@base44/app-plugin-commerce 0.8.2 → 0.8.3

package/base44/functions/commerce/admin-refunds/entry.ts

@@ -5,6 +5,9 @@
  * Actions: create | delete
  */
 import { createClientFromRequest } from "npm:@base44/sdk";
+// The only layer that may reach the runtime: shared/ is client-bundleable,
+// so the secret store is read here and handed down per call.
+import { secrets } from "base44:runtime";
 import { HttpError, requireAdmin } from "../../../shared/commerce/auth.ts";
 import { refundCardOrder } from "../../../shared/commerce/payments.ts";
 import { round2 } from "../../../shared/commerce/money.ts";
@@ -64,6 +67,7 @@ async function create(sr: any, payload: any, actor: string): Promise<any> {
   let gatewayRefund: Awaited<ReturnType<typeof refundCardOrder>> = null;
   if (payload.refund_payment) {
     gatewayRefund = await refundCardOrder(sr, order, {
+      secrets,
       amount,
       reason: payload.reason,
     });

package/base44/functions/commerce/payment-webhook/entry.ts

@@ -27,6 +27,9 @@
  * 400 `webhook_not_implemented`.
  */
 import { createClientFromRequest } from "npm:@base44/sdk";
+// The only layer that may reach the runtime: shared/ is client-bundleable,
+// so the secret store is read here and handed down per call.
+import { secrets } from "base44:runtime";
 import { HttpError } from "../../../shared/commerce/auth.ts";
 import { getSettings } from "../../../shared/commerce/settings.ts";
 import { confirmCardPayment } from "../../../shared/commerce/payments.ts";
@@ -41,7 +44,7 @@ Deno.serve(async (req: Request) => {
   try {
     const payload = await req.text();
 
-    const event = await parseWebhook(req, payload);
+    const event = await parseWebhook(req, payload, secrets);
     // Not about one of this store's orders — acknowledge so the provider
     // doesn't retry.
     if (!event || !event.order_id) {
@@ -62,6 +65,7 @@ Deno.serve(async (req: Request) => {
 
     const settings = await getSettings(sr);
     const result = await confirmCardPayment(sr, order, {
+      secrets,
       reference: event.reference,
       trustedPaid: event.paid,
       settings,

package/base44/functions/commerce/payments/entry.ts

@@ -25,6 +25,9 @@
  * order without a key. Entity access is service-role throughout.
  */
 import { createClientFromRequest } from "npm:@base44/sdk";
+// The only layer that may reach the runtime: shared/ is client-bundleable,
+// so the secret store is read here and handed down per call.
+import { secrets } from "base44:runtime";
 import { HttpError, getCallerUser, isAdmin } from "../../../shared/commerce/auth.ts";
 import { getSettings } from "../../../shared/commerce/settings.ts";
 import { serializeOrderForCustomer } from "../../../shared/commerce/orders.ts";
@@ -112,6 +115,7 @@ Deno.serve(async (req: Request) => {
           returnPath: settings.general?.order_received_path,
         });
         const link = await startCardPayment(sr, order, {
+      secrets,
           successUrl,
           cancelUrl,
           customerEmail: order.billing?.email || undefined,
@@ -134,6 +138,7 @@ Deno.serve(async (req: Request) => {
         const order = await authorizeOrder(sr, payload, admin);
         const settings = await getSettings(sr);
         const result = await confirmCardPayment(sr, order, {
+      secrets,
           settings,
           actor: admin ? (user?.email ?? "admin") : "customer-return",
         });
@@ -154,6 +159,7 @@ Deno.serve(async (req: Request) => {
               returnPath: settings.general?.order_received_path,
             });
             paymentLink = await startCardPayment(sr, result.order, {
+      secrets,
               successUrl,
               cancelUrl,
               customerEmail: result.order.billing?.email || undefined,
@@ -195,6 +201,7 @@ Deno.serve(async (req: Request) => {
         const order = await authorizeOrder(sr, payload, admin);
         const settings = await getSettings(sr);
         const result = await confirmCardPayment(sr, order, {
+      secrets,
           settings,
           actor: admin ? (user?.email ?? "admin") : "customer-return",
         });

