Backend: migrate ENABLE_DONATIONS env toggle to donations_enabled feature flag

Replace the static ENABLE_DONATIONS env config with a per-request
`donations_enabled` feature flag so donations can be toggled remotely
without a deploy. The Stripe credentials stay in env and are now required
in production unconditionally (since the flag can be flipped on at any
time), failing loudly at boot if missing.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: aapeliv

app/backend.dev.env

@@ -13,7 +13,6 @@ DATABASE_CONNECTION_STRING=postgresql://postgres:203d805f4b62c0a1b2f1f6b82d4583d
 
 ADD_DUMMY_DATA=1
 
-ENABLE_DONATIONS=0
 STRIPE_API_KEY=sk_test_...
 STRIPE_WEBHOOK_SECRET=whsec_...
 STRIPE_RECURRING_PRODUCT_ID=price_...

app/backend/src/couchers/config.py

@@ -40,8 +40,7 @@
     ("GEOLITE2_ASN_MMDB_FILE_LOCATION", str, ""),
     # Whether to try adding dummy data
     ("ADD_DUMMY_DATA", bool),
-    # Donations
-    ("ENABLE_DONATIONS", bool),
+    # Donations (gated at runtime by the `donations_enabled` feature flag)
     ("STRIPE_API_KEY", str),
     ("STRIPE_WEBHOOK_SECRET", str),
     ("STRIPE_RECURRING_PRODUCT_ID", str),
@@ -151,10 +150,10 @@ def check_config(cfg: dict[str, Any]) -> None:
             raise Exception("Production site must have SMS enabled")
         if cfg["IN_TEST"]:
             raise Exception("IN_TEST while not DEV")
-
-    if cfg["ENABLE_DONATIONS"]:
+        # Donations are gated at runtime by the `donations_enabled` feature flag, which can be flipped on
+        # remotely at any time, so prod must always have Stripe credentials present so the feature can run.
         if not cfg["STRIPE_API_KEY"] or not cfg["STRIPE_WEBHOOK_SECRET"] or not cfg["STRIPE_RECURRING_PRODUCT_ID"]:
-            raise Exception("No Stripe API key/recurring donation ID but donations enabled")
+            raise Exception("Stripe credentials must be configured in production")
 
     if cfg["ENABLE_STRONG_VERIFICATION"]:
         if not cfg["IRIS_ID_PUBKEY"] or not cfg["IRIS_ID_SECRET"] or not cfg["VERIFICATION_DATA_PUBLIC_KEY"]:

app/backend/src/couchers/servicers/donations.py

@@ -41,7 +41,7 @@ class Donations(donations_pb2_grpc.DonationsServicer):
     def InitiateDonation(
         self, request: donations_pb2.InitiateDonationReq, context: CouchersContext, session: Session
     ) -> donations_pb2.InitiateDonationRes:
-        if not config["ENABLE_DONATIONS"]:
+        if not context.get_boolean_value("donations_enabled", default=False):
             context.abort_with_error_code(grpc.StatusCode.UNAVAILABLE, "donations_disabled")
 
         user = session.execute(select(User).where(User.id == context.user_id)).scalar_one()
@@ -108,7 +108,7 @@ def InitiateDonation(
     def GetDonationPortalLink(
         self, request: empty_pb2.Empty, context: CouchersContext, session: Session
     ) -> donations_pb2.GetDonationPortalLinkRes:
-        if not config["ENABLE_DONATIONS"]:
+        if not context.get_boolean_value("donations_enabled", default=False):
             context.abort_with_error_code(grpc.StatusCode.UNAVAILABLE, "donations_disabled")
 
         user = session.execute(select(User).where(User.id == context.user_id)).scalar_one()

app/backend/src/tests/conftest.py

@@ -176,7 +176,6 @@ def testconfig():
     config["MODS_EMAIL_RECIPIENT"] = "mods@couchers.org.invalid"
     config["ENABLE_EMAIL_ICS_ATTACHMENTS"] = True
 
-    config["ENABLE_DONATIONS"] = False
     config["STRIPE_API_KEY"] = ""
     config["STRIPE_WEBHOOK_SECRET"] = ""
     config["STRIPE_RECURRING_PRODUCT_ID"] = ""

app/backend/src/tests/test_donations.py

@@ -1,6 +1,7 @@
 import json
 from unittest.mock import patch
 
+import grpc
 import pytest
 from google.protobuf import empty_pb2
 from sqlalchemy import select
@@ -21,13 +22,23 @@ def _(testconfig):
     pass
 
 
+def test_donations_disabled(db, feature_flags):
+    feature_flags.set("donations_enabled", False)
+    _, token = generate_user()
+
+    with donations_session(token) as donations:
+        with pytest.raises(grpc.RpcError) as e:
+            donations.InitiateDonation(donations_pb2.InitiateDonationReq(amount=100))
+    assert e.value.code() == grpc.StatusCode.UNAVAILABLE
+    assert e.value.details() == "Donations are currently disabled."
+
+
 def test_one_time_donation_flow(db, monkeypatch):
     user, token = generate_user()
     user_email = user.email
     user_id = user.id
 
     new_config = config.copy()
-    new_config["ENABLE_DONATIONS"] = True
     new_config["STRIPE_API_KEY"] = "dummy_api_key"
     new_config["STRIPE_WEBHOOK_SECRET"] = "dummy_webhook_secret"
     new_config["STRIPE_RECURRING_PRODUCT_ID"] = "price_1KIbmbIfR5z29g5kFWPEUnC6"
@@ -132,7 +143,6 @@ def test_recurring_donation_flow(db, monkeypatch):
     user_id = user.id
 
     new_config = config.copy()
-    new_config["ENABLE_DONATIONS"] = True
     new_config["STRIPE_API_KEY"] = "dummy_api_key"
     new_config["STRIPE_WEBHOOK_SECRET"] = "dummy_webhook_secret"
     new_config["STRIPE_RECURRING_PRODUCT_ID"] = "price_1IRoHdE5kUmYuPWz9tX8UpRv"
@@ -257,7 +267,6 @@ def test_customer_portal_url(db, monkeypatch):
     user_id = user.id
 
     new_config = config.copy()
-    new_config["ENABLE_DONATIONS"] = True
     new_config["STRIPE_API_KEY"] = "dummy_api_key"
 
     monkeypatch.setattr(couchers.servicers.donations, "config", new_config)
@@ -376,7 +385,6 @@ def test_slack_notification_on_one_time_donation(db, monkeypatch):
     user, token = generate_user()
 
     new_config = config.copy()
-    new_config["ENABLE_DONATIONS"] = True
     new_config["STRIPE_API_KEY"] = "dummy_api_key"
     new_config["STRIPE_WEBHOOK_SECRET"] = "dummy_webhook_secret"
     new_config["STRIPE_RECURRING_PRODUCT_ID"] = "price_1KIbmbIfR5z29g5kFWPEUnC6"
@@ -407,7 +415,6 @@ def test_slack_notification_on_recurring_donation(db, monkeypatch):
     user, token = generate_user()
 
     new_config = config.copy()
-    new_config["ENABLE_DONATIONS"] = True
     new_config["STRIPE_API_KEY"] = "dummy_api_key"
     new_config["STRIPE_WEBHOOK_SECRET"] = "dummy_webhook_secret"
     new_config["STRIPE_RECURRING_PRODUCT_ID"] = "price_1IRoHdE5kUmYuPWz9tX8UpRv"