feat: add /donate page with Stripe embedded checkout and Cloudflare Worker backend by alexwolson · Pull Request #118 · CivicTechTO/civictech.ca

alexwolson · 2026-05-05T13:01:27Z

The below PR notes are generated by Claude as a result of the work I've done on this. Everything I'm adding here, I've personally tested end-to-end using Stripe's official testing protocols. Secure information is exclusively handled by Stripe, using our already-existing CTTO stripe account which is connected to our bank account directly. There is no opportunity for information leakage here, and I volunteer to make the first real donation in order to demonstrate that everything is set up properly.

Summary

Adds a /donate/ page to civictech.ca for the 2027 food funding campaign, with a goal of raising $3,500 CAD to cover samosas across 50 Tuesday meetups
Implements a Cloudflare Worker (ctt-donations.ctt-donations.workers.dev) with three endpoints: GET /total, POST /checkout, POST /webhook
Persists a live donation total in Cloudflare KV, displayed as a progress bar on the page
Stripe Embedded Checkout renders inline on the page — donors never leave civictech.ca and no card data touches our infrastructure
Two new GitHub Actions secrets required before this will build: STRIPE_PUBLIC_KEY and WORKER_URL

Architecture

flowchart LR
    Page["civictech.ca/donate/\nJekyll static page"]
    Worker["Cloudflare Worker"]
    KV["Cloudflare KV\nrunning total"]
    Stripe["Stripe\npayment + events"]

    Page -- "GET /total" --> Worker
    Page -- "POST /checkout" --> Worker
    Worker -- "clientSecret" --> Page
    Page -- "card details" --> Stripe
    Stripe -- "POST /webhook" --> Worker
    Worker -- "read/write total_cents" --> KV

Jekyll page (_pages/donate.html): campaign explainer, live progress bar, preset amount buttons ($10 / $25 / $50 / custom / Sponsor a Tuesday $65 / Sponsor a month $260), donate button, embedded checkout mount, and thank-you state on return from Stripe.

Cloudflare Worker (worker/): plain JS, no framework, deployed to Cloudflare's edge. Stripe secret key and webhook secret live in Cloudflare Worker secrets (never in the repository).

Cloudflare KV: stores a single key total_cents. Incremented on each checkout.session.completed webhook event.

Stripe: processes card payments via Embedded Checkout (ui_mode: embedded). Fires checkout.session.completed webhook on success. Automatic email receipts enabled. Currency: CAD.

Files changed

File	What changed
`_pages/donate.html`	New page: campaign copy, progress bar, amount selector, Stripe checkout integration
`worker/src/index.js`	Worker entry point: `GET /total`, `POST /checkout`, `POST /webhook` handlers
`worker/src/validate.js`	`validateAmount()` — validates donation amount (integer, $1–$3,500)
`worker/src/webhook.js`	`incrementTotal()` and `verifyStripeSignature()` (HMAC-SHA256 via Web Crypto API)
`worker/test/`	Vitest unit tests for validate and webhook functions
`worker/wrangler.toml`	Cloudflare Worker config with KV namespace binding
`worker/package.json`	Worker dependencies (wrangler, vitest)
`.github/workflows/pages.yml`	Adds `STRIPE_PUBLIC_KEY` and `WORKER_URL` secret injection at build time

Security

Card data is handled exclusively by Stripe — it never touches the Worker or the Jekyll page
Stripe webhook endpoint is protected by HMAC-SHA256 signature verification using STRIPE_WEBHOOK_SECRET (stored in Cloudflare Worker secrets)
STRIPE_SECRET_KEY lives in Cloudflare Worker secrets, never in the repository
STRIPE_PUBLIC_KEY is a publishable key — safe to embed in page JS
Cloudflare KV stores only a single integer (running total in cents) — no PII, no card data
CORS restricts Worker access to https://civictech.ca only in production

Before merging

Two GitHub Actions secrets must be added in repo Settings → Secrets → Actions:

Secret	Description
`STRIPE_PUBLIC_KEY`	Stripe publishable key (`pk_live_...` for production)
`WORKER_URL`	`https://ctt-donations.ctt-donations.workers.dev`

Testing performed

Validated all three Worker endpoints locally and against the deployed Worker
Completed test payments using Stripe test card 4242 4242 4242 4242 across multiple preset amounts and a custom amount
Confirmed checkout.session.completed webhook fires, signature verification passes, and KV total increments correctly
Confirmed thank-you state renders on return from Stripe with ?session_id= in URL
Confirmed progress bar updates to reflect live total
Worker unit tests: 23 tests passing (validateAmount, incrementTotal, verifyStripeSignature)

Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Remove locally-added test keys from _config.yml - Fix "Sponsor a month" amount: $270 → $260 ($65 × 4) - Update explainer copy: clearer framing of what donations cover - Remove em dashes from all copy - Fix thank-you message to reflect food funding, not general operations Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-05-05T13:04:51Z

Pa11y Accessibility Report

✅ All pages passed — 0 warning(s) (WCAG2AA)

Homepage

✅ No issues found.

