@dineway-ai/plugin-payment 0.2.6 → 0.2.8

package/src/subscriptions/types.ts

@@ -62,6 +62,8 @@ export interface MemberSubscription {
 	cancelAtPeriodEnd: boolean;
 	verifiedAt: number;
 	lastError: string | null;
+	purchaseReference?: string | null;
+	revision?: number;
 }
 export interface PaidSubscriptionPeriod {
 	id: string;
@@ -70,6 +72,94 @@ export interface PaidSubscriptionPeriod {
 	planCode: string;
 	startsAt: number;
 	endsAt: number;
+	eligible?: boolean;
+	evidence?: InvoiceFundingEvidence;
+}
+
+/** Supplied by a trusted session adapter, never by a browser request body. */
+export interface BillingSubject {
+	realm: string;
+	id: string;
+	email: string;
+	emailVerified: boolean;
+}
+export type PurchasePricing =
+	| { kind: "catalogue"; planCode: string; interval: SubscriptionInterval }
+	| {
+			kind: "dynamic";
+			name: string;
+			amount: number;
+			currency: string;
+			interval: "day" | "week" | "month" | "year";
+			intervalCount: number;
+	  };
+export interface SubscriptionPurchaseInput {
+	reference: string;
+	groupKey: string;
+	pricing: PurchasePricing;
+	firstPeriodCredit?: number;
+	returnPath: string;
+	locale?: string;
+}
+export interface PurchaseContract extends SubscriptionPurchaseInput {
+	amount: number;
+	currency: string;
+	interval: "day" | "week" | "month" | "year";
+	intervalCount: number;
+	priceId: string | null;
+	couponId: string | null;
+}
+export interface SubscriptionPurchase {
+	reference: string;
+	userId: string;
+	contract: PurchaseContract;
+	createdAt: number;
+	expiresAt: number;
+	sessionId: string | null;
+	subscriptionId: string | null;
+	closed: boolean;
+	cancelMode: "period_end" | "immediate" | null;
+	lastError: string | null;
+}
+export interface RefundEvidence {
+	id: string;
+	amount: number;
+	status: string;
+	metadata: Record<string, string>;
+}
+export interface ChargeEvidence {
+	id: string;
+	paymentIntentId: string | null;
+	customerId: string | null;
+	currency: string;
+	amount: number;
+	captured: number;
+	refunded: number;
+	settled: boolean;
+	refunds: RefundEvidence[];
+	disputes: { id: string; amount: number; status: string }[];
+}
+export interface InvoiceFundingEvidence {
+	verifiedAt: number;
+	currency: string;
+	amount: number;
+	credit: number;
+	cash: number;
+	charges: ChargeEvidence[];
+	paymentMethodId: string | null;
+	reason: string | null;
+}
+export interface SubscriptionSnapshot {
+	subscription: MemberSubscription;
+	subject: BillingSubject | null;
+	purchase: SubscriptionPurchase | null;
+	periods: PaidSubscriptionPeriod[];
+}
+export interface SubscriptionChange {
+	id: string;
+	revision: number;
+	createdAt: number;
+	snapshot: SubscriptionSnapshot;
 }
 export interface MemberBilling {
 	customer: boolean;

package/src/types.ts

@@ -1,3 +1,4 @@
+export type { PaymentDatabase, PaymentTables } from "./database/types.js";
 export type StripeMode = "test" | "live";
 export type StripeTaxStatus = "unknown" | "active" | "pending" | "unavailable";
 
@@ -261,6 +262,7 @@ export interface StripeWebhookRefund {
 }
 
 export interface StripeWebhookEvent {
+	accountId?: string;
 	subscriptionId?: string;
 	eventId: string;
 	eventType: string;

package/src/webhooks/index.ts

@@ -0,0 +1,2 @@
+export * from "./types.js";
+export * from "./routes.js";

