@mathrunet/masamune_cloudflare_purchase_stripe 3.2.0

package/src/workers/stripe_webhook.ts

@@ -0,0 +1,414 @@
+import { Hono } from "hono";
+import { jsonError } from "@mathrunet/masamune_cloudflare/dist/lib/src/http_error";
+import {
+    resolveStripeClient,
+    resolveStripePurchaseStore,
+    resolveStripeSecretKey,
+    resolveStripeWebhookSecret,
+    StripePurchaseWorkersOptions,
+} from "../lib/options";
+import { constructStripeEvent } from "../lib/stripe_client";
+import { syncStripePayment } from "../lib/purchase/sync_payment";
+
+/**
+ * Receives and processes webhooks from Stripe (parity with the `stripeWebhook`
+ * function of `@mathrunet/masamune_firebase_purchase_stripe`).
+ * Please register the URL when you deploy this in your Stripe webhook settings.
+ *
+ * StripeからのWebhookを受け取り処理を行います
+ * （`@mathrunet/masamune_firebase_purchase_stripe`の`stripeWebhook`と同等）。
+ * こちらをデプロイした際のURLをStripeのWebhook設定に登録してください。
+ *
+ * @param {string} PURCHASE_STRIPE_SECRETKEY
+ * API key (secret key) to connect to Stripe.
+ * Stripeへ接続するためのAPIキー（シークレットキー）。
+ *
+ * @param {string} PURCHASE_STRIPE_WEBHOOKSECRET
+ * Specify the **Signature Secret** after setting it up as a webhook.
+ * Webhookとして設定したあとの**署名シークレット**を指定します。
+ */
+module.exports = (
+    hono: Hono,
+    options: StripePurchaseWorkersOptions,
+    data: { [key: string]: any },
+) => {
+    hono.post("/", async (c) => {
+        try {
+            const apiKey = resolveStripeSecretKey(c, options);
+            const webhookSecret = resolveStripeWebhookSecret(c, options);
+            const store = resolveStripePurchaseStore(c, options);
+            const stripeClient = resolveStripeClient(c, options, apiKey);
+            const signature = c.req.header("stripe-signature");
+            if (!signature || !webhookSecret) {
+                return c.json({
+                    "error": "Access denied.",
+                }, 403);
+            }
+            const payload = await c.req.text();
+            let event;
+            try {
+                event = await constructStripeEvent({
+                    client: stripeClient,
+                    payload,
+                    signature,
+                    secret: webhookSecret,
+                });
+            } catch (err) {
+                console.warn(err);
+                return c.json({
+                    "error": "Access denied.",
+                }, 403);
+            }
+
+            switch (event.type) {
+                case "payment_intent.requires_action":
+                case "payment_intent.amount_capturable_updated": {
+                    const payment = event.data.object as {
+                        [key: string]: any
+                    };
+                    const purchaseId = payment["id"];
+                    const customerId = payment["customer"];
+                    const status = payment["status"];
+                    if (!customerId) {
+                        return c.json({
+                            "error": "The customer id is not found.",
+                        }, 404);
+                    }
+                    if (!status) {
+                        return c.json({
+                            "error": "The status is not found.",
+                        }, 404);
+                    }
+                    const user = await store.findUserByCustomerId(customerId);
+                    if (!user) {
+                        return c.json({
+                            "error": "The account data is not found.",
+                        }, 404);
+                    }
+                    const purchase = await store.findPurchaseByPurchaseId(purchaseId);
+                    if (!purchase) {
+                        return c.json({
+                            "error": "The purchase data is not found.",
+                        }, 404);
+                    }
+                    const update: { [key: string]: any } = {};
+                    switch (status) {
+                        case "requires_payment_method":
+                        case "requires_confirmation": {
+                            update["confirm"] = false;
+                            update["verify"] = false;
+                            update["capture"] = false;
+                            update["success"] = false;
+                            break;
+                        }
+                        case "requires_action": {
+                            update["confirm"] = true;
+                            update["verify"] = false;
+                            update["capture"] = false;
+                            update["success"] = false;
+                            break;
+                        }
+                        case "requires_capture": {
+                            update["confirm"] = true;
+                            update["verify"] = true;
+                            update["capture"] = false;
+                            update["success"] = false;
+                            break;
+                        }
+                    }
+                    update["updatedTime"] = new Date();
+                    await store.savePurchase(purchase.orderId, update);
+                    return c.json({
+                        "success": true,
+                    });
+                }
+                case "payment_intent.succeeded": {
