fix: add idempotency keys to all Stripe mutation calls

backend/migrations/0003_invoice_nwc_payment_guard.sql

@@ -1,11 +0,0 @@
-CREATE TABLE IF NOT EXISTS invoice_nwc_payment (
-  invoice_id TEXT PRIMARY KEY,
-  tenant_pubkey TEXT NOT NULL,
-  state TEXT NOT NULL CHECK (state IN ('pending', 'paid')),
-  created_at INTEGER NOT NULL,
-  updated_at INTEGER NOT NULL,
-  FOREIGN KEY (tenant_pubkey) REFERENCES tenant(pubkey)
-);
-
-CREATE INDEX IF NOT EXISTS idx_invoice_nwc_payment_tenant_pubkey
-ON invoice_nwc_payment (tenant_pubkey);

backend/src/billing.rs

@@ -78,12 +78,6 @@ struct CoinbaseSpotPriceData {
     amount: String,
 }
 
-enum NwcInvoicePaymentOutcome {
-    Paid,
-    Fallback(anyhow::Error),
-    Pending(anyhow::Error),
-}
-
 #[derive(Clone)]
 pub struct Billing {
     nwc_url: String,
@@ -120,10 +114,6 @@ impl Billing {
     pub async fn start(self) {
         let mut rx = self.command.notify.subscribe();
 
-        if let Err(error) = self.reconcile_relay_subscriptions("startup").await {
-            tracing::error!(error = %error, "failed to reconcile relay billing state on startup");
-        }
-
         loop {
             match rx.recv().await {
                 Ok(activity) => {
@@ -133,39 +123,12 @@ impl Billing {
                 }
                 Err(tokio::sync::broadcast::error::RecvError::Lagged(n)) => {
                     tracing::warn!(missed = n, "billing lagged");
-
-                    if let Err(error) = self.reconcile_relay_subscriptions("lagged").await {
-                        tracing::error!(error = %error, "failed to reconcile relay billing state after lag");
-                    }
                 }
                 Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
             }
         }
     }
 
-    async fn reconcile_relay_subscriptions(&self, source: &str) -> Result<()> {
-        let relays = self.query.list_relays().await?;
-
-        if relays.is_empty() {
-            return Ok(());
-        }
-
-        tracing::info!(source, relay_count = relays.len(), "reconciling relay billing state");
-
-        for relay in relays {
-            if let Err(error) = self.sync_relay_subscription_for_relay(&relay).await {
-                tracing::error!(
-                    source,
-                    relay = %relay.id,
-                    error = %error,
-                    "failed to reconcile relay billing state"
-                );
-            }
-        }
-
-        Ok(())
-    }
-
     async fn handle_activity(&self, activity: &Activity) -> Result<()> {
         let needs_billing_sync = matches!(
             activity.activity_type.as_str(),
@@ -189,10 +152,6 @@ impl Billing {
             return Ok(());
         };
 
-        self.sync_relay_subscription_for_relay(&relay).await
-    }
-
-    async fn sync_relay_subscription_for_relay(&self, relay: &Relay) -> Result<()> {
         let Some(tenant) = self.query.get_tenant(&relay.tenant).await? else {
             return Ok(());
         };
@@ -301,23 +260,6 @@ impl Billing {
         Ok(())
     }
 
-    async fn existing_invoice_nwc_payment_outcome(
-        &self,
-        invoice_id: &str,
-    ) -> Result<Option<NwcInvoicePaymentOutcome>> {
-        let state = self.query.get_invoice_nwc_payment_state(invoice_id).await?;
-        match state.as_deref() {
-            Some("paid") => Ok(Some(NwcInvoicePaymentOutcome::Paid)),
-            Some("pending") => Ok(Some(NwcInvoicePaymentOutcome::Pending(anyhow!(
-                "invoice {invoice_id} has a pending NWC reconciliation; refusing to create a new Lightning charge"
-            )))),
-            Some(other) => Err(anyhow!(
-                "unknown invoice_nwc_payment state '{other}' for invoice {invoice_id}"
-            )),
-            None => Ok(None),
-        }
-    }
-
     pub async fn handle_webhook(&self, payload: &str, signature: &str) -> Result<()> {
         self.verify_webhook_signature(payload, signature)?;
 
