@darraghor/nest-backend-libs 5.7.4 → 6.0.0

package/dist/stripe-payments/services/secure-stripe-checkout.service.js

@@ -0,0 +1,213 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var SecureStripeCheckoutService_1;
+import { ConflictException, Inject, Injectable, Logger, ServiceUnavailableException, } from "@nestjs/common";
+import Stripe from "stripe";
+import { InjectRepository } from "@nestjs/typeorm";
+import { QueryFailedError, Repository } from "typeorm";
+import { StripeCheckoutAttempt } from "../entities/stripe-checkout-attempt.entity.js";
+import { SecureStripeProductService } from "./secure-stripe-product.service.js";
+import { STRIPE_PAYMENTS_ACCESS_POLICY, STRIPE_PAYMENTS_ENTITLEMENT_STORE, } from "../stripe-payments.extensions.js";
+import { StripePaymentsTelemetryService } from "./stripe-payments-telemetry.service.js";
+const idempotencyKeyPattern = /^[A-Za-z0-9._-]{8,255}$/;
+let SecureStripeCheckoutService = SecureStripeCheckoutService_1 = class SecureStripeCheckoutService {
+    stripe;
+    attemptRepository;
+    productService;
+    entitlementStore;
+    accessPolicy;
+    telemetry;
+    logger = new Logger(SecureStripeCheckoutService_1.name);
+    constructor(stripe, attemptRepository, productService, entitlementStore, accessPolicy, telemetry) {
+        this.stripe = stripe;
+        this.attemptRepository = attemptRepository;
+        this.productService = productService;
+        this.entitlementStore = entitlementStore;
+        this.accessPolicy = accessPolicy;
+        this.telemetry = telemetry;
+    }
+    async createCheckoutSession(request, user, idempotencyKey) {
+        const key = this.requireIdempotencyKey(idempotencyKey);
+        await this.accessPolicy.assertCanManageOrganisation({
+            organisationUuid: request.organisationUuid,
+            user,
+            operation: "checkout",
+        });
+        const product = this.productService.getByKey(request.productKey);
+        const successUrl = this.productService.buildRedirectUrl(request.successFrontendPath);
+        const cancelUrl = request.cancelFrontendPath
+            ? this.productService.buildRedirectUrl(request.cancelFrontendPath)
+            : undefined;
+        const existingAttempt = await this.attemptRepository.findOne({
+            where: { idempotencyKey: key },
+        });
+        if (existingAttempt) {
+            this.assertMatchingAttempt(existingAttempt, request, user, product.priceId);
+            if (existingAttempt.status === "created" &&
+                existingAttempt.stripeSessionId &&
+                existingAttempt.stripeSessionUrl) {
+                return {
+                    stripeSessionId: existingAttempt.stripeSessionId,
+                    stripeSessionUrl: existingAttempt.stripeSessionUrl,
+                };
+            }
+            if (existingAttempt.updatedDate.getTime() >
+                Date.now() - 10 * 60 * 1000) {
+                throw new ConflictException("Checkout attempt is already in progress");
+            }
+        }
+        const attempt = existingAttempt ??
+            this.attemptRepository.create({
+                idempotencyKey: key,
+                organisationUuid: request.organisationUuid,
+                userUuid: user.uuid,
+                productKey: product.key,
+                priceId: product.priceId,
+                mode: product.mode,
+                status: "creating",
+            });
+        attempt.status = "creating";
+        attempt.errorMessage = undefined;
+        try {
+            await this.attemptRepository.save(attempt);
+        }
+        catch (error) {
+            if (!this.isUniqueViolation(error)) {
+                throw error;
+            }
+            const concurrentAttempt = await this.attemptRepository.findOne({
+                where: { idempotencyKey: key },
+            });
+            if (!concurrentAttempt) {
+                throw error;
+            }
+            this.assertMatchingAttempt(concurrentAttempt, request, user, product.priceId);
+            if (concurrentAttempt.status === "created" &&
+                concurrentAttempt.stripeSessionId &&
+                concurrentAttempt.stripeSessionUrl) {
+                return {
+                    stripeSessionId: concurrentAttempt.stripeSessionId,
+                    stripeSessionUrl: concurrentAttempt.stripeSessionUrl,
+                };
+            }
+            throw new ConflictException("Checkout attempt is already in progress");
+        }
+        try {
+            const metadata = {
+                organisationUuid: request.organisationUuid,
+                userUuid: user.uuid,
+                productKey: product.key,
