@dineway-ai/plugin-payment 0.2.6 → 0.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dineway-ai/plugin-payment",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "Provider-neutral payment infrastructure and Stripe integration for Dineway plugins",
   "type": "module",
   "publishConfig": {
@@ -11,6 +11,7 @@
     ".": "./src/index.ts",
     "./admin": "./src/admin.tsx",
     "./configuration": "./src/configuration/index.ts",
+    "./database": "./src/database/index.ts",
     "./routes": "./src/routes/index.ts",
     "./stripe": "./src/stripe/index.ts",
     "./types": "./src/types.ts",
@@ -29,7 +30,7 @@
   "license": "MIT",
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",
-    "dineway": "^0.2.29"
+    "dineway": "^0.2.31"
   },
   "dependencies": {
     "@stripe/stripe-js": "9.9.0",

package/src/admin/subscriptions.tsx

@@ -5,6 +5,9 @@ import type { getSubscriptionConfiguration } from "../subscriptions/runtime.js";
 import type {
 	MemberBilling,
 	MemberSubscription,
+	BillingSubject,
+	SubscriptionPurchase,
+	SubscriptionSnapshot,
 	SaveSubscriptionPlan,
 	SubscriptionPlan,
 } from "../subscriptions/types.js";
@@ -12,6 +15,8 @@ import { postPaymentRoute } from "./api.js";
 import { SubscriptionPricePicker } from "./subscription-price-picker.js";
 
