low-priority fixes: ADMIN_TOKEN hard boot guard + invoice.paid subscription check

app/billing.py

@@ -319,19 +319,24 @@ async def handle_subscription_event(db: AsyncSession, event: dict) -> dict:
         log.info("stripe: subscription deleted -> chatbot OFF for %s", tenant.slug)
         return {"status": "disabled", "slug": tenant.slug}
     if etype == "invoice.paid":
+        # #28: check the subscription match FIRST, for both branches uniformly.
+        # Previously an ALREADY-enabled tenant returned "enabled" unconditionally
+        # without ever checking sub_id — harmless today (no mutation on that
+        # path), but the status was misleading and would silently mask a bug if
+        # that branch ever grew to mutate state on a stale/mismatched invoice.
+        sub_id = _invoice_subscription_id(obj)
+        if not sub_id or sub_id != tenant.stripe_subscription_id:
+            # Late/out-of-order invoice for a subscription that is no longer
+            # this tenant's active one — never act on it either way.
+            log.info("stripe: invoice paid for %s ignored (subscription %r "
+                     "does not match)", tenant.slug, sub_id)
+            return {"status": "subscription_mismatch", "slug": tenant.slug}
         if not tenant.chatbot_enabled:
             if tenant.disabled_reason == "admin":
                 # Manually paused by the owner — only the owner may re-enable.
                 log.info("stripe: invoice paid but %s is admin-paused; staying OFF",
                          tenant.slug)
                 return {"status": "admin_paused", "slug": tenant.slug}
-            sub_id = _invoice_subscription_id(obj)
-            if not sub_id or sub_id != tenant.stripe_subscription_id:
-                # Late/out-of-order invoice for a subscription that is no
-                # longer this tenant's active one — do not resurrect.
-                log.info("stripe: invoice paid for %s ignored (subscription %r "
-                         "does not match)", tenant.slug, sub_id)
-                return {"status": "subscription_mismatch", "slug": tenant.slug}
             tenant.chatbot_enabled = True
             tenant.disabled_reason = ""
             await db.flush()

app/main.py

@@ -79,8 +79,15 @@ def _check_security(settings) -> None:
     """Fail fast on insecure production config. Skipped under testing."""
     if settings.testing:
         return
+    # #27: an empty ADMIN_TOKEN previously only warned — the admin API/panel fails
+    # closed (never a security hole), but a misconfigured deploy would silently
+    # break the outreach machine's automation (it authenticates as admin) with no
+    # loud signal. Crash loudly instead, same as the SECRET_KEY guard below.
     if not settings.admin_token:
-        log.warning("ADMIN_TOKEN is empty — the admin panel/API will reject all requests")
+        raise RuntimeError(
+            "ADMIN_TOKEN is empty. Set it as a Space/env secret before starting "
+            "(the admin panel/API and the outreach automation both need it)."
+        )
     # Every tenant's Shopify/WhatsApp secret is encrypted with secret_key, so a
     # public default would let anyone decrypt them. Crash loudly, never run insecure.
     if settings.secret_key == "dev-insecure-change-me":

tests/test_billing.py

@@ -366,6 +366,30 @@ async def test_invoice_paid_matching_subscription_reenables(db_session):
         assert t.disabled_reason == "", slug
 
 
+async def test_invoice_paid_for_already_enabled_tenant_checks_subscription_too(db_session):
+    """#28: an ALREADY-enabled tenant used to return 'enabled' unconditionally
+    for ANY invoice.paid on their customer id, without checking the invoice's
+    subscription matches their CURRENT one. A stale invoice for an old/replaced
+    subscription must report subscription_mismatch, same as the disabled path."""
+    t = Tenant(slug="yaactiva", name="yaactiva", stripe_customer_id="cus_ya",
+              stripe_subscription_id="sub_actual", chatbot_enabled=True, disabled_reason="")
+    db_session.add(t)
+    await db_session.flush()
+
+    r = await billing.handle_subscription_event(
+        db_session, _paid_event("cus_ya", {"subscription": "sub_VIEJA"})
+    )
+    assert r["status"] == "subscription_mismatch"
+    await db_session.refresh(t)
+    assert t.chatbot_enabled is True  # untouched either way — just the status was misleading
+
+    # the matching subscription still reports "enabled" as before
+    r2 = await billing.handle_subscription_event(
+        db_session, _paid_event("cus_ya", {"subscription": "sub_actual"})
+    )
+    assert r2["status"] == "enabled"
+
+
 async def test_invoice_paid_mismatched_or_missing_subscription_stays_off(db_session):
     t = await _disabled_tenant(
         db_session, slug="desfase", customer="cus_mis", sub="sub_actual", reason="billing"

tests/test_security.py

@@ -20,6 +20,17 @@ def test_default_secret_key_refuses_to_boot_in_prod():
         _check_security(_settings(secret_key="dev-insecure-change-me"))
 
 
+def test_empty_admin_token_refuses_to_boot_in_prod():
+    """#27: was a silent warning — a misconfigured deploy would break the admin
+    API and the outreach automation (authenticates as admin) with no loud signal."""
+    with pytest.raises(RuntimeError, match="ADMIN_TOKEN"):
+        _check_security(_settings(admin_token=""))
+
+
+def test_empty_admin_token_skipped_under_testing():
+    _check_security(_settings(testing=True, admin_token=""))  # no raise
+
+
 def test_strong_secret_key_boots():
     _check_security(_settings())  # no raise