package/base44/functions/commerce/storefront-checkout/entry.ts

@@ -12,6 +12,9 @@
  * Checkout is open to guests; order_key possession is the guest bearer credential.
  */
 import { createClientFromRequest } from "npm:@base44/sdk";
+// The only layer that may reach the runtime: shared/ is client-bundleable,
+// so the secret store is read here and handed down per call.
+import { secrets } from "base44:runtime";
 import { HttpError, getCallerUser, ownsEmail } from "../../../shared/commerce/auth.ts";
 import { getSetting, getSettings } from "../../../shared/commerce/settings.ts";
 import { calculateTotals } from "../../../shared/commerce/totals.ts";
@@ -290,6 +293,7 @@ async function placeOrder(sr: any, req: Request, user: any, payload: any): Promi
       returnPath: settings.general?.order_received_path,
     });
     const link = await startCardPayment(sr, order, {
+      secrets,
       successUrl,
       cancelUrl,
       customerEmail: billing.email,
@@ -357,6 +361,7 @@ async function confirmPayment(sr: any, payload: any): Promise<any> {
 
   const settings = await getSettings(sr);
   const result = await confirmCardPayment(sr, order, {
+      secrets,
     settings,
     actor: "customer-return",
   });

package/base44/shared/commerce/card-payment.stripe.ts

@@ -41,6 +41,17 @@
  */
 import { HttpError } from "./auth.ts";
 
+/**
+ * The app's secret store, handed in per call by the function layer:
+ * `import { secrets } from "base44:runtime"` there, never in this file —
+ * that specifier resolves only in the Deno function runtime, and `shared/` is
+ * reachable by the client bundler, so importing it here fails the storefront's
+ * build. `Deno.env` would leak the same runtime assumption.
+ */
+export interface SecretStore {
+  get(name: string): unknown;
+}
+
 /** Stripe's REST API, called directly — no SDK to bundle in the function. */
 const STRIPE_API = "https://api.stripe.com/v1";
 /** Pinned, so a Stripe API release can never change the shapes read below. */
@@ -61,14 +72,9 @@ export interface CardPaymentPage {
  * store that has the file but not yet the secret answers a clean 503 at
  * checkout instead of failing to boot every commerce function that imports it.
  */
-const secret = (name: string): string => {
-  // Deno.env, never `secrets` from "base44:runtime": that specifier resolves
-  // only in the Deno function runtime, and this file lives under shared/ where
-  // a client bundler can reach it — the static import fails the Vite build of
-  // the whole storefront. Base44 publishes app secrets into the function
-  // environment, so Deno.env.get reads the same values.
+const secret = (secrets: SecretStore, name: string): string => {
   try {
-    return String(Deno.env.get(name) ?? "");
+    return String(secrets?.get(name) ?? "");
   } catch {
     return "";
   }
@@ -81,9 +87,9 @@ const secret = (name: string): string => {
  */
 const STRIPE_KEY_SECRETS = ["STRIPE_SECRET_KEY", "STRIPE_API_KEY", "STRIPE_KEY"];
 
-const stripeKey = (): string => {
+const stripeKey = (secrets: SecretStore): string => {
   for (const name of STRIPE_KEY_SECRETS) {
-    const value = secret(name);
+    const value = secret(secrets, name);
     if (value) return value;
   }
   // The client is told only that cards are unavailable — which secret is
@@ -104,7 +110,7 @@ const stripeKey = (): string => {
  * as `base44_app_id`, which is how the platform attributes a Stripe payment
  * back to this app — send it on every call that creates money movement.
  */
-const base44AppId = (): string => secret("BASE44_APP_ID");
+const base44AppId = (secrets: SecretStore): string => secret(secrets, "BASE44_APP_ID");
 
 /**
  * One Stripe REST call. A body makes it a POST (form-encoded, with an
@@ -113,9 +119,9 @@ const base44AppId = (): string => secret("BASE44_APP_ID");
  * Stripe's own error text stays in the log: it describes backend configuration
  * (keys, account state, API parameters), so the caller gets a flat message.
  */
-async function stripeCall(path: string, body?: URLSearchParams): Promise<any> {
+async function stripeCall(secrets: SecretStore, path: string, body?: URLSearchParams): Promise<any> {
   const headers: Record<string, string> = {
-    "Authorization": `Bearer ${stripeKey()}`,
+    "Authorization": `Bearer ${stripeKey(secrets)}`,
     "Stripe-Version": STRIPE_VERSION,
   };
   if (body) {
@@ -156,7 +162,7 @@ export async function createCardPayment(
     order_id: String(order.id),
     order_key: String(order.order_key),
   };
-  const appId = base44AppId();
+  const appId = base44AppId(opts.secrets);
   if (appId) metadata.base44_app_id = appId;
 
   const params = new URLSearchParams();
@@ -174,7 +180,7 @@ export async function createCardPayment(
     params.set(`payment_intent_data[metadata][${key}]`, value);
   }
 