+                internalSku: product.internalSku,
+                checkoutAttemptId: String(attempt.id),
+            };
+            const session = await this.stripe.checkout.sessions.create({
+                mode: product.mode,
+                client_reference_id: String(attempt.id),
+                line_items: [{ price: product.priceId, quantity: 1 }],
+                success_url: successUrl,
+                cancel_url: cancelUrl,
+                metadata,
+                ...(product.mode === "subscription"
+                    ? { subscription_data: { metadata } }
+                    : { payment_intent_data: { metadata } }),
+            }, { idempotencyKey: key });
+            if (!session.url) {
+                throw new Error("Stripe did not return a Checkout URL");
+            }
+            attempt.status = "created";
+            attempt.stripeSessionId = session.id;
+            attempt.stripeSessionUrl = session.url;
+            await this.attemptRepository.save(attempt);
+            await this.telemetry.record({
+                name: "checkout.created",
+                attemptId: attempt.id,
+                organisationUuid: attempt.organisationUuid,
+                productKey: attempt.productKey,
+                stripeSessionId: session.id,
+            });
+            return {
+                stripeSessionId: session.id,
+                stripeSessionUrl: session.url,
+            };
+        }
+        catch (error) {
+            attempt.status = "failed";
+            const errorMessage = error instanceof Error
+                ? error.message.slice(0, 500)
+                : "Stripe error";
+            attempt.errorMessage = errorMessage;
+            await this.attemptRepository.save(attempt);
+            await this.telemetry.record({
+                name: "checkout.failed",
+                attemptId: attempt.id,
+                organisationUuid: attempt.organisationUuid,
+                productKey: attempt.productKey,
+                error: errorMessage,
+            });
+            this.logger.error("Stripe Checkout session creation failed", {
+                attemptId: attempt.id,
+                productKey: product.key,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw new ServiceUnavailableException("Unable to start checkout right now. Please try again.");
+        }
+    }
+    async createCustomerPortalSession(request, user, idempotencyKey) {
+        const key = this.requireIdempotencyKey(idempotencyKey);
+        const subscription = await this.entitlementStore.findByUuid(request.subscriptionRecordUuid);
+        await this.accessPolicy.assertCanManageOrganisation({
+            organisationUuid: subscription.organisationUuid,
+            user,
+            operation: "customer-portal",
+        });
+        if (!/^cus_[A-Za-z0-9]+$/.test(subscription.paymentSystemCustomerId)) {
+            throw new ConflictException("This subscription has no valid Stripe customer");
+        }
+        const session = await this.stripe.billingPortal.sessions.create({
+            customer: subscription.paymentSystemCustomerId,
+            return_url: this.productService.buildRedirectUrl(request.returnUrl),
+        }, { idempotencyKey: key });
+        return { sessionUrl: session.url };
+    }
+    requireIdempotencyKey(idempotencyKey) {
+        if (!idempotencyKey || !idempotencyKeyPattern.test(idempotencyKey)) {
+            throw new ConflictException("An Idempotency-Key header is required for payment requests");
+        }
+        return idempotencyKey;
+    }
+    assertMatchingAttempt(attempt, request, user, priceId) {
+        if (attempt.organisationUuid !== request.organisationUuid ||
+            attempt.userUuid !== user.uuid ||
+            attempt.productKey !== request.productKey ||
+            attempt.priceId !== priceId) {
+            throw new ConflictException("The Idempotency-Key was already used for another checkout");
+        }
+    }
+    isUniqueViolation(error) {
+        return (error instanceof QueryFailedError &&
+            error
+                .driverError.code === "23505");
+    }
+};
+SecureStripeCheckoutService = SecureStripeCheckoutService_1 = __decorate([
+    Injectable(),
+    __param(0, Inject("SecureStripeClient")),
+    __param(1, InjectRepository(StripeCheckoutAttempt)),
+    __param(3, Inject(STRIPE_PAYMENTS_ENTITLEMENT_STORE)),
+    __param(4, Inject(STRIPE_PAYMENTS_ACCESS_POLICY)),
+    __metadata("design:paramtypes", [Stripe,
+        Repository,
+        SecureStripeProductService, Object, Object, StripePaymentsTelemetryService])
+], SecureStripeCheckoutService);
+export { SecureStripeCheckoutService };
+//# sourceMappingURL=secure-stripe-checkout.service.js.map

