@dineway-ai/plugin-payment 0.2.7 → 0.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dineway-ai/plugin-payment",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Provider-neutral payment infrastructure and Stripe integration for Dineway plugins",
   "type": "module",
   "publishConfig": {
@@ -30,7 +30,7 @@
   "license": "MIT",
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",
-    "dineway": "^0.2.30"
+    "dineway": "^0.2.31"
   },
   "dependencies": {
     "@stripe/stripe-js": "9.9.0",

package/src/admin/subscriptions.tsx

@@ -41,7 +41,6 @@ export function PaymentSubscriptionsPage() {
 	const [editorRevision, setEditorRevision] = React.useState(0);
 	const [boundPrices, setBoundPrices] = React.useState<SubscriptionPlan["prices"]>([]);
 	const [features, setFeatures] = React.useState<Feature[]>([]);
-	const [webhookSecret, setWebhookSecret] = React.useState("");
 	const [detail, setDetail] = React.useState<
 		(SubscriptionSnapshot & { member: MemberBilling }) | null
 	>(null);
@@ -153,7 +152,10 @@ export function PaymentSubscriptionsPage() {
 				<p className="mt-2 text-sm text-kumo-subtle">
 					Bind Stripe prices, configure plan entitlements, and inspect paid membership periods.
 				</p>
-				<a href="/_dineway/admin/payments" className="mt-2 inline-block text-sm underline">
+				<a
+					href="/_dineway/admin/plugins/dineway-payment/payments"
+					className="mt-2 inline-block text-sm underline"
+				>
 					Stripe account settings
 				</a>
 			</header>
@@ -178,7 +180,7 @@ export function PaymentSubscriptionsPage() {
 			) : (
 				<>
 					<section className="space-y-4 rounded-xl border border-kumo-line p-5">
-						<h2 className="text-lg font-semibold">Subscription webhook</h2>
+						<h2 className="text-lg font-semibold">Payment webhook</h2>
 						<p className="text-sm">
 							Application: {configuration.namespace} · {configuration.mode} ·{" "}
 							{configuration.ready ? "Ready" : "Configuration required"}
@@ -188,48 +190,14 @@ export function PaymentSubscriptionsPage() {
 							<input className={inputClass} readOnly value={configuration.webhookUrl} />
 						</label>
 						<p className="text-sm text-kumo-subtle">
-							Create a Stripe webhook for this endpoint using the subscription events in the Payment
-							documentation. Its signing secret is separate from other payment webhooks.
+							Payment receives and verifies Stripe events for subscriptions, restaurant orders, and
+							venue payments at this shared endpoint. Configure its signing secret once in Payments
+							using the Stripe account settings link above.
 						</p>
-						<form
-							className="flex flex-wrap items-end gap-3"
-							onSubmit={(event) => {
-								event.preventDefault();
-								void run(async () => {
-									setConfiguration(
-										await postPaymentRoute<Configuration>("subscriptions/configuration/update", {
-											webhookSecret,
-										}),
-									);
-									setWebhookSecret("");
-									await refresh();
-									setNotice("Subscription webhook secret saved.");
-								});
-							}}
-						>
-							<label className="min-w-64 flex-1 text-sm">
-								Signing secret
-								<input
-									type="password"
-									autoComplete="new-password"
-									required
-									className={inputClass}
-									value={webhookSecret}
-									placeholder={
-										configuration.webhookSecret
-											? "Leave unchanged unless rotating the secret"
-											: "whsec_…"
-									}
-									onChange={(event) => setWebhookSecret(event.target.value)}
-								/>
-							</label>
-							<button className={buttonClass} disabled={busy || !webhookSecret}>
-								Save secret
-							</button>
-						</form>
 						{!configuration.ready && (
 							<p className="text-sm text-kumo-subtle">
-								Verify the Stripe account and save this webhook secret to manage subscription plans.
+								Verify the Stripe account and configure the shared webhook in Payments to manage
+								plans.
 							</p>
 						)}
 					</section>

package/src/admin.tsx

@@ -8,6 +8,7 @@ import {
 } from "./admin/form.js";
 import { PaymentSubscriptionsPage } from "./admin/subscriptions.js";
 import type { PaymentStripeConfiguration } from "./configuration/service.js";
+import { PAYMENT_WEBHOOK_PATH } from "./webhooks/types.js";
 
 type CredentialName = "secretKey" | "webhookSecret";
 