+                    const payment = event.data.object as {
+                        [key: string]: any
+                    };
+                    const purchaseId = payment["id"];
+                    const customerId = payment["customer"];
+                    if (!customerId) {
+                        return c.json({
+                            "error": "The customer id is not found.",
+                        }, 404);
+                    }
+                    const user = await store.findUserByCustomerId(customerId);
+                    if (!user) {
+                        return c.json({
+                            "error": "The account data is not found.",
+                        }, 404);
+                    }
+                    const purchase = await store.findPurchaseByPurchaseId(purchaseId);
+                    if (!purchase) {
+                        return c.json({
+                            "error": "The purchase data is not found.",
+                        }, 404);
+                    }
+                    const update: { [key: string]: any } = {};
+                    update["confirm"] = true;
+                    update["verify"] = true;
+                    update["capture"] = true;
+                    update["success"] = true;
+                    update["error"] = null;
+                    update["errorMessage"] = null;
+                    update["updatedTime"] = new Date();
+
+                    if (payment["charges"] && payment["charges"]["data"] && payment["charges"]["data"].length > 0 && payment["charges"]["data"][0]) {
+                        if (payment["charges"]["data"][0]["receipt_url"]) {
+                            update["receiptUrl"] = payment["charges"]["data"][0]["receipt_url"];
+                        }
+                        if (payment["charges"]["data"][0]["amount_captured"]) {
+                            update["capturedAmount"] = payment["charges"]["data"][0]["amount_captured"];
+                        }
+                    }
+                    await store.savePurchase(purchase.orderId, update);
+                    return c.json({
+                        "success": true,
+                    });
+                }
+                case "payment_intent.payment_failed": {
+                    const payment = event.data.object as {
+                        [key: string]: any
+                    };
+                    const purchaseId = payment["id"];
+                    const customerId = payment["customer"];
+                    const status = payment["status"];
+                    if (!customerId) {
+                        return c.json({
+                            "error": "The customer id is not found.",
+                        }, 404);
+                    }
+                    const user = await store.findUserByCustomerId(customerId);
+                    if (!user) {
+                        return c.json({
+                            "error": "The account data is not found.",
+                        }, 404);
+                    }
+                    const purchase = await store.findPurchaseByPurchaseId(purchaseId);
+                    if (!purchase) {
+                        return c.json({
+                            "error": "The purchase data is not found.",
+                        }, 404);
+                    }
+                    const errorMessage = payment["last_payment_error"]?.["message"];
+                    const update: { [key: string]: any } = {};
+                    switch (status) {
+                        case "requires_payment_method":
+                        case "requires_confirmation": {
+                            update["confirm"] = false;
+                            update["verify"] = false;
+                            update["capture"] = false;
+                            update["success"] = false;
+                            break;
+                        }
+                        case "requires_action": {
+                            update["confirm"] = true;
+                            update["verify"] = false;
+                            update["capture"] = false;
+                            update["success"] = false;
+                            break;
+                        }
+                        case "requires_capture": {
+                            update["confirm"] = true;
+                            update["verify"] = true;
+                            update["capture"] = false;
+                            update["success"] = false;
+                            break;
+                        }
+                    }
+                    update["updatedTime"] = new Date();
+                    update["error"] = true;
+                    update["errorMessage"] = errorMessage;
+                    await store.savePurchase(purchase.orderId, update);
+                    return c.json({
+                        "success": true,
+                    });
+                }
+                case "payment_method.detached":
+                case "payment_method.updated": {
+                    const payment = event.data.object as {
+                        [key: string]: any
+                    };
+                    const previous = event.data.previous_attributes as {
+                        [key: string]: any
+                    };
+                    let customerId = payment["customer"];
+                    if (!customerId) {
+                        customerId = previous?.["customer"];
+                    }
+                    if (!customerId) {
+                        return c.json({
+                            "error": "The customer id is not found.",
+                        }, 404);
+                    }
+                    const user = await store.findUserByCustomerId(customerId);
+                    if (!user) {
+                        return c.json({
+                            "error": "The account data is not found.",
+                        }, 404);
+                    }
+                    await syncStripePayment({
+                        stripeClient,
+                        store,
+                        userId: user.userId,
+                        customerId,
+                    });
+                    return c.json({
+                        "success": true,
+                    });
+                }
+                case "customer.updated": {
+                    const customer = event.data.object as {
+                        [key: string]: any
+                    };
+                    const customerId = customer["id"];
+                    if (!customerId) {
+                        return c.json({
+                            "error": "The customer id is not found.",
+                        }, 404);
+                    }
+                    const user = await store.findUserByCustomerId(customerId);
+                    if (!user) {
+                        return c.json({
+                            "error": "The account data is not found.",
+                        }, 404);
+                    }
+                    await syncStripePayment({
+                        stripeClient,
+                        store,
+                        userId: user.userId,
+                        customerId,
+                    });
+                    return c.json({
+                        "success": true,
+                    });
+                }
+                case "checkout.session.completed": {
+                    const session = event.data.object as {
+                        [key: string]: any
+                    };
+                    const customerId = session["customer"];
+                    if (!customerId) {
+                        return c.json({
+                            "error": "The customer id is not found.",
+                        }, 404);
+                    }
+                    const setupIntent = session["setup_intent"];
+                    if (!setupIntent) {
+                        return c.json({
+                            "error": "The setup intent is not found.",
+                        }, 404);
+                    }
+                    const user = await store.findUserByCustomerId(customerId);
+                    if (!user) {
+                        return c.json({
+                            "error": "The account data is not found.",
+                        }, 404);
+                    }
+                    await store.saveUser(user.userId, {
+                        setupIntent: session["setup_intent"],
+                    });
+                    await syncStripePayment({
+                        stripeClient,
+                        store,
+                        userId: user.userId,
+                        customerId,
+                    });
+                    return c.json({
+                        "success": true,
+                    });
+                }
+                case "customer.subscription.trial_will_end":
+                case "customer.subscription.updated":
+                case "customer.subscription.created": {
+                    const now = new Date();
+                    const update: { [key: string]: any } = {};
+                    const subscription = event.data.object as {
+                        [key: string]: any
+                    };
+                    const status = subscription["status"];
+                    if (status != "active") {
+                        return c.json({
+                            "success": "Subscription is not active.",
+                        });
+                    }
+                    const endDate = new Date(subscription["current_period_end"] as number * 1000);
+                    const id = subscription["id"];
+                    const userId = subscription["metadata"]?.["userId"] as string;
+                    const orderId = (subscription["metadata"]?.["orderId"] as string) ?? id;
+                    const plan = subscription["plan"] as {
+                        [key: string]: any
+                    } ?? {};
+
+                    const existing = await store.findPurchaseBySubscriptionId(id);
+                    const targetOrderId = existing?.orderId ?? orderId;
+                    update["expired"] = now >= endDate;
+                    if (userId) {
+                        update["user"] = userId;
+                    }
+                    update["@uid"] = orderId;
+                    update["@time"] = new Date();
+                    update["subscription"] = id;
+                    update["application"] = subscription["application"];
+                    update["application_fee_percent"] = subscription["application_fee_percent"];
