Repository navigation
Fix stale Stripe-Account header on directly-retrieved Event related objects - #1968
Merged
Merged
Conversation
…bjects A directly-retrieved v2 Event keeps the requestor of whatever account fetched it, so Event.fetch_related_object() could send a stale Stripe-Account header alongside the event's own Stripe-Context. EventNotification already avoids this in its own construction via StripeClient.with_stripe_context; give Event the same treatment where it's deserialized in _convert_to_stripe_object. Fixes RUN_DEVSDK-3694. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Committed-By-Agent: claude
Refactor handling of requestor context for v2 events.
jar-stripe
marked this pull request as ready for review
November 6, 2026 23:23
jar-stripe
requested review from
mnorth-stripe
and removed request for
a team
November 6, 2026 23:23
jar-stripe
enabled auto-merge (squash)
November 7, 2026 00:14
zacchua-stripe
approved these changes
Nov 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
EventNotificationscopes its client to the event's ownstripe_contextviaStripeClient.with_stripe_context, which also clearsstripe_account. A directly-retrievedEvent(e.g.client.v2.core.events.retrieve(...)) has no equivalent, sofetch_related_object()sends the original request'sStripe-Contextinstead of the one returned with the event.What?
_APIRequestor.with_stripe_context(), which always replacesstripe_contextand clearsstripe_accountEvent's requestor with it in_convert_to_stripe_object, the single construction path shared byretrieve,list, andEventNotification.fetch_event().Test Plan
tests/test_api_requestor.py::test_with_stripe_context_clears_stripe_account: confirms the new helper clears a previously-setstripe_accounteven though_new_requestor_with_optionscan't.tests/test_v2_event.py::test_direct_retrieve_related_object_retains_event_context: retrieves anEventdirectly with a client default account different from the event's own context, then assertsfetch_related_object()uses only the event'sStripe-Contextwith noStripe-Accountheader. Reverting the fix makes both tests fail with the leakedStripe-Account: acct_platformheader.just test): 4375 passed, 7 skipped (pre-existing, unrelated).just lint,just typecheck,just format-check: clean.See Also
http://go/j/RUN_DEVSDK-3694 also covers java/ruby/php; this PR is the python slice.
Configuration
skip-changefile: This PR is not a user-facing change, so there's no changefile.🤖 Generated with Claude Code