@@ -184,6 +185,10 @@ export function PaymentSettingsPage() {
 					}
 					type="password"
 				/>
+				<p className="text-sm text-kumo-subtle">
+					Use the complete whsec_… signing secret from Stripe for the endpoint below. For local
+					forwarding, use the value printed by stripe listen. Do not generate your own value.
+				</p>
 				<Credential
 					label="Webhook secret"
 					present={Boolean(configuration.webhookSecret)}
@@ -210,10 +215,19 @@ export function PaymentSettingsPage() {
 			</form>
 			<section className="max-w-3xl rounded-xl bg-kumo-tint/40 p-5 text-sm text-kumo-subtle">
 				<h2 className="font-semibold text-kumo-default">Webhook endpoint</h2>
+				<input
+					aria-label="Payment webhook endpoint"
+					className="mt-2 w-full rounded-lg border border-kumo-line bg-kumo-base px-3 py-2"
+					readOnly
+					value={
+						typeof window === "undefined"
+							? PAYMENT_WEBHOOK_PATH
+							: new URL(PAYMENT_WEBHOOK_PATH, window.location.origin).href
+					}
+				/>
 				<p className="mt-2">
-					Configure Stripe to send domain events to the webhook shown by each installed
-					transactional plugin. Venue and Restaurant validate exact request bytes with this shared
-					signing secret.
+					Configure one Stripe endpoint for Venue, Restaurant, and Subscriptions. Payment verifies
+					each event and delivers it to the enabled plugins.
 				</p>
 			</section>
 		</div>

package/src/configuration/secrets.ts

@@ -10,12 +10,10 @@ import { PAYMENT_PLUGIN_ID } from "../constants.js";
 
 export const PAYMENT_STRIPE_SECRET_KEY = "stripe_secret_key";
 export const PAYMENT_STRIPE_WEBHOOK_SECRET = "stripe_webhook_secret";
-export const PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET = "stripe_subscription_webhook_secret";
 
 export type PaymentStripeSecretName =
 	| typeof PAYMENT_STRIPE_SECRET_KEY
-	| typeof PAYMENT_STRIPE_WEBHOOK_SECRET
-	| typeof PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET;
+	| typeof PAYMENT_STRIPE_WEBHOOK_SECRET;
 
 export class PaymentStripeSecretStore {
 	private readonly store: PluginSecretStore;

package/src/index.ts

@@ -7,7 +7,14 @@ import { PAYMENT_PLUGIN_ID } from "./constants.js";
 import { paymentMigrations } from "./database/index.js";
 import { createPaymentRoutes } from "./routes/index.js";
 import { createSubscriptionRoutes } from "./subscriptions/routes.js";
+import { getPaymentSubscriptionService } from "./subscriptions/runtime.js";
+import { SUBSCRIPTION_WEBHOOK_EVENTS } from "./subscriptions/service.js";
 import type { SubscriptionOptions } from "./subscriptions/types.js";
+import {
+	createPaymentWebhookRoute,
+	PAYMENT_WEBHOOK_EXTENSION,
+	type PaymentWebhookConsumer,
+} from "./webhooks/index.js";
 
