- Shipped
- August 26, 2026 at 2:22 AM UTC
- Author
- Kamo
- Commit
- bfc8092
A socket timeout on a Stripe write that actually succeeded is indistinguishable, from our side, from one that did not; without an idempotency key the retry creates a second subscription, checkout session, or price and the tenant is billed twice. StripeIdempotency.forKey derives a stable, prefixed, 255-char-safe Stripe idempotency key from a caller-supplied logical key naming the operation and its subject (never a random value, which would give no retry protection at all). Covers all 20 genuine Stripe write call sites across the five services that talk to Stripe directly, not just the 14 named in this task's brief: an independent audit of every create/update/cancel/attach/ detach/del call turned up five more in AccountSubscriptionService (cancel, terminateNow, reactivate, the default-payment-method amendment, and syncStripeItems' proration-bearing update) and one in AccountPaymentMethodService (attach), none of which the brief's class-anchored regex can see because their receiver is a local variable rather than the Stripe class name. EsignMeterSubmissionService stays untouched: MeterEvent already carries Stripe's own event-level dedupe via setIdentifier. The coverage test keeps that regex as a forward-looking net for new call sites shaped like ClassName.verb(...), and adds a second, line-independent assertion pinning the exact StripeIdempotency.forKey( count per file, since the regex is structurally unable to flag a write made through a local variable.