-  const session = await stripeCall("/checkout/sessions", params);
+  const session = await stripeCall(opts.secrets, "/checkout/sessions", params);
   if (!session?.url) throw new HttpError(502, "Stripe did not return a payment page URL.", "payment_session_failed");
   return { url: session.url, reference: String(session.id) };
 }
@@ -184,8 +190,8 @@ export async function createCardPayment(
  * caller. Runs on the customer-return page, the webhook's unverified path and
  * the admin's "Check payment" button.
  */
-export async function checkCardPaymentPaid(_sr: any, order: any, reference: string): Promise<boolean> {
-  const session = await stripeCall(`/checkout/sessions/${encodeURIComponent(reference)}`);
+export async function checkCardPaymentPaid(_sr: any, order: any, reference: string, secrets: SecretStore): Promise<boolean> {
+  const session = await stripeCall(secrets, `/checkout/sessions/${encodeURIComponent(reference)}`);
   // The payment must be for THIS order — stops a reference to some other
   // (genuinely paid) session being replayed against a different order.
   return session?.payment_status === "paid" && session?.metadata?.order_id === String(order.id);
@@ -200,20 +206,21 @@ export async function refundCardPayment(_sr: any, _order: any, opts: {
   amount: number;
   currency: string;
   reason?: string;
+  secrets: SecretStore;
 }): Promise<{ refund_id: string }> {
   // The stored reference is the Checkout Session; the refundable object is the
   // payment intent behind it, which only exists once the session was paid.
-  const session = await stripeCall(`/checkout/sessions/${encodeURIComponent(opts.reference)}`);
+  const session = await stripeCall(opts.secrets, `/checkout/sessions/${encodeURIComponent(opts.reference)}`);
   if (!session?.payment_intent) {
     throw new HttpError(409, "This payment has no charge to refund at Stripe.", "no_charge_to_refund");
   }
   const params = new URLSearchParams();
   params.set("payment_intent", String(session.payment_intent));
   params.set("amount", String(minorUnits(opts.amount, opts.currency)));
-  const appId = base44AppId();
+  const appId = base44AppId(opts.secrets);
   if (appId) params.set("metadata[base44_app_id]", appId);
 
-  const refund = await stripeCall("/refunds", params);
+  const refund = await stripeCall(opts.secrets, "/refunds", params);
   return { refund_id: String(refund.id) };
 }
 
@@ -246,7 +253,7 @@ export interface CardWebhookEvent {
  * null for anything that isn't a payment event for one of this store's orders;
  * the premade function answers 200 so Stripe stops retrying.
  */
-export async function parseWebhook(_req: Request, payload: string): Promise<CardWebhookEvent | null> {
+export async function parseWebhook(_req: Request, payload: string, secrets: SecretStore): Promise<CardWebhookEvent | null> {
   let event: any;
   try { event = JSON.parse(payload); } catch { return null; }
   const metadata = event?.data?.object?.metadata;

package/base44/shared/commerce/card-payment.ts

@@ -34,16 +34,25 @@
  * Until implemented, the Credit Card checkout option answers
  * 503 `no_card_payment_provider`.
  *
- * Credentials belong in Base44 secrets, read with `Deno.env.get("...")` —
- * never in an entity, never in the code, never from the client. Do NOT import
- * `secrets` from `base44:runtime` here: that specifier resolves only in the
- * Deno function runtime, and a static import of it in this shared file fails
- * the client bundle of the whole storefront. When one is missing, log which one and answer the caller with the
+ * Credentials belong in Base44 secrets — but this file never reaches for them
+ * itself. Every function below is handed a `SecretStore` by the function that
+ * called it, the one layer that may `import { secrets } from "base44:runtime"`.
+ * Neither that import nor `Deno.env` belongs here: `shared/` is reachable by
+ * the client bundler, so either one fails the storefront's build and pins this
+ * file to a single runtime. Never an entity, never the code, never the client. When one is missing, log which one and answer the caller with the
  * flat 503 below: the storefront must not learn the names of the app's
  * secrets.
  */
 import { HttpError } from "./auth.ts";
 