Event

✅ No issues found.

Project

✅ No issues found.

Person

✅ No issues found.

Organization

✅ No issues found.

Venue

✅ No issues found.

Resource

✅ No issues found.

Tag

✅ No issues found.

Pull request overview

Adds a new /donate/ page to the Jekyll site and a Cloudflare Worker backend to support Stripe Embedded Checkout plus a live donation progress total stored in Cloudflare KV.

Changes:

Adds Cloudflare Worker with GET /total, POST /checkout, and POST /webhook endpoints and supporting validation/helpers.
Adds a new /donate/ Jekyll page that displays a live progress bar and mounts Stripe Embedded Checkout inline.
Updates GitHub Pages workflow to inject Stripe publishable key and Worker URL into _config.yml at build time.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`worker/wrangler.toml`	Configures the Cloudflare Worker entrypoint and KV binding.
`worker/vitest.config.js`	Sets up Vitest configuration for Worker unit tests.
`worker/test/webhook.test.js`	Adds unit tests for KV total increment logic.
`worker/test/validate.test.js`	Adds unit tests for donation amount validation.
`worker/src/webhook.js`	Implements KV counter update and Stripe webhook signature verification.
`worker/src/validate.js`	Implements donation amount validation rules.
`worker/src/index.js`	Implements Worker routing + Stripe Checkout Session creation + webhook handler.
`worker/package.json`	Adds Worker dev tooling dependencies and npm scripts.
`worker/package-lock.json`	Locks Worker npm dependency tree.
`worker/.gitignore`	Ignores Worker-local artifacts (`node_modules`, Wrangler state, local vars).
`docs/superpowers/specs/2026-05-04-donation-campaign-design.md`	Adds design spec documenting the donation architecture and UX.
`docs/superpowers/plans/2026-05-04-donation-campaign.md`	Adds implementation plan and operational/testing runbook.
`.github/workflows/pages.yml`	Injects `STRIPE_PUBLIC_KEY` and `WORKER_URL` into Jekyll config during CI build.
`_pages/donate.html`	Adds `/donate/` page UI + Stripe Embedded Checkout client integration.

Files not reviewed (1)

worker/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

node-addon-api and node-gyp were listed as runtime deps but the Worker uses no native addons. Removed them and regenerated the lockfile. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replaced signatures.includes(computed) string comparison with crypto.subtle.verify, which performs a constant-time comparison internally and avoids timing side-channels. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Covers valid signature, wrong signature, multiple v1 values (key rotation), tampered body, wrong secret, and malformed headers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…victech.ca Previously the fallback set Access-Control-Allow-Origin to civictech.ca for every origin, which incorrectly told browsers all origins were allowed. Now the header is only included for origins in the allowlist. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Check r.ok before parsing JSON so non-2xx responses fall through to the catch handler rather than producing NaN UI state - Guard against missing/non-finite raised_cents - Clamp rendered dollars to 3500 so the <progress> bar never exceeds max Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…erance - Trim whitespace around comma-separated header fields - Skip malformed fields (no '=' or empty value) - Reject non-numeric timestamps - Reject signatures older than 5 minutes or more than 5 minutes in the future (Stripe replay-attack mitigation) - Update tests to use dynamic timestamps and cover new cases Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 10 comments.

Files not reviewed (1)

worker/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Returning 400 causes Stripe to retry for days with no benefit since the payload won't change. Log the anomaly for manual reconciliation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 6 comments.

Files not reviewed (1)

worker/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

gabesawhney

Looks good?

Khasir · 2026-05-11T15:36:15Z

I have 2 questions:

I assume the new Cloudflare Workers fall under the free tier and won't accrue any costs?
Does this change any part of the local testing & deployment process?

alexwolson · 2026-05-17T07:22:27Z

I have 2 questions:

I assume the new Cloudflare Workers fall under the free tier and won't accrue any costs?

Does this change any part of the local testing & deployment process?

This is correct!
Good question - the new code can be tested locally by providing test API keys from Stripe. For deployment, nothing changes really. I added new public secrets to the GitHub repo and that's all we need.

Khasir

I'll approve! @alexwolson for any changes/additions to testing do you think it makes sense to update the readme in another PR?

alexwolson · 2026-05-19T12:30:48Z

I'll approve! @alexwolson for any changes/additions to testing do you think it makes sense to update the readme in another PR?

