belt-pay 0.0.2 → 0.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 614581460579c56502eed359de29c1f36f746c3a8697b6ba3aa073266740649b
-  data.tar.gz: 00d84db5eb7ce1c47f23f666b8eab1511ace5745e2ad18e48e8c9753b2751503
+  metadata.gz: 225d94bd8d7f1b25849f237c4bb8432ce5b485b3a7ca5b88aee833d928481c4d
+  data.tar.gz: 7cabb1843e20857030506f0a3efe42a26aa375563f65c8ffb14334d84dc39b07
 SHA512:
-  metadata.gz: 51d01a9a411c28d3e080352bb265553b8de72d24e0166f953248910926b55bd139aa9a7864c7b7ba504a9a8470a12ef013ce1b5153f441c653ef97e847f1e65f
-  data.tar.gz: 4b8e05e523ca9abc3400a3455dfa7fb3b1adc0bd409eef90ed8856878e8938719663d45001ecbb3434e42fa17da07160be33f257acb753c900f9704ac05a7779
+  metadata.gz: ccf4f5972eabe4ffa0aa4c4d4be3207ac640970cea1ddaae857043bdf7d81a6df507932cc8c7704020326f578c46ee73ef0ea8e978b1443f761ca34f59deb960
+  data.tar.gz: 91f585c4b462664b2f193d8575fd5b551e969d613456ada465c4d3fa83387b4577b910fa64dd6e49f51b903082788ad8e48532a84174a76003368b5471ab40d1

data/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 0.0.4 — 2026-10-20
+
+- **`belt pay:setup` creates the Stripe webhook endpoint for you.** After the secret-key
+  prompt it reads `api_url` from `terraform output`, offers to create
+  `<api_url>/pay/webhooks` in Stripe (subscribed to every event Belt Pay handles), and
+  stores the returned `whsec_` signing secret directly. No Dashboard clicking.
+  - Shows whether the key is test or live mode before creating anything.
+  - If Stripe already has an endpoint for that URL, offers to replace it (the old one
+    is deleted only after the new secret is saved) or links to it in the Dashboard.
+  - Declining, or missing terraform output, prints step-by-step Dashboard instructions
+    with the exact URL and events, then prompts for the secret as before.
+  - `--webhook-url` / `BELT_PAY_WEBHOOK_URL` and `--webhook-events` /
+    `BELT_PAY_WEBHOOK_EVENTS` override the defaults.
+- `Belt::Pay::WebhookHandler::EVENTS` lists the Stripe events the handler acts on.
+
+## 0.0.3 — 2026-10-02
+
+- Add Belt-native `pay:setup`, `pay:show`, and `pay:edit` tasks through Belt's
+  gem Rake-task extension mechanism. Select an environment with `BELT_ENV` or standard
+  task-argument syntax such as `belt 'pay:setup[dev]'`.
+- Make `belt pay:setup` the happy path: it prompts without echo for Stripe's API and
+  webhook signing secrets, preserves either existing value when left blank, and writes
+  directly through the AWS SDK.
+- Add `belt pay:show` and `belt pay:edit` for inspecting and securely editing each
+  environment's Stripe JSON secret in AWS Secrets Manager.
+- Detect the Belt app name, AWS profile, and region from the selected environment,
+  with environment-variable and explicit overrides for custom setups.
+- Retain the packaged `belt-pay secrets:*` executable as a backward-compatible alias,
+  pin the AWS Secrets Manager SDK, and include the pinned Rake runtime required for
+  task dispatch in fresh Belt apps.
+
 ## 0.0.2 — 2026-09-05
 
 - **Plan DSL (convention over configuration).** Declare subscription plans, their

data/README.md

@@ -167,6 +167,61 @@ The Stripe secret should contain:
 }
 ```
 
+### Setting Up and Managing Secrets
+
+Belt Pay hooks into Belt through its standard gem-provided Rake task mechanism. The
+guided happy path uses `BELT_ENV` to select the environment:
+
+```bash
+BELT_ENV=dev belt pay:setup
+```
+
+It prompts without echo for the Stripe secret key, then offers to create the webhook
+endpoint in Stripe for you: it reads `api_url` from `terraform output`, creates
+`<api_url>/pay/webhooks` subscribed to every [handled event](#webhook-events), and stores
+the `whsec_` signing secret Stripe returns. Everything goes directly through the Stripe
+API and AWS SDK. Run it after `belt apply` so the URL is known.
