Upload folder using huggingface_hub

app/api/routes_payments.py

@@ -31,13 +31,24 @@ async def create_checkout_session(req: CheckoutRequest):
     """Create a Stripe Checkout session for the Pro tier."""
     if not stripe.api_key:
         raise HTTPException(status_code=500, detail="Stripe not configured")
+    if not tracker:
+        raise HTTPException(status_code=503, detail="Usage tracking service not initialised")
 
     # Verify the API key exists and is free tier
-    tier = tracker.get_tier(req.api_key) if tracker else None
+    tier = tracker.get_tier(req.api_key)
     if tier != Tier.FREE:
         raise HTTPException(status_code=400,
                             detail="Only free tier keys can be upgraded")
 
+    # tenant_id, not the raw api_key, is what travels to Stripe from here
+    # on. api_key is a bearer secret -- usage_tracker.py exists specifically
+    # to never store it in plaintext (pepper-HMAC lookup + salted
+    # verification hash), and Stripe's dashboard/webhook logs/API are a
+    # third party with no reason to ever see it. tenant_id is an opaque,
+    # non-secret row identifier and is exactly what the webhook needs to
+    # look up which tenant's keys to retier.
+    tenant_id = tracker.get_tenant_id(req.api_key)
+
     try:
         checkout_session = stripe.checkout.Session.create(
             payment_method_types=["card"],
@@ -51,15 +62,15 @@ async def create_checkout_session(req: CheckoutRequest):
             mode="subscription",
             success_url=req.success_url,
             cancel_url=req.cancel_url,
-            metadata={"api_key": req.api_key},
-            client_reference_id=req.api_key,
+            metadata={"tenant_id": tenant_id},
+            client_reference_id=tenant_id,
             # checkout.session.completed carries this metadata via
             # session.metadata (handled below), but customer.subscription.*
             # events only carry the *subscription's own* metadata -- Stripe
             # does not copy Session.metadata onto the Subscription it
             # creates. Without this, cancellations can't be traced back to
-            # an api_key and PRO tier never downgrades.
-            subscription_data={"metadata": {"api_key": req.api_key}},
+            # a tenant and PRO tier never downgrades.
+            subscription_data={"metadata": {"tenant_id": tenant_id}},
         )
         return {"sessionId": checkout_session.id, "url": checkout_session.url}
     except Exception:

app/api/webhooks.py

@@ -2,16 +2,24 @@
 Stripe webhook handler – updates API key tier on subscription events.
 """
 
+import logging
 import os
 import stripe
 from fastapi import APIRouter, Request, HTTPException
-from app.core.usage_tracker import update_key_tier, Tier
+from app.core.usage_tracker import update_key_tier_by_tenant_id, Tier
+
+logger = logging.getLogger(__name__)
 
 router = APIRouter(prefix="/webhooks", tags=["webhooks"])
 
 STRIPE_WEBHOOK_SECRET = os.getenv("STRIPE_WEBHOOK_SECRET")
 stripe.api_key = os.getenv("STRIPE_SECRET_KEY")
 
+# Subscription statuses that mean "not entitled to Pro anymore". Deliberately
+# does NOT include "past_due" -- whether a failed-payment grace period keeps
+# Pro access is a dunning-policy decision, not a bug, and isn't decided here.
+_DOWNGRADE_STATUSES = {"canceled", "unpaid", "incomplete_expired"}
+
 
 @router.post("/stripe")
 async def stripe_webhook(request: Request):
@@ -30,20 +38,33 @@ async def stripe_webhook(request: Request):
     except stripe.error.SignatureVerificationError:
         raise HTTPException(status_code=400, detail="Invalid signature")
 
