@umituz/web-payment 0.0.0-stage → 1.0.0

package/src/infrastructure/webhook/parse-event.ts

@@ -0,0 +1,135 @@
+import { toMajorUnits } from '../../domain/utils/minor-units';
+export interface WebhookEvent {
+    type: string;
+    data: Record<string, unknown>;
+}
+export interface CheckoutCompleted {
+    checkoutId: string | null;
+    productId: string | null;
+    customerEmail: string | null;
+    customerName: string | null;
+    amount: number | null;
+    currency: string | null;
+    metadata: Record<string, string>;
+    createdAt: string | null;
+}
+export interface SubscriptionChanged {
+    subscriptionId: string | null;
+    status: string | null;
+    productId: string | null;
+    amount: number | null;
+    currency: string | null;
+    currentPeriodEnd: string | null;
+    cancelAtPeriodEnd: boolean;
+    canceledAt: string | null;
+    endsAt: string | null;
+    customerId: string | null;
+    metadata: Record<string, string>;
+}
+export interface OrderPaid {
+    orderId: string | null;
+    productId: string | null;
+    productName: string | null;
+    amount: number | null;
+    currency: string | null;
+    customerEmail: string | null;
+    metadata: Record<string, string>;
+    createdAt: string | null;
+}
+const SUBSCRIPTION_EVENT_TYPES = new Set([
+    'subscription.active',
+    'subscription.canceled',
+    'subscription.updated',
+    'subscription.uncanceled',
+    'subscription.revoked',
+]);
+function readString(value: unknown): string | null {
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
+function readNumber(value: unknown): number | null {
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
+function readObject(value: unknown): Record<string, unknown> | null {
+    return value !== null && typeof value === 'object' ? (value as Record<string, unknown>) : null;
+}
+function readMetadata(value: unknown): Record<string, string> {
+    const metadata = readObject(value);
+    if (!metadata)
+        return {};
+    return Object.fromEntries(Object.entries(metadata).filter((entry): entry is [string, string] => typeof entry[1] === 'string'));
+}
+export function parseWebhookEvent(rawBody: string): WebhookEvent | null {
+    let parsed: unknown;
+    try {
+        parsed = JSON.parse(rawBody);
+    }
+    catch {
+        return null;
+    }
+    const envelope = readObject(parsed);
+    const type = envelope ? readString(envelope.type) : null;
+    const data = envelope ? readObject(envelope.data) : null;
+    if (!envelope || !type || !data)
+        return null;
+    return { type, data };
+}
+export function asCheckoutCompleted(event: WebhookEvent): CheckoutCompleted | null {
+    if (event.type !== 'checkout.completed')
+        return null;
+    const data = event.data;
+    const product = readObject(data.product);
+    const customer = readObject(data.customer);
+    const minorUnits = readNumber(data.total_amount ?? data.amount);
+    const currency = readString(data.currency);
+    return {
+        checkoutId: readString(data.id),
+        productId: readString(data.product_id) ?? (product ? readString(product.id) : null),
+        customerEmail: readString(data.customer_email) ?? (customer ? readString(customer.email) : null),
+        customerName: readString(data.customer_name) ?? (customer ? readString(customer.name) : null),
+        amount: minorUnits !== null && currency ? toMajorUnits(minorUnits, currency) : null,
+        currency,
+        metadata: readMetadata(data.metadata),
+        createdAt: readString(data.created_at) ?? readString(data.createdAt),
+    };
+}
+export function asSubscriptionChanged(event: WebhookEvent): SubscriptionChanged | null {
+    if (!SUBSCRIPTION_EVENT_TYPES.has(event.type))
+        return null;
+    const data = event.data;
+    const minorUnits = readNumber(data.amount);
+    const currency = readString(data.currency);
+    return {
+        subscriptionId: readString(data.id),
+        status: readString(data.status),
+        productId: readString(data.product_id),
+        amount: minorUnits !== null && currency ? toMajorUnits(minorUnits, currency) : null,
+        currency,
+        currentPeriodEnd: readString(data.current_period_end),
+        cancelAtPeriodEnd: data.cancel_at_period_end === true,
+        canceledAt: readString(data.canceled_at),
+        endsAt: readString(data.ends_at),
+        customerId: readString(data.customer_id),
+        metadata: readMetadata(data.metadata),
+    };
+}
+export function asOrderPaid(event: WebhookEvent): OrderPaid | null {
+    if (event.type !== 'order.paid')
+        return null;
+    const data = event.data;
+    const product = readObject(data.product);
+    const customer = readObject(data.customer);
+    const minorUnits = readNumber(data.amount);
+    const currency = readString(data.currency);
+    return {
+        orderId: readString(data.id),
+        productId: readString(data.product_id) ?? (product ? readString(product.id) : null),
+        productName: readString(data.product_name) ?? (product ? readString(product.name) : null),
+        amount: minorUnits !== null && currency ? toMajorUnits(minorUnits, currency) : null,
+        currency,
+        customerEmail: readString(data.customer_email) ?? (customer ? readString(customer.email) : null),
+        metadata: readMetadata(data.metadata),
+        createdAt: readString(data.created_at) ?? readString(data.paid_at),
+    };
+}
+
+export const parsePolarWebhookEvent = parseWebhookEvent;