 const PAYMENT_ADMIN_ENTRY = "@dineway-ai/plugin-payment/admin";
 const PAYMENT_ADMIN_PAGES = [
@@ -63,9 +70,23 @@ export function createPlugin(options: PaymentPluginOptions = {}): ResolvedPlugin
 			],
 		},
 		migrations: paymentMigrations,
+		nativeExtensions: options.subscriptions
+			? {
+					[PAYMENT_WEBHOOK_EXTENSION]: {
+						id: "subscriptions",
+						eventTypes: SUBSCRIPTION_WEBHOOK_EVENTS,
+						consume: async ({ event, rawBody }) => {
+							await (
+								await getPaymentSubscriptionService(options.subscriptions!)
+							).receiveVerifiedWebhook(event, rawBody);
+						},
+					} satisfies PaymentWebhookConsumer,
+				}
+			: {},
 		hooks,
 		routes: {
 			...createPaymentRoutes(),
+			"stripe/webhook": createPaymentWebhookRoute(),
 			...(options.subscriptions ? createSubscriptionRoutes(options.subscriptions) : {}),
 		},
 	});
@@ -76,3 +97,5 @@ export { PAYMENT_PLUGIN_ID } from "./constants.js";
 export * from "./stripe/index.js";
 export * from "./routes/index.js";
 export * from "./types.js";
+
+export * from "./webhooks/index.js";

package/src/stripe/webhook-verifier.ts

@@ -97,6 +97,7 @@ function projectEvent(event: Stripe.Event, rawBody: Uint8Array): StripeWebhookEv
 
 	return {
 		eventId: event.id,
+		...(event.account ? { accountId: requiredSafeString(event.account, 255) } : {}),
 		eventType: event.type,
 		eventCreated: event.created,
 		livemode: event.livemode,

package/src/subscriptions/routes.ts

@@ -1,10 +1,6 @@
 import { z } from "astro/zod";
-import { getDb, PluginRouteError, type PluginRoute, type RouteContext } from "dineway";
+import { PluginRouteError, type PluginRoute, type RouteContext } from "dineway";
 
-import {
-	PaymentStripeSecretStore,
-	PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET,
-} from "../configuration/secrets.js";
 import { getPaymentSubscriptionService, getSubscriptionConfiguration } from "./runtime.js";
 import {
 	checkoutSchema,
@@ -19,9 +15,6 @@ import type { PaymentSubscriptionService } from "./service.js";
 import { SubscriptionError, type SubscriptionOptions } from "./types.js";
 
 const empty = z.object({}).strict();
-const secretSchema = z
-	.object({ webhookSecret: z.string().trim().startsWith("whsec_").max(512) })
-	.strict();
 type PaymentPermission = "payments:read_own" | "payments:manage_own" | "payments:manage";
 export interface SubscriptionRouteOptions {
 	service?: () => Promise<PaymentSubscriptionService>;
@@ -83,17 +76,6 @@ export function createSubscriptionRoutes(
 		"subscriptions/configuration/get": privateRoute(empty, "payments:manage", async () =>
 			getSubscriptionConfiguration(options),
 		),
-		"subscriptions/configuration/update": privateRoute(
-			secretSchema,
-			"payments:manage",
-			async (context) => {
-				await new PaymentStripeSecretStore(await getDb()).set(
-					PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET,
-					context.input.webhookSecret,
-				);
-				return getSubscriptionConfiguration(options);
-			},
-		),
 		"subscriptions/plans/list": privateRoute(empty, "payments:manage", async () => ({
 			items: await (await service()).listPlans(true),
 		})),
@@ -132,24 +114,9 @@ export function createSubscriptionRoutes(
 			await client.refreshSubscription(context.input.subscriptionId);
 			return client.subscriptionDetail(context.input.subscriptionId);
 		}),
-		"subscriptions/webhook": {
-			methods: ["POST"],
-			public: true,
-			body: "raw",
-			maxBodyBytes: 262144,
-			handler: async (context) =>
-				run(async () => {
-					if (!context.rawBody)
-						throw new SubscriptionError("INVALID_SIGNATURE", "A signed body is required");
-					await (
-						await service()
-					).receiveWebhook(context.rawBody, context.request.headers.get("Stripe-Signature"));
-					return { received: true };
-				}, true),
-		},
 	};
 }
-async function run<T>(action: () => Promise<T>, webhook = false): Promise<T> {
+async function run<T>(action: () => Promise<T>): Promise<T> {
 	try {
 		return await action();
 	} catch (error) {
@@ -157,10 +124,6 @@ async function run<T>(action: () => Promise<T>, webhook = false): Promise<T> {
 			throw new PluginRouteError(error.code, error.message, error.status);
 		if (error instanceof z.ZodError)
 			throw new PluginRouteError("VALIDATION_ERROR", "Invalid subscription input", 400);
-		throw new PluginRouteError(
-			webhook ? "WEBHOOK_RETRY_REQUIRED" : "BILLING_UNAVAILABLE",
-			webhook ? "Retry this webhook" : "Billing is temporarily unavailable",
-			503,
-		);
+		throw new PluginRouteError("BILLING_UNAVAILABLE", "Billing is temporarily unavailable", 503);
 	}
 }