+
+Decline (or run it before the first apply) and it prints step-by-step Dashboard
+instructions with the exact URL and events, then prompts for the signing secret. Leave
+either prompt blank to preserve its existing value. Use `--webhook-url` /
+`BELT_PAY_WEBHOOK_URL` or `--webhook-events` / `BELT_PAY_WEBHOOK_EVENTS` to override the
+defaults. Test (`sk_test_`) and live (`sk_live_`) keys get separate endpoints and secrets.
+
+You can also pass the environment with standard Rake task-argument syntax:
+
+```bash
+belt 'pay:setup[dev]'
+```
+
+Rails-like inspection and arbitrary JSON editing remain available for advanced use:
+
+```bash
+BELT_ENV=dev belt pay:show
+EDITOR="code --wait" BELT_ENV=dev belt pay:edit
+# Or: belt 'pay:show[dev]' / belt 'pay:edit[dev]'
+```
+
+`pay:show` prints the complete decrypted JSON to stdout. `pay:edit` opens it with
+`$VISUAL` or `$EDITOR`, validates that the result is a JSON object, and writes a new
+Secrets Manager version only when the content changed. Its temporary file is mode
+`0600` and is removed when the editor closes. All write paths refuse to overwrite a
+secret that changed while the command was open.
+
+The tasks detect the application name from Terraform, the AWS profile from
+`infrastructure/<env>/belt.rb`, and the region from Terraform or AWS environment
+variables. Custom setups can override those values with `APP_NAME`,
+`BELT_PAY_SECRET_NAME`, `AWS_PROFILE`, and `AWS_REGION`:
+
+```bash
+APP_NAME=my_app BELT_ENV=prod AWS_PROFILE=my-prod-profile belt pay:setup
+BELT_PAY_SECRET_NAME=custom-stripe-secret BELT_ENV=prod belt pay:edit
+```
+
+Because `pay:show` intentionally reveals credentials, avoid redirecting its output to
+logs or sharing it in chat. The packaged `belt-pay secrets:*` executable remains as a
+backward-compatible alias, but the Belt-native tasks are the preferred interface.
+
 ## Common Patterns
 
 ### Annual Subscription (Feature Gating)
@@ -306,7 +361,8 @@ module "pay" {
 
 ## Stripe Dashboard Setup
 
-After deploying, configure your Stripe webhook endpoint:
+`BELT_ENV=<env> belt pay:setup` creates the webhook endpoint and stores its signing
+secret for you. To do it by hand instead:
 
 1. Go to Stripe Dashboard → Developers → Webhooks
 2. Add endpoint: `https://<your-api-domain>/pay/webhooks`

data/exe/belt-pay

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'belt/pay/cli'
+
+exit Belt::Pay::CLI.start(ARGV)

data/lib/belt/generators/pay_generator.rb

@@ -315,18 +315,15 @@ module Belt
                  # ...
                end
 
-            3. Create your Stripe API keys in Secrets Manager:
-               Secret name: <app_name>-<env>-stripe
-               Keys: stripe_secret_key, stripe_webhook_secret
-
-            4. Deploy:
+            3. Deploy:
                belt apply <env>
 
-            5. Configure Stripe webhook endpoint:
-               URL: https://<your-api-domain>/pay/webhooks
-               Events: checkout.session.completed, checkout.session.expired,
-                       invoice.paid, invoice.payment_failed,
-                       customer.subscription.deleted, customer.subscription.updated
+            4. Store your Stripe key and create the webhook endpoint:
+               BELT_ENV=<env> belt pay:setup
+
+               Prompts without echo for the Stripe secret key, then creates
+               <api_url>/pay/webhooks in Stripe and stores its signing secret.
+               Decline to get step-by-step Dashboard instructions instead.