+                    update["cancel_at"] = subscription["cancel_at"];
+                    update["cancel_at_period_end"] = subscription["cancel_at_period_end"];
+                    update["canceled_at"] = subscription["canceled_at"];
+                    update["collection_method"] = subscription["collection_method"];
+                    update["currency"] = subscription["currency"];
+                    update["current_period_start"] = subscription["current_period_start"];
+                    update["current_period_end"] = subscription["current_period_end"];
+                    update["customer"] = subscription["customer"];
+                    update["default_payment_method"] = subscription["default_payment_method"];
+                    update["ended_at"] = subscription["ended_at"];
+                    update["latest_invoice"] = subscription["latest_invoice"];
+                    update["price_id"] = plan["id"];
+                    update["active"] = plan["active"];
+                    update["amount"] = plan["amount"];
+                    update["billing_scheme"] = plan["billing_scheme"];
+                    update["interval"] = plan["interval"];
+                    update["interval_count"] = plan["interval_count"];
+                    update["usage_type"] = plan["usage_type"];
+                    update["quantity"] = subscription["quantity"];
+                    update["start_date"] = subscription["start_date"];
+                    console.log(`Subscription status is ${status}.`);
+                    await store.savePurchase(targetOrderId, update, {
+                        userId: userId || undefined,
+                    });
+                    return c.json({
+                        "success": "Subscription is active.",
+                    });
+                }
+                case "customer.subscription.deleted": {
+                    const subscription = event.data.object as {
+                        [key: string]: any
+                    };
+                    const status = subscription["status"];
+                    const id = subscription["id"];
+                    console.log(`Subscription status is ${status} expired.`);
+                    const existing = id ? await store.findPurchaseBySubscriptionId(id) : null;
+                    if (existing) {
+                        await store.savePurchase(existing.orderId, {
+                            expired: true,
+                            ended_at: subscription["ended_at"],
+                            canceled_at: subscription["canceled_at"],
+                            "@time": new Date(),
+                        });
+                    }
+                    return c.json({
+                        "success": true,
+                    });
+                }
+                default: {
+                    return c.json({
+                        "error": "Event is not found.",
+                    }, 404);
+                }
+            }
+        } catch (err) {
+            return jsonError(c, err);
+        }
+    });
+    return hono;
+};

package/src/workers/stripe_webhook_connect.ts

@@ -0,0 +1,107 @@
+import { Hono } from "hono";
+import { jsonError } from "@mathrunet/masamune_cloudflare/dist/lib/src/http_error";
+import {
+    resolveStripeClient,
+    resolveStripePurchaseStore,
+    resolveStripeSecretKey,
+    resolveStripeWebhookConnectSecret,
+    StripePurchaseWorkersOptions,
+} from "../lib/options";
+import { constructStripeEvent } from "../lib/stripe_client";
+
+/**
+ * Receive and process webhooks for Stripe Connect (parity with the
+ * `stripeWebhookConnect` function of
+ * `@mathrunet/masamune_firebase_purchase_stripe`).
+ * If you do not use Stripe Connect, do not configure it as a Webhook.
+ *
+ * Stripe Connect用のWebhookを受信して処理します
+ * （`@mathrunet/masamune_firebase_purchase_stripe`の`stripeWebhookConnect`と同等）。
+ * Stripe Connectを利用しない場合はWebhookとして設定しないでください。
+ *
+ * @param {string} PURCHASE_STRIPE_SECRETKEY
+ * API key (secret key) to connect to Stripe.
+ * Stripeへ接続するためのAPIキー（シークレットキー）。
+ *
+ * @param {string} PURCHASE_STRIPE_WEBHOOKCONNECTSECRET
+ * Specify the **Signature Secret** after setting it up as a webhook.
+ * Webhookとして設定したあとの**署名シークレット**を指定します。
+ */
+module.exports = (
+    hono: Hono,
+    options: StripePurchaseWorkersOptions,
+    data: { [key: string]: any },
+) => {
+    hono.post("/", async (c) => {
+        try {
+            const apiKey = resolveStripeSecretKey(c, options);
+            const webhookConnectSecret = resolveStripeWebhookConnectSecret(c, options);
+            const store = resolveStripePurchaseStore(c, options);
+            const stripeClient = resolveStripeClient(c, options, apiKey);
+            const signature = c.req.header("stripe-signature");
+            if (!signature || !webhookConnectSecret) {
+                return c.json({
+                    "error": "Access denied.",
+                }, 403);
+            }
+            const payload = await c.req.text();
+            let event;
+            try {
+                event = await constructStripeEvent({
+                    client: stripeClient,
+                    payload,
+                    signature,
+                    secret: webhookConnectSecret,
+                });
+            } catch (err) {
+                console.warn(err);
+                return c.json({
