Test Coverage Gap
Summary
app/billing/stripe_webhooks.py has only 18% test coverage
(75 of 92 statements untested). The Stripe webhook handler — which controls
plan upgrades and downgrades — is almost entirely untested.
Uncovered Lines
Lines 26–52 (verify_stripe_signature), 57–132 (full webhook handler)
Why This Matters
The Stripe webhook handler is a billing-critical security boundary:
- It upgrades accounts to
premium tier based on webhook payload
- It downgrades accounts on subscription cancellation
- Signature verification (
verify_stripe_signature) is the only guard
against forged upgrade requests
A bug here could allow free accounts to gain premium access or paying
accounts to be incorrectly downgraded. The signature verification function
itself (lines 26–52) has zero test coverage.
What Needs Tests
verify_stripe_signature — valid signature returns Trueverify_stripe_signature — invalid signature returns Falseverify_stripe_signature — expired timestamp (>5 min) returns FalsePOST /webhooks/stripe — checkout.session.completed upgrades account to premiumPOST /webhooks/stripe — customer.subscription.deleted downgrades to freePOST /webhooks/stripe — missing/invalid signature returns 400POST /webhooks/stripe — unknown org_login in metadata is handled gracefully
Test Coverage Gap
Summary
app/billing/stripe_webhooks.pyhas only 18% test coverage(75 of 92 statements untested). The Stripe webhook handler — which controls
plan upgrades and downgrades — is almost entirely untested.
Uncovered Lines
Lines 26–52 (
verify_stripe_signature), 57–132 (full webhook handler)Why This Matters
The Stripe webhook handler is a billing-critical security boundary:
premiumtier based on webhook payloadverify_stripe_signature) is the only guardagainst forged upgrade requests
A bug here could allow free accounts to gain premium access or paying
accounts to be incorrectly downgraded. The signature verification function
itself (lines 26–52) has zero test coverage.
What Needs Tests
verify_stripe_signature— valid signature returns Trueverify_stripe_signature— invalid signature returns Falseverify_stripe_signature— expired timestamp (>5 min) returns FalsePOST /webhooks/stripe—checkout.session.completedupgrades account to premiumPOST /webhooks/stripe—customer.subscription.deleteddowngrades to freePOST /webhooks/stripe— missing/invalid signature returns 400POST /webhooks/stripe— unknown org_login in metadata is handled gracefully