belt-pay 0.0.5 → 0.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 937d9e1a7ca86c274b1dd20feb2ad16b2f9f9aa8544b0bffd6d72ed1550768f7
-  data.tar.gz: f33e95b73bd5f8104d3da45c34ce7e3e4e6ca329224721c80271af3f8e7c85d3
+  metadata.gz: df0a213a964e2b9d6e20019719612a03ae5a38fdafaade9f75bdb8b853f2ca87
+  data.tar.gz: 0a539c50414142e25667909c2858a45a00056e9afeb6b5f3ed824d50d7b50e30
 SHA512:
-  metadata.gz: b1c7f6bb3f97548a05e060090f47b586aaf0435237931cd1c67b55534efd72eb706cf6af1d7294f07a5210268fdd6c232ef951d410722b00de1bdc56f43c30cc
-  data.tar.gz: 73e0341c2f2441a279814645e959df9f1b94c41d88ba70018bac6b3ef10c144583288e945ee0a1d22e955c057361dc5e71858c5e4a63769e9a2fb47af3d4ad38
+  metadata.gz: a8ece6c8fc7785233a665207bb5d68a7f652e3097d1706dd18fcb614b0b049a14d71b06f161fcda0acbd706ce01617061465c92b332f34c7f1f77021d2dafdd2
+  data.tar.gz: 5fae3025eff2bbc50cac637a22621d1f4de3b259a487653f5a3aeb2b6fe062312b6c4f9740088caa42288cc17d8b327bebaf698bc51fa819dc63a6d3767a98f4

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.0.6 — 2026-11-02
+
+- **`pay:setup` works with a restricted runtime key.** The stored key is what the app
+  runs with, so it should be a restricted key (`rk_`) holding only what checkout and the
+  portal need. Setup used to manage the webhook endpoint with that same key, so a
+  restricted key without Webhook Endpoints access failed with a Stripe permission error.
+  When Stripe refuses the stored key, setup now asks once for a key that can manage
+  endpoints (an `sk_` secret key, or a restricted key with Webhook Endpoints: Write),
+  uses it for the endpoint list/create/delete calls in that run only, and never stores
+  it. A key from the other Stripe mode is refused. Leaving the prompt blank, or a second
+  refusal, falls back to the Dashboard steps; the stored key is still saved either way.
+
 ## 0.0.5 — 2026-10-31
 
 - **`create_checkout` no longer drops Checkout Session options.** The Stripe provider used

data/README.md

@@ -200,6 +200,13 @@ either prompt blank to preserve its existing value. Use `--webhook-url` /
 `BELT_PAY_WEBHOOK_URL` or `--webhook-events` / `BELT_PAY_WEBHOOK_EVENTS` to override the
 defaults. Test (`sk_test_`) and live (`sk_live_`) keys get separate endpoints and secrets.
 