 type Configuration = Awaited<ReturnType<typeof getSubscriptionConfiguration>>;
+type AdminSubscription = MemberSubscription & { subject: BillingSubject | null };
+type AdminPurchase = SubscriptionPurchase & { subject: BillingSubject | null };
 type Feature = { key: string; kind: "boolean" | "number"; value: string };
 const emptyPlan: SaveSubscriptionPlan = {
 	code: "",
@@ -28,17 +33,17 @@ const buttonClass = "rounded-lg border border-kumo-line px-3 py-2 text-sm disabl
 export function PaymentSubscriptionsPage() {
 	const [configuration, setConfiguration] = React.useState<Configuration | null>(null);
 	const [plans, setPlans] = React.useState<SubscriptionPlan[]>([]);
-	const [members, setMembers] = React.useState<MemberSubscription[]>([]);
+	const [members, setMembers] = React.useState<AdminSubscription[]>([]);
+	const [purchases, setPurchases] = React.useState<AdminPurchase[]>([]);
+	const [purchaseCursor, setPurchaseCursor] = React.useState<string>();
 	const [cursor, setCursor] = React.useState<string>();
 	const [form, setForm] = React.useState<SaveSubscriptionPlan>({ ...emptyPlan });
 	const [editorRevision, setEditorRevision] = React.useState(0);
 	const [boundPrices, setBoundPrices] = React.useState<SubscriptionPlan["prices"]>([]);
 	const [features, setFeatures] = React.useState<Feature[]>([]);
-	const [webhookSecret, setWebhookSecret] = React.useState("");
-	const [detail, setDetail] = React.useState<{
-		subscription: MemberSubscription;
-		member: MemberBilling;
-	} | null>(null);
+	const [detail, setDetail] = React.useState<
+		(SubscriptionSnapshot & { member: MemberBilling }) | null
+	>(null);
 	const [busy, setBusy] = React.useState(false);
 	const [error, setError] = React.useState<string | null>(null);
 	const [notice, setNotice] = React.useState<string | null>(null);
@@ -46,15 +51,18 @@ export function PaymentSubscriptionsPage() {
 		const config = await postPaymentRoute<Configuration>("subscriptions/configuration/get");
 		setConfiguration(config);
 		if (config.ready) {
-			const [catalog, subscriptions] = await Promise.all([
+			const [catalog, subscriptions, purchasePage] = await Promise.all([
 				postPaymentRoute<{ items: SubscriptionPlan[] }>("subscriptions/plans/list"),
-				postPaymentRoute<{ items: MemberSubscription[]; nextCursor?: string }>(
-					"subscriptions/list",
+				postPaymentRoute<{ items: AdminSubscription[]; nextCursor?: string }>("subscriptions/list"),
+				postPaymentRoute<{ items: AdminPurchase[]; nextCursor?: string }>(
+					"subscriptions/purchases/list",
 				),
 			]);
 			setPlans(catalog.items);
 			setMembers(subscriptions.items);
 			setCursor(subscriptions.nextCursor);
+			setPurchases(purchasePage.items);
+			setPurchaseCursor(purchasePage.nextCursor);
 		}
 	}, []);
 	React.useEffect(() => {
@@ -144,7 +152,10 @@ export function PaymentSubscriptionsPage() {
 				<p className="mt-2 text-sm text-kumo-subtle">
 					Bind Stripe prices, configure plan entitlements, and inspect paid membership periods.
 				</p>
-				<a href="/_dineway/admin/payments" className="mt-2 inline-block text-sm underline">
+				<a
+					href="/_dineway/admin/plugins/dineway-payment/payments"
+					className="mt-2 inline-block text-sm underline"
+				>
 					Stripe account settings
 				</a>
 			</header>
@@ -169,7 +180,7 @@ export function PaymentSubscriptionsPage() {
 			) : (
 				<>
 					<section className="space-y-4 rounded-xl border border-kumo-line p-5">
-						<h2 className="text-lg font-semibold">Subscription webhook</h2>
+						<h2 className="text-lg font-semibold">Payment webhook</h2>
 						<p className="text-sm">
 							Application: {configuration.namespace} · {configuration.mode} ·{" "}
 							{configuration.ready ? "Ready" : "Configuration required"}
@@ -179,48 +190,14 @@ export function PaymentSubscriptionsPage() {
 							<input className={inputClass} readOnly value={configuration.webhookUrl} />
 						</label>
 						<p className="text-sm text-kumo-subtle">
-							Create a Stripe webhook for this endpoint using the subscription events in the Payment
-							documentation. Its signing secret is separate from other payment webhooks.
+							Payment receives and verifies Stripe events for subscriptions, restaurant orders, and
+							venue payments at this shared endpoint. Configure its signing secret once in Payments
+							using the Stripe account settings link above.
 						</p>
-						<form
-							className="flex flex-wrap items-end gap-3"
-							onSubmit={(event) => {
-								event.preventDefault();
-								void run(async () => {
-									setConfiguration(
-										await postPaymentRoute<Configuration>("subscriptions/configuration/update", {
-											webhookSecret,
-										}),
-									);
-									setWebhookSecret("");
-									await refresh();
-									setNotice("Subscription webhook secret saved.");
-								});
-							}}
-						>
-							<label className="min-w-64 flex-1 text-sm">
-								Signing secret
-								<input
-									type="password"
-									autoComplete="new-password"
-									required
-									className={inputClass}
-									value={webhookSecret}
-									placeholder={
-										configuration.webhookSecret
-											? "Leave unchanged unless rotating the secret"
-											: "whsec_…"
-									}
-									onChange={(event) => setWebhookSecret(event.target.value)}
-								/>
-							</label>
-							<button className={buttonClass} disabled={busy || !webhookSecret}>
-								Save secret
-							</button>
-						</form>
 						{!configuration.ready && (
 							<p className="text-sm text-kumo-subtle">
-								Verify the Stripe account and save this webhook secret to manage subscription plans.
+								Verify the Stripe account and configure the shared webhook in Payments to manage
+								plans.
 							</p>
 						)}
 					</section>
@@ -391,7 +368,100 @@ export function PaymentSubscriptionsPage() {
 								</form>
 							</section>
 							<section className="space-y-4">
-								<h2 className="text-lg font-semibold">Member subscriptions</h2>
+								<h2 className="text-lg font-semibold">Purchases</h2>
+								<button
+									className={buttonClass}
+									disabled={busy}
+									onClick={() =>
+										void run(async () => {
+											const result = await postPaymentRoute<{ processed: number; failed: number }>(