package/src/infrastructure/webhook/verify-webhook.ts

@@ -0,0 +1,124 @@
+
+export interface WebhookHeadersLike {
+  get(name: string): string | null | undefined;
+}
+
+const KNOWN_SECRET_PREFIXES = ['whsec_'] as const;
+
+function headerValue(
+  headers: WebhookHeadersLike | Record<string, string>,
+  name: string,
+): string | undefined {
+  if (typeof headers.get === 'function') {
+    const value = headers.get(name);
+    return value ?? undefined;
+  }
+  const record = headers as Record<string, string>;
+  return record[name] ?? record[name.toLowerCase()];
+}
+
+function stripSecretPrefix(secret: string): string {
+  for (const prefix of KNOWN_SECRET_PREFIXES) {
+    if (secret.startsWith(prefix)) return secret.slice(prefix.length);
+  }
+  return secret;
+}
+
+function base64ToBytes(value: string): Uint8Array | null {
+  try {
+    const normalized = value.replace(/-/g, '+').replace(/_/g, '/');
+    const binary = atob(normalized);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+    return bytes;
+  } catch {
+    return null;
+  }
+}
+
+function encodeUtf8(value: string): Uint8Array {
+  return new TextEncoder().encode(value);
+}
+
+async function hmacSha256(keyBytes: Uint8Array, payload: string): Promise<string> {
+  const cryptoRef = globalThis.crypto;
+  if (!cryptoRef?.subtle) {
+    throw new Error('WebCrypto (crypto.subtle) is not available in this runtime');
+  }
+  const key = await cryptoRef.subtle.importKey(
+    'raw',
+    keyBytes as BufferSource,
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  );
+  const signature = await cryptoRef.subtle.sign('HMAC', key, encodeUtf8(payload) as BufferSource);
+  const bytes = new Uint8Array(signature);
+  let binary = '';
+  for (let i = 0; i < bytes.length; i += 1) binary += String.fromCharCode(bytes[i]);
+  return btoa(binary);
+}
+
+function keyCandidates(secret: string): Uint8Array[] {
+  const stripped = stripSecretPrefix(secret);
+  const decoded = base64ToBytes(stripped);
+  const candidates: Uint8Array[] = [];
+  if (decoded && decoded.length > 0) candidates.push(decoded);
+  const raw = encodeUtf8(secret);
+  if (raw.length > 0) candidates.push(raw);
+  const rawStripped = encodeUtf8(stripped);
+  if (rawStripped.length > 0 && rawStripped.length !== raw.length) candidates.push(rawStripped);
+  return candidates;
+}
+
+function signaturesFromHeader(header: string): string[] {
+  return header
+    .split(',')
+    .map((part) => part.trim())
+    .filter((part) => part.length > 0)
+    .map((part) => (part.startsWith('v1,') ? part.slice(3) : part));
+}
+
+export const DEFAULT_WEBHOOK_TOLERANCE_MS = 5 * 60 * 1000;
+
+export interface VerifyWebhookOptions {
+  toleranceMs?: number;
+}
+
+export async function verifyWebhook(
+  rawBody: string,
+  headers: WebhookHeadersLike | Record<string, string>,
+  secret: string,
+  options: VerifyWebhookOptions = {},
+): Promise<boolean> {
+  const id = headerValue(headers, 'webhook-id');
+  const timestamp = headerValue(headers, 'webhook-timestamp');
+  const signatureHeader = headerValue(headers, 'webhook-signature');
+  if (!id || !timestamp || !signatureHeader || !secret) return false;
+
+  if (options.toleranceMs !== undefined) {
+    const age = Math.abs(Date.now() - Number(timestamp) * 1000);
+    if (!Number.isFinite(age) || age > options.toleranceMs) return false;
+  }
+
+  const expectedSignatures = signaturesFromHeader(signatureHeader);
+  if (expectedSignatures.length === 0) return false;
+
+  const payload = `${id}.${timestamp}.${rawBody}`;
+  for (const key of keyCandidates(secret)) {
+    const computed = await hmacSha256(key, payload);
+    for (const expected of expectedSignatures) {
+      if (timingSafeEqual(computed, expected)) return true;
+    }
+  }
+  return false;
+}
+
+function timingSafeEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i += 1) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return mismatch === 0;
+}
+
+export const verifyPolarWebhook = verifyWebhook;

package/src/memory.ts

@@ -0,0 +1,3 @@
+
+export { createMemoryBillingAdapter } from './infrastructure/services/memory/create-memory-adapter';
+export type { MemoryAdapterConfig } from './infrastructure/services/memory/create-memory-adapter';

package/src/portal.ts

@@ -0,0 +1,2 @@
+
+export * from './presentation/portal';

package/src/presentation/components/BillingHistoryList.tsx

@@ -0,0 +1,172 @@
+
+import { useEffect, useState, useCallback, useMemo } from 'react';
+import type { OrderItem } from '../../domain/entities/order.entity';
+import { useBilling } from '../context/billing-context';
+import { MoneyFormatter } from '../../infrastructure/utils/money-formatter';
+import { DateRenderer } from '../../infrastructure/utils/date-renderer';
+import { VisualTokens } from '../theme/visual-tokens';
+
+export interface BillingHistoryListProps {
+  autoLoad?: boolean;
+  orders?: OrderItem[];
+  loading?: boolean;
+  locale?: string;
+  labels?: BillingHistoryListLabels;
+}
+
+export interface BillingHistoryListLabels {
+  loading?: string;
+  empty?: string;
+  refresh?: string;
+  retry?: string;
+  paid?: string;
+  invoiceLink?: string;
+  invoiceFallback?: string;
+  colDate?: string;
+  colProduct?: string;
+  colStatus?: string;
+  colAmount?: string;
+  colInvoice?: string;
+}
+
+const DEFAULT_LABELS: Required<BillingHistoryListLabels> = Object.freeze({
+  loading: 'Loading billing history…',
+  empty: 'No invoices yet.',
+  refresh: 'Refresh',
+  retry: 'Retry',
+  paid: 'Paid',
+  invoiceLink: 'View',
+  invoiceFallback: '—',
+  colDate: 'Date',
+  colProduct: 'Product',
+  colStatus: 'Status',
+  colAmount: 'Amount',
+  colInvoice: 'Invoice',
+});
+
+export function BillingHistoryList({
+  autoLoad = true,
+  orders: ordersOverride,
+  loading: loadingOverride,
+  locale,
+  labels,
+}: BillingHistoryListProps) {
+  const { getBillingHistory } = useBilling();
+  const [orders, setOrders] = useState<OrderItem[]>(ordersOverride ?? []);
+  const [loading, setLoading] = useState(autoLoad && ordersOverride === undefined);
+  const [error, setError] = useState<string | null>(null);
+
+  const moneyFormatter = useMemo(() => new MoneyFormatter(locale), [locale]);
+  const dateRenderer = useMemo(() => new DateRenderer(locale), [locale]);
+  const text = useMemo(
+    () => ({ ...DEFAULT_LABELS, ...labels }),
+    [labels],
+  );
+
+  const refresh = useCallback(async (): Promise<void> => {
+    setLoading(true);
+    setError(null);
+    try {
+      const next = await getBillingHistory();
+      setOrders(next);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Failed to load billing history');
+    } finally {
+      setLoading(false);
+    }
+  }, [getBillingHistory]);
+
+  useEffect(() => {
+    if (autoLoad && ordersOverride === undefined) {
+      void refresh();
+    }
+  }, [autoLoad, ordersOverride, refresh]);
+
+  if (ordersOverride !== undefined && ordersOverride.length > 0) {