@@ -422,21 +364,15 @@ impl Billing {
         // 1. NWC auto-pay: if the tenant has a nwc_url
         if !tenant.nwc_url.is_empty() {
             match self
-                .nwc_pay_invoice(
-                    invoice_id,
-                    &tenant.pubkey,
-                    amount_due,
-                    currency,
-                    &tenant.nwc_url,
-                )
-                .await?
+                .nwc_pay_invoice(amount_due, currency, &tenant.nwc_url)
+                .await
             {
-                NwcInvoicePaymentOutcome::Paid => {
-                    self.mark_invoice_paid_out_of_band_after_nwc(invoice_id, &tenant.pubkey)
-                        .await?;
+                Ok(()) => {
+                    self.stripe_pay_invoice_out_of_band(invoice_id).await?;
+                    self.command.clear_tenant_nwc_error(&tenant.pubkey).await?;
                     return Ok(());
                 }
-                NwcInvoicePaymentOutcome::Fallback(e) => {
+                Err(e) => {
                     let error_msg = format!("{e}");
                     self.command
                         .set_tenant_nwc_error(&tenant.pubkey, &error_msg)
@@ -451,20 +387,6 @@ impl Billing {
                     nwc_error_for_dm = summarize_nwc_error_for_dm(&error_msg);
                     // Fall through to next option
                 }
-                NwcInvoicePaymentOutcome::Pending(e) => {
-                    let error_msg = format!("{e}");
-                    self.command
-                        .set_tenant_nwc_error(&tenant.pubkey, &error_msg)
-                        .await?;
-                    tracing::error!(
-                        error = %e,
-                        tenant_pubkey = %tenant.pubkey,
-                        stripe_customer_id,
-                        invoice_id,
-                        "nwc auto-payment requires reconciliation before retry"
-                    );
-                    return Err(e);
-                }
             }
         }
 
@@ -828,28 +750,21 @@ impl Billing {
             }
 
             match self
-                .nwc_pay_invoice(
-                    invoice_id,
-                    &tenant.pubkey,
-                    amount_due,
-                    currency,
-                    &tenant.nwc_url,
-                )
-                .await?
+                .nwc_pay_invoice(amount_due, currency, &tenant.nwc_url)
+                .await
             {
-                NwcInvoicePaymentOutcome::Paid => {
-                    if let Err(e) = self
-                        .mark_invoice_paid_out_of_band_after_nwc(invoice_id, &tenant.pubkey)
-                        .await
-                    {
+                Ok(()) => {
+                    if let Err(e) = self.stripe_pay_invoice_out_of_band(invoice_id).await {
                         tracing::error!(
                             error = %e,
                             invoice_id,
                             "failed to mark invoice paid out of band"
                         );
+                    } else {
+                        let _ = self.command.clear_tenant_nwc_error(&tenant.pubkey).await;
                     }
                 }
-                NwcInvoicePaymentOutcome::Fallback(e) => {
+                Err(e) => {
                     let error_msg = format!("{e}");
                     tracing::error!(
                         error = %e,
@@ -861,18 +776,6 @@ impl Billing {
                         .set_tenant_nwc_error(&tenant.pubkey, &error_msg)
                         .await;
                 }
-                NwcInvoicePaymentOutcome::Pending(e) => {
-                    let error_msg = format!("{e}");
-                    tracing::error!(
-                        error = %e,
-                        invoice_id,
-                        "outstanding invoice requires NWC reconciliation before retry"
-                    );
-                    let _ = self
-                        .command
-                        .set_tenant_nwc_error(&tenant.pubkey, &error_msg)
-                        .await;
-                }
             }
         }
 
