pay 11.8.0 → 12.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0d074d1f459f7129fb3f7e308075e87054d667f177453a89a08f3b243a4a029a
-  data.tar.gz: b6d3340eb343e55a964f925357076b76f751a2e1bae87fa262221682869cb9a7
+  metadata.gz: 14afa87f45020e488adeabd8512769dfb6505e4a4416fcd785ddfb44b5f1f1aa
+  data.tar.gz: 24ac5cb9a899928283198d52ac59f978ba36f5ecbb42b2188605ad4ac47e3fc3
 SHA512:
-  metadata.gz: c5b8ad8fad63c66e64d5c4f03f06dd52b06e981342a1388a8b2ec405dd8438f3ba7cbc1256db54658d8e051e84370fb91806a8b3b916674d532c5ed048d5791f
-  data.tar.gz: cb8f4b0b6ec9450846a947876ac11da6b44d7bab9c595253179df16f50244d76413d491f2fc4ba25248b6101112ba5ba9ef406e1e95c8b6b418c792ed157442e
+  metadata.gz: 1485f2c107bb18da658f958d20d6c849b552c487f9479649296c20a46c67fcc99d3e51ea2c28c6c3edf79585a99a6723da3e613f626f69111c50609884a2a549
+  data.tar.gz: 2dffe43858ed52b7f63a1249e0dbcfc88911a9e08cfdbf17702381bf75dd4e956b77ae66cdbbcd7d50832a136a108d33dc1daafe42177219c40d475d2842cd4f

data/app/controllers/pay/payments_controller.rb

@@ -2,21 +2,13 @@ module Pay
   class PaymentsController < ApplicationController
     layout "pay/application"
 
-    before_action :set_redirect_to
-
     # Intents on a Stripe Connect account are linked with ?stripe_account=acct_123
+    # The back link only follows a same-host URL or a path, so it can't be used for an open redirect
     def show
       @payment = Payment.from_id(params[:id], stripe_account: params[:stripe_account].presence)
-    rescue ::Stripe::StripeError => e
+      @redirect_to = url_from(params[:back]) || root_path
+    rescue Pay::Error => e
       redirect_to root_path, alert: e.message
     end
-
-    private
-
-    # Ensure the back parameter is a valid path
-    # This safely handles XSS or external redirects
-    def set_redirect_to
-      @redirect_to = URI.parse(params[:back].to_s).path.presence || root_path
-    end
   end
 end

data/app/controllers/pay/webhooks/base_controller.rb

@@ -0,0 +1,50 @@
+module Pay
+  module Webhooks
+    # Verifies a processor's webhook request and queues the event for Pay::Webhooks::ProcessJob.
+    #
+    # Subclasses implement verified_event, which raises a Pay::Error when the signature doesn't
+    # check out, and event_type. Processors whose parsed event can't be serialized override
+    # event_payload; Stripe overrides queue? to skip test-mode events.
+    class BaseController < ActionController::API
+      rescue_from Pay::Error, with: :invalid_signature
+
+      def create
+        event = verified_event
+        queue_event(event) if queue?(event)
+        head :ok
+      end
+
+      private
+
+      def queue?(event)
+        true
+      end
+
+      def event_payload(event)
+        event
+      end
+
+      def queue_event(event)
+        type = event_type(event)
+        return unless Pay::Webhooks.delegator.listening?("#{processor}.#{type}")
+
+        record = Pay::Webhook.create!(processor: processor, event_type: type, event: event_payload(event))
+        Pay::Webhooks::ProcessJob.perform_later(record)
+      end
+
+      # "stripe", "paddle_billing", and so on, from the controller name
+      def processor
+        controller_name
+      end
+
+      # The request body as a plain hash, for processors that sign the request rather than hand us an event object
+      def verified_params
+        params.except(:action, :controller).permit!.as_json
+      end
+
+      def invalid_signature
+        head :bad_request
+      end
+    end
+  end
+end

data/app/controllers/pay/webhooks/braintree_controller.rb

@@ -1,28 +1,21 @@
 module Pay
   module Webhooks
-    class BraintreeController < ActionController::API
-      def create
-        queue_event(verified_event)
-        head :ok
-      rescue ::Braintree::InvalidSignature
-        head :bad_request
-      end
-
+    class BraintreeController < BaseController
       private
 
