul 20, 2026
Merged

fix: prevent payment intent creation for unauthenticated user#3462
stalniy merged 1 commit into
mainfrom
fix/payment-setup-intent-auth

Conversation

@stalniy

@stalniy stalniy commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

Why

Closes CON-697

What

Summary by CodeRabbit

  • Bug Fixes
    • Payment setup intents are now created only after authentication is confirmed, preventing premature payment setup attempts.
    • Stripe payment and billing requests now use consistent authenticated request handling, improving reliability across payment methods, discounts, transactions, and payment confirmation.
  • Tests
    • Added coverage to verify that unauthenticated visitors do not trigger payment setup requests.

@coderabbitai

coderabbitai Bot commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d9959c4f-db9f-40b5-9735-4ebc08532712

📥 Commits

Reviewing files that changed from the base of the PR and between 857104c and 7785af0.

📒 Files selected for processing (4)
  • apps/deploy-web/src/components/onboarding/steps/PaymentMethodContainer/PaymentMethodContainer.spec.tsx
  • apps/deploy-web/src/components/onboarding/steps/PaymentMethodContainer/PaymentMethodContainer.tsx
  • apps/deploy-web/src/services/app-di-container/app-di-container.ts
  • packages/http-sdk/src/stripe/stripe.service.ts

📝 Walkthrough

Walkthrough

Changes

Stripe payment flow

Layer / File(s) Summary
Stripe HTTP client composition
packages/http-sdk/src/stripe/stripe.service.ts, apps/deploy-web/src/services/app-di-container/app-di-container.ts
StripeService now uses an injected HttpClient; the application container creates and intercepts the client before constructing the Stripe service, and payment methods use shared response extraction.
Authenticated setup-intent creation
apps/deploy-web/src/components/onboarding/steps/PaymentMethodContainer/PaymentMethodContainer.tsx, apps/deploy-web/src/components/onboarding/steps/PaymentMethodContainer/PaymentMethodContainer.spec.tsx
Setup-intent creation now requires an authenticated user, with a test covering unauthenticated rendering.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

Suggested reviewers: baktun14

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/payment-setup-intent-auth

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.


Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Jul 19, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.21%. Comparing base (857104c) to head (7785af0).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #3462      +/-   ##
==========================================
- Coverage   73.05%   72.21%   -0.85%     
==========================================
  Files        1175     1111      -64     
  Lines       29797    27868    -1929     
  Branches     7404     7001     -403     
==========================================
- Hits        21769    20124    -1645     
+ Misses       7062     6807     -255     
+ Partials      966      937      -29     
Flag Coverage Δ *Carryforward flag
api 85.93% <ø> (ø)
deploy-web 62.36% <100.00%> (ø)
log-collector ?
notifications 91.44% <ø> (ø)
provider-console 81.38% <ø> (ø) Carriedforward from 857104c
provider-inventory ?
provider-proxy 86.42% <ø> (ø) Carriedforward from 857104c
tx-signer 86.66% <ø> (ø)

*This pull request uses carry forward flags. Click here to find out more.

Files with missing lines Coverage Δ
.../PaymentMethodContainer/PaymentMethodContainer.tsx 73.21% <100.00%> (ø)
.../src/services/app-di-container/app-di-container.ts 55.84% <100.00%> (ø)

... and 64 files with indirect coverage changes

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@stalniy
stalniy added this pull request to the merge queue Jul 20, 2026
Merged via the queue into main with commit fe585f6 Jul 20, 2026
59 checks passed
@stalniy
stalniy deleted the fix/payment-setup-intent-auth branch July 20, 2026 07:48
baktun14 added a commit that referenced this pull request Jul 21, 2026
#3462 refactored StripeService from extractApiData (which unwrapped both
the axios data and the API data envelope) to extractData (one level) and
added a compensating .data to every method except getCustomerTransactions,
which was left returning the still-wrapped { data: { transactions } }. The
billing history table reads transactions one level too high, so it renders
"No billing history found" even when the endpoint returns rows.

Restore the .data unwrap and add a regression test that fails on the
wrapped shape.
baktun14 added a commit that referenced this pull request Jul 21, 2026
#3462 refactored StripeService from extractApiData (which unwrapped both
the axios data and the API data envelope) to extractData (one level) and
added a compensating .data to every method except getCustomerTransactions,
which was left returning the still-wrapped { data: { transactions } }. The
billing history table reads transactions one level too high, so it renders
"No billing history found" even when the endpoint returns rows.

Restore the .data unwrap and add a regression test that fails on the
wrapped shape.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants