@stratacommerce/stripe-connect 0.1.0 → 0.1.1

package/dist/enrollments.js

@@ -53,7 +53,8 @@ export function createEnrollments(ctx) {
             if (!parsed.success)
                 throw new AppError('Use a current payment challenge from Hub', 'PAYMENT_CHALLENGE_INVALID', 400);
             const value = parsed.data, expiry = Date.parse(value.expiresAt);
-            if (expiry <= Date.now() || expiry > Date.now() + 300000 || !Object.keys(value.publicKeys).length)
+            // A challenge lasts at most five minutes on the Hub's clock, which may run a minute ahead of this one.
+            if (expiry <= Date.now() || expiry > Date.now() + 300000 + 60000 || !Object.keys(value.publicKeys).length)
                 throw new AppError('Use a current payment challenge from Hub', 'PAYMENT_CHALLENGE_INVALID', 400);
             assertConnectLink(value.scope, link, ctx.environment);
             for (const pem of Object.values(value.publicKeys)) {

package/dist/index.js

@@ -14,7 +14,7 @@ export default defineExtension({
     manifest: {
         id: 'stripe-connect',
         name: 'Stripe Connect',
-        version: '0.1.0',
+        version: '0.1.1',
         apiVersion: '^1.0.0',
         category: 'payment',
         description: 'Card payments through Strata Hub’s Stripe Connect platform. Needs a store linked to Strata Hub.',

package/dist/provider.d.ts

@@ -5,7 +5,9 @@ export declare class ConnectHubClient {
     readonly origin: string;
     private token;
     private transport;
-    constructor(origin: string, token: string, transport?: typeof fetch);
+    private revoked?;
+    /** `revoked` runs when the Hub no longer knows the token, as after a disconnect in the Hub. */
+    constructor(origin: string, token: string, transport?: typeof fetch, revoked?: (() => Promise<unknown>) | undefined);
     request(path: string, body?: unknown): Promise<unknown>;
 }
 export interface ConnectServices {

