live charges fail with testmode_decline from test cards

"""Report whether a live Stripe key is actually transacting in live mode.

Read only. Four GET requests, no writes: give this a RESTRICTED key with read
access to Account, Charges, PaymentIntents and Customers. The repair is printed,
never performed, because this script holds a credential to a live payments
account.
"""
import argparse
import logging
import os
import sys

import requests

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("stripe_live_mode_check")

API = "https://api.stripe.com/v1"
TESTMODE = "testmode_decline"


def count_testmode_declines(charges, intents):
    """Count objects that failed because a test artefact reached live mode.

    Pure, so the rules can be tested without a network. Stripe records this one
    condition in three different fields depending on how far the payment got: a
    charge carries it as `failure_code` and again as `outcome.reason`, while a
    PaymentIntent that never produced a charge carries it as
    `last_payment_error.code`. Reading only one of them under-counts.
    """
    n = 0
    for c in charges:
        outcome = c.get("outcome") or {}
        if c.get("failure_code") == TESTMODE or outcome.get("reason") == TESTMODE:
            n += 1
    for pi in intents:
        err = pi.get("last_payment_error") or {}
        if err.get("code") == TESTMODE:
            n += 1
    return n


def verdict(key_mode, account, counts):
    """Classify one account. Pure.

    key_mode is "live" or "test", taken from the key prefix. counts holds how
    many objects of each kind this key could see, plus the decline tally.
    """
    if key_mode != "live":
        return ("test_key",
                "this is a test-mode key, so it cannot see the live account at "
                "all: run it again with a restricted live key")
    if not account.get("details_submitted") or not account.get("charges_enabled"):
        return ("not_activated",
                "activation is unfinished, so the account is limited to "
                "test-mode charges: charges_enabled=%s details_submitted=%s"
                % (account.get("charges_enabled"), account.get("details_submitted")))
    if counts.get("testmode_declines"):
        return ("test_cards_live",
                "%d live payment(s) failed with testmode_decline: a test card "
                "number or a test-mode object id reached production"
                % counts["testmode_declines"])
    if not any(counts.get(k, 0) for k in ("charges", "payment_intents", "customers")):
        return ("pointed_at_test",
                "the live account holds no charges, intents or customers: the "
                "application is transacting in test mode")
    return ("healthy", "live objects exist and no testmode_decline in the window")


def get(session, path, **params):
    r = session.get(API + path, params=params, timeout=30)
    if r.status_code == 401:
        raise SystemExit("401 from Stripe: the key is wrong, or is for the other mode")
    if r.status_code == 403:
        raise SystemExit("403 from Stripe: the restricted key lacks read access to " + path)
    r.raise_for_status()
    return r.json()


def main():
    ap = argparse.ArgumentParser(description=__doc__)
    ap.add_argument("--limit", type=int, default=100,
                    help="objects to read per resource (1-100)")
    args = ap.parse_args()

    key = os.environ.get("STRIPE_API_KEY")
    if not key:
        log.error("set STRIPE_API_KEY (use a restricted, read-only key)")
        return 2

    s = requests.Session()
    s.headers.update({"Authorization": "Bearer " + key})

    mode = "live" if "_live_" in key else "test"
    account = get(s, "/account")
    charges = get(s, "/charges", limit=args.limit).get("data", [])
    intents = get(s, "/payment_intents", limit=args.limit).get("data", [])
    customers = get(s, "/customers", limit=args.limit).get("data", [])

    counts = {
        "charges": len(charges),
        "payment_intents": len(intents),
        "customers": len(customers),
        "testmode_declines": count_testmode_declines(charges, intents),
    }

    state, detail = verdict(mode, account, counts)
    line = "%-16s %s" % (state, detail)
    if state == "healthy":
        log.info(line)
        return 0

    log.warning(line)
    if state == "test_key":
        log.warning("  repair: export a restricted key beginning rk_live_ and re-run")
        return 2
    if state == "not_activated":
        log.warning("  repair: finish activation at "
                    "https://dashboard.stripe.com/account/onboarding until "
                    "charges_enabled is true")
    else:
        log.warning("  repair: put a matching sk_live_ and pk_live_ pair from the "
                    "same account on server and client")
        log.warning("  repair: remove hardcoded test-mode ids; resolve prices by "
                    "lookup_key so one code path works in both modes")
    log.info("read %d charge(s), %d intent(s), %d customer(s) in %s mode",
             counts["charges"], counts["payment_intents"], counts["customers"], mode)
    return 1


if __name__ == "__main__":
    sys.exit(main())