package/dist/stripe-payments/services/secure-stripe-checkout.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-stripe-checkout.service.js","sourceRoot":"","sources":["../../../src/stripe-payments/services/secure-stripe-checkout.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACH,iBAAiB,EACjB,MAAM,EACN,UAAU,EACV,MAAM,EACN,2BAA2B,GAC9B,MAAM,gBAAgB,CAAC;AAExB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAC,gBAAgB,EAAC,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAC,gBAAgB,EAAE,UAAU,EAAC,MAAM,SAAS,CAAC;AASrD,OAAO,EAAC,qBAAqB,EAAC,MAAM,+CAA+C,CAAC;AACpF,OAAO,EAAC,0BAA0B,EAAC,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EACH,6BAA6B,EAC7B,iCAAiC,GAGpC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAC,8BAA8B,EAAC,MAAM,wCAAwC,CAAC;AAEtF,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAGjD,IAAM,2BAA2B,mCAAjC,MAAM,2BAA2B;IAKf;IAEA;IACA;IAEA;IAEA;IACA;IAZJ,MAAM,GAAG,IAAI,MAAM,CAAC,6BAA2B,CAAC,IAAI,CAAC,CAAC;IAEvE,YAEqB,MAAc,EAEd,iBAAoD,EACpD,cAA0C,EAE1C,gBAAgD,EAEhD,YAAwC,EACxC,SAAyC;QARzC,WAAM,GAAN,MAAM,CAAQ;QAEd,sBAAiB,GAAjB,iBAAiB,CAAmC;QACpD,mBAAc,GAAd,cAAc,CAA4B;QAE1C,qBAAgB,GAAhB,gBAAgB,CAAgC;QAEhD,iBAAY,GAAZ,YAAY,CAA4B;QACxC,cAAS,GAAT,SAAS,CAAgC;IAC3D,CAAC;IAEJ,KAAK,CAAC,qBAAqB,CACvB,OAAwC,EACxC,IAAiB,EACjB,cAAkC;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC;YAChD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,IAAI;YACJ,SAAS,EAAE,UAAU;SACxB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,gBAAgB,CACnD,OAAO,CAAC,mBAAmB,CAC9B,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,kBAAkB;YACxC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAClE,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,EAAC,cAAc,EAAE,GAAG,EAAC;SAC/B,CAAC,CAAC;QACH,IAAI,eAAe,EAAE,CAAC;YAClB,IAAI,CAAC,qBAAqB,CACtB,eAAe,EACf,OAAO,EACP,IAAI,EACJ,OAAO,CAAC,OAAO,CAClB,CAAC;YACF,IACI,eAAe,CAAC,MAAM,KAAK,SAAS;gBACpC,eAAe,CAAC,eAAe;gBAC/B,eAAe,CAAC,gBAAgB,EAClC,CAAC;gBACC,OAAO;oBACH,eAAe,EAAE,eAAe,CAAC,eAAe;oBAChD,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;iBACrD,CAAC;YACN,CAAC;YACD,IACI,eAAe,CAAC,WAAW,CAAC,OAAO,EAAE;gBACrC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAC7B,CAAC;gBACC,MAAM,IAAI,iBAAiB,CACvB,yCAAyC,CAC5C,CAAC;YACN,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GACT,eAAe;YACf,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBAC1B,cAAc,EAAE,GAAG;gBACnB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,UAAU,EAAE,OAAO,CAAC,GAAG;gBACvB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,UAAU;aACrB,CAAC,CAAC;QACP,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC;QAC5B,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;QACjC,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;gBAC3D,KAAK,EAAE,EAAC,cAAc,EAAE,GAAG,EAAC;aAC/B,CAAC,CAAC;YACH,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACrB,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,qBAAqB,CACtB,iBAAiB,EACjB,OAAO,EACP,IAAI,EACJ,OAAO,CAAC,OAAO,CAClB,CAAC;YACF,IACI,iBAAiB,CAAC,MAAM,KAAK,SAAS;gBACtC,iBAAiB,CAAC,eAAe;gBACjC,iBAAiB,CAAC,gBAAgB,EACpC,CAAC;gBACC,OAAO;oBACH,eAAe,EAAE,iBAAiB,CAAC,eAAe;oBAClD,gBAAgB,EAAE,iBAAiB,CAAC,gBAAgB;iBACvD,CAAC;YACN,CAAC;YACD,MAAM,IAAI,iBAAiB,CACvB,yCAAyC,CAC5C,CAAC;QACN,CAAC;QAED,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG;gBACb,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,UAAU,EAAE,OAAO,CAAC,GAAG;gBACvB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;aACxC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CACtD;gBACI,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,mBAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,UAAU,EAAE,CAAC,EAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAC,CAAC;gBACnD,WAAW,EAAE,UAAU;gBACvB,UAAU,EAAE,SAAS;gBACrB,QAAQ;gBACR,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc;oBAC/B,CAAC,CAAC,EAAC,iBAAiB,EAAE,EAAC,QAAQ,EAAC,EAAC;oBACjC,CAAC,CAAC,EAAC,mBAAmB,EAAE,EAAC,QAAQ,EAAC,EAAC,CAAC;aAC3C,EACD,EAAC,cAAc,EAAE,GAAG,EAAC,CACxB,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;YAC3B,OAAO,CAAC,eAAe,GAAG,OAAO,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC;YACvC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBACxB,IAAI,EAAE,kBAAkB;gBACxB,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,eAAe,EAAE,OAAO,CAAC,EAAE;aAC9B,CAAC,CAAC;YACH,OAAO;gBACH,eAAe,EAAE,OAAO,CAAC,EAAE;gBAC3B,gBAAgB,EAAE,OAAO,CAAC,GAAG;aAChC,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;YAC1B,MAAM,YAAY,GACd,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC7B,CAAC,CAAC,cAAc,CAAC;YACzB,OAAO,CAAC,YAAY,GAAG,YAAY,CAAC;YACpC,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBACxB,IAAI,EAAE,iBAAiB;gBACvB,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,KAAK,EAAE,YAAY;aACtB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE;gBACzD,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,UAAU,EAAE,OAAO,CAAC,GAAG;gBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,CAAC;YACH,MAAM,IAAI,2BAA2B,CACjC,uDAAuD,CAC1D,CAAC;QACN,CAAC;IACL,CAAC;IAED,KAAK,CAAC,2BAA2B,CAC7B,OAAuC,EACvC,IAAiB,EACjB,cAAkC;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CACvD,OAAO,CAAC,sBAAsB,CACjC,CAAC;QACF,MAAM,IAAI,CAAC,YAAY,CAAC,2BAA2B,CAAC;YAChD,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,IAAI;YACJ,SAAS,EAAE,iBAAiB;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,iBAAiB,CACvB,gDAAgD,CACnD,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAC3D;YACI,QAAQ,EAAE,YAAY,CAAC,uBAAuB;YAC9C,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAC5C,OAAO,CAAC,SAAS,CACpB;SACJ,EACD,EAAC,cAAc,EAAE,GAAG,EAAC,CACxB,CAAC;QACF,OAAO,EAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAC,CAAC;IACrC,CAAC;IAEO,qBAAqB,CAAC,cAAkC;QAC5D,IAAI,CAAC,cAAc,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,iBAAiB,CACvB,4DAA4D,CAC/D,CAAC;QACN,CAAC;QACD,OAAO,cAAc,CAAC;IAC1B,CAAC;IAEO,qBAAqB,CACzB,OAA8B,EAC9B,OAAwC,EACxC,IAAiB,EACjB,OAAe;QAEf,IACI,OAAO,CAAC,gBAAgB,KAAK,OAAO,CAAC,gBAAgB;YACrD,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI;YAC9B,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;YACzC,OAAO,CAAC,OAAO,KAAK,OAAO,EAC7B,CAAC;YACC,MAAM,IAAI,iBAAiB,CACvB,2DAA2D,CAC9D,CAAC;QACN,CAAC;IACL,CAAC;IAEO,iBAAiB,CAAC,KAAc;QACpC,OAAO,CACH,KAAK,YAAY,gBAAgB;YAChC,KAA2D;iBACvD,WAAW,CAAC,IAAI,KAAK,OAAO,CACpC,CAAC;IACN,CAAC;CACJ,CAAA;AApPY,2BAA2B;IADvC,UAAU,EAAE;IAKJ,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAE5B,WAAA,gBAAgB,CAAC,qBAAqB,CAAC,CAAA;IAGvC,WAAA,MAAM,CAAC,iCAAiC,CAAC,CAAA;IAEzC,WAAA,MAAM,CAAC,6BAA6B,CAAC,CAAA;qCANb,MAAM;QAEK,UAAU;QACb,0BAA0B,kBAK/B,8BAA8B;GAbrD,2BAA2B,CAoPvC"}

