Charges API (Java / Spring Boot)

Small payments service. Exposes POST /charges (idempotent), GET /charges/{id}, and GET /customers/search?email=.

Configuration

Secrets are read from a local .env file (gitignored), never hardcoded. Before running, copy the template and fill in real values:

cp .env.example .env
# then edit .env and set STRIPE_API_KEY=...

Spring Boot loads .env at startup via spring.config.import (see src/main/resources/application.properties). In CI/production, supply STRIPE_API_KEY as a real environment variable instead of a file.

Run

mvn spring-boot:run

The API listens on http://localhost:8080.

Quick smoke test

curl -X POST http://localhost:8080/charges \
  -H "Content-Type: application/json" \
  -d '{"idempotencyKey":"k1","amount":12.50,"currency":"USD","customerEmail":"a@b.com","cardToken":"tok_visa"}'

Design notes

• docs/idempotency.md — how POST /charges stays idempotent, why the in-memory approach is single-instance only, and what a multi-instance deployment needs.
• docs/session-log.md — the prompts that drove the hardening work and the change made in response to each.

What's known broken

Customers are reporting two issues:

1. Some are seeing duplicate charges for the same purchase.
2. Our security team flagged something on this endpoint in their last review.

There may be more. Find what you can.