From 5b76432c7b0e7af71fdda6b370e242e4007f28ff Mon Sep 17 00:00:00 2001
From: James Cool <james@newgenstudio.com>
Date: Wed, 9 Sep 2026 12:28:32 +1000
Subject: [PATCH] Treat Stripe permission errors as invalid keys.

Company payment settings crashed with 500 when Stripe returned 403 for Charge.list, instead of marking the key invalid.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 python/tests/test_stripe_util.py | 34 ++++++++++++++++++++++++++++++++
 python/util/stripe_util.py       |  8 +++++---
 2 files changed, 39 insertions(+), 3 deletions(-)
 create mode 100644 python/tests/test_stripe_util.py

diff --git a/python/tests/test_stripe_util.py b/python/tests/test_stripe_util.py
new file mode 100644
index 00000000..c7f5db66
--- /dev/null
+++ b/python/tests/test_stripe_util.py
@@ -0,0 +1,34 @@
+from unittest.mock import patch
+
+import stripe
+
+from sdk.python.util.stripe_util import is_valid_key
+
+
+def test_empty_key_is_invalid():
+    assert is_valid_key(None) is False
+    assert is_valid_key("") is False
+
+
+def test_publishable_key_is_invalid():
+    assert is_valid_key("pk_test_abc") is False
+    assert is_valid_key("pk_live_abc") is False
+
+
+@patch("sdk.python.util.stripe_util.stripe.Charge.list")
+def test_valid_secret_key(mock_list):
+    mock_list.return_value = []
+    assert is_valid_key("sk_test_abc") is True
+    mock_list.assert_called_once_with(limit=1)
+
+
+@patch("sdk.python.util.stripe_util.stripe.Charge.list")
+def test_authentication_error_is_invalid(mock_list):
+    mock_list.side_effect = stripe.error.AuthenticationError("bad key")
+    assert is_valid_key("sk_test_bad") is False
+
+
+@patch("sdk.python.util.stripe_util.stripe.Charge.list")
+def test_permission_error_is_invalid(mock_list):
+    mock_list.side_effect = stripe.error.PermissionError("no charges")
+    assert is_valid_key("rk_test_limited") is False
diff --git a/python/util/stripe_util.py b/python/util/stripe_util.py
index 7cad4995..21f7d987 100644
--- a/python/util/stripe_util.py
+++ b/python/util/stripe_util.py
@@ -2,10 +2,12 @@
 
 
 def is_valid_key(x):
-    """ Return True is valid stripe api key is given. """
+    """Return True if a valid Stripe secret API key is given."""
+    if not x or str(x).startswith("pk_"):
+        return False
     stripe.api_key = x
     try:
-        stripe.Charge.list(limit=0)
-    except stripe.error.AuthenticationError:
+        stripe.Charge.list(limit=1)
+    except stripe.error.StripeError:
         return False
     return True