belt-pay 0.0.3 → 0.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6949c31f8f5adaec1e1a6c6d08e36bac5fb3cdac59fd2054a46be18869fa196c
-  data.tar.gz: e07b2808dc053c34235ea4ec6ef183858c43401279a5f3d4b1c92ce7b46d2af1
+  metadata.gz: 225d94bd8d7f1b25849f237c4bb8432ce5b485b3a7ca5b88aee833d928481c4d
+  data.tar.gz: 7cabb1843e20857030506f0a3efe42a26aa375563f65c8ffb14334d84dc39b07
 SHA512:
-  metadata.gz: 5ba551d781ba509f1aa8b93f47c84b8d22e6af8727659f7643ec73d6876b58811c7383fd8780c086a1c38dd8eefc3a546efc11297ab9ea2856be0c4a6fcb58ba
-  data.tar.gz: 0e0b3dddaa5d235ba5d10362cc7d9d737ebfbc5f69649620b0adc5d42eb43d92a884560947a47cc53604f2080fd5179106eaab3015d527c6c274b9cd6f3f83b9
+  metadata.gz: ccf4f5972eabe4ffa0aa4c4d4be3207ac640970cea1ddaae857043bdf7d81a6df507932cc8c7704020326f578c46ee73ef0ea8e978b1443f761ca34f59deb960
+  data.tar.gz: 91f585c4b462664b2f193d8575fd5b551e969d613456ada465c4d3fa83387b4577b910fa64dd6e49f51b903082788ad8e48532a84174a76003368b5471ab40d1

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.0.4 — 2026-10-20
+
+- **`belt pay:setup` creates the Stripe webhook endpoint for you.** After the secret-key
+  prompt it reads `api_url` from `terraform output`, offers to create
+  `<api_url>/pay/webhooks` in Stripe (subscribed to every event Belt Pay handles), and
+  stores the returned `whsec_` signing secret directly. No Dashboard clicking.
+  - Shows whether the key is test or live mode before creating anything.
+  - If Stripe already has an endpoint for that URL, offers to replace it (the old one
+    is deleted only after the new secret is saved) or links to it in the Dashboard.
+  - Declining, or missing terraform output, prints step-by-step Dashboard instructions
+    with the exact URL and events, then prompts for the secret as before.
+  - `--webhook-url` / `BELT_PAY_WEBHOOK_URL` and `--webhook-events` /
+    `BELT_PAY_WEBHOOK_EVENTS` override the defaults.
+- `Belt::Pay::WebhookHandler::EVENTS` lists the Stripe events the handler acts on.
+
 ## 0.0.3 — 2026-10-02
 
 - Add Belt-native `pay:setup`, `pay:show`, and `pay:edit` tasks through Belt's

data/README.md

@@ -176,10 +176,17 @@ guided happy path uses `BELT_ENV` to select the environment:
 BELT_ENV=dev belt pay:setup
 ```
 
-It prompts without echo for the Stripe secret key and webhook signing secret, then
-writes them directly through the AWS SDK. Leave either prompt blank to preserve its
-existing value, so you can run setup once for the API key and again after Stripe gives
-you the webhook signing secret.
+It prompts without echo for the Stripe secret key, then offers to create the webhook
+endpoint in Stripe for you: it reads `api_url` from `terraform output`, creates
+`<api_url>/pay/webhooks` subscribed to every [handled event](#webhook-events), and stores
+the `whsec_` signing secret Stripe returns. Everything goes directly through the Stripe
+API and AWS SDK. Run it after `belt apply` so the URL is known.
+
+Decline (or run it before the first apply) and it prints step-by-step Dashboard
+instructions with the exact URL and events, then prompts for the signing secret. Leave
+either prompt blank to preserve its existing value. Use `--webhook-url` /
+`BELT_PAY_WEBHOOK_URL` or `--webhook-events` / `BELT_PAY_WEBHOOK_EVENTS` to override the
+defaults. Test (`sk_test_`) and live (`sk_live_`) keys get separate endpoints and secrets.