+Prefer a [restricted key](https://docs.stripe.com/keys#limit-access) (`rk_`) as the
+stored key, scoped to what your app calls at runtime (typically Customers, Checkout
+Sessions, Customer portal and Subscriptions). It doesn't need Webhook Endpoints access:
+when Stripe refuses it for the endpoint step, setup asks once for a key that can manage
+endpoints (your `sk_` secret key, or a restricted key with Webhook Endpoints: Write),
+uses it for that step only, and doesn't store it.
+
 You can also pass the environment with standard Rake task-argument syntax:
 
 ```bash

data/lib/belt/pay/cli.rb

@@ -14,6 +14,7 @@ module Belt
   module Pay
     class CLI
       class Error < StandardError; end
+      class EndpointKeyUnavailable < StandardError; end
 
       COMMANDS = %w[secrets:setup secrets:show secrets:edit].freeze
       WEBHOOK_PATH = '/pay/webhooks'
@@ -127,7 +128,7 @@ module Belt
         updated['stripe_webhook_secret'] = webhook_secret unless blank?(webhook_secret)
 
         update_secret(response, original, updated)
-        delete_replaced_endpoints(updated['stripe_secret_key'], replaced)
+        delete_replaced_endpoints(replaced)
       end
 
       # Returns [signing_secret, endpoints_to_delete]. Offers to create the Stripe
@@ -147,7 +148,8 @@ module Belt
         create = !url.nil? && confirm("Create the #{mode}-mode webhook endpoint in Stripe now?", default: blank?(existing_secret))
         return [manual_webhook_secret(url, mode: mode), []] unless create
 
-        existing = stripe_endpoints(api_key).select { |endpoint| endpoint.url == url }
+        @endpoint_key = api_key
+        existing = with_endpoint_key(mode) { |key| stripe_endpoints(key) }.select { |endpoint| endpoint.url == url }
         if existing.any?
           ids = existing.map(&:id).join(', ')
           @out.puts "Stripe already has an endpoint for this URL (#{ids}). Stripe never re-sends a signing secret,"
@@ -158,12 +160,17 @@ module Belt
           end
         end
 
-        endpoint = ::Stripe::WebhookEndpoint.create(
-          { url: url, enabled_events: webhook_events, description: "Belt Pay (#{@app_name} #{@environment})" },
-          { api_key: api_key }
-        )
+        endpoint = with_endpoint_key(mode) do |key|
+          ::Stripe::WebhookEndpoint.create(
+            { url: url, enabled_events: webhook_events, description: "Belt Pay (#{@app_name} #{@environment})" },
+            { api_key: key }
+          )
+        end
         @out.puts "Created #{mode}-mode webhook endpoint #{endpoint.id} for #{webhook_events.size} events."
         [endpoint.secret, existing.map(&:id)]
+      rescue EndpointKeyUnavailable => e
+        @out.puts e.message
+        [manual_webhook_secret(url, mode: mode), []]
       end
 
       def manual_webhook_secret(url, mode: nil)
@@ -183,13 +190,38 @@ module Belt
         hidden_prompt('Stripe webhook signing secret [blank keeps existing]')
       end
 
-      def delete_replaced_endpoints(api_key, ids)
+      def delete_replaced_endpoints(ids)
         ids.each do |id|
-          ::Stripe::WebhookEndpoint.delete(id, {}, { api_key: api_key })
+          ::Stripe::WebhookEndpoint.delete(id, {}, { api_key: @endpoint_key })
           @out.puts "Deleted replaced webhook endpoint #{id}"
         end
       end
 
+      # The stored key is what the app runs with, so it is usually a restricted key
+      # (rk_) without Webhook Endpoints access. When Stripe refuses it, ask once for a
+      # key that can manage endpoints (an sk_ secret key, or a restricted key with
+      # Webhook Endpoints: Write), use it for the endpoint calls in this run only, and
+      # never store it.
+      def with_endpoint_key(mode)
+        yield @endpoint_key
+      rescue ::Stripe::PermissionError => e
+        raise EndpointKeyUnavailable, "Stripe refused that key too: #{e.message}" if @endpoint_key_borrowed
+
+        @out.puts 'The stored Stripe key cannot manage webhook endpoints (a restricted key usually cannot).'
+        @out.puts 'Setup can use a second key for this step only; it is not stored.'
+        key = hidden_prompt("Stripe #{mode} secret key, or restricted key with Webhook Endpoints write [not stored]")
+        raise EndpointKeyUnavailable, 'No key given.' if blank?(key)
+
+        key = key.strip
+        unless stripe_mode(key) == mode
+          raise EndpointKeyUnavailable, "That is a #{stripe_mode(key)}-mode key; the stored key is #{mode} mode."
+        end
+
+        @endpoint_key = key
+        @endpoint_key_borrowed = true
+        retry
+      end
+
       def stripe_endpoints(api_key)
         ::Stripe::WebhookEndpoint.list({ limit: 100 }, { api_key: api_key }).auto_paging_each.to_a
       end
@@ -419,7 +451,8 @@ module Belt
 
           Security:
             secrets:setup reads values without echo and sends them directly through the
-            AWS SDK. secrets:show writes the complete secret to stdout. secrets:edit uses
+            AWS SDK. If the stored key is a restricted key without Webhook Endpoints
+            access, it asks for a second key for the endpoint step and never stores it. secrets:show writes the complete secret to stdout. secrets:edit uses
             a mode-0600 temporary file, validates JSON, and removes the file afterward.
         HELP
       end

data/lib/belt/pay/version.rb

@@ -2,6 +2,6 @@
 
 module Belt
   module Pay
-    VERSION = '0.0.5'
+    VERSION = '0.0.6'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: belt-pay
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.0.6
 platform: ruby
 authors:
 - Stowzilla