+    return renderList(ordersOverride, moneyFormatter, dateRenderer, text);
+  }
+  if (loadingOverride !== undefined && loadingOverride) {
+    return <div role="status">{text.loading}</div>;
+  }
+
+  if (loading) {
+    return <div role="status">{text.loading}</div>;
+  }
+
+  if (error) {
+    return (
+      <div
+        role="alert"
+        style={{
+          background: VisualTokens.color.surfaceDanger,
+          padding: VisualTokens.spacing.lg,
+          borderRadius: VisualTokens.radius.md,
+        }}
+      >
+        {error}{' '}
+        <button type="button" onClick={() => void refresh()}>
+          {text.retry}
+        </button>
+      </div>
+    );
+  }
+
+  if (orders.length === 0) {
+    return <div style={{ color: VisualTokens.color.textMuted }}>{text.empty}</div>;
+  }
+
+  return (
+    <div>
+      <div style={{ marginBottom: VisualTokens.spacing.md }}>
+        <button type="button" onClick={() => void refresh()}>
+          {text.refresh}
+        </button>
+      </div>
+      {renderList(orders, moneyFormatter, dateRenderer, text)}
+    </div>
+  );
+}
+
+function renderList(
+  orders: OrderItem[],
+  moneyFormatter: MoneyFormatter,
+  dateRenderer: DateRenderer,
+  text: Required<BillingHistoryListLabels>,
+) {
+  return (
+    <table style={{ width: '100%', borderCollapse: 'collapse' }}>
+      <thead>
+        <tr style={{ textAlign: 'left', borderBottom: `1px solid ${VisualTokens.color.borderSubtle}` }}>
+          <th style={{ padding: VisualTokens.spacing.md }}>{text.colDate}</th>
+          <th style={{ padding: VisualTokens.spacing.md }}>{text.colProduct}</th>
+          <th style={{ padding: VisualTokens.spacing.md }}>{text.colStatus}</th>
+          <th style={{ padding: VisualTokens.spacing.md }}>{text.colAmount}</th>
+          <th style={{ padding: VisualTokens.spacing.md }}>{text.colInvoice}</th>
+        </tr>
+      </thead>
+      <tbody>
+        {orders.map((order) => (
+          <tr key={order.id} style={{ borderBottom: `1px solid ${VisualTokens.color.surfaceSubtle}` }}>
+            <td style={{ padding: VisualTokens.spacing.md }}>{dateRenderer.short(order.createdAt)}</td>
+            <td style={{ padding: VisualTokens.spacing.md }}>{order.productName}</td>
+            <td style={{ padding: VisualTokens.spacing.md }}>
+              {order.paid ? text.paid : order.status}
+            </td>
+            <td style={{ padding: VisualTokens.spacing.md }}>
+              {moneyFormatter.format(order.amount, order.currency)}
+            </td>
+            <td style={{ padding: VisualTokens.spacing.md }}>
+              {order.invoiceUrl ? (
+                <a href={order.invoiceUrl} target="_blank" rel="noreferrer">
+                  {text.invoiceLink}
+                </a>
+              ) : (
+                text.invoiceFallback
+              )}
+            </td>
+          </tr>
+        ))}
+      </tbody>
+    </table>
+  );
+}