-    # Handle subscription events
+    # tenant_id (not api_key) is what Checkout was given -- see
+    # routes_payments.py's create_checkout_session for why the raw bearer
+    # key must never round-trip through a third party.
     if event["type"] == "checkout.session.completed":
         session = event["data"]["object"]
-        api_key = session.get("client_reference_id") or session.get(
-            "metadata", {}).get("api_key")
-        if api_key:
-            update_key_tier(api_key, Tier.PRO)
-    elif event["type"] == "customer.subscription.deleted":
+        # For card payments this is already "paid" by the time this event
+        # fires; for delayed-notification payment methods (bank debits,
+        # etc.) it can still be "unpaid" here. Upgrading on an unpaid
+        # session would grant Pro access before payment actually clears.
+        if session.get("payment_status") != "paid":
+            logger.info(
+                "checkout.session.completed with payment_status=%r; not upgrading yet",
+                session.get("payment_status"),
+            )
+            return {"status": "ok"}
+        tenant_id = session.get("client_reference_id") or session.get(
+            "metadata", {}).get("tenant_id")
+        if tenant_id:
+            update_key_tier_by_tenant_id(tenant_id, Tier.PRO)
+    elif event["type"] in ("customer.subscription.deleted", "customer.subscription.updated"):
         subscription = event["data"]["object"]
-        # You need to store a mapping from subscription ID to API key.
-        # For simplicity, we assume you stored it in metadata during checkout.
-        # Alternatively, look up by customer ID.
-        api_key = subscription.get("metadata", {}).get("api_key")
-        if api_key:
-            update_key_tier(api_key, Tier.FREE)
+        tenant_id = subscription.get("metadata", {}).get("tenant_id")
+        if not tenant_id:
+            return {"status": "ok"}
+        if event["type"] == "customer.subscription.deleted" or (
+            subscription.get("status") in _DOWNGRADE_STATUSES
+        ):
+            update_key_tier_by_tenant_id(tenant_id, Tier.FREE)
 
     return {"status": "ok"}

app/core/usage_tracker.py

@@ -90,6 +90,14 @@ class UsageRecord:
     processing_ms: Optional[float] = None
 
 
+# Bounded retry for the initial Postgres connect -- see _get_pg_conn's
+# docstring. 5 attempts with exponential backoff (1+2+4+8 = 15s of sleep,
+# worst case) comfortably fits inside a container's normal boot window
+# without turning a real outage into a long hang.
+_PG_CONNECT_MAX_ATTEMPTS = 5
+_PG_CONNECT_BACKOFF_BASE = 1.0
+
+
 class UsageTracker:
     """
     Thread‑safe usage tracker with atomic quota consumption and idempotency.
@@ -171,10 +179,30 @@ class UsageTracker:
     def _get_pg_conn(self):
         """Get a thread-local Postgres connection for the api_keys table.
         Rows come back as dict-like objects (row["col"]) via RealDictCursor,
-        matching the sqlite3.Row access pattern used elsewhere in this file."""
+        matching the sqlite3.Row access pattern used elsewhere in this file.
+
+        Retries the initial connect with backoff -- Render's internal
+        "dpg-*" hostname has been observed unresolvable for the first
+        couple of seconds after a cold container boot (2026-08-25 incident:
+        two consecutive "could not translate host name" crashes, then a
+        clean connect on the third restart with no config change). A DNS
+        race should not require a crash loop to self-heal; other genuine
+        connection errors (bad credentials, wrong host) still raise after
+        the attempts below are exhausted, preserving fail-closed."""
         if not hasattr(self._local, "pg_conn") or self._local.pg_conn.closed:
-            self._local.pg_conn = psycopg2.connect(
-                self._pg_dsn, cursor_factory=psycopg2.extras.RealDictCursor)
+            last_exc: Optional[psycopg2.OperationalError] = None
+            for attempt in range(_PG_CONNECT_MAX_ATTEMPTS):
+                try:
+                    self._local.pg_conn = psycopg2.connect(
+                        self._pg_dsn, cursor_factory=psycopg2.extras.RealDictCursor)
+                    last_exc = None
+                    break
+                except psycopg2.OperationalError as exc:
+                    last_exc = exc
+                    if attempt < _PG_CONNECT_MAX_ATTEMPTS - 1:
+                        time.sleep(_PG_CONNECT_BACKOFF_BASE * (2 ** attempt))
+            if last_exc is not None:
+                raise last_exc
         yield self._local.pg_conn
 
     @staticmethod
@@ -327,6 +355,25 @@ class UsageTracker:
             conn.commit()
             return True
 