@@ -1128,47 +1031,19 @@ impl Billing {
 
     // --- NWC helpers ---
 
-    async fn mark_invoice_paid_out_of_band_after_nwc(
-        &self,
-        invoice_id: &str,
-        tenant_pubkey: &str,
-    ) -> Result<()> {
-        self.stripe_pay_invoice_out_of_band(invoice_id).await?;
-        self.command.clear_tenant_nwc_error(tenant_pubkey).await?;
-        Ok(())
-    }
-
-    fn parse_nwc_uri(nwc_url: &str, role: &str) -> Result<NostrWalletConnectURI> {
-        nwc_url
-            .parse::<NostrWalletConnectURI>()
-            .map_err(|_| anyhow!("invalid {role} NWC URL"))
-    }
-
     async fn nwc_pay_invoice(
         &self,
-        invoice_id: &str,
-        tenant_pubkey: &str,
         amount_due_minor: i64,
         currency: &str,
         tenant_nwc_url: &str,
-    ) -> Result<NwcInvoicePaymentOutcome> {
-        if let Some(existing_outcome) = self
-            .existing_invoice_nwc_payment_outcome(invoice_id)
-            .await?
-        {
-            return Ok(existing_outcome);
-        }
-
-        let amount_msats = match self.fiat_minor_to_msats(amount_due_minor, currency).await {
-            Ok(amount_msats) => amount_msats,
-            Err(error) => return Ok(NwcInvoicePaymentOutcome::Fallback(error)),
-        };
+    ) -> Result<()> {
+        let amount_msats = self.fiat_minor_to_msats(amount_due_minor, currency).await?;
 
         // Create a bolt11 invoice using the system wallet (self.nwc_url)
-        let system_uri = match Self::parse_nwc_uri(&self.nwc_url, "system") {
-            Ok(system_uri) => system_uri,
-            Err(error) => return Ok(NwcInvoicePaymentOutcome::Fallback(error)),
-        };
+        let system_uri: NostrWalletConnectURI = self
+            .nwc_url
+            .parse()
+            .map_err(|_| anyhow!("invalid system NWC URL"))?;
         let system_nwc = NWC::new(system_uri);
 
         let make_req = MakeInvoiceRequest {
@@ -1178,61 +1053,29 @@ impl Billing {
             expiry: None,
         };
 
-        let invoice_response = system_nwc.make_invoice(make_req).await;
-
-        let invoice_response = match invoice_response {
-            Ok(invoice_response) => invoice_response,
-            Err(error) => {
-                system_nwc.shutdown().await;
-                return Ok(NwcInvoicePaymentOutcome::Fallback(anyhow!(
-                    "failed to create invoice: {error}"
-                )));
-            }
-        };
+        let invoice_response = system_nwc
+            .make_invoice(make_req)
+            .await
+            .map_err(|e| anyhow!("failed to create invoice: {e}"))?;
 
         system_nwc.shutdown().await;
 
         // Pay the bolt11 invoice using the tenant's wallet
-        let tenant_uri = match Self::parse_nwc_uri(tenant_nwc_url, "tenant") {
-            Ok(tenant_uri) => tenant_uri,
-            Err(error) => return Ok(NwcInvoicePaymentOutcome::Fallback(error)),
-        };
-
-        if !self
-            .command
-            .insert_pending_invoice_nwc_payment(invoice_id, tenant_pubkey)
-            .await?
-        {
-            if let Some(existing_outcome) = self
-                .existing_invoice_nwc_payment_outcome(invoice_id)
-                .await?
-            {
-                return Ok(existing_outcome);
-            }
-            return Err(anyhow!(
-                "invoice_nwc_payment row missing after insert race for invoice {invoice_id}"
-            ));
-        }
-
+        let tenant_uri: NostrWalletConnectURI = tenant_nwc_url
+            .parse()
+            .map_err(|_| anyhow!("invalid tenant NWC URL"))?;
         let tenant_nwc = NWC::new(tenant_uri);
 
         let pay_req = NwcPayInvoiceRequest::new(invoice_response.invoice);
 
-        let pay_result = tenant_nwc.pay_invoice(pay_req).await;
+        tenant_nwc
+            .pay_invoice(pay_req)
+            .await
+            .map_err(|e| anyhow!("failed to pay invoice: {e}"))?;
 
         tenant_nwc.shutdown().await;
 
-        match pay_result {
-            Ok(_) => match self.command.mark_invoice_nwc_payment_paid(invoice_id).await {
-                Ok(()) => Ok(NwcInvoicePaymentOutcome::Paid),
-                Err(error) => Ok(NwcInvoicePaymentOutcome::Pending(anyhow!(
-                    "invoice {invoice_id} was charged over NWC but failed to persist paid state: {error}"
-                ))),
-            },
-            Err(error) => Ok(NwcInvoicePaymentOutcome::Pending(anyhow!(
-                "invoice {invoice_id} NWC payment attempt requires reconciliation: {error}"
-            ))),
-        }
+        Ok(())
     }
 
     async fn fiat_minor_to_msats(&self, amount_due_minor: i64, currency: &str) -> Result<u64> {