package/src/presentation/components/BillingProvider.tsx

@@ -0,0 +1,179 @@
+
+import {
+  useCallback,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+  type ReactNode,
+} from 'react';
+import type { BillingAdapter } from '../../domain/interfaces';
+import type {
+  CancellationReason,
+  CancelResult,
+  CheckoutParams,
+  OrderItem,
+  SubscriptionStatus,
+  SyncResult,
+} from '../../domain/entities';
+import { FREE_SUBSCRIPTION_STATUS } from '../../domain/entities/subscription.entity';
+import {
+  isProductionInsecureUrl,
+  isValidCheckoutUrl,
+} from '../../infrastructure/utils/security.util';
+import { isValidProductId } from '../../infrastructure/utils/validation.util';
+import { normalizeUserId } from '../../infrastructure/utils/validation.util';
+import {
+  NoopNavigationStrategy,
+  type NavigationStrategy,
+} from '../navigation/navigation.strategy';
+import { BillingContext, type BillingContextValue } from '../context/billing-context';
+
+export interface BillingProviderProps {
+  adapter: BillingAdapter;
+  userId?: string;
+  navigation?: NavigationStrategy;
+  children: ReactNode;
+}
+
+function defaultNavigation(): NavigationStrategy {
+  if (typeof window === 'undefined') return new NoopNavigationStrategy();
+  return {
+    redirect(url: string): void {
+      window.location.href = url;
+    },
+  };
+}
+
+export function BillingProvider({
+  adapter,
+  userId,
+  navigation,
+  children,
+}: BillingProviderProps) {
+  const [status, setStatus] = useState<SubscriptionStatus>(FREE_SUBSCRIPTION_STATUS);
+  const [loading, setLoading] = useState(true);
+
+  const adapterRef = useRef(adapter);
+  const userIdRef = useRef(normalizeUserId(userId));
+  const navigationRef = useRef<NavigationStrategy>(navigation ?? defaultNavigation());
+  const refreshGenerationRef = useRef(0);
+
+  adapterRef.current = adapter;
+  userIdRef.current = normalizeUserId(userId);
+  navigationRef.current = navigation ?? navigationRef.current;
+
+  const refresh = useCallback(async (): Promise<void> => {
+    const generation = ++refreshGenerationRef.current;
+    const uid = userIdRef.current;
+    if (!uid) {
+      setStatus(FREE_SUBSCRIPTION_STATUS);
+      setLoading(false);
+      return;
+    }
+
+    setLoading(true);
+    try {
+      const next = await adapterRef.current.getStatus(uid);
+      if (generation !== refreshGenerationRef.current) return;
+      setStatus(next);
+    } catch {
+      if (generation !== refreshGenerationRef.current) return;
+      setStatus(FREE_SUBSCRIPTION_STATUS);
+    } finally {
+      if (generation === refreshGenerationRef.current) {
+        setLoading(false);
+      }
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+  }, [userId, refresh]);
+
+  const startCheckout = useCallback(async (params: CheckoutParams): Promise<void> => {
+    if (!isValidProductId(params.productId)) {
+      throw new Error('[billing] Invalid productId: must be a non-empty string');
+    }
+    const uid = userIdRef.current;
+    if (!uid) {
+      throw new Error('[billing] Cannot start checkout: no authenticated user');
+    }
+
+    const result = await adapterRef.current.createCheckout({ ...params, userId: uid });
+    if (!isValidCheckoutUrl(result.url)) {
+      throw new Error('[billing] Invalid checkout URL: must start with https:// or http://');
+    }
+    if (isProductionInsecureUrl(result.url)) {
+      throw new Error('[billing] Insecure http:// checkout URL in production');
+    }
+
+    navigationRef.current.redirect(result.url);
+  }, []);
+
+  const syncSubscription = useCallback(async (): Promise<SyncResult> => {
+    const uid = userIdRef.current;
+    if (!uid) return { synced: false };
+
+    const checkoutId =
+      typeof window !== 'undefined'
+        ? new URLSearchParams(window.location.search).get('checkout_id') ?? undefined
+        : undefined;
+
+    const result = await adapterRef.current.syncSubscription(uid, checkoutId);
+    if (result.synced) {
+      await refresh();
+    }
+    return result;
+  }, [refresh]);
+
+  const getBillingHistory = useCallback(async (): Promise<OrderItem[]> => {
+    const uid = userIdRef.current;
+    if (!uid) return [];
+    return adapterRef.current.getBillingHistory(uid);
+  }, []);
+
+  const cancelSubscription = useCallback(
+    async (reason?: CancellationReason): Promise<CancelResult> => {
+      const result = await adapterRef.current.cancelSubscription(reason);
+      if (result.success) {
+        await refresh();
+      }
+      return result;
+    },
+    [refresh],
+  );
+
+  const getPortalUrl = useCallback(async (): Promise<string> => {
+    const uid = userIdRef.current;
+    if (!uid) {
+      throw new Error('[billing] Cannot get portal URL: no authenticated user');
+    }
+    return adapterRef.current.getPortalUrl(uid);
+  }, []);
+
+  const value = useMemo<BillingContextValue>(
+    () => ({
+      status,
+      loading,
+      refresh,
+      startCheckout,
+      syncSubscription,
+      getBillingHistory,
+      cancelSubscription,
+      getPortalUrl,
+    }),
+    [
+      status,
+      loading,
+      refresh,
+      startCheckout,
+      syncSubscription,
+      getBillingHistory,
+      cancelSubscription,
+      getPortalUrl,
+    ],
+  );
+
+  return <BillingContext.Provider value={value}>{children}</BillingContext.Provider>;
+}