+												"subscriptions/reconcile",
+											);
+											await refresh();
+											setNotice(
+												`Processed ${result.processed}; ${result.failed} require retry or review.`,
+											);
+										})
+									}
+								>
+									Retry pending synchronization
+								</button>
+								<div className="overflow-x-auto">
+									<table className="w-full text-left text-sm">
+										<thead>
+											<tr>
+												<th className="p-2">Billing subject</th>
+												<th className="p-2">Purchase</th>
+												<th className="p-2">Terms</th>
+												<th className="p-2">Status</th>
+											</tr>
+										</thead>
+										<tbody>
+											{purchases.map((purchase) => (
+												<tr key={purchase.reference} className="border-t border-kumo-line">
+													<td className="p-2">
+														{purchase.subject
+															? `${purchase.subject.realm}: ${purchase.subject.id}`
+															: purchase.userId}
+													</td>
+													<td className="p-2">
+														{purchase.reference}
+														<br />
+														{purchase.contract.pricing.kind}
+													</td>
+													<td className="p-2">
+														{formatSubscriptionPrice(
+															purchase.contract.amount,
+															purchase.contract.currency,
+														)}{" "}
+														every {purchase.contract.intervalCount} {purchase.contract.interval}
+														<br />
+														First invoice credit:{" "}
+														{formatSubscriptionPrice(
+															purchase.contract.firstPeriodCredit ?? 0,
+															purchase.contract.currency,
+														)}
+													</td>
+													<td className="p-2">
+														{purchase.closed
+															? "Closed"
+															: purchase.subscriptionId
+																? "Subscription recorded"
+																: "Awaiting confirmation"}
+														<br />
+														{purchase.cancelMode && `Cancellation: ${purchase.cancelMode}`}
+														<br />
+														{purchase.lastError}
+													</td>
+												</tr>
+											))}
+										</tbody>
+									</table>
+								</div>
+								{!purchases.length && (
+									<p className="text-sm text-kumo-subtle">No purchases recorded.</p>
+								)}
+								{purchaseCursor && (
+									<button
+										className={buttonClass}
+										disabled={busy}
+										onClick={() =>
+											void run(async () => {
+												const page = await postPaymentRoute<{
+													items: AdminPurchase[];
+													nextCursor?: string;
+												}>("subscriptions/purchases/list", { cursor: purchaseCursor });
+												setPurchases([...purchases, ...page.items]);
+												setPurchaseCursor(page.nextCursor);
+											})
+										}
+									>
+										Load more purchases
+									</button>
+								)}
+							</section>
+							<section className="space-y-4">
+								<h2 className="text-lg font-semibold">Subscriptions and funding</h2>
 								<p className="text-sm text-kumo-subtle">
 									Failed renewals keep access until the end of the paid period. Cancellation takes
 									effect at period end.
@@ -410,8 +480,18 @@ export function PaymentSubscriptionsPage() {
 										<tbody>
 											{members.map((member) => (
 												<tr key={member.id} className="border-t border-kumo-line">
-													<td className="p-2">{member.userId}</td>
-													<td className="p-2">{member.planCode}</td>
+													<td className="p-2">
+														{member.subject
+															? `${member.subject.realm}: ${member.subject.id}`
+															: member.userId}
+													</td>
+													<td className="p-2">
+														{member.planCode || "Dynamic purchase"}
+														<br />
+														<span className="text-xs text-kumo-subtle">
+															{member.purchaseReference}
+														</span>
+													</td>
 													<td className="p-2">{member.status}</td>
 													<td className="p-2">
 														{new Date(member.verifiedAt).toLocaleString()}
@@ -441,7 +521,7 @@ export function PaymentSubscriptionsPage() {
 										onClick={() =>
 											void run(async () => {
 												const page = await postPaymentRoute<{
-													items: MemberSubscription[];
+													items: AdminSubscription[];
 													nextCursor?: string;
 												}>("subscriptions/list", { cursor });
 												setMembers([...members, ...page.items]);
@@ -457,11 +537,31 @@ export function PaymentSubscriptionsPage() {
 										<h3 className="font-semibold">{detail.subscription.id}</h3>
 										<dl className="grid gap-2 text-sm">
 											<dt>Member</dt>
-											<dd>{detail.subscription.userId}</dd>
+											<dd>
+												{detail.subject
+													? `${detail.subject.realm}: ${detail.subject.id} · ${detail.subject.email}`
+													: detail.subscription.userId}
+											</dd>
+											<dt>Purchase reference</dt>
+											<dd>{detail.purchase?.reference ?? "Catalogue subscription"}</dd>
 											<dt>Paid access until</dt>
 											<dd>
-												{detail.member.paidThrough
-													? new Date(detail.member.paidThrough * 1000).toLocaleString()
+												{detail.periods.some(
+													(period) =>
+														period.eligible &&
+														period.startsAt * 1000 <= Date.now() &&
+														period.endsAt * 1000 > Date.now(),
+												)
+													? new Date(
+															Math.max(
+																...detail.periods
+																	.filter(
+																		(period) =>
+																			period.eligible && period.startsAt * 1000 <= Date.now(),
+																	)
+																	.map((period) => period.endsAt),
+															) * 1000,
+														).toLocaleString()
 													: "No current paid period"}
 											</dd>
 											<dt>Cancellation</dt>
@@ -469,7 +569,9 @@ export function PaymentSubscriptionsPage() {
 												{detail.subscription.cancelAtPeriodEnd
 													? "At period end: " +
 														new Date(detail.subscription.periodEnd * 1000).toLocaleString()
-													: "Not scheduled"}
+													: detail.subscription.status === "canceled"
+														? "Canceled"
+														: "Not scheduled"}
 											</dd>
 											<dt>Last synchronization</dt>
 											<dd>