+    def update_tier_by_tenant_id(self, tenant_id: str, new_tier: Tier) -> bool:
+        """Update the tier of every active API key belonging to tenant_id.
+
+        Used by the Stripe webhook, which must never handle a raw API key
+        (Stripe's own systems -- dashboard, logs, webhook payloads -- are a
+        third party; the plaintext bearer secret has no business being
+        stored there, which is exactly what passing it as Checkout
+        metadata used to do). tenant_id is not a secret -- it's an opaque
+        row identifier -- so it's safe to round-trip through Stripe."""
+        with self._get_pg_conn() as conn:
+            cur = self._pg_execute(
+                conn,
+                "UPDATE api_keys SET tier = %s WHERE tenant_id = %s AND is_active = true",
+                (new_tier.value, tenant_id),
+            )
+            updated = cur.rowcount > 0
+            conn.commit()
+            return updated
+
     # --------------------------------------------------------------------------
     # Atomic quota consumption (unchanged, but uses api_key which links to tenant)
     # --------------------------------------------------------------------------
@@ -524,6 +571,12 @@ def update_key_tier(api_key: str, new_tier: Tier) -> bool:
     return tracker.update_api_key_tier(api_key, new_tier)
 
 
+def update_key_tier_by_tenant_id(tenant_id: str, new_tier: Tier) -> bool:
+    if tracker is None:
+        return False
+    return tracker.update_tier_by_tenant_id(tenant_id, new_tier)
+
+
 async def enforce_quota(request: Request, api_key: str = None):
     """
     FastAPI dependency that enforces quota and attaches tenant_id to request state.

tests/test_payments.py

@@ -1,17 +1,19 @@
-import os
 import pytest
 from unittest.mock import patch, MagicMock
 from fastapi.testclient import TestClient
 from app.main import app
 
+# Every Stripe call in this module is mocked -- nothing here reaches the
+# network, and no real credentials are involved. This module used to skip
+# entirely whenever STRIPE_SECRET_KEY was unset (always, in CI), so none of
+# it ran; stripe.api_key is patched below instead of relying on env vars,
+# since routes_payments.py reads it at import time.
 client = TestClient(app)
 
-# Skip all tests in this module if Stripe secret key is not set
-STRIPE_SECRET_KEY = os.getenv("STRIPE_SECRET_KEY")
-if not STRIPE_SECRET_KEY:
-    pytest.skip(
-        "Stripe not configured – skipping payment tests",
-        allow_module_level=True)
+
+@pytest.fixture(autouse=True)
+def stripe_configured(monkeypatch):
+    monkeypatch.setattr("stripe.api_key", "sk_test_fake")
 
 
 @pytest.fixture
@@ -21,7 +23,9 @@ def mock_stripe():
 
 
 def test_create_checkout_session_missing_stripe_key(monkeypatch):
-    monkeypatch.setenv("STRIPE_SECRET_KEY", "")
+    # routes_payments.py sets stripe.api_key from the environment at import
+    # time and checks `stripe.api_key`, so setenv here would be a no-op.
+    monkeypatch.setattr("stripe.api_key", None)
     response = client.post(
         "/api/v1/payments/create-checkout-session",
         json={
@@ -34,8 +38,9 @@ def test_create_checkout_session_missing_stripe_key(monkeypatch):
 
 def test_create_checkout_session_free_key(mock_stripe):
     # Mock tracker.get_tier to return Tier.FREE
-    with patch("app.core.usage_tracker.tracker") as mock_tracker:
+    with patch("app.api.routes_payments.tracker") as mock_tracker:
         mock_tracker.get_tier.return_value = "free"
+        mock_tracker.get_tenant_id.return_value = "tenant_test_123"
         mock_stripe.return_value = MagicMock(
             id="cs_test_123", url="https://checkout.stripe.com/pay")
         response = client.post(
@@ -51,7 +56,7 @@ def test_create_checkout_session_free_key(mock_stripe):
 
 
 def test_create_checkout_session_pro_key():
-    with patch("app.core.usage_tracker.tracker") as mock_tracker:
+    with patch("app.api.routes_payments.tracker") as mock_tracker:
         mock_tracker.get_tier.return_value = "pro"
         response = client.post(
             "/api/v1/payments/create-checkout-session",

tests/test_webhooks.py

@@ -1,17 +1,25 @@
-import os
 import pytest
 from unittest.mock import patch
 from fastapi.testclient import TestClient
 from app.main import app
 