backend/src/command.rs

@@ -113,12 +113,12 @@ impl Command {
 
         sqlx::query(
             "INSERT INTO relay (
-                id, tenant, schema, subdomain, plan, status, synced, sync_error,
+                id, tenant, schema, subdomain, plan, status, sync_error,
                 info_name, info_icon, info_description,
                 policy_public_join, policy_strip_signatures,
                 groups_enabled, management_enabled, blossom_enabled,
                 livekit_enabled, push_enabled
-            ) VALUES (?, ?, ?, ?, ?, 'active', 0, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+            ) VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
         )
         .bind(&relay.id)
         .bind(&relay.tenant)
@@ -151,7 +151,7 @@ impl Command {
 
         sqlx::query(
             "UPDATE relay
-             SET tenant = ?, schema = ?, subdomain = ?, plan = ?, status = ?, sync_error = ?, synced = 0,
+             SET tenant = ?, schema = ?, subdomain = ?, plan = ?, status = ?, sync_error = ?,
                  info_name = ?, info_icon = ?, info_description = ?,
                  policy_public_join = ?, policy_strip_signatures = ?,
                  groups_enabled = ?, management_enabled = ?, blossom_enabled = ?,
@@ -203,7 +203,7 @@ impl Command {
     ) -> Result<()> {
         let mut tx = self.pool.begin().await?;
 
-        sqlx::query("UPDATE relay SET status = ?, synced = 0 WHERE id = ?")
+        sqlx::query("UPDATE relay SET status = ? WHERE id = ?")
             .bind(status)
             .bind(relay_id)
             .execute(&mut *tx)
@@ -224,7 +224,7 @@ impl Command {
     pub async fn fail_relay_sync(&self, relay: &Relay, sync_error: String) -> Result<()> {
         let mut tx = self.pool.begin().await?;
 
-        sqlx::query("UPDATE relay SET synced = 0, sync_error = ? WHERE id = ?")
+        sqlx::query("UPDATE relay SET sync_error = ? WHERE id = ?")
             .bind(&sync_error)
             .bind(&relay.id)
             .execute(&mut *tx)
@@ -313,46 +313,6 @@ impl Command {
         Ok(())
     }
 
-    pub async fn insert_pending_invoice_nwc_payment(
-        &self,
-        invoice_id: &str,
-        tenant_pubkey: &str,
-    ) -> Result<bool> {
-        let now = chrono::Utc::now().timestamp();
-        let result = sqlx::query(
-            "INSERT INTO invoice_nwc_payment (invoice_id, tenant_pubkey, state, created_at, updated_at)
-             VALUES (?, ?, 'pending', ?, ?)
-             ON CONFLICT(invoice_id) DO NOTHING",
-        )
-        .bind(invoice_id)
-        .bind(tenant_pubkey)
-        .bind(now)
-        .bind(now)
-        .execute(&self.pool)
-        .await?;
-
-        Ok(result.rows_affected() > 0)
-    }
-
-    pub async fn mark_invoice_nwc_payment_paid(&self, invoice_id: &str) -> Result<()> {
-        let now = chrono::Utc::now().timestamp();
-        let result = sqlx::query(
-            "UPDATE invoice_nwc_payment
-             SET state = 'paid', updated_at = ?
-             WHERE invoice_id = ?",
-        )
-        .bind(now)
-        .bind(invoice_id)
-        .execute(&self.pool)
-        .await?;
-
-        if result.rows_affected() == 0 {
-            anyhow::bail!("invoice_nwc_payment row missing for invoice_id: {invoice_id}");
-        }
-
-        Ok(())
-    }
-
     pub async fn set_tenant_past_due(&self, pubkey: &str) -> Result<()> {
         let now = chrono::Utc::now().timestamp();
         sqlx::query("UPDATE tenant SET past_due_at = ? WHERE pubkey = ?")

backend/src/infra.rs

@@ -53,8 +53,8 @@ impl Infra {
     pub async fn start(self) {
         let mut rx = self.command.notify.subscribe();
 
-        if let Err(error) = self.reconcile_relay_state("startup").await {
-            tracing::error!(error = %error, "failed to reconcile relay state on startup");
+        if let Err(e) = self.schedule_startup_retries().await {
+            tracing::error!(error = %e, "failed to schedule relay sync retries on startup");
         }
 
         loop {
@@ -66,10 +66,6 @@ impl Infra {
                 }
                 Err(tokio::sync::broadcast::error::RecvError::Lagged(n)) => {
                     tracing::warn!(missed = n, "infra lagged");
-
-                    if let Err(error) = self.reconcile_relay_state("lagged").await {
-                        tracing::error!(error = %error, "failed to reconcile relay state after lag");
-                    }
                 }
                 Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
             }
@@ -93,28 +89,17 @@ impl Infra {
             return Ok(());
         };
 