package/src/webhooks/routes.ts

@@ -0,0 +1,109 @@
+import { getDb, PluginRouteError, type PluginRoute, type PluginSecretStoreOptions } from "dineway";
+
+import { PaymentStripeConfigurationRepository } from "../configuration/repository.js";
+import {
+	PaymentStripeSecretStore,
+	PAYMENT_STRIPE_SECRET_KEY,
+	PAYMENT_STRIPE_WEBHOOK_SECRET,
+} from "../configuration/secrets.js";
+import { StripeNodeWebhookVerifier, STRIPE_WEBHOOK_MAX_BYTES } from "../stripe/webhook-verifier.js";
+import type { StripeWebhookVerifier } from "../types.js";
+import { PAYMENT_WEBHOOK_EXTENSION, type PaymentWebhookConsumer } from "./types.js";
+
+export interface PaymentWebhookRouteOptions {
+	secretOptions?: PluginSecretStoreOptions;
+	verifier?: StripeWebhookVerifier;
+	now?: () => Date;
+}
+export function createPaymentWebhookRoute(options: PaymentWebhookRouteOptions = {}): PluginRoute {
+	return {
+		methods: ["POST"],
+		public: true,
+		body: "raw",
+		maxBodyBytes: STRIPE_WEBHOOK_MAX_BYTES,
+		handler: async (context) => {
+			const rawBody = context.rawBody ?? new Uint8Array();
+			const signature = context.request.headers.get("stripe-signature");
+			if (
+				!rawBody.byteLength ||
+				rawBody.byteLength > STRIPE_WEBHOOK_MAX_BYTES ||
+				!signature?.trim()
+			)
+				throw new PluginRouteError("STRIPE_WEBHOOK_INVALID", "Stripe webhook is invalid", 400);
+			const db = await getDb();
+			let runtime;
+			try {
+				const store = new PaymentStripeSecretStore(db, options.secretOptions);
+				const [settings, secretKey, webhookSecret] = await Promise.all([
+					new PaymentStripeConfigurationRepository(db).requireSettings(),
+					store.resolveForRuntime(PAYMENT_STRIPE_SECRET_KEY),
+					store.resolveForRuntime(PAYMENT_STRIPE_WEBHOOK_SECRET),
+				]);
+				if (!secretKey || !webhookSecret) throw new Error("Missing credentials");
+				runtime = { settings, secretKey, webhookSecret };
+			} catch {
+				throw new PluginRouteError(
+					"STRIPE_WEBHOOK_NOT_CONFIGURED",
+					"Stripe webhook is not configured",
+					503,
+				);
+			}
+			const now = options.now?.() ?? new Date();
+			const result = (options.verifier ?? new StripeNodeWebhookVerifier()).verify({
+				secretKey: runtime.secretKey,
+				webhookSecret: runtime.webhookSecret,
+				rawBody,
+				signature,
+				receivedAt: Math.floor(now.getTime() / 1000),
+			});
+			if (
+				!result.ok ||
+				result.event.livemode !== (runtime.settings.mode === "live") ||
+				(result.event.accountId && result.event.accountId !== runtime.settings.stripeAccountId)
+			)
+				throw new PluginRouteError("STRIPE_WEBHOOK_INVALID", "Stripe webhook is invalid", 400);
+			if (!context.getNativeExtensions)
+				throw new PluginRouteError(
+					"STRIPE_WEBHOOK_NOT_CONFIGURED",
+					"Update Dineway to enable payment event dispatch",
+					503,
+				);
+			let failed = false;
+			for (const extension of context.getNativeExtensions(PAYMENT_WEBHOOK_EXTENSION)) {
+				if (!isConsumer(extension)) {
+					failed = true;
+					continue;
+				}
+				if (!extension.eventTypes.includes(result.event.eventType)) continue;
+				try {
+					await extension.consume({
+						db,
+						event: result.event,
+						rawBody,
+						expectedLivemode: result.event.livemode,
+						now,
+					});
+				} catch {
+					failed = true;
+				}
+			}
+			if (failed)
+				throw new PluginRouteError(
+					"STRIPE_WEBHOOK_PROCESSING_FAILED",
+					"Stripe webhook could not be processed",
+					503,
+				);
+			return { received: true };
+		},
+	};
+}
+function isConsumer(value: unknown): value is PaymentWebhookConsumer {
+	if (!value || typeof value !== "object") return false;
+	const candidate = value as Partial<PaymentWebhookConsumer>;
+	return (
+		typeof candidate.id === "string" &&
+		Array.isArray(candidate.eventTypes) &&
+		candidate.eventTypes.every((type) => typeof type === "string") &&
+		typeof candidate.consume === "function"
+	);
+}

package/src/webhooks/types.ts

@@ -0,0 +1,21 @@
+import type { Database } from "dineway";
+import type { Kysely } from "kysely";
+
+import type { StripeWebhookEvent } from "../types.js";
+
+export const PAYMENT_WEBHOOK_EXTENSION = "dineway-payment:stripe-webhook";
+export const PAYMENT_WEBHOOK_PATH = "/_dineway/api/plugins/dineway-payment/stripe/webhook";
+
+/** Delivered only after Payment has verified the exact request bytes and environment. */
+export interface PaymentWebhookDelivery {
+	db: Kysely<Database>;
+	event: StripeWebhookEvent;
+	rawBody: Uint8Array;
+	expectedLivemode: boolean;
+	now: Date;
+}
+export interface PaymentWebhookConsumer {
+	id: string;
+	eventTypes: readonly string[];
+	consume(delivery: PaymentWebhookDelivery): Promise<void>;
+}