Fix Stripe webhook mode handling for live mode installations receiving test events #2999

devkiran · 2025-10-23T16:58:17Z

Summary by CodeRabbit

Bug Fixes
- Webhook now ignores Stripe test-mode events on live endpoints to prevent accidental processing.
Bug Fixes
- Country field in the profile form no longer uses an explicit error flag; it now relies on default validation/display behavior.

vercel · 2025-10-23T16:58:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
dub	Ready	Preview	Oct 23, 2025 5:29pm

coderabbitai · 2025-10-23T16:58:46Z

Walkthrough

Adds a safeguard to the Stripe webhook route: after validating/wrapping the incoming event, if the app is running the live route but the Stripe event is in test mode, the route now logs and returns early (skipping event-type handling). Also removes an explicit error prop from a country combobox in a profile form.

Changes

Cohort / File(s)	Summary
Stripe webhook guard `apps/web/app/(ee)/api/stripe/integration/webhook/route.ts`	After event wrapping/validation and before switching on event type, detect when the route is live but the incoming event has `livemode: false`; log and return early to avoid processing test events on the live endpoint.
Profile form UI tweak `apps/web/app/(ee)/partners.dub.co/(dashboard)/profile/profile-details-form.tsx`	Removed the explicit `error={errors.country ? true : false}` prop from `CountryCombobox`, relying on default behavior instead.

Sequence Diagram

sequenceDiagram
    participant Stripe
    participant WebhookRoute as Webhook Route
    participant Handler

    Stripe->>WebhookRoute: POST webhook event
    WebhookRoute->>WebhookRoute: Validate & wrap event
    rect rgb(255, 245, 230)
    Note over WebhookRoute: NEW: Pre-switch safeguard
    WebhookRoute->>WebhookRoute: If route.mode == live && event.livemode == false\nlog warning + return 200 (skip processing)
    end
    alt not returned
        WebhookRoute->>WebhookRoute: Switch on event.type
        WebhookRoute->>Handler: Dispatch to handler
        Handler->>WebhookRoute: Processing result
        WebhookRoute->>Stripe: Respond 200 OK
    end

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

Stripe integration test webhook #2597: Edits the same Stripe webhook route to distinguish test vs live events and prevent processing test-mode webhooks on the live endpoint.

Poem

🐰 I hopped to the webhook, ears alert and bright,
Found a test-mode event on the live-route night.
I logged a small note, then gently withdrew,
Letting handlers sleep till the modes were true.
Hooray — tidy hops and quiet logs tonight! ✨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run `@coderabbitai generate docstrings` to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The pull request title "Fix Stripe webhook mode handling for live mode installations receiving test events" directly and accurately describes the primary change in the changeset—the addition of a pre-switch safeguard in the Stripe webhook route that prevents test events from being processed on the live endpoint. The title is concise, specific, and clearly communicates the intent of the main modification. While the PR also includes a secondary UI change in the profile-details-form.tsx file, this does not diminish the title's relevance since it accurately captures the primary and most significant change, and per the guidance, titles are not expected to cover every detail of a changeset.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix-stripe-webhook

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 12df806 and 3f4800e.

📒 Files selected for processing (2)

apps/web/app/(ee)/api/stripe/integration/webhook/route.ts (1 hunks)
apps/web/app/(ee)/partners.dub.co/(dashboard)/profile/profile-details-form.tsx (0 hunks)

💤 Files with no reviewable changes (1)

apps/web/app/(ee)/partners.dub.co/(dashboard)/profile/profile-details-form.tsx

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: build

🔇 Additional comments (1)

apps/web/app/(ee)/api/stripe/integration/webhook/route.ts (1)

70-78: No additional safeguards needed; code correctly implements Stripe's asymmetric event behavior.

The safeguard at lines 70-78 is correctly implemented as the only check required. Per Stripe's documented behavior (referenced in the comment): test events are sent to both test and live endpoints, but live events are only sent to the live endpoint. Therefore:

Test endpoint does not need to filter live events (Stripe never sends them there)

Sandbox endpoint does not need to filter live events (Stripe never sends them there)

Only the live endpoint needs protection from test events (which is already implemented)

The code is correct as-is. The original review comment's questions about reverse scenarios were based on a misunderstanding of Stripe's asymmetric event routing behavior.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 0

🧹 Nitpick comments (1)

apps/web/app/(ee)/api/stripe/integration/webhook/route.ts (1)
70-76: Logic correctly addresses live mode installations receiving test events.

The implementation properly handles the documented Stripe App behavior where live mode installations receive both live and test events. The placement after webhook validation and before event processing is correct.

Consider two enhancements for robustness:

Add logging when mode is switched to aid debugging:
  if (mode === "live" && !event.livemode) {
+   console.log(`[Stripe Webhook] Switching mode from live to test for event ${event.id}`);
    mode = "test";
  }
Verify whether other mode mismatches should be handled: Should test mode also check for event.livemode === true and switch to live? Similarly, should sandbox mode validate against event.livemode? If these scenarios are invalid or won't occur in practice, the current one-directional check is sufficient.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 90a08db and 12df806.

📒 Files selected for processing (1)

apps/web/app/(ee)/api/stripe/integration/webhook/route.ts (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: build

Update route.ts

12df806

coderabbitai bot reviewed Oct 23, 2025

View reviewed changes

vercel bot had a problem deploying to Preview October 23, 2025 17:10 Failure

update implementation

3f4800e

steven-tey approved these changes Oct 23, 2025

View reviewed changes

vercel bot deployed to Preview October 23, 2025 17:29 View deployment

steven-tey merged commit f553bc7 into main Oct 23, 2025
7 of 8 checks passed

steven-tey deleted the fix-stripe-webhook branch October 23, 2025 19:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix Stripe webhook mode handling for live mode installations receiving test events #2999

Fix Stripe webhook mode handling for live mode installations receiving test events #2999

Uh oh!

devkiran commented Oct 23, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

vercel bot commented Oct 23, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Oct 23, 2025 •

edited

Loading

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Fix Stripe webhook mode handling for live mode installations receiving test events #2999

Fix Stripe webhook mode handling for live mode installations receiving test events #2999

Uh oh!

Conversation

devkiran commented Oct 23, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

vercel bot commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram

Estimated code review effort

Possibly related PRs

Poem

Pre-merge checks and finishing touches

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

devkiran commented Oct 23, 2025 •

edited by coderabbitai bot

Loading

vercel bot commented Oct 23, 2025 •

edited

Loading

coderabbitai bot commented Oct 23, 2025 •

edited

Loading