-      def queue_event(event)
-        return unless Pay::Webhooks.delegator.listening?("braintree.#{event.kind}")
+      def verified_event
+        Pay.braintree_gateway.webhook_notification.parse(params[:bt_signature], params[:bt_payload])
+      rescue ::Braintree::InvalidSignature => e
+        raise Pay::Braintree::Error, e
+      end
 
-        record = Pay::Webhook.create!(
-          processor: :braintree,
-          event_type: event.kind,
-          event: {bt_signature: params[:bt_signature], bt_payload: params[:bt_payload]}
-        )
-        Pay::Webhooks::ProcessJob.perform_later(record)
+      def event_type(event)
+        event.kind
       end
 
-      def verified_event
-        Pay.braintree_gateway.webhook_notification.parse(params[:bt_signature], params[:bt_payload])
+      # The parsed notification can't be serialized, so store the signed payload and parse it again in the job
+      def event_payload(event)
+        {bt_signature: params[:bt_signature], bt_payload: params[:bt_payload]}
       end
     end
   end

data/app/controllers/pay/webhooks/lemon_squeezy_controller.rb

@@ -1,41 +1,23 @@
 module Pay
   module Webhooks
-    class LemonSqueezyController < ActionController::API
-      def create
-        if valid_signature?(request.headers["X-Signature"])
-          queue_event(verify_params.as_json)
-          head :ok
-        else
-          head :bad_request
-        end
-      rescue Pay::LemonSqueezy::Error
-        head :bad_request
-      end
-
+    class LemonSqueezyController < BaseController
       private
 
-      def queue_event(event)
-        return unless Pay::Webhooks.delegator.listening?("lemon_squeezy.#{params[:meta][:event_name]}")
+      def verified_event
+        raise Pay::LemonSqueezy::Error, "Unable to verify Lemon Squeezy webhook signature" unless valid_signature?(request.headers["X-Signature"])
+        verified_params
+      end
 
-        record = Pay::Webhook.create!(processor: :lemon_squeezy, event_type: params[:meta][:event_name], event: event)
-        Pay::Webhooks::ProcessJob.perform_later(record)
+      def event_type(event)
+        event.dig("meta", "event_name")
       end
 
-      # Pass Lemon Squeezy signature from request.headers["X-Signature"]
       def valid_signature?(signature)
         return false if signature.blank?
 
-        key = Pay::LemonSqueezy.signing_secret
-        data = request.raw_post
-        digest = OpenSSL::Digest.new("sha256")
-
-        hmac = OpenSSL::HMAC.hexdigest(digest, key, data)
+        hmac = OpenSSL::HMAC.hexdigest("sha256", Pay::LemonSqueezy.signing_secret.to_s, request.raw_post)
         ActiveSupport::SecurityUtils.secure_compare(hmac, signature)
       end
-
-      def verify_params
-        params.except(:action, :controller).permit!
-      end
     end
   end
 end

data/app/controllers/pay/webhooks/paddle_billing_controller.rb

@@ -1,48 +1,26 @@
 module Pay
   module Webhooks
-    class PaddleBillingController < ActionController::API
-      def create
-        if valid_signature?(request.headers["Paddle-Signature"])
-          queue_event(verify_params.as_json)
-          head :ok
-        else
-          head :bad_request
-        end
-      rescue Pay::PaddleBilling::Error
-        head :bad_request
-      end
-
+    class PaddleBillingController < BaseController
       private
 
-      def queue_event(event)
-        return unless Pay::Webhooks.delegator.listening?("paddle_billing.#{params[:event_type]}")
-
-        record = Pay::Webhook.create!(processor: :paddle_billing, event_type: params[:event_type], event: event)
-        Pay::Webhooks::ProcessJob.perform_later(record)
+      def verified_event
+        raise Pay::PaddleBilling::Error, "Unable to verify Paddle webhook signature" unless valid_signature?(request.headers["Paddle-Signature"])
+        verified_params
       end
 
