Fix #1125: link logged-in donors to their Stripe Customer (not 'anonymous user')

[rdhyee]

Fixes #1125.

The one-line fix

In payment/stripelib.py, Pay.__init__ used token-presence as a proxy for "anonymous user." But a logged-in donor entering card details also produces a token, so they were routed through make_account()'s anonymous branch → Stripe Customer description='anonymous user' and Account.user=None (orphaned, no saved-card reuse).

Fix: pass user=transaction.user into make_account (it's None for a truly anonymous donor, and the user for a logged-in one). This makes the donation path consistent with the other make_account(user=...) call sites already in FundView (e.g. the transaction.user.id != request.user.id branch).

Behavior note (for review)

make_account with user set runs the existing if user and user.profile.account: path (deactivate old account → save new → recharge_failed_transactions()). That path is already exercised for logged-in users elsewhere, so this isn't new behavior — it just extends it to the campaign/THANKS donation path. Worth a reviewer eye on the recharge_failed_transactions() side-effect for repeat donors.

Verification

• Bug reproduced on live txns 16674 (2026-06-18, the cutover-validation payment) and 15493 (2026-04-16) — both showed "anonymous user" for a logged-in donor.
• ⚠️ Not yet run against Stripe test-mode — should be charge-tested before merge (small change, but payment flow).

Scope

Minimal targeted fix. The broader Stripe modernization (13-yr-old API version, missing name/receipt_email/metadata) is tracked separately in #1142.

---

Provenance (deliberate disclosure): rbotyee+Claude diagnosis + fix; rbotyee+Codex review (in progress → LGTM); curated by @rdhyee, not yet human/test-verified.

🤖 Generated with Claude Code

[rdhyee]

Codex collaboration → converged (rbotyee+Claude × rbotyee+Codex)

3 review rounds, each caught something real:

1. R1: passing user=transaction.user let an anonymous request mutate an owner's Stripe account → added ownership guard.
2. R2: an authenticated different user could still take over the txn → consolidated guard rejects both; added FundViewOwnershipTest.
3. R3: guard confirmed correct (closes both vectors; owner / anonymous-unowned paths still proceed). Test import + @patch targets needed the regluit. prefix → fixed (verified against repo convention).

Status: guard logic Codex-LGTM'd; tests corrected per repo convention but not yet executed (no Django test env here). Will run manage.py test frontend on the rebuilt test.unglue.it (4.2) before marking ready.

[rdhyee]

✅ Tests PASS on real Django 4.2 (test.unglue.it)

Ran on the freshly-rebuilt test.unglue.it (Django 4.2.21, py3.12, prod-snapshot DB) — the regression test the Codex loop produced now executes green:

test_anonymous_cannot_pay_owned_transaction ... ok
test_other_user_cannot_pay_owned_transaction ... ok
Ran 2 tests in 2.319s
OK

Test DB built + migrated cleanly; both ownership-guard cases confirmed (anonymous + authenticated-mismatch rejected before charge()). manage.py check surfaced only pre-existing warnings (django-ckeditor CVE notice → tracked in #1142; MySQL strict-mode hint). Moving out of draft — guard is Codex-LGTM'd and the regression suite is green on real 4.2.