 
 You can also pass the environment with standard Rake task-argument syntax:
 
@@ -354,7 +361,8 @@ module "pay" {
 
 ## Stripe Dashboard Setup
 
-After deploying, configure your Stripe webhook endpoint:
+`BELT_ENV=<env> belt pay:setup` creates the webhook endpoint and stores its signing
+secret for you. To do it by hand instead:
 
 1. Go to Stripe Dashboard → Developers → Webhooks
 2. Add endpoint: `https://<your-api-domain>/pay/webhooks`

data/lib/belt/generators/pay_generator.rb

@@ -315,20 +315,15 @@ module Belt
                  # ...
                end
 
-            3. Add your Stripe API keys to Secrets Manager:
-               BELT_ENV=<env> belt pay:setup
-
-               Values are prompted without echo. Leave the webhook secret blank
-               until Stripe gives it to you, then run setup again.
-
-            4. Deploy:
+            3. Deploy:
                belt apply <env>
 
-            5. Configure Stripe webhook endpoint:
-               URL: https://<your-api-domain>/pay/webhooks
-               Events: checkout.session.completed, checkout.session.expired,
-                       invoice.paid, invoice.payment_failed,
-                       customer.subscription.deleted, customer.subscription.updated
+            4. Store your Stripe key and create the webhook endpoint:
+               BELT_ENV=<env> belt pay:setup
+
+               Prompts without echo for the Stripe secret key, then creates
+               <api_url>/pay/webhooks in Stripe and stores its signing secret.
+               Decline to get step-by-step Dashboard instructions instead.
 
           Quick Usage:
             # Create a checkout session

data/lib/belt/pay/cli.rb

@@ -2,10 +2,13 @@
 
 require 'io/console'
 require 'json'
+require 'open3'
 require 'optparse'
 require 'shellwords'
 require 'tempfile'
 require 'aws-sdk-secretsmanager'
+require 'stripe'
+require 'belt/pay/webhook_handler'
 
 module Belt
   module Pay
@@ -13,6 +16,7 @@ module Belt
       class Error < StandardError; end
 
       COMMANDS = %w[secrets:setup secrets:show secrets:edit].freeze
+      WEBHOOK_PATH = '/pay/webhooks'
 
       def self.start(args, input: $stdin, out: $stdout, err: $stderr)
         new(args, input: input, out: out, err: err).run
@@ -24,6 +28,9 @@ module Belt
       rescue Aws::Errors::ServiceError => e
         err.puts "AWS error: #{e.message}"
         1
+      rescue ::Stripe::StripeError => e
+        err.puts "Stripe error: #{e.message}"
+        1
       end
 
       def initialize(args, input:, out:, err:)
@@ -78,6 +85,12 @@ module Belt
           opts.on('--region REGION', 'Override the AWS region') do |value|
             @options[:region] = value
           end
+          opts.on('--webhook-url URL', 'Override the Stripe webhook endpoint URL') do |value|
+            @options[:webhook_url] = value
+          end
+          opts.on('--webhook-events LIST', 'Comma-separated Stripe events for a new endpoint') do |value|
+            @options[:webhook_events] = value
+          end
           opts.on('-h', '--help', 'Show this help') do
             @out.puts help
             exit 0
@@ -108,11 +121,122 @@ module Belt
         updated = original.dup
 
         secret_key = hidden_prompt('Stripe secret key [blank keeps existing]')
-        webhook_secret = hidden_prompt('Stripe webhook signing secret [blank keeps existing]')
         updated['stripe_secret_key'] = secret_key unless blank?(secret_key)
+
+        webhook_secret, replaced = webhook_secret_for(updated['stripe_secret_key'], original['stripe_webhook_secret'])
         updated['stripe_webhook_secret'] = webhook_secret unless blank?(webhook_secret)
 
         update_secret(response, original, updated)
+        delete_replaced_endpoints(updated['stripe_secret_key'], replaced)
+      end
+
+      # Returns [signing_secret, endpoints_to_delete]. Offers to create the Stripe
+      # webhook endpoint (Stripe only returns a signing secret at creation time);
+      # otherwise prints Dashboard instructions and prompts for the secret.