-      # Pass Paddle signature from request.headers["Paddle-Signature"]
-      def valid_signature?(paddle_signature)
-        return false if paddle_signature.blank?
-
-        ts_part, h1_part = paddle_signature.split(";")
-        _, ts = ts_part.split("=")
-        _, h1 = h1_part.split("=")
-
-        signed_payload = "#{ts}:#{request.raw_post}"
+      def event_type(event)
+        event["event_type"]
+      end
 
-        key = Pay::PaddleBilling.signing_secret
-        data = signed_payload
-        digest = OpenSSL::Digest.new("sha256")
+      # The header looks like "ts=1671552777;h1=eb4d0dc8..."
+      def valid_signature?(signature)
+        parts = signature.to_s.split(";").filter_map { |part| part.split("=", 2) if part.include?("=") }.to_h
+        ts, h1 = parts.values_at("ts", "h1")
+        return false if ts.blank? || h1.blank?
 
-        hmac = OpenSSL::HMAC.hexdigest(digest, key, data)
-        return false if h1.nil? || hmac.bytesize != h1.bytesize
+        hmac = OpenSSL::HMAC.hexdigest("sha256", Pay::PaddleBilling.signing_secret.to_s, "#{ts}:#{request.raw_post}")
         ActiveSupport::SecurityUtils.secure_compare(hmac, h1)
       end
-
-      def verify_params
-        params.except(:action, :controller).permit!
-      end
     end
   end
 end

data/app/controllers/pay/webhooks/paddle_classic_controller.rb

@@ -1,31 +1,16 @@
 module Pay
   module Webhooks
-    class PaddleClassicController < ActionController::API
-      def create
-        queue_event(verified_event)
-        head :ok
-      rescue Pay::PaddleClassic::Error
-        head :bad_request
-      end
-
+    class PaddleClassicController < BaseController
       private
 
-      def queue_event(event)
-        return unless Pay::Webhooks.delegator.listening?("paddle_classic.#{params[:alert_name]}")
-
-        record = Pay::Webhook.create!(processor: :paddle_classic, event_type: params[:alert_name], event: event)
-        Pay::Webhooks::ProcessJob.perform_later(record)
-      end
-
       def verified_event
-        event = verify_params.as_json
-        verifier = Pay::PaddleClassic::Webhooks::SignatureVerifier.new(event)
-        return event if verifier.verify
+        event = verified_params
+        return event if Pay::PaddleClassic::Webhooks::SignatureVerifier.new(event).verify
         raise Pay::PaddleClassic::Error, "Unable to verify Paddle webhook event"
       end
 
-      def verify_params
-        params.except(:action, :controller).permit!
+      def event_type(event)
+        event["alert_name"]
       end
     end
   end

data/app/controllers/pay/webhooks/stripe_controller.rb

@@ -1,46 +1,30 @@
 module Pay
   module Webhooks
-    class StripeController < ActionController::API
-      def create
-        event = verified_event
-        queue_event(event) if event.livemode || Pay::Stripe.webhook_receive_test_events
-        head :ok
-      rescue ::Stripe::SignatureVerificationError => e
-        log_error(e)
-        head :bad_request
-      end
-
+    class StripeController < BaseController
       private
 
-      def queue_event(event)
-        return unless Pay::Webhooks.delegator.listening?("stripe.#{event.type}")
-
-        record = Pay::Webhook.create!(processor: :stripe, event_type: event.type, event: event)
-        Pay::Webhooks::ProcessJob.perform_later(record)
-      end
-
       def verified_event
         payload = request.body.read
         signature = request.headers["Stripe-Signature"]
-        possible_secrets = secrets(payload, signature)
+        secrets = Array.wrap(Pay::Stripe.signing_secret)
+        raise Pay::Stripe::Error, "Cannot verify signature without a Stripe signing secret" if secrets.empty?
 
