Event Ticketing: Payments Rebuilt

 1// Cheap dedupe first. The real guarantee is below, in the transaction. 2func (h *Handler) HandleStripeWebhook(w http.ResponseWriter, r *http.Request) { 3  event, err := webhook.ConstructEvent(body, sig, h.webhookSecret) 4  if err != nil { 5    http.Error(w, "bad signature", http.StatusBadRequest) 6    return 7  } 8 9  seen, err := h.store.IsStripeEventProcessed(ctx, event.ID)10  if err == nil && seen {11    w.WriteHeader(http.StatusOK) // already handled, ack and exit12    return13  }14  // On a read error we keep going. A duplicate is safe. A lost event is not.1516  if err := h.process(ctx, event); err != nil {17    h.store.MarkStripeEventFailed(ctx, event.ID, err)18    http.Error(w, "retry", http.StatusInternalServerError) // Stripe retries19    return20  }21  h.store.MarkStripeEventProcessed(ctx, event.ID) // INSERT … ON CONFLICT (id) DO NOTHING22  w.WriteHeader(http.StatusOK)23}2425// One transaction. If a second path races us, the unique index on26// tickets(order_id, ticket_seq) fails the insert and the whole tx rolls back.27func (h *Handler) handlePaymentSuccess(ctx context.Context, pi *stripe.PaymentIntent) error {28  return h.db.Tx(ctx, func(tx *sql.Tx) error {29    order, err := q.LockOrderByPaymentIntent(tx, pi.ID)30    if err != nil {31      return err32    }33    if order.Status == "confirmed" {34      return nil // replay, nothing to do35    }36    if err := q.SetOrderStatus(tx, order.ID, "confirmed"); err != nil {37      return err38    }39    if err := q.ConsumeReservation(tx, order.ReservationID); err != nil {40      return err41    }42    for seq := 1; seq <= order.Quantity; seq++ {43      if err := q.InsertTicket(tx, order.ID, seq, newValidationCode()); err != nil {44        return err // unique violation: the other path won45      }46    }47    return q.AuditPaymentConfirmed(tx, order.ID, pi.ID)48  })49  // The caller sends the email after commit. Never inside the transaction.50}