package/src/subscriptions/runtime.ts

@@ -3,9 +3,10 @@ import { getDb, type PluginSecretStoreOptions } from "dineway";
 import {
 	PaymentStripeSecretStore,
 	PAYMENT_STRIPE_SECRET_KEY,
-	PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET,
+	PAYMENT_STRIPE_WEBHOOK_SECRET,
 } from "../configuration/secrets.js";
 import { getPaymentStripeConfiguration } from "../configuration/service.js";
+import { PAYMENT_WEBHOOK_PATH } from "../webhooks/types.js";
 import { PaymentSubscriptionService } from "./service.js";
 import { SubscriptionError, type SubscriptionOptions } from "./types.js";
 
@@ -17,7 +18,7 @@ export async function getPaymentSubscriptionService(
 	const config = await getPaymentStripeConfiguration(db, secretOptions);
 	const store = new PaymentStripeSecretStore(db, secretOptions);
 	const secretKey = await store.resolveForRuntime(PAYMENT_STRIPE_SECRET_KEY);
-	const webhookSecret = await store.resolveForRuntime(PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET);
+	const webhookSecret = await store.resolveForRuntime(PAYMENT_STRIPE_WEBHOOK_SECRET);
 	if (
 		config.settings.configurationStatus !== "valid" ||
 		!config.settings.stripeAccountId ||
@@ -26,7 +27,7 @@ export async function getPaymentSubscriptionService(
 	) {
 		throw new SubscriptionError(
 			"BILLING_UNAVAILABLE",
-			"Configure and verify Stripe and the subscription webhook first",
+			"Configure and verify Stripe and the Payment webhook first",
 			503,
 		);
 	}
@@ -47,7 +48,7 @@ export async function getSubscriptionConfiguration(options: SubscriptionOptions)
 	const db = await getDb();
 	const configuration = await getPaymentStripeConfiguration(db);
 	const webhookSecret = await new PaymentStripeSecretStore(db).status(
-		PAYMENT_STRIPE_SUBSCRIPTION_WEBHOOK_SECRET,
+		PAYMENT_STRIPE_WEBHOOK_SECRET,
 	);
 	return {
 		namespace: options.namespace,
@@ -57,9 +58,6 @@ export async function getSubscriptionConfiguration(options: SubscriptionOptions)
 			configuration.settings.configurationStatus === "valid" &&
 			Boolean(configuration.secretKey && webhookSecret),
 		webhookSecret,
-		webhookUrl: new URL(
-			"/_dineway/api/plugins/dineway-payment/subscriptions/webhook",
-			options.siteUrl,
-		).href,
+		webhookUrl: new URL(PAYMENT_WEBHOOK_PATH, options.siteUrl).href,
 	};
 }

package/src/subscriptions/service.ts

@@ -5,6 +5,7 @@ import type { Kysely } from "kysely";
 import Stripe from "stripe";
 
