Gate full audits behind Stripe payment - #7
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e2e7dbde08
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| PAYMENT_LINK_ID = "plink_1UFLuMAyiOEDWiRnLUiYEx3Y" | ||
| PAYMENT_LINK_URL = "https://buy.stripe.com/14A6oG5Sk9MWg8z3UO5EY01" |
There was a problem hiding this comment.
The Stripe Payment Link and paid server endpoint turn this distribution repository into a hosted SaaS, while the applicable work order explicitly lists “Do not host a SaaS” in HANDOFF.md:26-30. This expands the repository beyond its clone/CLI scope and should be removed unless the repository contract is separately updated by an authorized change.
AGENTS.md reference: AGENTS.md:L3-L5
Useful? React with 👍 / 👎.
| repo_url = (field.get("text") or {}).get("value", "").strip() | ||
| if REPO.fullmatch(repo_url): | ||
| return repo_url |
There was a problem hiding this comment.
If a buyer mistypes the Checkout custom field, uses a common but rejected form such as a trailing slash, or supplies a private/unavailable repository, Stripe can complete the $19 payment before this validation or the subsequent clone fails. The paid endpoint then returns only an error, with no correction or refund path, so a successfully charged customer receives no audit; create the Checkout Session from the already validated preview URL or provide a secure recovery flow.
Useful? React with 👍 / 👎.
| PAYMENT_LINK_ID = "plink_1UFLuMAyiOEDWiRnLUiYEx3Y" | ||
| PAYMENT_LINK_URL = "https://buy.stripe.com/14A6oG5Sk9MWg8z3UO5EY01" | ||
| PRICE_CENTS = 1900 | ||
| FREE_FINDINGS = 3 |
There was a problem hiding this comment.
The Stripe Payment Link and paid server endpoint turn this distribution repository into a hosted SaaS, while the applicable work order explicitly lists “Do not host a SaaS” in HANDOFF.md:26-30. This expands the repository beyond its clone/CLI scope and should be removed unless the repository contract is separately updated by an authorized change.
AGENTS.md reference: AGENTS.md:L3-L5
Useful? React with 👍 / 👎.
| repo_url = (field.get("text") or {}).get("value", "").strip() | ||
| if REPO.fullmatch(repo_url): | ||
| return repo_url |
There was a problem hiding this comment.
If a buyer makes a typo in the Payment Link's free-text githubrepo field, uses a commonly formatted URL this regex rejects, or supplies an unavailable/private repository, Stripe has already completed the charge before this validation or the subsequent clone fails. The paid endpoint then returns only an error and provides no correction or refund path, so bind the previously validated preview URL to a server-created Checkout Session or otherwise validate it before accepting payment.
Useful? React with 👍 / 👎.
| key = os.environ.get("STRIPE_SECRET_KEY") | ||
| if not key: | ||
| raise RuntimeError("payment verification is not configured") |
There was a problem hiding this comment.
When STRIPE_SECRET_KEY is absent, /audit still returns the live Payment Link and the UI allows a customer to pay, but the redirect reaches this exception and /paid returns 500 instead of delivering the audit. The checked Dockerfile, .env.example, and repository-wide configuration references do not supply or document this required variable, so a default deployment can accept real payments while being unable to verify any of them; validate the key at startup or suppress checkout until verification is configured.
Useful? React with 👍 / 👎.
| session = stripe_session(session_id) | ||
| repo_url = paid_repo(session) | ||
| result = run_audit(repo_url) | ||
| result["paid"] = True |
There was a problem hiding this comment.
Every request containing the same paid Checkout Session ID reaches run_audit again, and neither the session nor a result is recorded as consumed. Consequently, one $19 session can be shared or replayed indefinitely to obtain fresh full audits whenever the bound repository changes; it can also return a different commit than the preview on which the purchase was based. Persist the purchased snapshot/result or enforce one-time session redemption.
Useful? React with 👍 / 👎.
1 participant
Free audits now return only the first three findings. Paid unlock verifies the live Stripe Checkout Session, product payment link, $19 amount, and the checkout-bound GitHub repository URL before returning the full audit. The UI renders repository data without raw HTML injection and automatically loads the paid result after Stripe redirects back with the Checkout Session ID.