backend-manager 5.0.197 → 5.0.198

package/CHANGELOG.md

@@ -14,6 +14,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+# [5.0.198] - 2026-04-10
+### Security
+- Added Stripe idempotency keys on all Stripe write operations to prevent duplicate charges, refunds, customers, and coupons from webhook retries, concurrent requests, or user double-clicks. Keys are scoped to stable resource identifiers and Stripe caches responses for 24 hours.
+  - `bem-dispute-refund-{chargeId}` on auto-refunds from dispute alert Firestore triggers
+  - `bem-customer-create-{uid}` on Stripe customer creation
+  - `bem-coupon-{couponId}` on coupon creation in the intent route
+  - `bem-refund-{resourceId}` on manual subscription refunds
+
 # [5.0.197] - 2026-04-10
 ### Added
 - `--retry=N` flag on `npx mgr setup` — re-runs the full setup sequence up to N times, stopping early as soon as all checks pass. Useful for test cases that only succeed after a prior run creates fixtures or indexes propagate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.0.197",
+  "version": "5.0.198",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {

package/src/manager/events/firestore/payments-disputes/processors/stripe.js

@@ -121,9 +121,14 @@ async function processDispute(match, alert, assistant) {
   // Issue full refund
   if (match.chargeId) {
     try {
+      // Idempotency key scoped to the charge prevents double-refund when the
+      // Firestore trigger fires more than once (retries, re-delivered webhooks,
+      // etc.). Stripe caches the response for 24 hours.
       const refund = await stripe.refunds.create({
         charge: match.chargeId,
         amount: amountCents,
+      }, {
+        idempotencyKey: `bem-dispute-refund-${match.chargeId}`,
       });
 
       result.refundId = refund.id;

package/src/manager/libraries/payment/processors/stripe.js

@@ -206,6 +206,9 @@ const Stripe = {
     }
 
     // Create new customer
+    // Use an idempotency key scoped to the uid so concurrent creates (e.g. user
+    // double-clicks checkout) return the same customer instead of duplicates.
+    // Stripe caches the response under this key for 24 hours.
     const params = {
       metadata: { uid },
     };
@@ -214,7 +217,9 @@ const Stripe = {
       params.email = email;
     }
 
-    const customer = await stripe.customers.create(params);
+    const customer = await stripe.customers.create(params, {
+      idempotencyKey: `bem-customer-create-${uid}`,
+    });
     assistant.log(`Created new Stripe customer: ${customer.id}`);
     return customer;
   },

package/src/manager/routes/payments/intent/processors/stripe.js

@@ -153,11 +153,16 @@ async function resolveStripeCoupon(stripe, discount, assistant) {
   }
 
   // Create the coupon
+  // Idempotency key uses the deterministic couponId so concurrent requests for
+  // the same discount code don't race each other into a duplicate-create error.
+  // Stripe returns the cached response for 24 hours.
   await stripe.coupons.create({
     id: couponId,
     percent_off: discount.percent,
     duration: 'once',
     name: `${discount.code} (${discount.percent}% off first payment)`,
+  }, {
+    idempotencyKey: `bem-coupon-${couponId}`,
   });
 
   assistant.log(`Stripe coupon created: ${couponId}`);

package/src/manager/routes/payments/refund/processors/stripe.js

@@ -79,10 +79,16 @@ module.exports = {
       ? invoice.payment_intent
       : invoice.payment_intent.id;
 
+    // Idempotency key scoped to the subscription prevents double-refund from
+    // a user double-clicking the refund button. Stripe caches the response for
+    // 24 hours — any concurrent or repeated refund request for the same sub
+    // within that window returns the original refund instead of issuing a new one.
     const refund = await stripe.refunds.create({
       payment_intent: paymentIntentId,
       amount: refundAmount,
       reason: 'requested_by_customer',
+    }, {
+      idempotencyKey: `bem-refund-${resourceId}`,
     });
 
     assistant.log(`Stripe refund created: refundId=${refund.id}, amount=${refundAmount}, full=${isFullRefund}, uid=${uid}`);