+      def webhook_secret_for(api_key, existing_secret)
+        if blank?(api_key)
+          @out.puts 'No Stripe secret key stored yet, so the webhook endpoint cannot be created for you.'
+          return [manual_webhook_secret(nil), []]
+        end
+
+        mode = stripe_mode(api_key)
+        url = webhook_url
+        @out.puts "Stripe account mode: #{mode}"
+        @out.puts "Webhook endpoint URL: #{url || '(unknown; run `belt apply` first or pass --webhook-url)'}"
+
+        create = !url.nil? && confirm("Create the #{mode}-mode webhook endpoint in Stripe now?", default: blank?(existing_secret))
+        return [manual_webhook_secret(url, mode: mode), []] unless create
+
+        existing = stripe_endpoints(api_key).select { |endpoint| endpoint.url == url }
+        if existing.any?
+          ids = existing.map(&:id).join(', ')
+          @out.puts "Stripe already has an endpoint for this URL (#{ids}). Stripe never re-sends a signing secret,"
+          @out.puts 'so setup can only replace it with a new endpoint (the old secret stops working).'
+          unless confirm('Replace it?', default: false)
+            @out.puts "Reveal its signing secret at #{dashboard_url(mode, existing.first.id)}"
+            return [hidden_prompt('Stripe webhook signing secret [blank keeps existing]'), []]
+          end
+        end
+
+        endpoint = ::Stripe::WebhookEndpoint.create(
+          { url: url, enabled_events: webhook_events, description: "Belt Pay (#{@app_name} #{@environment})" },
+          { api_key: api_key }
+        )
+        @out.puts "Created #{mode}-mode webhook endpoint #{endpoint.id} for #{webhook_events.size} events."
+        [endpoint.secret, existing.map(&:id)]
+      end
+
+      def manual_webhook_secret(url, mode: nil)
+        @out.puts <<~STEPS
+
+          To set up the webhook in the Stripe Dashboard#{" (#{mode} mode)" if mode}:
+            1. Developers -> Webhooks -> Add destination (#{mode == 'live' ? 'https://dashboard.stripe.com/webhooks' : 'https://dashboard.stripe.com/test/webhooks'})
+            2. Events from: Your account. API version: the default.
+            3. Events: #{webhook_events.join(', ')}
+            4. Destination type: Webhook endpoint
+            5. URL: #{url || "your API base URL (`belt output #{@environment}` api_url) + #{WEBHOOK_PATH}"}
+            6. Open the new endpoint -> Signing secret -> Reveal, and paste it below.
+          Each endpoint (and test vs. live mode) has its own whsec_ secret. Do not use the
+          one `stripe listen` prints; it only works for local forwarding.
+
+        STEPS
+        hidden_prompt('Stripe webhook signing secret [blank keeps existing]')
+      end
+
+      def delete_replaced_endpoints(api_key, ids)
+        ids.each do |id|
+          ::Stripe::WebhookEndpoint.delete(id, {}, { api_key: api_key })
+          @out.puts "Deleted replaced webhook endpoint #{id}"
+        end
+      end
+
+      def stripe_endpoints(api_key)
+        ::Stripe::WebhookEndpoint.list({ limit: 100 }, { api_key: api_key }).auto_paging_each.to_a
+      end
+
+      def webhook_url
+        return @webhook_url if defined?(@webhook_url)
+
+        explicit = @options[:webhook_url] || ENV['BELT_PAY_WEBHOOK_URL']
+        @webhook_url = if blank?(explicit)
+                         api_url = terraform_output('api_url')
+                         "#{api_url.chomp('/')}#{WEBHOOK_PATH}" unless blank?(api_url)
+                       else
+                         explicit.strip
+                       end
+      end
+
+      def webhook_events
+        list = @options[:webhook_events] || ENV['BELT_PAY_WEBHOOK_EVENTS']
+        return Belt::Pay::WebhookHandler::EVENTS if blank?(list)
+
+        list.split(',').map(&:strip).reject(&:empty?)
