Stripe integration test webhook #2597

steven-tey · 2025-07-01T20:15:03Z

Summary by CodeRabbit

New Features
- Introduced a dedicated endpoint for handling Stripe test webhooks, improving support for test and live Stripe events.
Refactor
- Updated the logic for selecting between test and production Stripe webhook secrets, now based on the request URL rather than request body content.

vercel · 2025-07-01T20:15:07Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated (UTC)
dub	✅ Ready (Inspect)	Visit Preview	Jul 1, 2025 8:24pm

coderabbitai · 2025-07-01T20:15:09Z

Walkthrough

The webhook handler for Stripe integration was updated to determine test or live mode based on the request URL rather than the request body. Additionally, a new dedicated route for handling Stripe test webhooks was introduced, which re-exports the main webhook handler and ensures correct routing for test events.

Changes

File(s)	Change Summary
apps/web/app/(ee)/api/stripe/integration/webhook/route.ts	Changed logic to determine test/live mode using URL pathname instead of request body; updated secret selection accordingly.
apps/web/app/(ee)/api/stripe/integration/webhook/test/route.ts	Added new route for Stripe test webhooks; re-exports the main webhook handler; includes explanatory comment.

Sequence Diagram(s)

sequenceDiagram
    participant Stripe
    participant WebhookRouter
    participant WebhookHandler

    Stripe->>WebhookRouter: POST /api/stripe/integration/webhook or /webhook/test
    WebhookRouter->>WebhookHandler: Determine testmode from URL
    WebhookHandler->>WebhookHandler: Select secret (test or live)
    WebhookHandler->>WebhookHandler: Read and process request body
    WebhookHandler-->>Stripe: Respond to webhook

Poem

In the warren where webhooks hop and play,
A new path for tests now leads the way.
No more peeking in the JSON nest—
The URL tells us if it’s a test!
With secrets sorted, events handled right,
Stripe bunnies sleep soundly through the night.
🐇✨

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 073056c and 35432a2.

📒 Files selected for processing (2)

apps/web/app/(ee)/api/stripe/integration/webhook/route.ts (1 hunks)
apps/web/app/(ee)/api/stripe/integration/webhook/test/route.ts (1 hunks)

🧰 Additional context used

🧠 Learnings (3)

📓 Common learnings

Learnt from: steven-tey
PR: dubinc/dub#0
File: :0-0
Timestamp: 2025-06-19T01:46:45.723Z
Learning: PayPal webhook verification in the Dub codebase is handled at the route level in `apps/web/app/(ee)/api/paypal/webhook/route.ts` using the `verifySignature` function. Individual webhook handlers like `payoutsItemFailed` don't need to re-verify signatures since they're only called after successful verification.

apps/web/app/(ee)/api/stripe/integration/webhook/test/route.ts (1)

Learnt from: steven-tey
PR: dubinc/dub#0
File: :0-0
Timestamp: 2025-06-19T01:46:45.723Z
Learning: PayPal webhook verification in the Dub codebase is handled at the route level in `apps/web/app/(ee)/api/paypal/webhook/route.ts` using the `verifySignature` function. Individual webhook handlers like `payoutsItemFailed` don't need to re-verify signatures since they're only called after successful verification.

apps/web/app/(ee)/api/stripe/integration/webhook/route.ts (1)

Learnt from: steven-tey
PR: dubinc/dub#0
File: :0-0
Timestamp: 2025-06-19T01:46:45.723Z
Learning: PayPal webhook verification in the Dub codebase is handled at the route level in `apps/web/app/(ee)/api/paypal/webhook/route.ts` using the `verifySignature` function. Individual webhook handlers like `payoutsItemFailed` don't need to re-verify signatures since they're only called after successful verification.

⏰ Context from checks skipped due to timeout of 90000ms (1)

GitHub Check: build

🔇 Additional comments (5)

apps/web/app/(ee)/api/stripe/integration/webhook/route.ts (3)

22-23: LGTM! Cleaner approach to mode detection.

Using URL path to determine test mode is more reliable and efficient than parsing the request body. This approach aligns well with the dedicated test route structure.

25-25: Good optimization - single request body read.

Moving the request body read after mode determination is more efficient, as you now only read the body once instead of potentially parsing it twice (once for mode detection, once for webhook processing).

28-30: ✔️ Confirm Stripe Webhook Secrets Configuration

The conditional selection of STRIPE_APP_WEBHOOK_SECRET_TEST and STRIPE_APP_WEBHOOK_SECRET in apps/web/app/(ee)/api/stripe/integration/webhook/route.ts is correct and both variables are referenced as expected.