package/src/admin.tsx

@@ -8,6 +8,7 @@ import {
 } from "./admin/form.js";
 import { PaymentSubscriptionsPage } from "./admin/subscriptions.js";
 import type { PaymentStripeConfiguration } from "./configuration/service.js";
+import { PAYMENT_WEBHOOK_PATH } from "./webhooks/types.js";
 
 type CredentialName = "secretKey" | "webhookSecret";
 
@@ -184,6 +185,10 @@ export function PaymentSettingsPage() {
 					}
 					type="password"
 				/>
+				<p className="text-sm text-kumo-subtle">
+					Use the complete whsec_… signing secret from Stripe for the endpoint below. For local
+					forwarding, use the value printed by stripe listen. Do not generate your own value.
+				</p>
 				<Credential
 					label="Webhook secret"
 					present={Boolean(configuration.webhookSecret)}
@@ -210,10 +215,19 @@ export function PaymentSettingsPage() {
 			</form>
 			<section className="max-w-3xl rounded-xl bg-kumo-tint/40 p-5 text-sm text-kumo-subtle">
 				<h2 className="font-semibold text-kumo-default">Webhook endpoint</h2>
+				<input
+					aria-label="Payment webhook endpoint"
+					className="mt-2 w-full rounded-lg border border-kumo-line bg-kumo-base px-3 py-2"
+					readOnly
+					value={
+						typeof window === "undefined"
+							? PAYMENT_WEBHOOK_PATH
+							: new URL(PAYMENT_WEBHOOK_PATH, window.location.origin).href
+					}
+				/>
 				<p className="mt-2">
-					Configure Stripe to send domain events to the webhook shown by each installed
-					transactional plugin. Venue and Restaurant validate exact request bytes with this shared
-					signing secret.
+					Configure one Stripe endpoint for Venue, Restaurant, and Subscriptions. Payment verifies
+					each event and delivers it to the enabled plugins.
 				</p>
 			</section>
 		</div>

package/src/configuration/repository.ts

@@ -1,13 +1,17 @@
 import type { Database } from "dineway";
 import type { Kysely, Selectable, Transaction, Updateable } from "kysely";
 
+import type { PaymentDatabase, PaymentTables } from "../database/types.js";
 import type { PaymentStripeSettings, UpdatePaymentStripeSettings } from "./types.js";
 
 type PaymentDb = Kysely<Database> | Transaction<Database>;
-type SettingsRow = Selectable<Database["payment_stripe_settings"]>;
+type SettingsRow = Selectable<PaymentDatabase["payment_stripe_settings"]>;
 
 export class PaymentStripeConfigurationRepository {
-	constructor(private readonly db: PaymentDb) {}
+	private readonly db: Kysely<PaymentDatabase> | Transaction<PaymentDatabase>;
+	constructor(db: PaymentDb) {
+		this.db = db.withTables<PaymentTables>();
+	}
 
 	async ensureDefaults(): Promise<PaymentStripeSettings> {
 		await this.db
@@ -32,7 +36,7 @@ export class PaymentStripeConfigurationRepository {
 		expectedVersion: number,
 		input: UpdatePaymentStripeSettings,
 	): Promise<PaymentStripeSettings> {
-		const update: Updateable<Database["payment_stripe_settings"]> = {
+		const update: Updateable<PaymentDatabase["payment_stripe_settings"]> = {
 			...(input.mode === undefined ? {} : { mode: input.mode }),
 			...(input.publishableKey === undefined ? {} : { publishable_key: input.publishableKey }),
 			...(input.configurationStatus === undefined

package/src/configuration/secrets.ts

@@ -10,12 +10,10 @@ import { PAYMENT_PLUGIN_ID } from "../constants.js";
 
 export const PAYMENT_STRIPE_SECRET_KEY = "stripe_secret_key";
 export const PAYMENT_STRIPE_WEBHOOK_SECRET = "stripe_webhook_secret";
-export const PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET = "stripe_subscription_webhook_secret";
 