+      end
+
+      def terraform_output(name)
+        env_dir = File.join(@root, 'infrastructure', @environment)
+        stdout, _stderr, status = Open3.capture3('terraform', "-chdir=#{env_dir}", 'output', '-raw', name)
+        stdout.strip if status.success?
+      rescue SystemCallError
+        nil
+      end
+
+      def stripe_mode(api_key)
+        api_key.match?(/\A[sr]k_live_/) ? 'live' : 'test'
+      end
+
+      def dashboard_url(mode, endpoint_id)
+        "https://dashboard.stripe.com/#{'test/' unless mode == 'live'}webhooks/#{endpoint_id}"
+      end
+
+      def confirm(question, default:)
+        @out.print "#{question} #{default ? '[Y/n]' : '[y/N]'} "
+        @out.flush
+        answer = @input.gets
+        @out.puts if answer.nil?
+        return default if answer.nil? || answer.strip.empty?
+
+        answer.strip.downcase.start_with?('y')
       end
 
       def show
@@ -171,7 +295,7 @@ module Belt
                   @input.gets
                 end
         @out.puts
-        raise Error, 'input ended before both Stripe secrets were read' if value.nil?
+        raise Error, 'input ended before the Stripe secrets were read' if value.nil?
 
         value.chomp
       end
@@ -264,7 +388,9 @@ module Belt
             belt-pay secrets:edit ENV [options]
 
           Commands:
-            secrets:setup        Prompt without echo for Stripe's secret values
+            secrets:setup        Prompt without echo for the Stripe secret key, then create
+                                 the webhook endpoint in Stripe and store its signing
+                                 secret (or walk through creating it in the Dashboard)
             secrets:show         Print the decrypted JSON secret
             secrets:edit         Edit the secret with $VISUAL or $EDITOR
 
@@ -273,12 +399,16 @@ module Belt
             --secret-name NAME   Override <app>-<environment>-stripe
             --profile PROFILE    Override the environment's AWS profile
             --region REGION      Override the detected AWS region
+            --webhook-url URL    Override <terraform api_url>#{WEBHOOK_PATH}
+            --webhook-events L   Comma-separated events (default: every event Belt Pay handles)
             -h, --help           Show this help
 
           Environment:
             BELT_ENV             Environment when ENV is omitted
             AWS_PROFILE          AWS profile (overrides infrastructure/ENV/belt.rb)
             AWS_REGION           AWS region (default: us-east-1)
+            BELT_PAY_WEBHOOK_URL     Same as --webhook-url
+            BELT_PAY_WEBHOOK_EVENTS  Same as --webhook-events
             VISUAL, EDITOR       Editor command for secrets:edit
 
           Examples:

data/lib/belt/pay/version.rb

@@ -2,6 +2,6 @@
 
 module Belt
   module Pay
-    VERSION = '0.0.3'
+    VERSION = '0.0.4'
   end
 end

data/lib/belt/pay/webhook_handler.rb

@@ -5,6 +5,17 @@ module Belt
     # Handles incoming webhooks from the payment provider.
     # Verifies signatures, dispatches events, and records transactions.
     module WebhookHandler
+      # Stripe events #dispatch acts on. `belt pay:setup` subscribes new webhook
+      # endpoints to exactly this list.
+      EVENTS = %w[
+        checkout.session.completed
+        checkout.session.expired
+        invoice.paid
+        invoice.payment_failed
+        customer.subscription.deleted
+        customer.subscription.updated
+      ].freeze
+
       class << self
         # Process a raw webhook request.
         # @param payload [String] Raw request body

data/lib/tasks/pay.rake

@@ -11,7 +11,7 @@ run_pay_secret_command = lambda do |command, environment|
 end
 
 namespace :pay do
-  desc 'Prompt without echo for Stripe secrets (BELT_ENV or pay:setup[env])'
+  desc 'Store the Stripe key and create the webhook endpoint (BELT_ENV or pay:setup[env])'
   task :setup, [:environment] do |_task, args|
     run_pay_secret_command.call(:setup, args[:environment])
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt-pay
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.4
 platform: ruby
 authors:
 - Stowzilla