fix(dev): pass Stripe checkout redirect URLs to the api on dev-sso (BUNYIP-175) #208

Merged

longjacksonle merged 1 commit from fix/BUNYIP-175-dev-sso-checkout-urls into main

2026-06-24 03:02:17 +02:00

longjacksonle commented

2026-06-24 02:57:39 +02:00

Owner

Problem

Follow-up to #207 (which wired the Stripe keys). With keys flowing, the Subscribe button on the dev-sso stack still breaks at the final click: Stripe rejects the checkout session because success_url is malformed.

Checkout uses config.success_url / config.cancel_url, and those are always env-derived (STRIPE_SUCCESS_URL / STRIPE_CANCEL_URL, else {CORS_ORIGIN}/...); the DB/admin Stripe config never overrides them (StripeConfig::from_db_model copies them straight from the env config). On dev-sso CORS_ORIGIN is a comma-list of relying-party origins, so the derived URL becomes https://<user>-bunyip.a8n.run,https://<user>-mokosh.a8n.run/checkout/success.

The override vars exist, but compose.dev.yml never forwarded them to the api container (no env_file:), so setting them in .env did nothing.

Fix

Add STRIPE_SUCCESS_URL + STRIPE_CANCEL_URL to the api environment: block (${VAR:-} pattern). Empty default keeps plain just dev working (single localhost CORS_ORIGIN derives a valid URL). On dev-sso, set them in .env to a single bunyip origin; documented in the .env.example dev Stripe block.

Verified

docker compose -f compose.dev.yml -f compose.dev-sso.yml config resolves both into the api service once .env sets them.

🤖 Generated with Claude Code

## Problem Follow-up to #207 (which wired the Stripe keys). With keys flowing, the Subscribe button on the dev-sso stack still breaks at the final click: Stripe rejects the checkout session because `success_url` is malformed. Checkout uses `config.success_url` / `config.cancel_url`, and those are always env-derived (`STRIPE_SUCCESS_URL` / `STRIPE_CANCEL_URL`, else `{CORS_ORIGIN}/...`); the DB/admin Stripe config never overrides them (`StripeConfig::from_db_model` copies them straight from the env config). On dev-sso `CORS_ORIGIN` is a comma-list of relying-party origins, so the derived URL becomes `https://<user>-bunyip.a8n.run,https://<user>-mokosh.a8n.run/checkout/success`. The override vars exist, but compose.dev.yml never forwarded them to the api container (no `env_file:`), so setting them in `.env` did nothing. ## Fix Add `STRIPE_SUCCESS_URL` + `STRIPE_CANCEL_URL` to the api `environment:` block (`${VAR:-}` pattern). Empty default keeps plain `just dev` working (single localhost CORS_ORIGIN derives a valid URL). On dev-sso, set them in `.env` to a single bunyip origin; documented in the `.env.example` dev Stripe block. ## Verified `docker compose -f compose.dev.yml -f compose.dev-sso.yml config` resolves both into the api service once `.env` sets them. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

longjacksonle added 1 commit

2026-06-24 02:57:39 +02:00

fix(dev): pass STRIPE_SUCCESS_URL + STRIPE_CANCEL_URL to api (BUNYIP-175)

E2E / Playwright against deployment (pull_request) Successful in 29s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 4m35s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

ff970cc09c

Checkout sessions use `config.success_url` / `config.cancel_url`, which are always env-derived: `STRIPE_SUCCESS_URL` / `STRIPE_CANCEL_URL` when set, otherwise `{CORS_ORIGIN}/checkout/success` and `{CORS_ORIGIN}/pricing?checkout=canceled`. The DB/admin Stripe config never overrides them.

On the dev-sso (Traefik) stack CORS_ORIGIN is a comma-list of relying-party origins (`https://<user>-bunyip.a8n.run,https://<user>-mokosh.a8n.run`), so the derived success_url becomes `https://<user>-bunyip.a8n.run,https://<user>-mokosh.a8n.run/checkout/success` - a malformed URL Stripe rejects at checkout-session creation, breaking the Subscribe button at the final step. The two override vars were the fix, but compose.dev.yml never forwarded them to the api container (no `env_file:`), so setting them in `.env` had no effect.

Add both to the api `environment:` block with the `${VAR:-}` pattern. Empty default preserves plain `just dev` behaviour (single localhost CORS_ORIGIN derives a valid URL); on dev-sso set them in `.env` to a single bunyip origin. Documented in the `.env.example` dev Stripe block.

#BUNYIP-175

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

longjacksonle scheduled this pull request to auto merge when all checks succeed

2026-06-24 02:59:29 +02:00