 import { StripeNodeWebhookVerifier } from "../stripe/webhook-verifier.js";
+import type { StripeWebhookEvent } from "../types.js";
 import { collectBounded, invoiceFunding, inspectCharge } from "./funding.js";
 import {
 	recurringPrice,
@@ -53,7 +54,7 @@ export interface SubscriptionServiceOptions {
 	stripe?: Stripe;
 }
 const terminal = new Set(["canceled", "incomplete_expired"]);
-const events = new Set([
+export const SUBSCRIPTION_WEBHOOK_EVENTS = [
 	"checkout.session.completed",
 	"checkout.session.async_payment_succeeded",
 	"checkout.session.async_payment_failed",
@@ -76,7 +77,8 @@ const events = new Set([
 	"refund.updated",
 	"refund.failed",
 	"payment_intent.payment_failed",
-]);
+] as const;
+const events = new Set<string>(SUBSCRIPTION_WEBHOOK_EVENTS);
 const localeSchema = checkoutSchema.shape.locale;
 const fingerprint = (values: unknown[]) =>
 	createHash("sha256").update(JSON.stringify(values)).digest("hex");
@@ -723,7 +725,9 @@ export class PaymentSubscriptionService {
 		});
 		if (!verified.ok)
 			throw new SubscriptionError("INVALID_SIGNATURE", "Invalid Stripe webhook", 400);
-		const event = verified.event;
+		await this.receiveVerifiedWebhook(verified.event, rawBody);
+	}
+	async receiveVerifiedWebhook(event: StripeWebhookEvent, rawBody: Uint8Array): Promise<void> {
 		if (event.livemode !== (this.options.scope.mode === "live"))
 			throw new SubscriptionError("MODE_MISMATCH", "Invalid webhook mode", 400);
 		if (!events.has(event.eventType)) return;

package/src/types.ts

@@ -262,6 +262,7 @@ export interface StripeWebhookRefund {
 }
 
 export interface StripeWebhookEvent {
+	accountId?: string;
 	subscriptionId?: string;
 	eventId: string;
 	eventType: string;

package/src/webhooks/index.ts

@@ -0,0 +1,2 @@
+export * from "./types.js";
+export * from "./routes.js";

