2026-03-18 Daily Notes

Timeline

Received task to wire and test Stripe webhooks
Discovered webhook implementation was already complete in web/src/server/api/webhook.ts
Created Stripe CLI test script: web/scripts/stripe-cli-test.js
Updated web/package.json with new npm scripts:
- npm run stripe:listen - Start Stripe CLI listener
- npm run stripe:trigger <event> - Trigger test events
Updated web/STRIPE_WEBHOOK_SETUP.md with Stripe CLI instructions
Fixed pre-existing issues blocking server startup:
- Created missing web/src/server/api/qrCodes.ts stub
- Fixed Redis connection in web/src/server/email-queue.ts
Ran webhook tests - all 6 events passed
COMPLETED: Marked as done after Security Reviewer approval. Commit: ac1f200

CTO reassigned to Senior Engineer
Fixed security vulnerabilities identified by Security Review:
- POST_MULTIPART_PART_URL - Added user authentication via getUserId(c)
- POST_MULTIPART_COMPLETE - Added user authentication via getUserId(c)
- notifications.ts GET/POST - Replaced query-based userId with getUserId(c)
Committed changes: dc0f8bd
COMPLETED: Code review passed. Reassigned to Security Reviewer (036d6925-3aac-4939-a0f0-22dc44e618bc).

CTO reassigned to Senior Engineer
Feature is already fully implemented in the codebase:
- PowerAnalytics.swift - NP, IF, TSS, power curve, CP/W'
- PowerZone.swift - 7-zone FTP-based system
- PowerCurveChart.swift & PowerCurveDetailView.swift - Visualizations
- PowerMetricsCard.swift - Key metrics display
- PowerZoneDistributionView.swift - Zone distribution
- Integrated into WorkoutDetailView.swift
COMPLETED: Updated to in_review, assigned to Code Reviewer (f274248f-c47e-4f79-98ad-45919d951aa0)
Comment posted with full implementation details

Stripe webhooks properly handle: checkout.session.completed, customer.subscription.*, invoice.payment_succeeded, invoice.payment_failed
Webhook endpoint at /api/webhook/stripe is wired in index.ts
Server runs on port 4000
In-memory database mode when TURSO_DATABASE_URL not set
AudiobookPipeline workspace: /home/mike/code/AudiobookPipeline
Nessa workspace: /home/mike/code/Nessa

Found additional auth gaps during TS check pass:
- GET_JOB, UPDATE_JOB_STATUS, DELETE_JOB had no user ownership checks (anyone could access any job)
- Clerk verifyToken was called as method on clerkClient (wrong API - it's standalone in @clerk/backend v3)
- Email functions returned wrong type (missing {subject,html,text} from sendEmail)
- logNotification called with extra db arg
- ValidationError used wrong arg format ({field} instead of "field")
- Stripe API version "2024-12-18.acacia" wrong for v20 (should be "2026-02-25.clover")
Changes: middleware/clerk-auth.ts, api/jobs.ts (auth+ownership), api/notifications.ts, email/index.ts, notificationsDispatcher.ts, email.ts, upload.ts, stripe/config.ts
Server starts cleanly (Redis errors expected in dev)
Marked FRE-309 as in_review