Implement stripe sdk appsec events

[estringana]

Description

Implements RFC-1072 Automated Payment Events for Stripe integration. Adds instrumentation for payment creation methods and webhook event processing to automatically detect and tag payment transactions for AppSec monitoring.

Changes

Instrumented Methods:

1. \Stripe\Service\Checkout\SessionService::create() / \Stripe\Checkout\Session::create() (payment mode only)
2. \Stripe\Service\PaymentIntentService::create() / \Stripe\PaymentIntent::create()
3. \Stripe\Webhook::constructEvent() (webhook processing)
4. \Stripe\Event::constructFrom() (webhook processing)

Event Types:

• Payment creation (checkout sessions, payment intents)
• Payment success (payment_intent.succeeded)
• Payment failure (payment_intent.payment_failed)
• Payment cancellation (payment_intent.canceled)

Reviewer checklist

• Test coverage seems ok.
• Appropriate labels assigned.

[datadog-datadog-prod-us1]

⚠️ Tests

✨ Fix all issues with BitsAI or with Cursor

⚠️ Warnings

❄️ 8 New flaky tests detected

testCheckoutSessionCreateDirectMethod from tests/Integrations/Stripe/Latest.DDTrace\Tests\Integrations\Stripe\StripeTest (Datadog) (Fix with Cursor)

DDTrace
Error: Call to undefined method DDTrace

tests/Integrations/Stripe/Latest/StripeTest.php:323
tests/Common/TracerTestTrait.php:67
tests/Integrations/Stripe/Latest/StripeTest.php:291
tests/Common/RetryTraitVersionGeneric.php:28

testCheckoutSessionCreateDirectMethodNonPaymentMode from tests/Integrations/Stripe/Latest.DDTrace\Tests\Integrations\Stripe\StripeTest (Datadog) (Fix with Cursor)

DDTrace
Error: Call to undefined method DDTrace

tests/Integrations/Stripe/Latest/StripeTest.php:369
tests/Common/TracerTestTrait.php:67
tests/Integrations/Stripe/Latest/StripeTest.php:346
tests/Common/RetryTraitVersionGeneric.php:28

testPaymentCancellationWebhook from tests/Integrations/Stripe/Latest.DDTrace\Tests\Integrations\Stripe\StripeTest (Datadog) (Fix with Cursor)

DDTrace
Error: Call to undefined method DDTrace

tests/Integrations/Stripe/Latest/StripeTest.php:195
tests/Common/TracerTestTrait.php:67
tests/Integrations/Stripe/Latest/StripeTest.php:174
tests/Common/RetryTraitVersionGeneric.php:28

View all

🧪 1029 Tests failed

testSearchPhpBinaries from integration.DDTrace\Tests\Integration\PHPInstallerTest (Datadog) (Fix with Cursor)

Risky Test
phpvfscomposer://tests/vendor/phpunit/phpunit/phpunit:52

testSimplePushAndProcess from laravel-58-test.DDTrace\Tests\Integrations\Laravel\V5_8\QueueTest (Datadog) (Fix with Cursor)

Risky Test
phpvfscomposer://tests/vendor/phpunit/phpunit/phpunit:97

testSimplePushAndProcess from laravel-8x-test.DDTrace\Tests\Integrations\Laravel\V8_x\QueueTest (Datadog) (Fix with Cursor)

DDTrace\Tests\Integrations\Laravel\V8_x\QueueTest::testSimplePushAndProcess
Test code or tested code printed unexpected output: spanLinksTraceId: 69aaa74e00000000a55ddf9fded530f8
tid: 69aaa74e00000000
hexProcessTraceId: a55ddf9fded530f8
hexProcessSpanId: 1dd96506e4174675
processTraceId: 11915926066823508216
processSpanId: 2150861377317062261

View all

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 39402ef | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback!}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.19%. Comparing base (8cd0131) to head (39402ef).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3681      +/-   ##
==========================================
- Coverage   62.22%   62.19%   -0.03%     
==========================================
  Files         141      141              
  Lines       13352    13352              
  Branches     1746     1746              
==========================================
- Hits         8308     8304       -4     
- Misses       4253     4256       +3     
- Partials      791      792       +1     

see 1 file with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8cd0131...39402ef. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pr-commenter]

Benchmarks [ tracer ]

Benchmark execution time: 2026-03-05 16:11:58

Comparing candidate commit 370b8b5 in PR branch estringana/implement-stripe-events with baseline commit 8cd0131 in branch master.

Found 2 performance improvements and 1 performance regressions! Performance is the same for 191 metrics, 0 unstable metrics.

scenario:ComposerTelemetryBench/benchTelemetryParsing

• 🟩 execution_time [-1243.104ns; -356.896ns] or [-10.810%; -3.103%]

scenario:ComposerTelemetryBench/benchTelemetryParsing-opcache

• 🟥 execution_time [+0.703µs; +1.497µs] or [+5.759%; +12.274%]

scenario:MessagePackSerializationBench/benchMessagePackSerialization

• 🟩 execution_time [-4.040µs; -3.000µs] or [-3.608%; -2.679%]