 
           Quick Usage:
             # Create a checkout session

data/lib/belt/pay/cli.rb

@@ -0,0 +1,428 @@
+# frozen_string_literal: true
+
+require 'io/console'
+require 'json'
+require 'open3'
+require 'optparse'
+require 'shellwords'
+require 'tempfile'
+require 'aws-sdk-secretsmanager'
+require 'stripe'
+require 'belt/pay/webhook_handler'
+
+module Belt
+  module Pay
+    class CLI
+      class Error < StandardError; end
+
+      COMMANDS = %w[secrets:setup secrets:show secrets:edit].freeze
+      WEBHOOK_PATH = '/pay/webhooks'
+
+      def self.start(args, input: $stdin, out: $stdout, err: $stderr)
+        new(args, input: input, out: out, err: err).run
+        0
+      rescue Error, OptionParser::ParseError => e
+        err.puts "Error: #{e.message}"
+        err.puts "Run `belt tasks --grep pay` for available Belt Pay commands."
+        1
+      rescue Aws::Errors::ServiceError => e
+        err.puts "AWS error: #{e.message}"
+        1
+      rescue ::Stripe::StripeError => e
+        err.puts "Stripe error: #{e.message}"
+        1
+      end
+
+      def initialize(args, input:, out:, err:)
+        @args = args.dup
+        @input = input
+        @out = out
+        @err = err
+        @options = {}
+      end
+
+      def run
+        command = @args.shift
+        if command.nil? || %w[help --help -h].include?(command)
+          @out.puts help
+          return
+        end
+
+        raise Error, "unknown command #{command.inspect}" unless COMMANDS.include?(command)
+
+        parse_options!
+        resolve_context!
+
+        case command
+        when 'secrets:setup' then setup
+        when 'secrets:show' then show
+        when 'secrets:edit' then edit
+        end
+      end
+
+      private
+
+      def parse_options!
+        parser.parse!(@args)
+        @environment = @args.shift || ENV['BELT_ENV']
+        raise Error, 'environment is required (for example, dev or prod)' if blank?(@environment)
+        raise Error, "unexpected argument #{@args.first.inspect}" unless @args.empty?
+      end
+
+      def parser
+        OptionParser.new do |opts|
+          opts.banner = 'Usage: belt-pay secrets:setup|secrets:show|secrets:edit ENV [options]'
+
+          opts.on('--app-name NAME', 'Override the detected Belt application name') do |value|
+            @options[:app_name] = value
+          end
+          opts.on('--secret-name NAME', 'Override the Secrets Manager secret name') do |value|
+            @options[:secret_name] = value
+          end
+          opts.on('--profile PROFILE', 'Override the AWS profile') do |value|
+            @options[:profile] = value
+          end
+          opts.on('--region REGION', 'Override the AWS region') do |value|
+            @options[:region] = value
+          end
+          opts.on('--webhook-url URL', 'Override the Stripe webhook endpoint URL') do |value|
+            @options[:webhook_url] = value
+          end
+          opts.on('--webhook-events LIST', 'Comma-separated Stripe events for a new endpoint') do |value|
+            @options[:webhook_events] = value
+          end
+          opts.on('-h', '--help', 'Show this help') do
+            @out.puts help
+            exit 0
+          end
+        end
+      end
+
+      def resolve_context!