+/**
+ * The app's secret store, handed in per call by the function layer:
+ * `import { secrets } from "base44:runtime"` there, never here.
+ */
+export interface SecretStore {
+  get(name: string): unknown;
+}
+
 /** A hosted payment page for one order. */
 export interface CardPaymentPage {
   /** Where the customer goes to pay. */
@@ -67,7 +76,7 @@ export interface CardPaymentPage {
 export async function createCardPayment(
   _sr: any,
   _order: any,
-  _opts: { successUrl: string; cancelUrl: string; customerEmail?: string },
+  _opts: { successUrl: string; cancelUrl: string; customerEmail?: string; secrets: SecretStore },
 ): Promise<CardPaymentPage> {
   throw new HttpError(
     503,
@@ -82,7 +91,7 @@ export async function createCardPayment(
  * a claim from the client. Called by the customer-return page, the webhook's
  * unsigned path, and the admin's "Check payment" button.
  */
-export async function checkCardPaymentPaid(_sr: any, _order: any, _reference: string): Promise<boolean> {
+export async function checkCardPaymentPaid(_sr: any, _order: any, _reference: string, _secrets: SecretStore): Promise<boolean> {
   return false;
 }
 
@@ -97,6 +106,7 @@ export async function refundCardPayment(_sr: any, _order: any, _opts: {
   amount: number;
   currency: string;
   reason?: string;
+  secrets: SecretStore;
 }): Promise<{ refund_id: string }> {
   throw new HttpError(
     501,
@@ -140,7 +150,7 @@ export interface CardWebhookEvent {
  * aren't about a payment for one of this store's orders (answered 200 so the
  * provider doesn't retry).
  */
-export async function parseWebhook(_req: Request, _payload: string): Promise<CardWebhookEvent | null> {
+export async function parseWebhook(_req: Request, _payload: string, _secrets: SecretStore): Promise<CardWebhookEvent | null> {
   throw new HttpError(
     400,
     "This store's payment webhook is not implemented.",

package/base44/shared/commerce/payments.ts

@@ -19,7 +19,7 @@
 import { HttpError } from "./auth.ts";
 import { round2 } from "./money.ts";
 import { transitionOrder } from "./orders.ts";
-import { checkCardPaymentPaid, createCardPayment, refundCardPayment } from "./card-payment.ts";
+import { checkCardPaymentPaid, createCardPayment, refundCardPayment, type SecretStore } from "./card-payment.ts";
 
 /** The one `commerce.PaymentGateway` slug that pays online; all others are manual. */
 export const CARD_GATEWAY_SLUG = "card";
@@ -182,6 +182,8 @@ export async function startCardPayment(sr: any, order: any, opts: {
   successUrl: string;
   cancelUrl: string;
   customerEmail?: string;
+  // Handed down from the function entry — shared/ may not read secrets itself.
+  secrets: SecretStore;
 }): Promise<{ url: string; reference: string }> {
   if (isOrderPaid(order)) {
     throw new HttpError(409, "This order is already paid.", "already_paid");
@@ -210,12 +212,13 @@ export async function confirmCardPayment(sr: any, order: any, opts: {
   settings?: Record<string, any>;
   actor?: string;
   trustedPaid?: boolean;
-} = {}): Promise<{ paid: boolean; already_confirmed: boolean; order: any }> {
+  secrets: SecretStore;
+}): Promise<{ paid: boolean; already_confirmed: boolean; order: any }> {
   if (isOrderPaid(order)) return { paid: true, already_confirmed: true, order };
 
   const reference = opts.reference || orderMeta(order, REFERENCE_META_KEY) || String(order?.transaction_id ?? "");
   const paid = opts.trustedPaid === true ||
-    (reference ? await checkCardPaymentPaid(sr, order, reference) : false);
+    (reference ? await checkCardPaymentPaid(sr, order, reference, opts.secrets) : false);
   if (!paid) return { paid: false, already_confirmed: false, order };
 
   if (reference) {
@@ -242,10 +245,12 @@ export async function confirmCardPayment(sr: any, order: any, opts: {
 export async function refundCardOrder(sr: any, order: any, opts: {
   amount: number;
   reason?: string;
+  secrets: SecretStore;
 }): Promise<{ refund_id: string } | null> {
   const reference = order?.transaction_id || orderMeta(order, REFERENCE_META_KEY);
   if (!isCardGateway(order?.payment_method) || !reference) return null;
   return await refundCardPayment(sr, order, {
+    secrets: opts.secrets,
     reference,
     amount: round2(opts.amount),
     currency: String(order.currency || "USD"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@base44/app-plugin-commerce",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Base44 Commerce plugin — entities, backend functions, shared commerce engine, admin UI and the commerce skill, shipped as copyable source",
   "keywords": [
     "base44",