Critical Security Fixes:
- Fix CSRF webhook vulnerability with IP validation and rate limiting
- Secure debug endpoint with superuser-only access and data masking
- Add rate limiting to all payment operations (5/min for top-up, 10/min for success)
- Replace debug print statements with secure logging throughout
Security Enhancements:
- Stripe webhook IP whitelist validation with current IP ranges
- Content type and payload size validation for webhooks
- Comprehensive error handling with sanitized error messages
- Proper logging for all payment operations and security events
Payment System Improvements:
- Enhanced duplicate payment prevention
- Improved error handling and user feedback
- Secure session verification and balance updates
- Comprehensive audit trail for all payment operations
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update domain configuration to quantumtaskai.com
- Change all page titles and branding across templates
- Update Stripe integration with new domain URLs
- Modify settings.py for new domain and cache prefixes
- Update project documentation and test files
- Change company name and contact information
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
BREAKING CHANGES:
- Move marketplace and agent discovery views from core to agent_base app
- Transfer all wallet functionality from core to dedicated wallet app
- Move Stripe webhook handling to wallet app for better organization
- Consolidate payment system logic under single responsibility
NEW STRUCTURE:
- core app: Platform pages only (homepage, pricing)
- agent_base app: Complete agent marketplace and catalog system
- wallet app: Full payment system with Stripe integration
- Individual agent apps: Unchanged, self-contained
IMPROVEMENTS:
- Clean URL namespacing (agent_base:marketplace, wallet:wallet)
- Template organization by app responsibility
- Removed deprecated CSS files (header.css)
- Added utility classes (.hidden)
- Updated all template references to new URL structure
- Comprehensive CLAUDE.md documentation updates
TECHNICAL CHANGES:
- Templates moved: marketplace.html, agent_detail.html → agent_base/
- Templates moved: wallet*.html → wallet/
- New files: agent_base/views.py, agent_base/urls.py, wallet/urls.py
- Updated main urls.py routing configuration
- Fixed Django system checks and namespace conflicts
- Verified all functionality with test suite
This reorganization follows Django best practices with single responsibility
principle, making the codebase more maintainable and scalable.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add stripe_payment_intent_id field to WalletTransaction model with proper defaults
- Update User.deduct_balance() to handle missing stripe_payment_intent_id gracefully
- Update User.add_balance() to handle missing stripe_payment_intent_id gracefully
- Use try-catch pattern to handle database schema mismatches
- Provide empty string as default for stripe_payment_intent_id when field is required
Issue: Database has NOT NULL constraint on stripe_payment_intent_id but code doesn't provide it
Solution: Add field with proper defaults and graceful error handling
Prevents: 'NOT NULL constraint failed: wallet_wallettransaction.stripe_payment_intent_id'
✅ IMPROVEMENTS:
- Changed transaction description from 'Manual Verification' to clean 'Wallet top-up via Stripe'
- Removed confusing 'Verify Payment' button from wallet page
- Removed manual verification modal and JavaScript
- Removed manual verification URL endpoint
- Cleaner, more professional user interface
Result: Simple, automatic payment system that works seamlessly without user intervention.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
🔍 DEBUGGING TOOLS ADDED:
1. Enhanced Payment Creation Logging:
- Show API key, version, environment details
- Log complete session creation response
- Immediate session verification after creation
- Detailed session metadata and status
2. Enhanced Payment Verification Logging:
- Complete session retrieval details
- Payment intent information if available
- Full session status and metadata
- Account verification details
3. Stripe Debug Endpoint (/stripe/debug/):
- Test API connectivity
- Show account information
- List recent checkout sessions
- List recent charges/payments
- Identify which Stripe account we're connected to
This will help identify:
- If payments are going to wrong Stripe account
- If API keys are correct
- If sessions are being created properly
- Where the disconnect between payments and dashboard is happening
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Set stripe.api_version to '2025-05-28.basil' to match webhook
configuration. This ensures checkout sessions created by Django
will trigger webhook events properly.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Add detailed logging to Stripe webhook handler
- Log webhook events, user processing, and balance updates
- Help identify if webhooks are being received and processed correctly
- Temporary debugging to resolve wallet balance not updating after payment
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove hardcoded payment link URLs that were environment-specific
- Implement dynamic Stripe checkout session creation with automatic domain detection
- Add success/cancel URLs that automatically work on localhost and Railway
- Update StripePaymentHandler to use request.build_absolute_uri() for proper URL generation
- Add wallet top-up success and cancel views with proper user feedback
- This fixes the issue where payment success redirected to old/wrong URLs
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