package/dist/provider.js

@@ -1,40 +1,72 @@
 import { isDeepStrictEqual } from 'node:util';
 import { and, eq } from 'drizzle-orm';
+import { z } from 'zod';
 import { AppError } from '@stratacommerce/extension-sdk';
 import { connectConfigurationSchema, connectFactsPageSchema, connectFactsAckResultSchema, CONNECT_API_BASE, CONNECT_API_PATHS, connectOperationResultSchema, connectPath } from '@stratacommerce/hub-protocol';
 import { CONNECT_PROVIDER, connectIdentity, connectScopeOf } from './identity.js';
 import { enrollments, financialFacts } from './schema.js';
+// The Hub's payment error codes pass through to the admin and storefront.
+// Its messages don't, so nothing the Hub echoes reaches them.
+const hubErrorSchema = z.object({ error: z.object({ code: z.string().regex(/^PAYMENT_[A-Z_]{1,64}$/) }) });
+async function hubError(response) {
+    const bytes = await response.text().catch(() => '');
+    try {
+        return bytes.length <= 16384 ? hubErrorSchema.safeParse(JSON.parse(bytes)).data?.error.code : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 // Core never calls Stripe. The Hub holds the platform key; this provider
 // calls the Hub's Connect API with the enrollment's payment client token.
 export class ConnectHubClient {
     origin;
     token;
     transport;
-    constructor(origin, token, transport = fetch) {
+    revoked;
+    /** `revoked` runs when the Hub no longer knows the token, as after a disconnect in the Hub. */
+    constructor(origin, token, transport = fetch, revoked) {
         this.origin = origin;
         this.token = token;
         this.transport = transport;
+        this.revoked = revoked;
     }
     async request(path, body) {
         if (!path.startsWith(`${CONNECT_API_BASE}/`) || !/^[a-zA-Z0-9/?=&%_.-]+$/.test(path) || new URL(path, this.origin).origin !== this.origin)
             throw new AppError('Invalid payment service path', 'PAYMENT_SCOPE_INVALID', 400);
+        let response;
         try {
-            const response = await this.transport(`${this.origin}${path}`, { method: body === undefined ? 'GET' : 'POST', headers: { Authorization: `Bearer ${this.token}`, ...(body === undefined ? {} : { 'Content-Type': 'application/json' }) },
+            response = await this.transport(`${this.origin}${path}`, { method: body === undefined ? 'GET' : 'POST', headers: { Authorization: `Bearer ${this.token}`, ...(body === undefined ? {} : { 'Content-Type': 'application/json' }) },
                 ...(body === undefined ? {} : { body: JSON.stringify(body) }), redirect: 'error', cache: 'no-store', signal: AbortSignal.timeout(15000) });
-            if (!response.ok)
-                throw new AppError('Strata payment service is unavailable; retry this payment operation', response.status === 409 ? 'PAYMENT_AUTHORIZATION_UNAVAILABLE' : 'PAYMENT_UNAVAILABLE', response.status >= 500 ? 503 : 409);
+        }
+        catch {
+            throw new AppError('Strata payment service is unavailable; retry this payment operation', 'PAYMENT_UNAVAILABLE', 503);
+        }
+        if (!response.ok) {
+            const code = await hubError(response), retry = response.status >= 500 || response.status === 429;
+            if (response.status === 401 && code === 'PAYMENT_CLIENT_INVALID') {
+                await this.revoked?.();
+                throw new AppError('Strata Hub disconnected this payment account. Reconnect payments in Strata Hub.', 'PAYMENT_AUTHORIZATION_REVOKED', 409);
+            }
+            if (retry)
+                throw new AppError('Strata payment service is unavailable; retry this payment operation', code ?? 'PAYMENT_UNAVAILABLE', 503);
+            throw new AppError('Strata payment service refused this payment operation', code ?? (response.status === 409 ? 'PAYMENT_AUTHORIZATION_UNAVAILABLE' : 'PAYMENT_UNAVAILABLE'), 409);
+        }
+        try {
             const bytes = await response.text();
             if (bytes.length > 1048576)
                 throw Error();
             return JSON.parse(bytes);
         }
-        catch (error) {
-            if (error instanceof AppError)
-                throw error;
+        catch {
             throw new AppError('Strata payment service is unavailable; retry this payment operation', 'PAYMENT_UNAVAILABLE', 503);
         }
     }
 }
+/** A Hub client with an enrollment's credentials. When the Hub has revoked the client, core revokes the enrollment too. */
+function enrolledClient(enrollments, enrollment) {
+    return new ConnectHubClient(enrollment.scope.hubOrigin, enrollment.token, fetch, () => enrollments.revoke(enrollment.id));
+}
 export class ConnectPaymentProvider {
     services;
     identity;
@@ -58,7 +90,7 @@ export class ConnectPaymentProvider {
         const enrollment = await this.services.enrollments.credentials(this.recipientId);
         if (enrollment.id !== this.identity.connectionId && !enrollment.recoveryBindingIds.includes(this.identity.connectionId))
             throw new AppError('Historical payment recovery was not approved', 'PAYMENT_SCOPE_INVALID', 409);
-        return new ConnectHubClient(enrollment.scope.hubOrigin, enrollment.token);
+        return enrolledClient(this.services.enrollments, enrollment);
     }
     async original(paymentIntentId) {
         const rows = await this.services.ctx.payments.attemptsForSession(paymentIntentId);
@@ -162,7 +194,7 @@ export function connectRegistration(services) {
                 return null;
             const scope = connectScopeOf(provider.identity);
             const enrollment = await services.enrollments.credentials(provider.identity.connectionId);
-            const publicConfig = connectConfigurationSchema.safeParse(await new ConnectHubClient(enrollment.scope.hubOrigin, enrollment.token).request(CONNECT_API_PATHS.configuration));
+            const publicConfig = connectConfigurationSchema.safeParse(await enrolledClient(services.enrollments, enrollment).request(CONNECT_API_PATHS.configuration));
             if (!publicConfig.success || !isDeepStrictEqual(publicConfig.data.scope, scope))
                 return null;
             return { publishableKey: publicConfig.data.publishableKey, stripeAccount: provider.accountId, livemode: scope.livemode };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratacommerce/stripe-connect",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Card payments through Strata Hub’s Stripe Connect platform, as a StrataCommerce payment extension.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
     "@stripe/react-stripe-js": "^6.1.0",
     "@stripe/stripe-js": "^9.1.0",
     "zod": "^3",
-    "@stratacommerce/extension-sdk": "^1.0.0",
-    "@stratacommerce/hub-protocol": "^0.1.0"
+    "@stratacommerce/hub-protocol": "^0.1.0",
+    "@stratacommerce/extension-sdk": "^1.0.0"
   },
   "peerDependencies": {
     "drizzle-orm": ">=0.39 <1",