Harden Stripe webhook handling and remove exposed Vercel identifiers

[Copilot]

This change prepares the Flask/Vercel webhook path for production by removing hardcoded secret-related values and tightening Stripe signature validation and event handling. It also replaces exposed Vercel project/org identifiers in operational scripts and docs with environment-driven configuration.

• Webhook hardening

  • Rejects empty payloads and missing/invalid Stripe-Signature headers with explicit 400 responses.
  • Reads STRIPE_ENDPOINT_SECRET from environment only and warns clearly when the service is misconfigured.
  • Adds structured handling for:
    • payment_intent.succeeded
    • payment_intent.payment_failed
    • checkout.session.completed
    • charge.refunded
  • Adds basic safe logging around accepted/rejected events without leaking secrets.

• Configuration cleanup

  • Removes hardcoded Vercel org/project identifiers from helper scripts.
  • Standardizes Vercel helpers on:
    • VERCEL_TOKEN
    • VERCEL_PROJECT_ID
    • VERCEL_ORG_ID
    • VERCEL_DEPLOYMENT_ID where applicable
  • Keeps local Flask debug behavior environment-controlled instead of hardcoded.

• Deployment/runtime examples

  • Adds a root .env.example with placeholder values only, including the Stripe/Vercel variables requested.
  • Adds api/requirements.example.txt with the minimal Flask/Stripe example dependency set.
  • Updates IDX example env values to placeholders and points developers to example-based configuration.

• Docs and operational references

  • Replaces embedded Vercel IDs in repo notes with environment variable references to avoid copying live identifiers into uncontrolled locations.

• Coverage

  • Adds webhook tests for invalid payloads, missing signatures, and valid signed events across the supported Stripe event types.

ENDPOINT_SECRET = os.environ.get("STRIPE_ENDPOINT_SECRET")

payload = request.get_data(cache=False, as_text=False)
sig_header = (request.headers.get("Stripe-Signature") or "").strip()

event = stripe.Webhook.construct_event(payload, sig_header, ENDPOINT_SECRET)

[LVT-ENG]

Supercommit_max.sh

[LVT-ENG]

Yes

[LVT-ENG]

Supercommit_max.sh

[LVT-ENG]

Supercommit max.sh

[Copilot]

Pull request overview

This PR hardens the Flask /api/webhook Stripe endpoint for production use (stricter input/signature validation and safer logging) and removes hardcoded Vercel identifiers from operational tooling by standardizing on environment-driven configuration.

Changes:

• Tightens Stripe webhook handling in api/index.py (reject empty payloads / missing signature headers, explicit misconfiguration behavior, structured event-type handling, and logging).
• Replaces hardcoded Vercel org/project/deployment IDs in scripts/docs with VERCEL_* environment variables.
• Adds developer-facing configuration examples (.env.example, api/requirements.example.txt) and Stripe webhook unit tests.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
todo.md	Replaces embedded Vercel project ID references with VERCEL_PROJECT_ID placeholders.
tests/test_stripe_webhook.py	Adds webhook tests for missing signature header, invalid payload, and supported event types.
scripts/fetch_logs.py	Switches log-fetch script to environment-driven Vercel identifiers (token/org/project/deployment).
scripts/deploy_vercel.py	Removes hardcoded Vercel IDs and standardizes deployment script on VERCEL_ORG_ID / VERCEL_PROJECT_ID.
api/requirements.example.txt	Provides minimal example dependencies for a Flask/Stripe setup.
api/index.py	Implements stricter webhook validation, improved logging, and environment-controlled Flask debug mode.
.idx/dev.nix	Updates IDX env placeholders to non-sensitive example values for Stripe/Vercel vars.
.env.example	Adds a repo-level example env file covering Stripe/Vercel and other runtime variables.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[LVT-ENG]

Pégale esto a Copilot:Estoy en Slack y aparece un mensaje que dice: “Este mensaje contiene elementos interactivos.”
La acción que quiero ejecutar es “Desbloquear fondos”.
No puedo activar botones interactivos desde el chat actual, así que necesito ayuda para:
localizar el mensaje exacto en Slack,
abrirlo correctamente,
pulsar “Desbloquear fondos”,
y explicarme qué hacer si no veo el botón o si aparece un error.
Si hace falta, dame pasos concretos para escritorio y móvil.Si quieres, también te lo reformulo más corto o más técnico.