+        @root = find_project_root
+        env_dir = File.join(@root, 'infrastructure', @environment)
+        raise Error, "environment not found: #{env_dir}" unless Dir.exist?(env_dir)
+
+        @app_name = @options[:app_name] || ENV['APP_NAME'] || detect_app_name(env_dir)
+        raise Error, 'could not determine the application name; pass --app-name or set APP_NAME' if blank?(@app_name)
+
+        @secret_name = @options[:secret_name] || ENV['BELT_PAY_SECRET_NAME'] ||
+                       "#{@app_name}-#{@environment}-stripe"
+        @profile = @options[:profile] || ENV['AWS_PROFILE'] || detect_profile(env_dir)
+        @region = @options[:region] || ENV['AWS_REGION'] || ENV['AWS_DEFAULT_REGION'] || detect_region(env_dir)
+
+        ENV['AWS_PROFILE'] = @profile unless blank?(@profile)
+        @client = Aws::SecretsManager::Client.new(region: @region)
+      end
+
+      def setup
+        response = fetch_secret
+        original = parse_secret(response.secret_string)
+        updated = original.dup
+
+        secret_key = hidden_prompt('Stripe secret key [blank keeps existing]')
+        updated['stripe_secret_key'] = secret_key unless blank?(secret_key)
+
+        webhook_secret, replaced = webhook_secret_for(updated['stripe_secret_key'], original['stripe_webhook_secret'])
+        updated['stripe_webhook_secret'] = webhook_secret unless blank?(webhook_secret)
+
+        update_secret(response, original, updated)
+        delete_replaced_endpoints(updated['stripe_secret_key'], replaced)
+      end
+
+      # Returns [signing_secret, endpoints_to_delete]. Offers to create the Stripe
+      # webhook endpoint (Stripe only returns a signing secret at creation time);
+      # otherwise prints Dashboard instructions and prompts for the secret.
+      def webhook_secret_for(api_key, existing_secret)
+        if blank?(api_key)
+          @out.puts 'No Stripe secret key stored yet, so the webhook endpoint cannot be created for you.'
+          return [manual_webhook_secret(nil), []]
+        end
+
+        mode = stripe_mode(api_key)
+        url = webhook_url
+        @out.puts "Stripe account mode: #{mode}"
+        @out.puts "Webhook endpoint URL: #{url || '(unknown; run `belt apply` first or pass --webhook-url)'}"
+
+        create = !url.nil? && confirm("Create the #{mode}-mode webhook endpoint in Stripe now?", default: blank?(existing_secret))
+        return [manual_webhook_secret(url, mode: mode), []] unless create
+
+        existing = stripe_endpoints(api_key).select { |endpoint| endpoint.url == url }
+        if existing.any?
+          ids = existing.map(&:id).join(', ')
+          @out.puts "Stripe already has an endpoint for this URL (#{ids}). Stripe never re-sends a signing secret,"
+          @out.puts 'so setup can only replace it with a new endpoint (the old secret stops working).'
+          unless confirm('Replace it?', default: false)
+            @out.puts "Reveal its signing secret at #{dashboard_url(mode, existing.first.id)}"
+            return [hidden_prompt('Stripe webhook signing secret [blank keeps existing]'), []]
+          end
+        end
+
+        endpoint = ::Stripe::WebhookEndpoint.create(
+          { url: url, enabled_events: webhook_events, description: "Belt Pay (#{@app_name} #{@environment})" },
+          { api_key: api_key }
+        )
+        @out.puts "Created #{mode}-mode webhook endpoint #{endpoint.id} for #{webhook_events.size} events."
+        [endpoint.secret, existing.map(&:id)]
+      end
+
+      def manual_webhook_secret(url, mode: nil)
+        @out.puts <<~STEPS
+
+          To set up the webhook in the Stripe Dashboard#{" (#{mode} mode)" if mode}:
+            1. Developers -> Webhooks -> Add destination (#{mode == 'live' ? 'https://dashboard.stripe.com/webhooks' : 'https://dashboard.stripe.com/test/webhooks'})
+            2. Events from: Your account. API version: the default.
+            3. Events: #{webhook_events.join(', ')}
+            4. Destination type: Webhook endpoint
+            5. URL: #{url || "your API base URL (`belt output #{@environment}` api_url) + #{WEBHOOK_PATH}"}
+            6. Open the new endpoint -> Signing secret -> Reveal, and paste it below.
+          Each endpoint (and test vs. live mode) has its own whsec_ secret. Do not use the
+          one `stripe listen` prints; it only works for local forwarding.