-        let is_new = self.relay_sync_is_new(&relay).await?;
+        let is_new = relay.synced == 0;
         self.sync_and_report(&relay, is_new).await;
 
         Ok(())
     }
 
-    async fn reconcile_relay_state(&self, source: &str) -> Result<()> {
-        let relays = self.query.list_relays_pending_sync().await?;
-
-        if relays.is_empty() {
-            return Ok(());
-        }
-
-        tracing::info!(source, relay_count = relays.len(), "reconciling pending relay state");
+    async fn schedule_startup_retries(&self) -> Result<()> {
+        let relays = self.query.list_relays_with_sync_error().await?;
 
         for relay in relays {
-            if relay.sync_error.trim().is_empty() {
-                let is_new = self.relay_sync_is_new(&relay).await?;
-                self.sync_and_report(&relay, is_new).await;
-            } else {
-                self.schedule_relay_sync_retry(&relay.id, source).await?;
-            }
+            self.schedule_relay_sync_retry(&relay.id, "startup").await?;
         }
 
         Ok(())
@@ -166,20 +151,11 @@ impl Infra {
             return Ok(());
         }
 
-        let is_new = self.relay_sync_is_new(&relay).await?;
+        let is_new = relay.synced == 0;
         self.sync_and_report(&relay, is_new).await;
         Ok(())
     }
 
-    async fn relay_sync_is_new(&self, relay: &Relay) -> Result<bool> {
-        if relay.synced == 1 {
-            return Ok(false);
-        }
-
-        let has_completed_sync = self.query.relay_has_completed_sync(&relay.id).await?;
-        Ok(!has_completed_sync)
-    }
-
     async fn sync_and_report(&self, relay: &Relay, is_new: bool) {
         match self.sync_relay(relay, is_new).await {
             Ok(()) => {

backend/src/query.rs

@@ -94,7 +94,7 @@ impl Query {
         Ok(rows)
     }
 
-    pub async fn list_relays_pending_sync(&self) -> Result<Vec<Relay>> {
+    pub async fn list_relays_with_sync_error(&self) -> Result<Vec<Relay>> {
         let rows = sqlx::query_as::<_, Relay>(
             "SELECT id, tenant, schema, subdomain, plan, stripe_subscription_item_id,
                      status, sync_error,
@@ -103,7 +103,7 @@ impl Query {
                      groups_enabled, management_enabled, blossom_enabled,
                      livekit_enabled, push_enabled, synced
               FROM relay
-              WHERE synced = 0 OR TRIM(sync_error) != ''
+              WHERE TRIM(sync_error) != ''
               ORDER BY id",
         )
         .fetch_all(&self.pool)
@@ -161,16 +161,6 @@ impl Query {
         Ok(row)
     }
 
-    pub async fn get_invoice_nwc_payment_state(&self, invoice_id: &str) -> Result<Option<String>> {
-        let state = sqlx::query_scalar::<_, String>(
-            "SELECT state FROM invoice_nwc_payment WHERE invoice_id = ?",
-        )
-        .bind(invoice_id)
-        .fetch_optional(&self.pool)
-        .await?;
-        Ok(state)
-    }
-
     pub async fn has_active_paid_relays(&self, tenant_id: &str) -> Result<bool> {
         let plans = sqlx::query_scalar::<_, String>(
             "SELECT plan FROM relay WHERE tenant = ? AND status = 'active'",
@@ -194,20 +184,4 @@ impl Query {
         .await?;
         Ok(rows)
     }
-
-    pub async fn relay_has_completed_sync(&self, relay_id: &str) -> Result<bool> {
-        let found = sqlx::query_scalar::<_, i64>(
-            "SELECT 1
-             FROM activity
-             WHERE resource_type = 'relay'
-               AND resource_id = ?
-               AND activity_type = 'complete_relay_sync'
-             LIMIT 1",
-        )
-        .bind(relay_id)
-        .fetch_optional(&self.pool)
-        .await?;
-
-        Ok(found.is_some())
-    }
 }