package/dist/stripe-payments/services/secure-stripe-client.provider.d.ts

@@ -0,0 +1,2 @@
+import { Provider } from "@nestjs/common";
+export declare const secureStripeClientProvider: Provider;

package/dist/stripe-payments/services/secure-stripe-client.provider.js

@@ -0,0 +1,15 @@
+import Stripe from "stripe";
+import { SECURE_STRIPE_CONFIGURATION, } from "../stripe-payment.config.js";
+export const secureStripeClientProvider = {
+    provide: "SecureStripeClient",
+    useFactory: (configuration) => new Stripe(configuration.accessToken, {
+        apiVersion: Stripe.API_VERSION,
+        appInfo: {
+            name: "Miller Secure Payments",
+            url: "https://usemiller.dev",
+        },
+        maxNetworkRetries: 2,
+    }),
+    inject: [SECURE_STRIPE_CONFIGURATION],
+};
+//# sourceMappingURL=secure-stripe-client.provider.js.map

package/dist/stripe-payments/services/secure-stripe-client.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-stripe-client.provider.js","sourceRoot":"","sources":["../../../src/stripe-payments/services/secure-stripe-client.provider.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACH,2BAA2B,GAE9B,MAAM,6BAA6B,CAAC;AAErC,MAAM,CAAC,MAAM,0BAA0B,GAAa;IAChD,OAAO,EAAE,oBAAoB;IAC7B,UAAU,EAAE,CAAC,aAAwC,EAAU,EAAE,CAC7D,IAAI,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,MAAM,CAAC,WAAW;QAC9B,OAAO,EAAE;YACL,IAAI,EAAE,wBAAwB;YAC9B,GAAG,EAAE,uBAAuB;SAC/B;QACD,iBAAiB,EAAE,CAAC;KACvB,CAAC;IACN,MAAM,EAAE,CAAC,2BAA2B,CAAC;CACxC,CAAC"}

package/dist/stripe-payments/services/secure-stripe-product.service.d.ts

@@ -0,0 +1,9 @@
+import { SecureStripeConfiguration, SecureStripeProduct } from "../stripe-payment.config.js";
+export declare class SecureStripeProductService {
+    private readonly configuration;
+    constructor(configuration: SecureStripeConfiguration);
+    getByKey(productKey: string): SecureStripeProduct;
+    getByPriceId(priceId: string): SecureStripeProduct;
+    getConfiguredProducts(): readonly SecureStripeProduct[];
+    buildRedirectUrl(path: string): string;
+}

package/dist/stripe-payments/services/secure-stripe-product.service.js

@@ -0,0 +1,54 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { BadRequestException, Inject, Injectable } from "@nestjs/common";
+import { SECURE_STRIPE_CONFIGURATION, } from "../stripe-payment.config.js";
+let SecureStripeProductService = class SecureStripeProductService {
+    configuration;
+    constructor(configuration) {
+        this.configuration = configuration;
+    }
+    getByKey(productKey) {
+        const product = this.configuration.products.get(productKey);
+        if (!product) {
+            throw new BadRequestException("Unknown payment product");
+        }
+        return product;
+    }
+    getByPriceId(priceId) {
+        const product = [...this.configuration.products.values()].find((candidate) => candidate.priceId === priceId);
+        if (!product) {
+            throw new Error("Stripe returned a price outside the configured catalog");
+        }
+        return product;
+    }
+    getConfiguredProducts() {
+        return [...this.configuration.products.values()];
+    }
+    buildRedirectUrl(path) {
+        const url = new URL(path, `${this.configuration.redirectsBaseUrl}/`);
+        const baseUrl = new URL(`${this.configuration.redirectsBaseUrl}/`);
+        if (url.origin !== baseUrl.origin ||
+            !path.startsWith("/") ||
+            path.startsWith("//")) {
+            throw new BadRequestException("Redirect path must remain on the configured application origin");
+        }
+        return url.toString();
+    }
+};
+SecureStripeProductService = __decorate([
+    Injectable(),
+    __param(0, Inject(SECURE_STRIPE_CONFIGURATION)),
+    __metadata("design:paramtypes", [Object])
+], SecureStripeProductService);
+export { SecureStripeProductService };
+//# sourceMappingURL=secure-stripe-product.service.js.map

package/dist/stripe-payments/services/secure-stripe-product.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-stripe-product.service.js","sourceRoot":"","sources":["../../../src/stripe-payments/services/secure-stripe-product.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAC,mBAAmB,EAAE,MAAM,EAAE,UAAU,EAAC,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACH,2BAA2B,GAG9B,MAAM,6BAA6B,CAAC;AAG9B,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAGd;IAFrB,YAEqB,aAAwC;QAAxC,kBAAa,GAAb,aAAa,CAA2B;IAC1D,CAAC;IAEJ,QAAQ,CAAC,UAAkB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,YAAY,CAAC,OAAe;QACxB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAC1D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAC/C,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACX,wDAAwD,CAC3D,CAAC;QACN,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,qBAAqB;QACjB,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,gBAAgB,CAAC,IAAY;QACzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,GAAG,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,GAAG,CAAC,CAAC;QACnE,IACI,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAC7B,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YACrB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EACvB,CAAC;YACC,MAAM,IAAI,mBAAmB,CACzB,gEAAgE,CACnE,CAAC;QACN,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;CACJ,CAAA;AA5CY,0BAA0B;IADtC,UAAU,EAAE;IAGJ,WAAA,MAAM,CAAC,2BAA2B,CAAC,CAAA;;GAF/B,0BAA0B,CA4CtC"}

package/dist/stripe-payments/services/secure-stripe-webhook.service.d.ts

@@ -0,0 +1,14 @@
+import Stripe from "stripe";
+import { SecureStripeConfiguration } from "../stripe-payment.config.js";
+import { StripePaymentEventService } from "./stripe-payment-event.service.js";
+export interface RawStripeWebhookRequest {
+    headers: Record<string, string | string[] | undefined>;
+    rawBody?: Buffer;
+}
+export declare class SecureStripeWebhookService {
+    private readonly stripe;
+    private readonly configuration;
+    private readonly paymentEventService;
+    constructor(stripe: Stripe, configuration: SecureStripeConfiguration, paymentEventService: StripePaymentEventService);
+    handleWebhook(request: RawStripeWebhookRequest): Promise<void>;
+}

