Stripe Reconcile

Stripe Reconcile

Fix issues identified by the audit.

Branching

Assumes you start on master/main. Before making code changes:

git checkout -b fix/stripe-reconcile-$(date +%Y%m%d)

Configuration-only changes (env vars, dashboard settings) don't require a branch. Code changes do.

Objective

Take audit findings and fix them. Configuration issues get fixed directly. Code issues get delegated to Codex.

Process

1. Triage Findings

From the audit report, categorize:

Configuration fixes (do directly):

• Missing env vars
• Wrong webhook URL
• Dashboard settings

Code fixes (delegate to Codex):

• Missing trial_end handling
• Idempotency implementation
• Access control corrections

Design issues (may need stripe-design):

• Wrong checkout mode
• Missing webhook events
• Architectural problems

2. Fix Configuration

For env var issues:

# Example: missing prod webhook secret
npx convex env set --prod STRIPE_WEBHOOK_SECRET "whsec_..."

For webhook URL issues:

• Update in Stripe Dashboard
• Or use Stripe CLI: stripe webhook_endpoints update <id> --url "https://..."

Verify fixes immediately.

3. Delegate Code Fixes to Codex

For each code issue, create a focused Codex task:

codex exec --full-auto "Fix: [specific issue from audit]. \
Current code in [file]. Problem: [what's wrong]. \
Fix: [what it should do]. Reference [pattern file] for correct approach. \
Run pnpm typecheck after." \
--output-last-message /tmp/codex-fix.md 2>/dev/null

Then review: git diff --stat && pnpm typecheck

4. Verify Each Fix

After fixing, verify:

• Configuration: npx convex env list --prod | grep STRIPE
• Webhook URL: curl -I -X POST <url>
• Code: pnpm typecheck && pnpm test

5. Re-audit

After all fixes, run a quick re-audit to confirm issues resolved.

Common Fixes

Missing env var on prod

npx convex env set --prod STRIPE_WEBHOOK_SECRET "$(printf '%s' 'whsec_...')"

(Use printf to avoid trailing newlines)

Webhook URL redirect Update to canonical domain in Stripe Dashboard. If example.com redirects to www.example.com, use www.example.com.

Missing trial_end handling In checkout session creation, calculate remaining trial and pass to Stripe:

const trialEnd = user.trialEndsAt && user.trialEndsAt > Date.now()
  ? Math.floor(user.trialEndsAt / 1000)
  : undefined;
// Pass in subscription_data.trial_end

Missing idempotency Store lastStripeEventId on user, check before processing webhook.

Output

For each finding:

• What was fixed
• How it was fixed
• Verification result

Any remaining issues that couldn't be auto-fixed.