/**
 * Report whether a live Stripe key is actually transacting in live mode.
 *
 * Read only. Four GET requests, no writes: give this a RESTRICTED key with read
 * access to Account, Charges, PaymentIntents and Customers. The repair is
 * printed, never performed.
 */
const API = 'https://api.stripe.com/v1';
const TESTMODE = 'testmode_decline';

/**
 * Count objects that failed because a test artefact reached live mode. Pure.
 *
 * Stripe records this one condition in three fields depending on how far the
 * payment got, so reading only one of them under-counts.
 */
export function countTestmodeDeclines(charges, intents) {
  let n = 0;
  for (const c of charges) {
    const outcome = c.outcome ?? {};
    if (c.failure_code === TESTMODE || outcome.reason === TESTMODE) n += 1;
  }
  for (const pi of intents) {
    const err = pi.last_payment_error ?? {};
    if (err.code === TESTMODE) n += 1;
  }
  return n;
}

/**
 * Classify one account. Pure.
 */
export function verdict(keyMode, account, counts) {
  if (keyMode !== 'live') {
    return ['test_key',
      'this is a test-mode key, so it cannot see the live account at all: run ' +
      'it again with a restricted live key'];
  }
  if (!account.details_submitted || !account.charges_enabled) {
    return ['not_activated',
      'activation is unfinished, so the account is limited to test-mode ' +
      `charges: charges_enabled=${account.charges_enabled} ` +
      `details_submitted=${account.details_submitted}`];
  }
  if (counts.testmode_declines) {
    return ['test_cards_live',
      `${counts.testmode_declines} live payment(s) failed with testmode_decline: ` +
      'a test card number or a test-mode object id reached production'];
  }
  const seen = (counts.charges ?? 0) + (counts.payment_intents ?? 0) +
               (counts.customers ?? 0);
  if (!seen) {
    return ['pointed_at_test',
      'the live account holds no charges, intents or customers: the ' +
      'application is transacting in test mode'];
  }
  return ['healthy', 'live objects exist and no testmode_decline in the window'];
}

async function get(key, path, params = {}) {
  const url = new URL(API + path);
  for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
  const res = await fetch(url, { headers: { Authorization: `Bearer ${key}` } });
  if (res.status === 401) {
    throw new Error('401 from Stripe: the key is wrong, or is for the other mode');
  }
  if (res.status === 403) {
    throw new Error(`403 from Stripe: the restricted key lacks read access to ${path}`);
  }
  if (!res.ok) throw new Error(`${res.status} from ${url.pathname}`);
  return res.json();
}

async function main() {
  const key = process.env.STRIPE_API_KEY;
  if (!key) {
    console.error('set STRIPE_API_KEY (use a restricted, read-only key)');
    process.exitCode = 2;
    return;
  }

  const mode = key.includes('_live_') ? 'live' : 'test';
  const account = await get(key, '/account');
  const { data: charges = [] } = await get(key, '/charges', { limit: 100 });
  const { data: intents = [] } = await get(key, '/payment_intents', { limit: 100 });
  const { data: customers = [] } = await get(key, '/customers', { limit: 100 });

  const counts = {
    charges: charges.length,
    payment_intents: intents.length,
    customers: customers.length,
    testmode_declines: countTestmodeDeclines(charges, intents),
  };

  const [state, detail] = verdict(mode, account, counts);
  const line = `${state.padEnd(16)} ${detail}`;
  if (state === 'healthy') { console.log(line); return; }

  console.warn(line);
  if (state === 'test_key') {
    console.warn('  repair: export a restricted key beginning rk_live_ and re-run');
    process.exitCode = 2;
    return;
  }
  if (state === 'not_activated') {
    console.warn('  repair: finish activation at ' +
      'https://dashboard.stripe.com/account/onboarding until charges_enabled is true');
  } else {
    console.warn('  repair: put a matching sk_live_ and pk_live_ pair from the ' +
      'same account on server and client');
    console.warn('  repair: remove hardcoded test-mode ids; resolve prices by ' +
      'lookup_key so one code path works in both modes');
  }
  console.log(`read ${counts.charges} charge(s), ${counts.payment_intents} intent(s), ` +
              `${counts.customers} customer(s) in ${mode} mode`);
  process.exitCode = 1;
}