package/dist/stripe-payments/services/secure-stripe-webhook.service.js

@@ -0,0 +1,58 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { BadRequestException, Inject, Injectable, ServiceUnavailableException, } from "@nestjs/common";
+import Stripe from "stripe";
+import { SECURE_STRIPE_CONFIGURATION, } from "../stripe-payment.config.js";
+import { StripePaymentEventService } from "./stripe-payment-event.service.js";
+let SecureStripeWebhookService = class SecureStripeWebhookService {
+    stripe;
+    configuration;
+    paymentEventService;
+    constructor(stripe, configuration, paymentEventService) {
+        this.stripe = stripe;
+        this.configuration = configuration;
+        this.paymentEventService = paymentEventService;
+    }
+    async handleWebhook(request) {
+        if (!request.rawBody) {
+            throw new BadRequestException("Webhook body was not received as raw bytes");
+        }
+        const signatureHeader = request.headers["stripe-signature"];
+        if (typeof signatureHeader !== "string") {
+            throw new BadRequestException("Missing Stripe webhook signature");
+        }
+        let event;
+        try {
+            event = this.stripe.webhooks.constructEvent(request.rawBody, signatureHeader, this.configuration.webhookVerificationKey);
+        }
+        catch {
+            throw new BadRequestException("Invalid Stripe webhook signature");
+        }
+        try {
+            await this.paymentEventService.receive(event);
+        }
+        catch {
+            // A non-2xx response tells Stripe to retry delivery. The event row is
+            // deliberately durable so a later delivery can enqueue it again.
+            throw new ServiceUnavailableException("Payment event could not be queued");
+        }
+    }
+};
+SecureStripeWebhookService = __decorate([
+    Injectable(),
+    __param(0, Inject("SecureStripeClient")),
+    __param(1, Inject(SECURE_STRIPE_CONFIGURATION)),
+    __metadata("design:paramtypes", [Stripe, Object, StripePaymentEventService])
+], SecureStripeWebhookService);
+export { SecureStripeWebhookService };
+//# sourceMappingURL=secure-stripe-webhook.service.js.map

package/dist/stripe-payments/services/secure-stripe-webhook.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-stripe-webhook.service.js","sourceRoot":"","sources":["../../../src/stripe-payments/services/secure-stripe-webhook.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EACH,mBAAmB,EACnB,MAAM,EACN,UAAU,EACV,2BAA2B,GAC9B,MAAM,gBAAgB,CAAC;AACxB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACH,2BAA2B,GAE9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAC,yBAAyB,EAAC,MAAM,mCAAmC,CAAC;AAQrE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IAGd;IAEA;IACA;IALrB,YAEqB,MAAc,EAEd,aAAwC,EACxC,mBAA8C;QAH9C,WAAM,GAAN,MAAM,CAAQ;QAEd,kBAAa,GAAb,aAAa,CAA2B;QACxC,wBAAmB,GAAnB,mBAAmB,CAA2B;IAChE,CAAC;IAEJ,KAAK,CAAC,aAAa,CAAC,OAAgC;QAChD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,mBAAmB,CACzB,4CAA4C,CAC/C,CAAC;QACN,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CACvC,OAAO,CAAC,OAAO,EACf,eAAe,EACf,IAAI,CAAC,aAAa,CAAC,sBAAsB,CAC5C,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACL,sEAAsE;YACtE,iEAAiE;YACjE,MAAM,IAAI,2BAA2B,CACjC,mCAAmC,CACtC,CAAC;QACN,CAAC;IACL,CAAC;CACJ,CAAA;AAzCY,0BAA0B;IADtC,UAAU,EAAE;IAGJ,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;IAE5B,WAAA,MAAM,CAAC,2BAA2B,CAAC,CAAA;qCADX,MAAM,UAGO,yBAAyB;GAN1D,0BAA0B,CAyCtC"}

