双重验证：Stripe生产模式的防御性切换

{
  "lite-monthly": {
    "test": "price_test_xxxxx",
    "live": "price_live_xxxxx",
    "credits": 360
  },
  "pro-5000-monthly": {
    "test": "price_test_yyyyy",
    "live": "price_live_yyyyy",
    "credits": 5000
  }
}

// 从数据库读取所有plans
const plans = await db.select().from('plans');

// 从Stripe API读取所有prices
const prices = await stripe.prices.list({ limit: 100 });

// 验证每个plan的price_id是否存在于Stripe
plans.forEach(plan => {
  const exists = prices.data.find(p => p.id === plan.stripe_price_id);
  if (!exists) {
    console.error(`❌ Plan ${plan.id} has invalid price_id: ${plan.stripe_price_id}`);
  } else {
    console.log(`✅ Plan ${plan.id} verified`);
  }
});

npm run dev

stripe listen --forward-to localhost:8787/api/webhooks/stripe

> Ready! Your webhook signing secret is whsec_xxxxx

export STRIPE_WEBHOOK_SECRET=whsec_xxxxx

stripe trigger checkout.session.completed
stripe trigger invoice.payment_succeeded
stripe trigger payment_intent.payment_failed

function validateEnvironment() {
  const required = [
    'STRIPE_SECRET_KEY',
    'STRIPE_WEBHOOK_SECRET',
    'NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY',
    'SUPABASE_URL',
    'SUPABASE_SERVICE_ROLE_KEY'
  ];

  const missing = required.filter(key => !process.env[key]);

  if (missing.length > 0) {
    throw new Error(`Missing environment variables: ${missing.join(', ')}`);
  }

  // 验证key的格式和环境
  const secretKey = process.env.STRIPE_SECRET_KEY;
  const publishableKey = process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY;

  // 检查是否误用了测试key
  if (process.env.NODE_ENV === 'production') {
    if (secretKey.startsWith('sk_test_')) {
      throw new Error('Using test secret key in production!');
    }
    if (publishableKey.startsWith('pk_test_')) {
      throw new Error('Using test publishable key in production!');
    }
  }

  console.log('✅ Environment variables validated');
}

// 应用启动时立即执行
validateEnvironment();

# 测试Stripe API
curl https://api.stripe.com/v1/balance \
  -u sk_live_xxxxx:

# 测试Webhook endpoint
curl -X POST https://api.yourdomain.com/webhooks/stripe \
  -H "Content-Type: application/json" \
  -d '{"type": "ping"}'

async function validatePaymentSystem() {
  const checks = {
    stripe_api: false,
    webhook_reachability: false,
    price_ids_existence: false,
    database_connection: false
  };

  try {
    // 验证Stripe API连通性
    await stripe.balance.retrieve();
    checks.stripe_api = true;

    // 验证所有Price IDs存在
    const plans = await db.select().from('plans');
    const prices = await stripe.prices.list({ limit: 100 });
    checks.price_ids_existence = plans.every(p =>
      prices.data.find(price => price.id === p.stripe_price_id)
    );

    // 验证数据库连接
    await db.select().from('plans').limit(1);
    checks.database_connection = true;

    // 验证webhook endpoint可达（检查最近的事件）
    const recentEvents = await stripe.events.list({ limit: 5 });
    checks.webhook_reachability = recentEvents.data.length > 0;

  } catch (error) {
    console.error('Payment system validation failed:', error);
  }

  const allHealthy = Object.values(checks).every(v => v === true);

  if (!allHealthy) {
    // 发送告警
    await sendAlert('Payment system health check failed', checks);
  }

  return checks;
}

app.get('/health/stripe', async (req, res) => {
  const checks = {
    api_connectivity: false,
    webhook_endpoint: false,
    database_connection: false,
    price_ids_valid: false
  };

  try {
    // 测试Stripe API
    await stripe.balance.retrieve();
    checks.api_connectivity = true;

    // 测试数据库
    await db.select().from('plans').limit(1);
    checks.database_connection = true;

    // 验证Price IDs
    const plans = await db.select().from('plans');
    const prices = await stripe.prices.list({ limit: 100 });
    const allValid = plans.every(p =>
      prices.data.find(price => price.id === p.stripe_price_id)
    );
    checks.price_ids_valid = allValid;

    // 测试webhook（通过最近的事件）
    const events = await stripe.events.list({ limit: 1 });
    checks.webhook_endpoint = events.data.length > 0;

  } catch (error) {
    console.error('Health check failed:', error);
  }

  const allHealthy = Object.values(checks).every(v => v === true);

  res.status(allHealthy ? 200 : 503).json({
    status: allHealthy ? 'healthy' : 'degraded',
    checks
  });
});