 export type PaymentStripeSecretName =
 	| typeof PAYMENT_STRIPE_SECRET_KEY
-	| typeof PAYMENT_STRIPE_WEBHOOK_SECRET
-	| typeof PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET;
+	| typeof PAYMENT_STRIPE_WEBHOOK_SECRET;
 
 export class PaymentStripeSecretStore {
 	private readonly store: PluginSecretStore;

package/src/database/index.ts

@@ -0,0 +1,12 @@
+import type { PluginMigration } from "dineway";
+
+import * as configuration from "./migrations/001_stripe_configuration.js";
+import * as subscriptions from "./migrations/002_subscriptions.js";
+import * as purchases from "./migrations/003_purchases.js";
+
+export const paymentMigrations = {
+	"001_stripe_configuration": configuration,
+	"002_subscriptions": subscriptions,
+	"003_purchases": purchases,
+} satisfies Record<string, PluginMigration>;
+export type { PaymentDatabase, PaymentTables } from "./types.js";

package/src/database/migrations/001_stripe_configuration.ts

@@ -0,0 +1,100 @@
+import { currentTimestamp } from "dineway";
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+import { schemaExists } from "./adoption.js";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	if (
+		await schemaExists(db, {
+			payment_stripe_settings: [
+				"id",
+				"default_key",
+				"mode",
+				"publishable_key",
+				"configuration_status",
+				"stripe_account_id",
+				"charges_enabled",
+				"details_submitted",
+				"tax_status",
+				"validation_error_code",
+				"last_validated_at",
+				"connect_status",
+				"version",
+				"created_at",
+				"updated_at",
+			],
+		})
+	)
+		return;
+	await db.schema
+		.createTable("payment_stripe_settings")
+		.addColumn("id", "text", (col) => col.primaryKey())
+		.addColumn("default_key", "text", (col) => col.notNull().unique().defaultTo("default"))
+		.addColumn("mode", "text", (col) =>
+			col
+				.notNull()
+				.check(sql`mode in ('test', 'live')`)
+				.defaultTo("test"),
+		)
+		.addColumn("publishable_key", "text")
+		.addColumn("configuration_status", "text", (col) =>
+			col
+				.notNull()
+				.check(sql`configuration_status in ('unconfigured', 'unverified', 'valid', 'invalid')`)
+				.defaultTo("unconfigured"),
+		)
+		.addColumn("stripe_account_id", "text")
+		.addColumn("charges_enabled", "integer", (col) =>
+			col.check(sql`charges_enabled is null or charges_enabled in (0, 1)`),
+		)
+		.addColumn("details_submitted", "integer", (col) =>
+			col.check(sql`details_submitted is null or details_submitted in (0, 1)`),
+		)
+		.addColumn("tax_status", "text", (col) =>
+			col
+				.notNull()
+				.check(sql`tax_status in ('unknown', 'active', 'pending', 'unavailable')`)
+				.defaultTo("unknown"),
+		)
+		.addColumn("validation_error_code", "text")
+		.addColumn("last_validated_at", "text")
+		.addColumn("connect_status", "text", (col) =>
+			col
+				.notNull()
+				.check(sql`connect_status in ('not_configured', 'restricted', 'ready')`)
+				.defaultTo("not_configured"),
+		)
+		.addColumn("version", "integer", (col) => col.notNull().defaultTo(1))
+		.addColumn("created_at", "text", (col) => col.notNull().defaultTo(currentTimestamp(db)))
+		.addColumn("updated_at", "text", (col) => col.notNull().defaultTo(currentTimestamp(db)))
+		.addCheckConstraint("ck_payment_stripe_settings_default_key", sql`default_key = 'default'`)
+		.execute();
+
+	const tables = await db.introspection.getTables();
+	if (tables.some((table) => table.name === "restaurant_stripe_settings"))
+		await sql`
+		INSERT INTO payment_stripe_settings (
+			id, default_key, mode, publishable_key, configuration_status,
+			stripe_account_id, charges_enabled, details_submitted, tax_status,
+			validation_error_code, last_validated_at, connect_status, version,
+			created_at, updated_at
+		)
+		SELECT
+			id, default_key, mode, publishable_key, configuration_status,
+			stripe_account_id, charges_enabled, details_submitted, tax_status,
+			validation_error_code, last_validated_at, connect_status, version,
+			created_at, updated_at
+		FROM restaurant_stripe_settings
+	`.execute(db);
+
+	await db.schema
+		.createIndex("idx_payment_stripe_settings_updated_at")
+		.on("payment_stripe_settings")
+		.column("updated_at")
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropTable("payment_stripe_settings").execute();
+}