Ensure in your deployment environment (CI/CD secrets, .env, Kubernetes secrets, etc.) that:

STRIPE_APP_WEBHOOK_SECRET_TEST is set for test mode

STRIPE_APP_WEBHOOK_SECRET is set for production mode

apps/web/app/(ee)/api/stripe/integration/webhook/test/route.ts (2)

1-9: Excellent documentation and architectural decision.

The comment clearly explains why a separate test route is needed, referencing Stripe's specific behavior. This will help future maintainers understand the design decision.

11-11: Clean implementation - re-export ensures consistency.

Re-exporting the POST handler from the main route is the right approach. It ensures consistent webhook processing logic while providing the separate endpoint that Stripe requires for test webhooks.

✨ Finishing Touches

📝 Generate Docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

steven-tey · 2025-07-01T20:54:42Z

@CodeRabbit final review

coderabbitai · 2025-07-01T20:55:22Z

Tip

For best results, initiate chat on the files or code changes.

@steven-tey Here's my comprehensive final review of this PR:

✅ APPROVED - Excellent Implementation

This PR successfully implements a clean and robust solution for handling Stripe test webhooks. Here's my assessment:

🏗️ Architectural Excellence

Smart mode detection: Using URL pathname (/test) instead of parsing request body is more efficient and reliable
Proper separation of concerns: Dedicated test endpoint addresses Stripe's specific behavior while maintaining shared logic
Code reuse: Re-exporting the main handler ensures consistency without duplication

🔒 Security & Reliability

Correct webhook secret selection based on test/live mode
Single request body read prevents potential parsing issues
Maintains existing webhook verification patterns

📖 Documentation & Maintainability

Excellent inline documentation explaining Stripe's webhook routing behavior
Clear rationale for architectural decisions
Code is self-documenting and future-maintainer friendly

🎯 Implementation Quality

Clean, concise code with no apparent edge cases
Follows established patterns in the codebase
Ready for production deployment

Key Strengths:

Performance: Single body read vs. double parsing
Reliability: URL-based detection is more deterministic
Compliance: Properly handles Stripe's test/live webhook requirements
Maintainability: Well-documented design decisions

No issues found. This is production-ready code that improves upon the previous implementation. 🚀

🐰✨ Happy to see such thoughtful webhook architecture - this implementation handles Stripe's quirks elegantly!

🧠 Learnings used

Learnt from: steven-tey
PR: dubinc/dub#0
File: :0-0
Timestamp: 2025-06-19T01:46:45.723Z
Learning: PayPal webhook verification in the Dub codebase is handled at the route level in `apps/web/app/(ee)/api/paypal/webhook/route.ts` using the `verifySignature` function. Individual webhook handlers like `payoutsItemFailed` don't need to re-verify signatures since they're only called after successful verification.

Stripe integration test webhook

35432a2

vercel bot deployed to Preview July 1, 2025 20:24 View deployment

steven-tey merged commit 6af6b2e into main Jul 1, 2025
9 checks passed

steven-tey deleted the stripe-test-webhook branch July 1, 2025 20:58

coderabbitai bot mentioned this pull request Aug 18, 2025

Discount code attribution tracking #2620

Merged

coderabbitai bot mentioned this pull request Oct 8, 2025

Support Stripe sandbox for app testing #2784

Merged

coderabbitai bot mentioned this pull request Oct 23, 2025

Fix Stripe webhook mode handling for live mode installations receiving test events #2999

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Stripe integration test webhook #2597

Stripe integration test webhook #2597

Uh oh!

steven-tey commented Jul 1, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

vercel bot commented Jul 1, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Jul 1, 2025 •

edited

Loading

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

Uh oh!

steven-tey commented Jul 1, 2025

Uh oh!

coderabbitai bot commented Jul 1, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Stripe integration test webhook #2597

Stripe integration test webhook #2597

Uh oh!

Conversation

steven-tey commented Jul 1, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

vercel bot commented Jul 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Jul 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Poem

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

steven-tey commented Jul 1, 2025

Uh oh!

coderabbitai bot commented Jul 1, 2025

✅ APPROVED - Excellent Implementation

🏗️ Architectural Excellence

🔒 Security & Reliability

📖 Documentation & Maintainability

🎯 Implementation Quality

Key Strengths:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

steven-tey commented Jul 1, 2025 •

edited by coderabbitai bot

Loading

vercel bot commented Jul 1, 2025 •

edited

Loading

coderabbitai bot commented Jul 1, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)