-        possible_secrets.each_with_index do |secret, i|
+        # Several secrets can be configured while rotating; accept the first that verifies
+        secrets.each_with_index do |secret, i|
           return ::Stripe::Webhook.construct_event(payload, signature, secret.to_s)
-        rescue ::Stripe::SignatureVerificationError
-          raise if i == possible_secrets.length - 1
-          next
+        rescue ::Stripe::SignatureVerificationError => e
+          next unless i == secrets.length - 1
+          logger.error e.message
+          raise Pay::Stripe::Error, e
         end
       end
 
-      def secrets(payload, signature)
-        secret = Pay::Stripe.signing_secret
-        return Array.wrap(secret) if secret
-        raise ::Stripe::SignatureVerificationError.new("Cannot verify signature without a Stripe signing secret", signature, http_body: payload)
+      def event_type(event)
+        event.type
       end
 
-      def log_error(e)
-        logger.error e.message
-        e.backtrace.each { |line| logger.error "  #{line}" }
+      def queue?(event)
+        event.livemode || Pay::Stripe.webhook_receive_test_events
       end
     end
   end

data/app/models/pay/braintree/charge.rb

@@ -1,20 +1,14 @@
 module Pay
   module Braintree
     class Charge < Pay::Charge
-      def self.sync(charge_id, object: nil, try: 0, retries: 1)
-        object ||= Pay.braintree_gateway.transaction.find(charge_id)
+      extend Pay::Sync
 
-        pay_customer = Pay::Customer.find_by(processor: :braintree, processor_id: object.customer_details.id)
-        return unless pay_customer
+      def self.sync(charge_id, object: nil)
+        sync_with_retries do
+          transaction = object || Pay.braintree_gateway.transaction.find(charge_id)
+          return unless (pay_customer = find_pay_customer(transaction.customer_details.id))
 
-        pay_customer.save_transaction(object)
-      rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique
-        try += 1
-        if try <= retries
-          sleep 0.1
-          retry
-        else
-          raise
+          pay_customer.save_transaction(transaction)
         end
       end
 

data/app/models/pay/braintree/payment_method.rb

@@ -1,13 +1,15 @@
 module Pay
   module Braintree
     class PaymentMethod < Pay::PaymentMethod
-      def self.sync(id, object: nil, try: 0, retries: 1)
-        object ||= Pay.braintree_gateway.payment_method.find(id)
+      extend Pay::Sync
 
-        pay_customer = Pay::Braintree::Customer.find_by(processor_id: object.customer_id)
-        return unless pay_customer
+      def self.sync(id, object: nil)
+        sync_with_retries do
+          payment_method = object || Pay.braintree_gateway.payment_method.find(id)
+          return unless (pay_customer = find_pay_customer(payment_method.customer_id))
 
-        pay_customer.save_payment_method(object, default: object.default?)
+          pay_customer.save_payment_method(payment_method, default: payment_method.default?)
+        end
       end
 
       # Sets payment method as default

data/app/models/pay/braintree/subscription.rb

@@ -1,49 +1,44 @@
 module Pay
   module Braintree
     class Subscription < Pay::Subscription
-      def self.sync(subscription_id, object: nil, name: nil, try: 0, retries: 1)
-        object ||= Pay.braintree_gateway.subscription.find(subscription_id)
-
-        # Retrieve Pay::Customer
-        payment_method = Pay.braintree_gateway.payment_method.find(object.payment_method_token)
-        pay_customer = Pay::Customer.find_by(processor: :braintree, processor_id: payment_method.customer_id)
-        return unless pay_customer
-
-        # Sync the PaymentMethod since we've got it
-        pay_customer.save_payment_method(payment_method, default: payment_method.default?)
-
-        attributes = {
-          created_at: object.created_at,
-          current_period_end: object.billing_period_end_date,
-          current_period_start: object.billing_period_start_date,
-          payment_method_id: object.payment_method_token,
-          processor_plan: object.plan_id,
-          status: object.status.parameterize(separator: "_"),
-          trial_ends_at: (object.created_at + object.trial_duration.send(object.trial_duration_unit) if object.trial_period)
-        }
-
-        # Canceled subscriptions should have access through the paid_through_date or updated_at
-        if object.status == "Canceled"
-          attributes[:ends_at] = object.updated_at
-
-        # Set grace period for subscriptions that are marked to be canceled
-        elsif object.status == "Active" && object.number_of_billing_cycles
-          attributes[:ends_at] = object.paid_through_date.end_of_day
-        end
+      extend Pay::Sync
+
+      def self.sync(subscription_id, object: nil, name: nil)
+        sync_with_retries do
+          subscription = object || Pay.braintree_gateway.subscription.find(subscription_id)
+
+          # The customer is only reachable through the subscription's payment method
+          payment_method = Pay.braintree_gateway.payment_method.find(subscription.payment_method_token)
+          return unless (pay_customer = find_pay_customer(payment_method.customer_id))
+
+          # Sync the PaymentMethod since we've got it
+          pay_customer.save_payment_method(payment_method, default: payment_method.default?)
+
+          attributes = {
+            created_at: subscription.created_at,
+            current_period_end: subscription.billing_period_end_date,
+            current_period_start: subscription.billing_period_start_date,
+            payment_method_id: subscription.payment_method_token,
+            processor_plan: subscription.plan_id,
+            status: subscription.status.parameterize(separator: "_"),
+            trial_ends_at: (subscription.created_at + subscription.trial_duration.send(subscription.trial_duration_unit) if subscription.trial_period)
+          }
 