+                    "error": "Access denied.",
+                }, 403);
+            }
+
+            switch (event.type) {
+                case "account.updated": {
+                    const account = event.data.object as {
+                        [key: string]: any
+                    };
+                    const id = account["id"];
+                    if (!id) {
+                        return c.json({
+                            "error": "The account id is not found.",
+                        }, 404);
+                    }
+                    const user = await store.findUserByAccountId(id);
+                    if (!user) {
+                        return c.json({
+                            "error": "The account data is not found.",
+                        }, 404);
+                    }
+                    const update: { [key: string]: any } = {};
+                    if (account["capabilities"]) {
+                        const capability: { [key: string]: any } = {};
+                        if (account["capabilities"]["card_payments"]) {
+                            capability["card_payments"] = true;
+                        }
+                        if (account["capabilities"]["transfers"]) {
+                            capability["transfers"] = true;
+                        }
+                        update["capability"] = capability;
+                    }
+                    await store.saveUser(user.userId, update);
+                    return c.json({
+                        "success": true,
+                    });
+                }
+                default: {
+                    return c.json({
+                        "error": `Event ${event.type} is not found.`,
+                    }, 404);
+                }
+            }
+        } catch (err) {
+            return jsonError(c, err);
+        }
+    });
+    return hono;
+};

package/src/workers/stripe_webhook_secure.ts

@@ -0,0 +1,91 @@
+import { Hono } from "hono";
+import { jsonError } from "@mathrunet/masamune_cloudflare/dist/lib/src/http_error";
+import "@mathrunet/masamune";
+import {
+    resolveStripeClient,
+    resolveStripePurchaseStore,
+    resolveStripeSecretKey,
+    StripePurchaseWorkersOptions,
+} from "../lib/options";
+
+/**
+ * Webhook for proper redirection when 3D Secure authentication is required
+ * (parity with the `stripeWebhookSecure` function of
+ * `@mathrunet/masamune_firebase_purchase_stripe`).
+ * Please set here for `returnUrl`.
+ *
+ * 3Dセキュア認証が必要な場合、適切なリダイレクトを行うためのWebhookです
+ * （`@mathrunet/masamune_firebase_purchase_stripe`の`stripeWebhookSecure`と同等）。
+ * `returnUrl`にこちらを設定してください。
+ *
+ * @param {string} PURCHASE_STRIPE_SECRETKEY
+ * API key (secret key) to connect to Stripe.
+ * Stripeへ接続するためのAPIキー（シークレットキー）。
+ */
+module.exports = (
+    hono: Hono,
+    options: StripePurchaseWorkersOptions,
+    data: { [key: string]: any },
+) => {
+    hono.get("/", async (c) => {
+        try {
+            const apiKey = resolveStripeSecretKey(c, options);
+            const store = resolveStripePurchaseStore(c, options);
+            const stripeClient = resolveStripeClient(c, options, apiKey);
+            const token = c.req.query("token");
+            if (!token || typeof token !== "string") {
+                return c.json({
+                    "error": "Invalid parameters",
+                }, 403);
+            }
+            let param: { [key: string]: any };
+            try {
+                param = JSON.parse(await token.decrypt({
+                    key: apiKey.slice(0, 32),
+                    ivKey: apiKey.slice(-16),
+                }));
+            } catch (err) {
+                return c.json({
+                    "error": "Invalid parameters",
+                }, 403);
+            }
+            if (!param["userId"] || !param["orderId"] || !param["successUrl"] || !param["failureUrl"]) {
+                return c.json({
+                    "error": "Invalid parameters",
+                }, 403);
+            }
+
+            const userId = param["userId"];
+            const orderId = param["orderId"];
+            const successUrl = param["successUrl"];
+            const failureUrl = param["failureUrl"];
+
+            const purchaseDoc = await store.getPurchase(orderId, userId);
+            // Firebase実装は`paymentId`を参照するが、購入作成時に保存されるキーは
+            // `purchaseId`のためそちらを正とし、`paymentId`はフォールバックに残す。
+            const purchaseId = purchaseDoc?.data["purchaseId"] ?? purchaseDoc?.data["paymentId"];
+            if (!purchaseDoc || !purchaseId) {
+                return c.json({
+                    "error": "The purchase data is not found.",
+                }, 404);
+            }
+            const purchase = await stripeClient.paymentIntents.retrieve(
+                purchaseId,
+            );
+            if (!purchase) {
+                return c.json({
+                    "error": "The purchase data is not found.",
+                }, 404);
+            }
+            const status = purchase.status;
+            if (status === "requires_capture" || status === "succeeded" || status === "processing") {
+                return c.redirect(successUrl);
+            } else {
+                return c.redirect(failureUrl);
+            }
+        } catch (err) {
+            return jsonError(c, err);
+        }
+    });
+    return hono;
+};