+
+        STEPS
+        hidden_prompt('Stripe webhook signing secret [blank keeps existing]')
+      end
+
+      def delete_replaced_endpoints(api_key, ids)
+        ids.each do |id|
+          ::Stripe::WebhookEndpoint.delete(id, {}, { api_key: api_key })
+          @out.puts "Deleted replaced webhook endpoint #{id}"
+        end
+      end
+
+      def stripe_endpoints(api_key)
+        ::Stripe::WebhookEndpoint.list({ limit: 100 }, { api_key: api_key }).auto_paging_each.to_a
+      end
+
+      def webhook_url
+        return @webhook_url if defined?(@webhook_url)
+
+        explicit = @options[:webhook_url] || ENV['BELT_PAY_WEBHOOK_URL']
+        @webhook_url = if blank?(explicit)
+                         api_url = terraform_output('api_url')
+                         "#{api_url.chomp('/')}#{WEBHOOK_PATH}" unless blank?(api_url)
+                       else
+                         explicit.strip
+                       end
+      end
+
+      def webhook_events
+        list = @options[:webhook_events] || ENV['BELT_PAY_WEBHOOK_EVENTS']
+        return Belt::Pay::WebhookHandler::EVENTS if blank?(list)
+
+        list.split(',').map(&:strip).reject(&:empty?)
+      end
+
+      def terraform_output(name)
+        env_dir = File.join(@root, 'infrastructure', @environment)
+        stdout, _stderr, status = Open3.capture3('terraform', "-chdir=#{env_dir}", 'output', '-raw', name)
+        stdout.strip if status.success?
+      rescue SystemCallError
+        nil
+      end
+
+      def stripe_mode(api_key)
+        api_key.match?(/\A[sr]k_live_/) ? 'live' : 'test'
+      end
+
+      def dashboard_url(mode, endpoint_id)
+        "https://dashboard.stripe.com/#{'test/' unless mode == 'live'}webhooks/#{endpoint_id}"
+      end
+
+      def confirm(question, default:)
+        @out.print "#{question} #{default ? '[Y/n]' : '[y/N]'} "
+        @out.flush
+        answer = @input.gets
+        @out.puts if answer.nil?
+        return default if answer.nil? || answer.strip.empty?
+
+        answer.strip.downcase.start_with?('y')
+      end
+
+      def show
+        response = fetch_secret
+        @out.puts JSON.pretty_generate(parse_secret(response.secret_string))
+      end
+
+      def edit
+        response = fetch_secret
+        original = parse_secret(response.secret_string)
+        edited = edit_json(original)
+
+        update_secret(response, original, edited)
+      end
+
+      def update_secret(response, original, updated)
+        if updated == original
+          @out.puts "Secret unchanged: #{@secret_name}"
+          return
+        end
+
+        latest = fetch_secret
+        if latest.version_id != response.version_id
+          raise Error, "#{@secret_name} changed while it was open; reopen it and apply your edits again"
+        end
+
+        @client.put_secret_value(
+          secret_id: @secret_name,
+          secret_string: JSON.generate(updated)
+        )
+        @out.puts "Updated secret: #{@secret_name}"
+      end
+
+      def fetch_secret
+        response = @client.get_secret_value(secret_id: @secret_name)
+        raise Error, "#{@secret_name} is binary; belt-pay only supports JSON string secrets" if response.secret_string.nil?
+
+        response
+      end
+
+      def parse_secret(value)
+        parsed = JSON.parse(value)
+        raise Error, "#{@secret_name} must contain a JSON object" unless parsed.is_a?(Hash)
+
+        parsed
+      rescue JSON::ParserError => e
+        raise Error, "#{@secret_name} does not contain valid JSON: #{e.message}"
+      end
+
+      def hidden_prompt(label)
+        @out.print "#{label}: "
+        @out.flush
+        value = if @input.respond_to?(:tty?) && @input.tty? && @input.respond_to?(:noecho)
+                  @input.noecho { @input.gets }
+                else
+                  @input.gets
+                end
+        @out.puts
+        raise Error, 'input ended before the Stripe secrets were read' if value.nil?