-        if (pay_subscription = find_by(customer: pay_customer, processor_id: object.id))
-          pay_subscription.with_lock { pay_subscription.update!(attributes) }
-        else
-          name ||= Pay.default_product_name
-          create!(attributes.merge(customer: pay_customer, name: name, processor_id: object.id))
-        end
-      rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique
-        try += 1
-        if try <= retries
-          sleep 0.1
-          retry
-        else
-          raise
+          # Canceled subscriptions should have access through the paid_through_date or updated_at
+          if subscription.status == "Canceled"
+            attributes[:ends_at] = subscription.updated_at
+
+          # Set grace period for subscriptions that are marked to be canceled
+          elsif subscription.status == "Active" && subscription.number_of_billing_cycles
+            attributes[:ends_at] = subscription.paid_through_date.end_of_day
+          end
+
+          if (pay_subscription = find_by(customer: pay_customer, processor_id: subscription.id))
+            pay_subscription.with_lock { pay_subscription.update!(attributes) }
+          else
+            name ||= Pay.default_product_name
+            create!(attributes.merge(customer: pay_customer, name: name, processor_id: subscription.id))
+          end
         end
       end
 
@@ -75,7 +70,7 @@ module Pay
       end
 
       def change_quantity(quantity, **options)
-        raise NotImplementedError, "Braintree does not support setting quantity on subscriptions"
+        raise Pay::NotSupportedError, "Braintree does not support setting quantity on subscriptions"
       end
 
       def paused?
@@ -83,7 +78,7 @@ module Pay
       end
 
       def pause
-        raise NotImplementedError, "Braintree does not support pausing subscriptions"
+        raise Pay::NotSupportedError, "Braintree does not support pausing subscriptions"
       end
 
       def resumable?

data/app/models/pay/charge.rb

@@ -11,7 +11,7 @@ module Pay
 
     # Validations
     validates :amount, presence: true
-    validates :processor_id, presence: true, uniqueness: {scope: :customer_id, case_sensitive: true}
+    validates :processor_id, presence: true
 
     delegate :owner, to: :customer
 

data/app/models/pay/customer.rb

@@ -8,10 +8,8 @@ module Pay
 
     scope :active, -> { where(deleted_at: nil) }
     scope :deleted, -> { where.not(deleted_at: nil) }
-    scope :not_fake_processor, -> { where.not(processor: :fake_processor) }
 
     validates :processor, presence: true
-    validates :processor_id, allow_blank: true, uniqueness: {scope: :processor, case_sensitive: true}
 
     # Account(s) for marketplace payments
     store_accessor :data, :braintree_account
@@ -58,7 +56,7 @@ module Pay
     end
 
     def has_incomplete_payment?
-      subscriptions.active.incomplete.any?
+      subscriptions.where(status: %w[incomplete past_due]).exists?
     end
 
     def customer_name
@@ -83,12 +81,6 @@ module Pay
       # If these match, consider it a generic trial
       subscription.trial_ends_at == subscription.ends_at
     end
-
-    # Attempts to pay all past_due subscription invoices to bring them back to active state
-    # Pass in `statuses: []` if you would like to only include specific subscription statuses
-    def retry_past_due_subscriptions!(status: [:past_due])
-      subscriptions.where(status: Array.wrap(status)).each(&:pay_open_invoices)
-    end
   end
 end