// Only run when invoked directly. The test file imports this module, and without
// the guard main() would run there too, fail on the missing key, and set a
// non-zero exit code that fails the whole test file even as every test passes.
if (import.meta.url === `file://${process.argv[1]}`) {
  main().catch((err) => { console.error(err.message); process.exitCode = 2; });
}

from stripe_live_mode_check import count_testmode_declines, verdict

LIVE = {"charges_enabled": True, "details_submitted": True}
BUSY = {"charges": 40, "payment_intents": 40, "customers": 12}


def test_counts_a_charge_that_only_names_it_in_outcome_reason():
    # failure_code is absent here; a counter reading one field misses this.
    charges = [{"outcome": {"reason": "testmode_decline"}}]
    assert count_testmode_declines(charges, []) == 1


def test_counts_an_intent_that_never_produced_a_charge():
    intents = [{"last_payment_error": {"code": "testmode_decline"}}]
    assert count_testmode_declines([], intents) == 1


def test_ordinary_declines_are_not_counted():
    charges = [{"failure_code": "card_declined",
                "outcome": {"reason": "insufficient_funds"}}]
    assert count_testmode_declines(charges, []) == 0


def test_a_test_key_short_circuits_every_other_rule():
    state, detail = verdict("test", {"charges_enabled": False}, {"testmode_declines": 9})
    assert state == "test_key"
    assert "live key" in detail


def test_unactivated_account_outranks_the_decline_count():
    # The declines are real, but the cause is the unfinished onboarding.
    state, _ = verdict("live", {"charges_enabled": False, "details_submitted": True},
                       {"testmode_declines": 3})
    assert state == "not_activated"


def test_declines_on_an_activated_account_name_the_count():
    state, detail = verdict("live", LIVE, dict(BUSY, testmode_declines=3))
    assert state == "test_cards_live"
    assert "3" in detail


def test_an_empty_live_account_is_not_healthy():
    state, _ = verdict("live", LIVE, {"testmode_declines": 0})
    assert state == "pointed_at_test"


def test_busy_and_clean_is_healthy():
    state, _ = verdict("live", LIVE, dict(BUSY, testmode_declines=0))
    assert state == "healthy"

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { countTestmodeDeclines, verdict } from './stripe-live-mode-check.mjs';

const LIVE = { charges_enabled: true, details_submitted: true };
const BUSY = { charges: 40, payment_intents: 40, customers: 12 };

test('counts a charge that only names it in outcome.reason', () => {
  assert.equal(countTestmodeDeclines([{ outcome: { reason: 'testmode_decline' } }], []), 1);
});

test('counts an intent that never produced a charge', () => {
  const intents = [{ last_payment_error: { code: 'testmode_decline' } }];
  assert.equal(countTestmodeDeclines([], intents), 1);
});

test('ordinary declines are not counted', () => {
  const charges = [{ failure_code: 'card_declined',
                     outcome: { reason: 'insufficient_funds' } }];
  assert.equal(countTestmodeDeclines(charges, []), 0);
});

test('a test key short circuits every other rule', () => {
  const [state, detail] = verdict('test', { charges_enabled: false },
                                  { testmode_declines: 9 });
  assert.equal(state, 'test_key');
  assert.match(detail, /live key/);
});

test('unactivated account outranks the decline count', () => {
  const [state] = verdict('live', { charges_enabled: false, details_submitted: true },
                          { testmode_declines: 3 });
  assert.equal(state, 'not_activated');
});

test('declines on an activated account name the count', () => {
  const [state, detail] = verdict('live', LIVE, { ...BUSY, testmode_declines: 3 });
  assert.equal(state, 'test_cards_live');
  assert.match(detail, /3/);
});

test('an empty live account is not healthy', () => {
  assert.equal(verdict('live', LIVE, { testmode_declines: 0 })[0], 'pointed_at_test');
});

test('busy and clean is healthy', () => {
  assert.equal(verdict('live', LIVE, { ...BUSY, testmode_declines: 0 })[0], 'healthy');
});