package/dist/stripe-payments/services/secure-subscription.service.d.ts

@@ -0,0 +1,18 @@
+import { OrganisationSubscriptionRecord } from "../../organisation-subscriptions/entities/organisation-subscription.entity.js";
+import { Queue } from "bullmq";
+import { Repository } from "typeorm";
+import type { StripePaymentsEntitlementInput } from "../stripe-payments.extensions.js";
+export type SecureSubscriptionInput = StripePaymentsEntitlementInput;
+export declare class SecureSubscriptionService {
+    private readonly subscriptionRepository;
+    private readonly activationQueue;
+    private readonly logger;
+    constructor(subscriptionRepository: Repository<OrganisationSubscriptionRecord>, activationQueue: Queue);
+    findByUuid(uuid: string): Promise<OrganisationSubscriptionRecord>;
+    findByTransactionId(paymentSystemTransactionId: string): Promise<OrganisationSubscriptionRecord | null>;
+    findByCustomerId(paymentSystemCustomerId: string, mode?: string): Promise<OrganisationSubscriptionRecord[]>;
+    save(input: SecureSubscriptionInput): Promise<OrganisationSubscriptionRecord>;
+    revokeCustomerPayments(customerId: string, input: Pick<SecureSubscriptionInput, "stripeEventId" | "stripeEventCreatedAt" | "stripeStatus">): Promise<void>;
+    revokePayment(paymentSystemTransactionId: string, input: Pick<SecureSubscriptionInput, "stripeEventId" | "stripeEventCreatedAt" | "stripeStatus">): Promise<boolean>;
+    private saveRecord;
+}

