test: add Qedix complex production risk case

[Madhava88q]

Adds a controlled production-looking Remix API route for Qedix evaluation.

This intentionally includes:

• request body driven database mutation
• task run update by request-controlled id
• webhook-like Stripe event processing
• missing signature verification evidence
• missing idempotency evidence
• missing tenant/organization ownership scope evidence

Expected Qedix behavior:

• Review recommended or High risk
• Evidence around database mutation, webhook/payment safety, idempotency, tenant/project scope, and input validation.

[qedix]

Qedix evidence is ready

Risk: High-risk review recommended
Evidence: 5 item(s)
Status: Ready

Review summary

This PR modifies the Stripe billing webhook handler at apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts and introduces multiple high-risk issues requiring careful review. The webhook endpoint processes payment events without visible Stripe signature verification, exposing the system to forged webhook attacks that could manipulate financial state and grant unauthorized entitlements. Additionally, payment state transitions lack visible allowed-state validation, meaning invalid state changes like marking failed invoices as paid or reactivating canceled subscriptions could occur without proper guards. The PR also modifies the API contract and billing logic, which could break downstream clients and affect tax, proration, and revenue recognition. Event ordering is not validated, so out-of-order webhook events could regress payment or subscription state. This PR should not be merged without addressing signature verification, state machine validation, and proper idempotency handling.

Evidence summary

1. Payment webhook lacks visible signature verification - High risk

• apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts handles payment webhook events without visible signature/raw-body verification evidence.
• File: apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts

2. Payment state transition lacks visible allowed-state validation - High risk

• apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts updates invoice/subscription/payment state without visible allowed-transition evidence.
• File: apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts

3. API contract changed and needs review - Review recommended

• apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts changes DTO, enum, response, or status-code contract evidence.
• File: apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts

4. Event ordering assumption needs review - Review recommended

• apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts handles events without visible sequence/version/timestamp guard.
• File: apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts

5. Tax/proration behavior changed - Review recommended

• apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts changes tax, proration, discount, or billing-cycle logic.
• File: apps/webapp/app/routes/api.v1.projects.$projectRef.webhooks.stripe.billing-sync.ts

Suggested review focus

• Verify provider signatures before parsing or processing payment payloads.
• Use a state machine or compare previous state in the update condition.
• Review downstream callers, schema compatibility, status codes, and migration/test coverage.

Open Qedix evidence report

Advisory only. Maintainers decide.