+# Every Stripe call in this module is mocked -- nothing here reaches the
+# network, and no real credentials are involved.
+#
+# This module used to skip entirely (pytest.skip(allow_module_level=True))
+# whenever STRIPE_* env vars were unset, which is always in CI -- so none of
+# it was ever exercised anywhere. webhooks.py reads its config into
+# module-level globals at import time, so env vars set in conftest.py can't
+# help (conftest's imports run before its os.environ assignments); the
+# fixture below patches those globals directly instead, which works
+# regardless of import order.
 client = TestClient(app)
 
-# Skip all tests in this module if Stripe webhook secret is not set
-STRIPE_WEBHOOK_SECRET = os.getenv("STRIPE_WEBHOOK_SECRET")
-if not STRIPE_WEBHOOK_SECRET:
-    pytest.skip(
-        "Stripe webhook not configured – skipping webhook tests",
-        allow_module_level=True)
+
+@pytest.fixture(autouse=True)
+def stripe_configured(monkeypatch):
+    monkeypatch.setattr("app.api.webhooks.STRIPE_WEBHOOK_SECRET", "whsec_test_fake")
+    monkeypatch.setattr("stripe.api_key", "sk_test_fake")
 
 
 @pytest.fixture
@@ -21,7 +29,9 @@ def mock_stripe_webhook():
 
 
 def test_webhook_missing_secret(monkeypatch):
-    monkeypatch.setenv("STRIPE_WEBHOOK_SECRET", "")
+    # webhooks.py reads STRIPE_WEBHOOK_SECRET into a module-level global at
+    # import time, so setenv here would be a no-op -- patch the global.
+    monkeypatch.setattr("app.api.webhooks.STRIPE_WEBHOOK_SECRET", "")
     response = client.post(
         "/webhooks/stripe",
         json={},
@@ -31,8 +41,7 @@ def test_webhook_missing_secret(monkeypatch):
     assert "Stripe not configured" in response.json()["detail"]
 
 
-def test_webhook_invalid_payload(mock_stripe_webhook, monkeypatch):
-    monkeypatch.setenv("STRIPE_WEBHOOK_SECRET", "whsec_test")
+def test_webhook_invalid_payload(mock_stripe_webhook):
     mock_stripe_webhook.side_effect = ValueError("Invalid payload")
     response = client.post(
         "/webhooks/stripe",
@@ -43,9 +52,12 @@ def test_webhook_invalid_payload(mock_stripe_webhook, monkeypatch):
     assert "Invalid payload" in response.json()["detail"]
 
 
-def test_webhook_invalid_signature(mock_stripe_webhook, monkeypatch):
-    monkeypatch.setenv("STRIPE_WEBHOOK_SECRET", "whsec_test")
-    mock_stripe_webhook.side_effect = Exception("Invalid signature")
+def test_webhook_invalid_signature(mock_stripe_webhook):
+    import stripe
+    # Must be the real exception type the route catches -- a bare Exception
+    # would propagate as a 500 instead of the 400 this asserts.
+    mock_stripe_webhook.side_effect = stripe.error.SignatureVerificationError(
+        "Invalid signature", "sig_header")
     response = client.post(
         "/webhooks/stripe",
         json={},
@@ -55,35 +67,92 @@ def test_webhook_invalid_signature(mock_stripe_webhook, monkeypatch):
     assert "Invalid signature" in response.json()["detail"]
 