package/dist/stripe-payments/services/secure-subscription.service.js

@@ -0,0 +1,217 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var SecureSubscriptionService_1;
+import { Injectable, Logger } from "@nestjs/common";
+import { InjectQueue } from "@nestjs/bullmq";
+import { Organisation } from "../../organisation/entities/organisation.entity.js";
+import { OrganisationSubscriptionRecord } from "../../organisation-subscriptions/entities/organisation-subscription.entity.js";
+import { Queue } from "bullmq";
+import { InjectRepository } from "@nestjs/typeorm";
+import { QueryFailedError, Repository } from "typeorm";
+import { StripePaymentState } from "../entities/stripe-payment-state.entity.js";
+let SecureSubscriptionService = SecureSubscriptionService_1 = class SecureSubscriptionService {
+    subscriptionRepository;
+    activationQueue;
+    logger = new Logger(SecureSubscriptionService_1.name);
+    constructor(subscriptionRepository, activationQueue) {
+        this.subscriptionRepository = subscriptionRepository;
+        this.activationQueue = activationQueue;
+    }
+    async findByUuid(uuid) {
+        const record = await this.subscriptionRepository.findOne({
+            where: { uuid },
+            relations: { organisation: true },
+        });
+        if (!record) {
+            throw new Error("Subscription record not found");
+        }
+        return record;
+    }
+    async findByTransactionId(paymentSystemTransactionId) {
+        return this.subscriptionRepository.findOne({
+            where: { paymentSystemTransactionId },
+            relations: { organisation: true },
+        });
+    }
+    async findByCustomerId(paymentSystemCustomerId, mode) {
+        return this.subscriptionRepository.find({
+            where: {
+                paymentSystemCustomerId,
+                ...(mode ? { paymentSystemMode: mode } : {}),
+            },
+            relations: { organisation: true },
+        });
+    }
+    async save(input) {
+        const { record, shouldActivate } = await this.saveRecord(input);
+        if (shouldActivate) {
+            await this.activationQueue.add("activation-changed", {
+                organisationUuid: record.organisation.uuid,
+                subscriptionUuid: record.uuid,
+                productKey: record.internalSku,
+                active: record.validUntil > new Date(),
+            }, {
+                jobId: `subscription-activation:${record.uuid}:${String(record.validUntil.getTime())}`,
+                attempts: 5,
+                backoff: { type: "exponential", delay: 2_000 },
+                removeOnComplete: { age: 86_400, count: 10_000 },
+                removeOnFail: { age: 604_800, count: 10_000 },
+            });
+        }
+        return record;
+    }
+    async revokeCustomerPayments(customerId, input) {
+        const records = await this.findByCustomerId(customerId, "payment");
+        for (const record of records) {
+            await this.save({
+                paymentSystemTransactionId: record.paymentSystemTransactionId,
+                paymentSystemProductId: record.paymentSystemProductId,
+                paymentSystemCustomerId: record.paymentSystemCustomerId,
+                paymentSystemCustomerEmail: record.paymentSystemCustomerEmail,
+                paymentSystemMode: "payment",
+                paymentSystemName: "stripe",
+                validUntil: new Date(),
+                internalSku: record.internalSku,
+                productDisplayName: record.productDisplayName,
+                organisationUuid: record.organisation.uuid,
+                stripeEventId: input.stripeEventId,
+                stripeEventCreatedAt: input.stripeEventCreatedAt,
+                stripeStatus: input.stripeStatus,
+            });
+        }
+    }
+    async revokePayment(paymentSystemTransactionId, input) {
+        const record = await this.findByTransactionId(paymentSystemTransactionId);
+        if (record?.paymentSystemMode !== "payment") {
+            return false;
+        }
+        await this.save({
+            paymentSystemTransactionId: record.paymentSystemTransactionId,
+            paymentSystemProductId: record.paymentSystemProductId,
+            paymentSystemCustomerId: record.paymentSystemCustomerId,
+            paymentSystemCustomerEmail: record.paymentSystemCustomerEmail,
+            paymentSystemMode: "payment",
+            paymentSystemName: "stripe",
+            validUntil: new Date(),
+            internalSku: record.internalSku,
+            productDisplayName: record.productDisplayName,
+            organisationUuid: record.organisation.uuid,
+            stripeEventId: input.stripeEventId,
+            stripeEventCreatedAt: input.stripeEventCreatedAt,
+            stripeStatus: input.stripeStatus,
+        });
+        return true;
+    }
+    async saveRecord(input) {
+        try {
+            return await this.subscriptionRepository.manager.transaction(async (manager) => {
+                await manager.query("SELECT pg_advisory_xact_lock(hashtext($1))", [input.paymentSystemTransactionId]);
+                const subscriptionRepository = manager.getRepository(OrganisationSubscriptionRecord);
+                const stateRepository = manager.getRepository(StripePaymentState);
+                const state = await stateRepository.findOne({
+                    where: {
+                        paymentSystemTransactionId: input.paymentSystemTransactionId,
+                    },
+                });
+                let record = await subscriptionRepository.findOne({
+                    where: {
+                        paymentSystemTransactionId: input.paymentSystemTransactionId,
+                    },
+                    relations: { organisation: true },
+                });
+                const isDuplicateEvent = state?.lastStripeEventCreatedAt.getTime() ===
+                    input.stripeEventCreatedAt.getTime() &&
+                    state.lastStripeEventId === input.stripeEventId;
+                if (record &&
+                    state &&
+                    (state.lastStripeEventCreatedAt >
+                        input.stripeEventCreatedAt ||
+                        isDuplicateEvent)) {
+                    return {
+                        record,
+                        // Retry the durable activation notification if the
+                        // previous attempt failed after the DB commit.
+                        shouldActivate: isDuplicateEvent,
+                    };
+                }
+                const isNewRecord = !record;
+                if (!record) {
+                    const organisation = input.organisationUuid
+                        ? await manager
+                            .getRepository(Organisation)
+                            .findOne({
+                            where: { uuid: input.organisationUuid },
+                        })
+                        : null;
+                    if (!organisation) {
+                        throw new Error("Payment could not be matched to an organisation");
+                    }
+                    record = subscriptionRepository.create({
+                        organisation,
+                    });
+                }
+                const previousValidUntil = isNewRecord
+                    ? undefined
+                    : record.validUntil.getTime();
+                record.paymentSystemTransactionId =
+                    input.paymentSystemTransactionId;
+                record.paymentSystemProductId =
+                    input.paymentSystemProductId;
+                record.paymentSystemCustomerId =
+                    input.paymentSystemCustomerId;
+                record.paymentSystemCustomerEmail =
+                    input.paymentSystemCustomerEmail;
+                record.paymentSystemMode = input.paymentSystemMode;
+                record.paymentSystemName = input.paymentSystemName;
+                record.validUntil = input.validUntil;
+                record.internalSku = input.internalSku;
+                record.productDisplayName = input.productDisplayName;
+                const savedRecord = await subscriptionRepository.save(record);
+                const shouldActivate = isNewRecord ||
+                    state?.lastStripeEventId !== input.stripeEventId ||
+                    previousValidUntil !== input.validUntil.getTime();
+                const paymentState = state ??
+                    stateRepository.create({
+                        paymentSystemTransactionId: input.paymentSystemTransactionId,
+                    });
+                paymentState.lastStripeEventId = input.stripeEventId;
+                paymentState.lastStripeEventCreatedAt =
+                    input.stripeEventCreatedAt;
+                paymentState.status = input.stripeStatus;
+                await stateRepository.save(paymentState);
+                return { record: savedRecord, shouldActivate };
+            });
+        }
+        catch (error) {
+            if (error instanceof QueryFailedError &&
+                error
+                    .driverError.code === "23505") {
+                const existing = await this.findByTransactionId(input.paymentSystemTransactionId);
+                if (existing) {
+                    this.logger.warn(`Ignored concurrent duplicate payment ${input.paymentSystemTransactionId}`);
+                    return { record: existing, shouldActivate: false };
+                }
+            }
+            throw error;
+        }
+    }
+};
+SecureSubscriptionService = SecureSubscriptionService_1 = __decorate([
+    Injectable(),
+    __param(0, InjectRepository(OrganisationSubscriptionRecord)),
+    __param(1, InjectQueue("subscription-activation-changed")),
+    __metadata("design:paramtypes", [Repository,
+        Queue])
+], SecureSubscriptionService);
+export { SecureSubscriptionService };
+//# sourceMappingURL=secure-subscription.service.js.map