fix/BUNYIP-188-cors-origin-comma-list #210

Merged

YousifShkara merged 2 commits from fix/BUNYIP-188-cors-origin-comma-list into main

2026-06-24 09:59:35 +02:00

YousifShkara commented

2026-06-24 09:56:38 +02:00

Owner

No description provided.

YousifShkara self-assigned this

2026-06-24 09:56:38 +02:00

YousifShkara added 2 commits

2026-06-24 09:56:38 +02:00

fix(stripe): split CORS_ORIGIN on comma for success_url fallback (BUNYIP-188) ca54fb9cbd

`StripeConfig::from_env` derives the Stripe Checkout `success_url` and
`cancel_url` fallback from `CORS_ORIGIN`. `CORS_ORIGIN` is a comma-separated
list of allowed origins everywhere else in the codebase: on the dev-sso
stack it lands as e.g. `"https://x-bunyip.a8n.run,https://x-mokosh.a8n.run"`.
The old fallback interpolated the entire list, producing
`"https://x-bunyip.a8n.run,https://x-mokosh.a8n.run/checkout/success"`,
and Stripe rejected that URL at session creation.

BUNYIP-175 PR #208 papered over this by forcing operators to set
`STRIPE_SUCCESS_URL` / `STRIPE_CANCEL_URL` explicitly in their `.env`. This
fixes the underlying fallback: a new `first_origin` helper splits the
value on `,`, trims whitespace per entry, and returns the first non-empty
origin. Explicit env-var overrides still take precedence (BUNYIP-175 PR
#208 behaviour preserved).

Five unit tests cover: single-origin pass-through, comma-list first-wins,
whitespace trimming, empty-entry skipping, all-empty returning `None`.

#BUNYIP-188