package/src/webhooks/routes.ts

@@ -0,0 +1,109 @@
+import { getDb, PluginRouteError, type PluginRoute, type PluginSecretStoreOptions } from "dineway";
+
+import { PaymentStripeConfigurationRepository } from "../configuration/repository.js";
+import {
+	PaymentStripeSecretStore,
+	PAYMENT_STRIPE_SECRET_KEY,
+	PAYMENT_STRIPE_WEBHOOK_SECRET,
+} from "../configuration/secrets.js";
+import { StripeNodeWebhookVerifier, STRIPE_WEBHOOK_MAX_BYTES } from "../stripe/webhook-verifier.js";
+import type { StripeWebhookVerifier } from "../types.js";
+import { PAYMENT_WEBHOOK_EXTENSION, type PaymentWebhookConsumer } from "./types.js";
+
+export interface PaymentWebhookRouteOptions {
+	secretOptions?: PluginSecretStoreOptions;
+	verifier?: StripeWebhookVerifier;
+	now?: () => Date;
+}
+export function createPaymentWebhookRoute(options: PaymentWebhookRouteOptions = {}): PluginRoute {
+	return {
+		methods: ["POST"],
+		public: true,
+		body: "raw",
+		maxBodyBytes: STRIPE_WEBHOOK_MAX_BYTES,
+		handler: async (context) => {
+			const rawBody = context.rawBody ?? new Uint8Array();
+			const signature = context.request.headers.get("stripe-signature");
+			if (
+				!rawBody.byteLength ||
+				rawBody.byteLength > STRIPE_WEBHOOK_MAX_BYTES ||
+				!signature?.trim()
+			)
+				throw new PluginRouteError("STRIPE_WEBHOOK_INVALID", "Stripe webhook is invalid", 400);
+			const db = await getDb();
+			let runtime;
+			try {
+				const store = new PaymentStripeSecretStore(db, options.secretOptions);
+				const [settings, secretKey, webhookSecret] = await Promise.all([
+					new PaymentStripeConfigurationRepository(db).requireSettings(),
+					store.resolveForRuntime(PAYMENT_STRIPE_SECRET_KEY),
+					store.resolveForRuntime(PAYMENT_STRIPE_WEBHOOK_SECRET),
+				]);
+				if (!secretKey || !webhookSecret) throw new Error("Missing credentials");
+				runtime = { settings, secretKey, webhookSecret };
+			} catch {
+				throw new PluginRouteError(
+					"STRIPE_WEBHOOK_NOT_CONFIGURED",
+					"Stripe webhook is not configured",
+					503,
+				);
+			}
+			const now = options.now?.() ?? new Date();
+			const result = (options.verifier ?? new StripeNodeWebhookVerifier()).verify({
+				secretKey: runtime.secretKey,
+				webhookSecret: runtime.webhookSecret,
+				rawBody,
+				signature,
+				receivedAt: Math.floor(now.getTime() / 1000),
+			});
+			if (
+				!result.ok ||
+				result.event.livemode !== (runtime.settings.mode === "live") ||
+				(result.event.accountId && result.event.accountId !== runtime.settings.stripeAccountId)
+			)
+				throw new PluginRouteError("STRIPE_WEBHOOK_INVALID", "Stripe webhook is invalid", 400);
+			if (!context.getNativeExtensions)
+				throw new PluginRouteError(
+					"STRIPE_WEBHOOK_NOT_CONFIGURED",
+					"Update Dineway to enable payment event dispatch",
+					503,
+				);
+			let failed = false;
+			for (const extension of context.getNativeExtensions(PAYMENT_WEBHOOK_EXTENSION)) {
+				if (!isConsumer(extension)) {
+					failed = true;
+					continue;
+				}
+				if (!extension.eventTypes.includes(result.event.eventType)) continue;
+				try {
+					await extension.consume({
+						db,
+						event: result.event,
+						rawBody,
+						expectedLivemode: result.event.livemode,
+						now,
+					});
+				} catch {
+					failed = true;
+				}
+			}
+			if (failed)
+				throw new PluginRouteError(
+					"STRIPE_WEBHOOK_PROCESSING_FAILED",
+					"Stripe webhook could not be processed",
+					503,
+				);
+			return { received: true };
+		},
+	};
+}
+function isConsumer(value: unknown): value is PaymentWebhookConsumer {
+	if (!value || typeof value !== "object") return false;
+	const candidate = value as Partial<PaymentWebhookConsumer>;
+	return (
+		typeof candidate.id === "string" &&
+		Array.isArray(candidate.eventTypes) &&
+		candidate.eventTypes.every((type) => typeof type === "string") &&
+		typeof candidate.consume === "function"
+	);
+}

package/src/webhooks/types.ts

@@ -0,0 +1,21 @@
+import type { Database } from "dineway";
+import type { Kysely } from "kysely";
+
+import type { StripeWebhookEvent } from "../types.js";
+
+export const PAYMENT_WEBHOOK_EXTENSION = "dineway-payment:stripe-webhook";
+export const PAYMENT_WEBHOOK_PATH = "/_dineway/api/plugins/dineway-payment/stripe/webhook";
+
+/** Delivered only after Payment has verified the exact request bytes and environment. */
+export interface PaymentWebhookDelivery {
+	db: Kysely<Database>;
+	event: StripeWebhookEvent;
+	rawBody: Uint8Array;
+	expectedLivemode: boolean;
+	now: Date;
+}
+export interface PaymentWebhookConsumer {
+	id: string;
+	eventTypes: readonly string[];
+	consume(delivery: PaymentWebhookDelivery): Promise<void>;
+}