+
+        value.chomp
+      end
+
+      def edit_json(secret)
+        editor = ENV['VISUAL'] || ENV['EDITOR']
+        raise Error, 'set $VISUAL or $EDITOR before running secrets:edit' if blank?(editor)
+
+        Tempfile.create(["belt-pay-#{@environment}-", '.json']) do |file|
+          File.chmod(0o600, file.path)
+          file.write("#{JSON.pretty_generate(secret)}\n")
+          file.flush
+
+          success = system(*Shellwords.split(editor), file.path)
+          raise Error, 'editor exited unsuccessfully; secret was not updated' unless success
+
+          file.rewind
+          parse_secret(file.read)
+        end
+      end
+
+      def find_project_root
+        dir = File.expand_path(Dir.pwd)
+        loop do
+          routes = [
+            File.join(dir, 'config', 'routes.rb'),
+            File.join(dir, 'config', 'routes.tf.rb'),
+            File.join(dir, 'infrastructure', 'routes.tf.rb')
+          ]
+          return dir if routes.any? { |path| File.file?(path) }
+
+          parent = File.dirname(dir)
+          break if parent == dir
+
+          dir = parent
+        end
+
+        raise Error, 'could not find a Belt application; run this command inside one'
+      end
+
+      def detect_app_name(env_dir)
+        from_assignment(File.join(env_dir, 'terraform.tfvars'), 'app_name') ||
+          from_variable_default(File.join(env_dir, 'variables.tf'), 'app_name') ||
+          Dir.glob(File.join(@root, 'infrastructure', '*', 'terraform.tfvars')).sort.filter_map do |path|
+            from_assignment(path, 'app_name')
+          end.first ||
+          Dir.glob(File.join(@root, 'infrastructure', '*', 'variables.tf')).sort.filter_map do |path|
+            from_variable_default(path, 'app_name')
+          end.first ||
+          File.basename(@root)
+      end
+
+      def detect_profile(env_dir)
+        path = File.join(env_dir, 'belt.rb')
+        return unless File.file?(path)
+
+        File.read(path)[/config\.aws_profile\s*=\s*['\"]([^'\"]+)['\"]/, 1]
+      end
+
+      def detect_region(env_dir)
+        from_assignment(File.join(env_dir, 'terraform.tfvars'), 'aws_region') ||
+          from_variable_default(File.join(env_dir, 'variables.tf'), 'aws_region') ||
+          'us-east-1'
+      end
+
+      def from_assignment(path, key)
+        return unless File.file?(path)
+
+        File.read(path)[/^\s*#{Regexp.escape(key)}\s*=\s*['\"]([^'\"]+)['\"]/, 1]
+      end
+
+      def from_variable_default(path, key)
+        return unless File.file?(path)
+
+        block = File.read(path)[/variable\s+['\"]#{Regexp.escape(key)}['\"]\s*\{(.*?)\}/m, 1]
+        block&.match(/^\s*default\s*=\s*['\"]([^'\"]+)['\"]/)&.captures&.first
+      end
+
+      def blank?(value)
+        value.nil? || value.strip.empty?
+      end
+
+      def help
+        <<~HELP
+          Manage a Belt application's Stripe secret in AWS Secrets Manager.
+
+          Usage:
+            belt-pay secrets:setup ENV [options]
+            belt-pay secrets:show ENV [options]
+            belt-pay secrets:edit ENV [options]
+
+          Commands:
+            secrets:setup        Prompt without echo for the Stripe secret key, then create
+                                 the webhook endpoint in Stripe and store its signing
+                                 secret (or walk through creating it in the Dashboard)
+            secrets:show         Print the decrypted JSON secret
+            secrets:edit         Edit the secret with $VISUAL or $EDITOR
+
+          Options:
+            --app-name NAME      Override the detected application name
+            --secret-name NAME   Override <app>-<environment>-stripe
+            --profile PROFILE    Override the environment's AWS profile
+            --region REGION      Override the detected AWS region
+            --webhook-url URL    Override <terraform api_url>#{WEBHOOK_PATH}
+            --webhook-events L   Comma-separated events (default: every event Belt Pay handles)
+            -h, --help           Show this help
+
+          Environment:
+            BELT_ENV             Environment when ENV is omitted
+            AWS_PROFILE          AWS profile (overrides infrastructure/ENV/belt.rb)
+            AWS_REGION           AWS region (default: us-east-1)
+            BELT_PAY_WEBHOOK_URL     Same as --webhook-url
+            BELT_PAY_WEBHOOK_EVENTS  Same as --webhook-events
+            VISUAL, EDITOR       Editor command for secrets:edit
+
+          Examples:
+            belt-pay secrets:setup dev
+            belt-pay secrets:show dev
+            belt-pay secrets:edit prod --profile my-prod-profile
+            BELT_ENV=staging belt-pay secrets:setup
+
+          Security:
+            secrets:setup reads values without echo and sends them directly through the
+            AWS SDK. secrets:show writes the complete secret to stdout. secrets:edit uses
+            a mode-0600 temporary file, validates JSON, and removes the file afterward.
