john/tractatus
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
tractatus/docs/stripe-analysis/STRIPE_STATUS_CLARIFICATION_2025-10-21.md
TheFlow 2298d36bed fix(submissions): restructure Economist package and fix article display 
- Create Economist SubmissionTracking package correctly:
  * mainArticle = full blog post content
  * coverLetter = 216-word SIR— letter
  * Links to blog post via blogPostId
- Archive 'Letter to The Economist' from blog posts (it's the cover letter)
- Fix date display on article cards (use published_at)
- Target publication already displaying via blue badge

Database changes:
- Make blogPostId optional in SubmissionTracking model
- Economist package ID: 68fa85ae49d4900e7f2ecd83
- Le Monde package ID: 68fa2abd2e6acd5691932150

Next: Enhanced modal with tabs, validation, export

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-24 08:47:42 +13:00

8.2 KiB
Raw Blame History

Stripe Account Status Clarification

Date: 2025-10-21 Session: 2025-10-07-001 (continued)

Executive Summary

✅ CORRECT STATUS: Activated Stripe account operating in TEST MODE ❌ INCORRECT ASSUMPTION: Live mode with real money transactions

What We Know For Certain

1. Current Configuration (.env)

STRIPE_SECRET_KEY=sk_test_51RX67kGhfAwOYBrf2yU9XCbjkJERKuYhv...
STRIPE_PUBLISHABLE_KEY=pk_test_51RX67kGhfAwOYBrfbow71FlMSRR2fZlWy...

Key Type: sk_test_ = TEST MODE

2. Deployment Status (docs/STRIPE_DEPLOYMENT_STATUS.md)

Date: 2025-10-18 Status: "TEST MODE COMPLETE ✅ | READY FOR LIVE MODE DEPLOYMENT" Next Step: "Switch to Live Mode (follow STRIPE_LIVE_MODE_DEPLOYMENT.md)"

3. The $5 Transaction

  • Date: 18 Oct 2025, 17:27
  • Amount: NZ$5.00
  • Customer: john.stroh.nz@pm.me
  • Type: Subscription creation
  • Source: koha.html page (recurring payment)
  • Mode: Test mode transaction with real payment method

Understanding "Live Account" vs "Live Mode"

Live Account (Account Status)

✅ This is what the user has:

  • Stripe account is fully activated and verified
  • Business details submitted and approved
  • Bank account connected (TSB Bank, ending 085)
  • Ready to accept real payments
  • No longer in "sandbox" or "restricted" status

Live Mode (Transaction Mode)

❌ This is what the user does NOT have active:

  • Using live API keys (sk_live_, pk_live_)
  • Processing real transactions with real money
  • Actual card charges and payouts
  • Production webhook endpoints

Test Mode Capabilities

What test mode CAN do:

  • ✅ Attach real payment methods (cards, bank accounts)
  • ✅ Simulate real transactions
  • ✅ Process test charges that look real
  • ✅ Show transaction amounts in dashboard
  • ✅ Test webhooks and integrations
  • ✅ Practice payouts and refunds

What test mode CANNOT do:

  • ❌ Actually charge real money from cards
  • ❌ Transfer real money to bank accounts
  • ❌ Process real customer payments
  • ❌ Generate real revenue

The $5 Transaction Explained

What Happened:

  1. User visited koha.html page (donation form)
  2. Selected $5 NZD Foundation tier
  3. Attached real payment method (ending 3471)
  4. Stripe created test subscription
  5. Dashboard shows NZ$5.00 and balance of $4.56

What This Means:

  • Test transaction: No real money charged
  • Test balance: Simulated balance in test mode
  • Real payment method: Attached for testing purposes
  • Normal behavior: Stripe allows this for integration testing

Bank Account Configuration

What We Observed:

  • Correct format: 15-3959-xxxxx36-085
  • Dashboard shows: ••••0085 / 153959
  • Issue: Extra '0' displayed (0085 instead of 085)

Assessment:

  • Severity: LOW in test mode (no real payouts)
  • Fix needed: Before switching to live mode
  • Action: User working with Stripe Support

Security Assessment Correction

Previous (INCORRECT) Assessments:

  1. First Assessment: "Low risk, test keys only"

    • ✅ CORRECT conclusion
    • ❌ INCOMPLETE reasoning (didn't understand activated account)

  2. Second Assessment: "Moderate risk (test mode with real bank connection)"

    • ❌ INCORRECT - Overstated risk
    • Real bank connection is normal for activated accounts

  3. Third Assessment: "CRITICAL - live account with test keys"

    • ❌ INCORRECT - Misunderstood "live account" terminology

Corrected Assessment:

Risk Level: 🟢 LOW (Test mode, appropriate for current development phase)

Rationale:

  • ✅ Using test keys as intended for development
  • ✅ No real money transactions possible
  • ✅ Keys properly secured (.gitignore, permissions 600)
  • ✅ No exposure in public documents or git history
  • ✅ Account activation is normal and expected
  • ✅ Test mode allows safe integration testing

Concerns Resolved:

  • Real money at risk → No, test mode transactions only
  • Key mismatch → No mismatch, test keys for test mode
  • Live keys missing → Not needed yet, deployment not complete
  • Bank account vulnerability → Normal configuration for activated account

Timeline of Account Setup

2025-10-18: Initial Setup

  • Created Stripe account (passport-consolidated)
  • Completed business verification
  • Connected TSB Bank account (15-3959-xxxxx36-085)
  • Configured test API keys
  • Created Koha product and price tiers
  • Deployed to production server (still in test mode)
  • Status: "TEST MODE COMPLETE ✅"

2025-10-18: Test Transaction

  • Made $5 test donation via koha.html
  • Verified webhook processing
  • Confirmed database recording
  • Result: All systems working correctly

2025-10-21: Clarification Session

  • Identified confusion about "live account" vs "live mode"
  • Verified current status: Test mode with test keys
  • Corrected risk assessments
  • Status: Ready for live mode deployment when needed

Deployment Path Forward

Current State (2025-10-21)

  • ✅ Test mode fully functional
  • ✅ Integration tested and verified
  • ✅ Documentation complete
  • ✅ Bank account connected
  • ⏳ NOT YET DEPLOYED TO LIVE MODE

When Ready to Accept Real Donations

Prerequisites:

  1. Resolve bank account display bug (0085 vs 085) with Stripe Support
  2. Respond to open Stripe case (complete any pending requirements)
  3. Review STRIPE_LIVE_MODE_DEPLOYMENT.md guide
  4. Backup current .env configuration

Deployment Steps (follow docs/STRIPE_LIVE_MODE_DEPLOYMENT.md):

  1. Switch Stripe Dashboard toggle to "Live Mode"
  2. Obtain live API keys (sk_live_, pk_live_)
  3. Create production webhook endpoint
  4. Update production .env with live keys
  5. Restart tractatus.service
  6. Test with $5 real donation
  7. Verify webhook and database recording

Estimated Time: 40-45 minutes

Recommendations

Immediate (Test Mode)

  1. ✅ Continue using test mode for development
  2. ✅ No changes needed to current configuration
  3. ✅ Work with Stripe Support to resolve bank account display
  4. ✅ Respond to open Stripe case requirements

Before Live Mode Switch

  1. ⏳ Enable 2FA on Stripe account
  2. ⏳ Set up transaction notification emails
  3. ⏳ Configure receipt email service (SendGrid/SES)
  4. ⏳ Review and test cancellation flow
  5. ⏳ Verify all webhook events handling

Security Best Practices

  1. ✅ Keep test keys in .env (already done)
  2. ✅ Never commit to git (already enforced)
  3. ⏳ Store live keys separately when obtained
  4. ⏳ Use separate .env.production file
  5. ⏳ Backup test keys before switching

Key Takeaways

  1. "Live Account" ≠ "Live Mode"

    • Account can be activated while still in test mode
    • This is normal and expected for proper integration testing

  2. Test Mode is Appropriate

    • Application is in active development
    • Integration testing still ongoing
    • No real customers using the system yet

  3. No Security Risk

    • Test keys are meant to be used this way
    • No real money can be charged in test mode
    • Configuration is correct for current phase

  4. Ready When You Are

    • Switching to live mode is straightforward
    • Documentation is complete (STRIPE_LIVE_MODE_DEPLOYMENT.md)
    • Bank account issue should be resolved first

Corrections to Previous Documents

Documents to Update:

  1. ❌ CRITICAL_LIVE_ACCOUNT_CORRECTION_2025-10-21.md → Incorrect premise
  2. ❌ STRIPE_SECURITY_CORRECTION_2025-10-21.md → Overstated risk
  3. ✅ STRIPE_SECURITY_AUDIT_2025-10-21.md → Correct conclusions
  4. ✅ STRIPE_BANK_ACCOUNT_BUG_2025-10-21.md → Still valid
  5. ✅ STRIPE_ACCOUNT_SETUP_ANALYSIS_2025-10-21.md → Still valid

Final Status:

  • Account: Activated and ready ✅
  • Current Mode: Test mode (appropriate) ✅
  • Risk Level: Low (test keys secured) ✅
  • Action Required: None until ready to deploy live mode ✅

Recommended Next Steps:

  1. Continue development in test mode
  2. Resolve bank account display with Stripe Support
  3. Complete any open Stripe case requirements
  4. When ready: Follow STRIPE_LIVE_MODE_DEPLOYMENT.md

Document Status: FINAL CLARIFICATION (replaces all previous assessments) Last Updated: 2025-10-21 Confidence: HIGH (verified from .env, deployment status docs, and Stripe key format)