 
-def test_webhook_checkout_completed(monkeypatch):
-    monkeypatch.setenv("STRIPE_WEBHOOK_SECRET", "whsec_test")
-    monkeypatch.setenv("STRIPE_SECRET_KEY", "sk_test")
+def test_webhook_checkout_completed():
     with patch("stripe.Webhook.construct_event") as mock_construct, \
-            patch("app.core.usage_tracker.update_key_tier") as mock_update:
+            patch("app.api.webhooks.update_key_tier_by_tenant_id") as mock_update:
         mock_construct.return_value = {
             "type": "checkout.session.completed",
             "data": {
                 "object": {
-                    "client_reference_id": "test_key",
+                    "client_reference_id": "tenant_123",
+                    "payment_status": "paid",
                     "metadata": {
-                        "api_key": "test_key"}}}}
+                        "tenant_id": "tenant_123"}}}}
+        response = client.post(
+            "/webhooks/stripe",
+            json={},
+            headers={"stripe-signature": "test"}
+        )
+        assert response.status_code == 200
+        mock_update.assert_called_once_with("tenant_123", "pro")
+
+
+def test_webhook_checkout_completed_not_yet_paid_does_not_upgrade():
+    """checkout.session.completed can fire before payment actually clears
+    for delayed-notification payment methods -- must not grant Pro yet."""
+    with patch("stripe.Webhook.construct_event") as mock_construct, \
+            patch("app.api.webhooks.update_key_tier_by_tenant_id") as mock_update:
+        mock_construct.return_value = {
+            "type": "checkout.session.completed",
+            "data": {
+                "object": {
+                    "client_reference_id": "tenant_123",
+                    "payment_status": "unpaid",
+                    "metadata": {"tenant_id": "tenant_123"}}}}
         response = client.post(
             "/webhooks/stripe",
             json={},
             headers={"stripe-signature": "test"}
         )
         assert response.status_code == 200
-        mock_update.assert_called_once_with("test_key", "pro")
+        mock_update.assert_not_called()
 
 
-def test_webhook_subscription_deleted(monkeypatch):
-    monkeypatch.setenv("STRIPE_WEBHOOK_SECRET", "whsec_test")
-    monkeypatch.setenv("STRIPE_SECRET_KEY", "sk_test")
+def test_webhook_subscription_deleted():
     with patch("stripe.Webhook.construct_event") as mock_construct, \
-            patch("app.core.usage_tracker.update_key_tier") as mock_update:
+            patch("app.api.webhooks.update_key_tier_by_tenant_id") as mock_update:
         mock_construct.return_value = {
             "type": "customer.subscription.deleted",
-            "data": {"object": {"metadata": {"api_key": "test_key"}}}
+            "data": {"object": {"metadata": {"tenant_id": "tenant_123"}}}
+        }
+        response = client.post(
+            "/webhooks/stripe",
+            json={},
+            headers={"stripe-signature": "test"}
+        )
+        assert response.status_code == 200
+        mock_update.assert_called_once_with("tenant_123", "free")
+
+
+def test_webhook_subscription_updated_canceled_downgrades():
+    """customer.subscription.updated (not just .deleted) must also
+    downgrade -- a status transition to canceled/unpaid can arrive this
+    way, and .deleted is not the only terminal event Stripe sends."""
+    with patch("stripe.Webhook.construct_event") as mock_construct, \
+            patch("app.api.webhooks.update_key_tier_by_tenant_id") as mock_update:
+        mock_construct.return_value = {
+            "type": "customer.subscription.updated",
+            "data": {"object": {
+                "status": "canceled",
+                "metadata": {"tenant_id": "tenant_123"}}}
+        }
+        response = client.post(
+            "/webhooks/stripe",
+            json={},
+            headers={"stripe-signature": "test"}
+        )
+        assert response.status_code == 200
+        mock_update.assert_called_once_with("tenant_123", "free")
+
+
+def test_webhook_subscription_updated_active_does_not_downgrade():
+    with patch("stripe.Webhook.construct_event") as mock_construct, \
+            patch("app.api.webhooks.update_key_tier_by_tenant_id") as mock_update:
+        mock_construct.return_value = {
+            "type": "customer.subscription.updated",
+            "data": {"object": {
+                "status": "active",
+                "metadata": {"tenant_id": "tenant_123"}}}
         }
         response = client.post(
             "/webhooks/stripe",
@@ -91,4 +160,4 @@ def test_webhook_subscription_deleted(monkeypatch):
             headers={"stripe-signature": "test"}
         )
         assert response.status_code == 200
-        mock_update.assert_called_once_with("test_key", "free")
+        mock_update.assert_not_called()