Definitely!

alexwolson · 2026-05-19T12:32:09Z

Not adding for now as there are further discussions happening re. funding.

alexwolson and others added 13 commits May 4, 2026 19:48

Add donation campaign page design spec

335ff5d

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add donation campaign implementation plan

9493659

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: scaffold Cloudflare Worker for donation campaign

11cf918

feat: implement validateAmount with tests

0776784

feat: implement incrementTotal and verifyStripeSignature with tests

999e81a

feat: implement Worker routing and endpoint handlers

5fd1db8

feat: add donation campaign page with embedded Stripe checkout

b0bd7e0

chore: inject Stripe public key and Worker URL at build time

934e394

chore: set real Cloudflare KV namespace ID

7d55f6c

Update dependencies

541cf5c

fix: allow 127.0.0.1 CORS origin; derive return_url from request origin

9e9548d

chore: gitignore .wrangler/ cache directory

e848ede

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

alexwolson requested a review from Copilot May 5, 2026 13:04

Copilot started reviewing on behalf of alexwolson May 5, 2026 13:05 View session

alexwolson added 3 commits May 5, 2026 09:06

Delete docs/superpowers/specs/2026-05-04-donation-campaign-design.md

a5f7feb

Update maximum donation limit to $3,500.00

3f4f97e

Update test for maximum donation limit

9bfd4db

Copilot AI reviewed May 5, 2026

View reviewed changes

alexwolson and others added 8 commits May 5, 2026 09:22

chore: remove unused native build dependencies from worker

b76b99f

node-addon-api and node-gyp were listed as runtime deps but the Worker uses no native addons. Removed them and regenerated the lockfile. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: update stale $10,000 maximum test to match $3,500 limit

4c3131d

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

test: add unit tests for verifyStripeSignature

1adbc58

Covers valid signature, wrong signature, multiple v1 values (key rotation), tampered body, wrong secret, and malformed headers. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: handle invalid JSON in webhook body with 400 instead of 500

79e4fc0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

alexwolson requested a review from Copilot May 5, 2026 13:29

Copilot started reviewing on behalf of alexwolson May 5, 2026 13:30 View session

Copilot AI reviewed May 5, 2026

View reviewed changes

alexwolson and others added 9 commits May 5, 2026 10:24

Potential fix for pull request finding

6b088f7

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

fix: fail CI fast when donate page secrets are missing

f7e5a0d

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: guard against malformed hex in Stripe signature v1 values

521f179

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: treat corrupted KV total as 0 instead of propagating NaN

e8ef6d5

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: deduplicate Stripe webhook events using event.id in KV

1765206

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: validate amount_total before incrementing KV total

0926236

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: return 200 + log on invalid amount_total instead of 400

4cecf96

Returning 400 causes Stripe to retry for days with no benefit since the payload won't change. Log the anomaly for manual reconciliation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: guard against missing Stripe config before initialising SDK

ba2f6bd

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: add aria-pressed to amount selection buttons for screen readers

e136532

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

alexwolson requested a review from Copilot May 5, 2026 14:25

Copilot started reviewing on behalf of alexwolson May 5, 2026 14:26 View session

Copilot AI reviewed May 5, 2026

View reviewed changes

Comment thread worker/src/webhook.js

Comment thread worker/src/index.js

Comment thread worker/src/index.js

Comment thread .github/workflows/pages.yml

Comment thread worker/package.json

Comment thread _pages/donate.html

alexwolson requested review from Khasir, gabesawhney and jamiepantling May 5, 2026 14:32

gabesawhney approved these changes May 5, 2026

View reviewed changes

Khasir approved these changes May 18, 2026

View reviewed changes

alexwolson closed this May 19, 2026

alexwolson deleted the samosas branch July 21, 2026 22:51

Uh oh!

Conversation

alexwolson commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Architecture

Files changed

Security

Before merging

Testing performed

Uh oh!

github-actions Bot commented May 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pa11y Accessibility Report

Homepage

Event

Project

Person

Organization

Venue

Resource

Tag

Category

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gabesawhney left a comment

Choose a reason for hiding this comment

Uh oh!

Khasir commented May 11, 2026

Uh oh!

alexwolson commented May 17, 2026

Uh oh!

Khasir left a comment

Choose a reason for hiding this comment

Uh oh!

alexwolson commented May 19, 2026

Uh oh!

alexwolson commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

alexwolson commented May 5, 2026 •

edited

Loading

github-actions Bot commented May 5, 2026 •

edited

Loading