Give the webhook a fake Stripe in the full-stack gate

The webhook now reads subscription state from Stripe, so it honours
STRIPE_API_URL like the account function, and the fake serves
GET /v1/subscriptions/:id from state the test sets. The billing journey
also checks that a late active update cannot revive a canceled plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Programcode

e2e/full-stack/billing.spec.ts

@@ -38,25 +38,27 @@ function sendWebhook(event: object, signature = true) {
   });
 }
 
-function subscriptionEvent(type: string, subscriptionId: string, status: string) {
+function subscriptionObject(subscriptionId: string, status: string) {
   const now = Math.floor(Date.now() / 1000);
+  return {
+    id: subscriptionId,
+    object: "subscription",
+    status,
+    cancel_at_period_end: false,
+    current_period_start: now,
+    current_period_end: now + 30 * 86_400,
+    cancel_at: null,
+    canceled_at: null,
+    ended_at: null,
+  };
+}
+
+function subscriptionEvent(type: string, subscriptionId: string, status: string) {
   return {
     id: `evt_${randomUUID()}`,
     object: "event",
     type,
-    data: {
-      object: {
-        id: subscriptionId,
-        object: "subscription",
-        status,
-        cancel_at_period_end: false,
-        current_period_start: now,
-        current_period_end: now + 30 * 86_400,
-        cancel_at: null,
-        canceled_at: null,
-        ended_at: null,
-      },
-    },
+    data: { object: subscriptionObject(subscriptionId, status) },
   };
 }
 
@@ -114,6 +116,8 @@ test("signed Stripe webhooks grant and revoke Pro, and forged ones change nothin
   expect(forged.status).toBe(400);
   expect(await tier(userId)).toBe("expired");
 
+  // The webhook applies Stripe's current state, which the fake Stripe holds.
+  await fake.stripeSubscription(subscriptionObject(subscriptionId, "active"));
   const accepted = await sendWebhook(activated);
   expect(accepted.status).toBe(200);
   expect(await tier(userId)).toBe("pro");
@@ -124,9 +128,14 @@ test("signed Stripe webhooks grant and revoke Pro, and forged ones change nothin
   await expect(page.getByText("Pro", { exact: true })).toBeVisible();
   await expect(page.getByRole("button", { name: "Manage Subscription" })).toBeVisible();
 
+  await fake.stripeSubscription(subscriptionObject(subscriptionId, "canceled"));
   const canceled = await sendWebhook(subscriptionEvent("customer.subscription.deleted", subscriptionId, "canceled"));
   expect(canceled.status).toBe(200);
   expect(await tier(userId)).toBe("expired");
+  // An older "active" update that Stripe delivers late must not revive the plan.
+  const stale = await sendWebhook(subscriptionEvent("customer.subscription.updated", subscriptionId, "active"));
+  expect(stale.status).toBe(200);
+  expect(await tier(userId)).toBe("expired");
   const { data: row } = await admin.from("subscriptions").select("status").eq("stripe_subscription_id", subscriptionId).single();
   expect(row?.status).toBe("canceled");
 

e2e/full-stack/fake-openrouter.mjs

@@ -17,6 +17,8 @@ const chatModel = (requested) => (liveModel === "as-requested" ? requested : liv
 const maxUpstreamCalls = Number(process.env.MAX_UPSTREAM_CALLS ?? 200);
 if (upstream && !liveModel) throw new Error("LIVE_MODEL is required with UPSTREAM");
 const requests = [];
+// Subscription state the fake Stripe returns, set by tests through /__subscription.
+const subscriptions = new Map();
 let failures = [];
 let upstreamCalls = 0;
 
@@ -275,6 +277,11 @@ createServer(async (req, res) => {
     failures = [];
     return json(res, 200, { ok: true });
   }
+  if (url.pathname === "/__subscription" && req.method === "POST") {
+    const subscription = JSON.parse(await readBody(req) || "{}");
+    subscriptions.set(subscription.id, subscription);
+    return json(res, 200, { ok: true });
+  }
   if (url.pathname === "/__fail" && req.method === "POST") {
     const { feature, count = 1, status = 500 } = JSON.parse(await readBody(req) || "{}");
     failures.push({ feature, count, status });
@@ -290,6 +297,14 @@ createServer(async (req, res) => {
     requests.push({ feature: "jev", model: body.model, status: 200 });
     return json(res, 200, { model: body.model, answers: jevAnswers(body.questions ?? {}), usage: { input_tokens: 40, output_tokens: 8, cost: 0.00001 } });
   }
+  const subscriptionPath = url.pathname.match(/^\/v1\/subscriptions\/([^/]+)$/);
+  if (subscriptionPath && req.method === "GET") {
+    // The webhook applies Stripe's current subscription state, not the event's.
+    const subscription = subscriptions.get(decodeURIComponent(subscriptionPath[1]));
+    if (!subscription) return json(res, 404, { error: { type: "invalid_request_error", message: "No such subscription" } });
+    requests.push({ feature: "stripe-subscription", user: subscription.id });
+    return json(res, 200, subscription);
+  }
   if (url.pathname === "/v1/customers/search" && req.method === "GET") {
     // Account deletion searches Stripe (through STRIPE_API_URL) for the user's
     // customers. Test accounts have none.

e2e/full-stack/stack-core.ts

@@ -34,6 +34,10 @@ export const fake = {
   async fail(feature: string, status = 500, count = 1) {
     await fetch(`${fakeUrl}/__fail`, { method: "POST", body: JSON.stringify({ feature, status, count }) });
   },
+  /** Sets what the fake Stripe returns for GET /v1/subscriptions/:id. */
+  async stripeSubscription(subscription: { id: string; status: string }) {
+    await fetch(`${fakeUrl}/__subscription`, { method: "POST", body: JSON.stringify(subscription) });
+  },
 };
 
 export type DemoUser = { code: string; email: string; userId: () => Promise<string> };

supabase/functions/stripe-webhook/index.ts

@@ -23,9 +23,17 @@ if (!STRIPE_WEBHOOK_SECRET) throw new Error("Missing required env: STRIPE_WEBHOO
 if (!SUPABASE_URL) throw new Error("Missing required env: SUPABASE_URL");
 if (!SUPABASE_SERVICE_ROLE_KEY) throw new Error("Missing required env: SUPABASE_SERVICE_ROLE_KEY");
 
+// Only the local full-stack gate sets this, to reach its fake Stripe.
+const stripeApiUrl = Deno.env.get("STRIPE_API_URL");
+const stripeEndpoint = stripeApiUrl ? new URL(stripeApiUrl) : null;
 const stripe = new Stripe(STRIPE_SECRET_KEY, {
   apiVersion: "2023-10-16",
   httpClient: Stripe.createFetchHttpClient(),
+  ...(stripeEndpoint && {
+    host: stripeEndpoint.hostname,
+    port: stripeEndpoint.port || (stripeEndpoint.protocol === "http:" ? "80" : "443"),
+    protocol: stripeEndpoint.protocol.replace(":", "") as "http" | "https",
+  }),
 });
 
 const supabase = createClient(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY);