Fix: Duplicate payment_method.attached Webhook Events

Release: v1.0.115

Summary

A spec drift bug has been resolved in the checkout session callback handler. Prior to this release, every successful checkout session completion for a returning customer (i.e. one with a known customerId) would trigger two identical payment_method.attached webhook events for the same PaymentMethod in a single request. This violated the Calmony Pay REST API Contract's one-event-per-action guarantee.

What Changed

Before (Incorrect Behaviour)

In src/app/api/v1/checkout/sessions/callback/route.ts, the payment_method.attached event was fired at two separate points during the same request:

1. Immediately after the PaymentMethod record was inserted into the database.
2. Again inside the if (customerId) block, which also updated the customer's default payment method.

Both emissions passed the same pm.id and identical event payload, meaning every subscribed webhook endpoint received the event twice.

After (Correct Behaviour)

The duplicate emission inside the if (customerId) block has been removed. The payment_method.attached event is now emitted exactly once per attach operation — immediately after the PaymentMethod record is inserted — regardless of whether a customerId is present on the session.

Impact on Webhook Consumers

If your integration subscribes to the payment_method.attached event, you should be aware of the following:

• Before this fix: You would receive two webhook deliveries per attach operation for sessions tied to a known customer.
• After this fix: You will receive exactly one delivery per attach operation, as specified in the API contract.

If your consumer was previously de-duplicating on pm.id to guard against this bug, that guard remains safe to keep in place — it will simply never trigger after upgrading to v1.0.115.

Webhook Event Reference

Event	Trigger	Frequency
payment_method.attached	A PaymentMethod is successfully attached during checkout session completion	Exactly once per attach operation

Recommendation

If you process payment_method.attached events in downstream systems (e.g. to provision features, send notifications, or update billing records), review any logic that may have inadvertently relied on or compensated for the duplicate delivery. After upgrading, each attach operation will produce exactly one event.