+        HELP
+      end
+    end
+  end
+end

data/lib/belt/pay/version.rb

@@ -2,6 +2,6 @@
 
 module Belt
   module Pay
-    VERSION = '0.0.2'
+    VERSION = '0.0.4'
   end
 end

data/lib/belt/pay/webhook_handler.rb

@@ -5,6 +5,17 @@ module Belt
     # Handles incoming webhooks from the payment provider.
     # Verifies signatures, dispatches events, and records transactions.
     module WebhookHandler
+      # Stripe events #dispatch acts on. `belt pay:setup` subscribes new webhook
+      # endpoints to exactly this list.
+      EVENTS = %w[
+        checkout.session.completed
+        checkout.session.expired
+        invoice.paid
+        invoice.payment_failed
+        customer.subscription.deleted
+        customer.subscription.updated
+      ].freeze
+
       class << self
         # Process a raw webhook request.
         # @param payload [String] Raw request body

data/lib/tasks/pay.rake

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'belt/pay/cli'
+
+run_pay_secret_command = lambda do |command, environment|
+  args = ["secrets:#{command}"]
+  args << environment unless environment.nil? || environment.to_s.strip.empty?
+
+  status = Belt::Pay::CLI.start(args)
+  exit status unless status.zero?
+end
+
+namespace :pay do
+  desc 'Store the Stripe key and create the webhook endpoint (BELT_ENV or pay:setup[env])'
+  task :setup, [:environment] do |_task, args|
+    run_pay_secret_command.call(:setup, args[:environment])
+  end
+
+  desc 'Print the decrypted Stripe secret (BELT_ENV or pay:show[env])'
+  task :show, [:environment] do |_task, args|
+    run_pay_secret_command.call(:show, args[:environment])
+  end
+
+  desc 'Edit the Stripe secret as JSON (BELT_ENV or pay:edit[env])'
+  task :edit, [:environment] do |_task, args|
+    run_pay_secret_command.call(:edit, args[:environment])
+  end
+end

metadata

@@ -1,14 +1,28 @@
 --- !ruby/object:Gem::Specification
 name: belt-pay
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.4
 platform: ruby
 authors:
 - Stowzilla
-bindir: bin
+bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-secretsmanager
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.136.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.136.0
 - !ruby/object:Gem::Dependency
   name: belt
   requirement: !ruby/object:Gem::Requirement
@@ -23,6 +37,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0.2'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 13.4.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 13.4.2
 - !ruby/object:Gem::Dependency
   name: stripe
   requirement: !ruby/object:Gem::Requirement
@@ -43,18 +71,21 @@ description: Belt plugin providing payment collection, subscriptions, and billin
 email:
 - andy@stowzilla.com
 - adam@stowzilla.com
-executables: []
+executables:
+- belt-pay
 extensions: []
 extra_rdoc_files: []
 files:
 - CHANGELOG.md
 - LICENSE
 - README.md
+- exe/belt-pay
 - lib/belt-pay.rb
 - lib/belt/generators/pay_generator.rb
 - lib/belt/pay.rb
 - lib/belt/pay/billable.rb
 - lib/belt/pay/checkout.rb
+- lib/belt/pay/cli.rb
 - lib/belt/pay/configuration.rb
 - lib/belt/pay/controllers/webhooks_controller.rb
 - lib/belt/pay/customer_provisioner.rb
@@ -73,6 +104,7 @@ files:
 - lib/belt/pay/transaction.rb
 - lib/belt/pay/version.rb
 - lib/belt/pay/webhook_handler.rb
+- lib/tasks/pay.rake
 homepage: https://github.com/stowzilla/belt-pay
 licenses:
 - MIT