cabloy 5.1.134 → 5.1.136

package/vona/src/suite-vendor/a-pay/modules/pay-stripe/src/bean/payProvider.stripe.ts

@@ -11,14 +11,20 @@ import type {
   IPayProviderWebhookInput,
 } from 'vona-module-a-pay';
 
+import Stripe from 'stripe';
 import { BeanBase, useApp } from 'vona';
-import { PayProvider } from 'vona-module-a-pay';
+import { PayProvider, ProviderOperationFailure } from 'vona-module-a-pay';
+
+import type { IStripeGateway, IStripeGatewayOptions } from '../lib/stripeGateway.ts';
+
+import { createStripeGateway, StripeGatewayError } from '../lib/stripeGateway.ts';
 
 export interface IPayProviderStripeClientRecord extends IPayProviderClientRecord {}
 
 export interface IPayProviderStripeClientOptions extends IPayProviderClientOptions {
   secretCredential: string | undefined;
   secretWebhook: string | undefined;
+  gateway?: IStripeGateway;
 }
 
 const app = useApp();
@@ -31,8 +37,8 @@ export interface IPayProviderOptionsStripe extends IDecoratorPayProviderOptions<
 @PayProvider<IPayProviderOptionsStripe>({
   base: {
     capabilities: {
-      redirectCheckout: false,
-      embeddedCheckout: true,
+      redirectCheckout: true,
+      embeddedCheckout: false,
       automaticCapture: true,
       manualCapture: false,
       refunds: true,
@@ -42,9 +48,10 @@ export interface IPayProviderOptionsStripe extends IDecoratorPayProviderOptions<
   },
   clients: {
     default: {
-      environment: 'sandbox',
+      environment: app.meta.env.STRIPE_ENVIRONMENT as 'sandbox' | 'live',
       secretCredential: app.meta.env.STRIPE_SECRET_KEY,
       secretWebhook: app.meta.env.STRIPE_WEBHOOK_SECRET,
+      merchantReference: app.meta.env.STRIPE_MERCHANT_REFERENCE,
     },
   },
 })
@@ -53,43 +60,472 @@ export class PayProviderStripe
   implements IPayProviderExecute<IPayProviderStripeClientOptions>
 {
   async startPayment(
-    _input: IPayProviderPaymentInput,
-    _clientOptions: IPayProviderStripeClientOptions,
+    input: IPayProviderPaymentInput,
+    clientOptions: IPayProviderStripeClientOptions,
   ): Promise<IPayProviderPaymentSnapshot> {
-    this.app.throw(501, 'Stripe provider is not implemented');
+    if (input.providerOrderId) return await this.queryPayment(input, clientOptions);
+    if (!input.returnUrl || !input.cancelUrl) {
+      this.app.throw(500, 'Stripe payment requires return and cancel URLs');
+    }
+    const gatewayOptions = this._gatewayOptions(clientOptions);
+    assertStripeMoney(input.amountMinor, input.currency);
+    const body = {
+      mode: 'payment',
+      success_url: input.returnUrl,
+      cancel_url: input.cancelUrl,
+      client_reference_id: input.providerCorrelationReference,
+      metadata: this._paymentMetadata(input),
+      payment_intent_data: { metadata: this._paymentMetadata(input) },
+      managed_payments: { enabled: false },
+      line_items: [
+        {
+          quantity: 1,
+          price_data: {
+            currency: input.currency.toLowerCase(),
+            unit_amount: input.amountMinor,
+            product_data: { name: `Payment ${input.providerInvoiceReference}` },
+          },
+        },
+      ],
+    } satisfies Stripe.Checkout.SessionCreateParams;
+    let checkoutSession: unknown;
+    try {
+      checkoutSession = await this._gateway(clientOptions).createCheckoutSession(gatewayOptions, {
+        idempotencyKey: input.idempotencyKey,
+        body,
+      });
+    } catch (error) {
+      this._throwTerminalPaymentFailure(error);
+    }
+    return this._mapCheckoutSession(checkoutSession, input, clientOptions, true);
   }
 
   async confirmPayment(
-    _input: IPayProviderPaymentInput,
-    _clientOptions: IPayProviderStripeClientOptions,
+    input: IPayProviderPaymentInput,
+    clientOptions: IPayProviderStripeClientOptions,
   ): Promise<IPayProviderPaymentSnapshot> {
-    this.app.throw(501, 'Stripe provider is not implemented');
+    return await this.queryPayment(input, clientOptions);
   }
 
   async queryPayment(
-    _input: IPayProviderPaymentInput,
-    _clientOptions: IPayProviderStripeClientOptions,
+    input: IPayProviderPaymentInput,
+    clientOptions: IPayProviderStripeClientOptions,
   ): Promise<IPayProviderPaymentSnapshot> {
-    this.app.throw(501, 'Stripe provider is not implemented');
+    const gatewayOptions = this._gatewayOptions(clientOptions);
+    if (!input.providerOrderId) this.app.throw(409, 'Stripe payment has no Checkout Session');
+    const checkoutSession = await this._gateway(clientOptions).retrieveCheckoutSession(
+      gatewayOptions,
+      { id: input.providerOrderId },
+    );
+    return this._mapCheckoutSession(checkoutSession, input, clientOptions);
   }
 
   async createRefund(
-    _input: IPayProviderRefundInput,
-    _clientOptions: IPayProviderStripeClientOptions,
+    input: IPayProviderRefundInput,
+    clientOptions: IPayProviderStripeClientOptions,
+  ): Promise<IPayProviderRefundSnapshot> {
+    const gatewayOptions = this._gatewayOptions(clientOptions);
+    assertStripeMoney(input.amountMinor, input.currency);
+    try {
+      const refund = await this._gateway(clientOptions).createRefund(gatewayOptions, {
+        idempotencyKey: input.idempotencyKey,
+        body: {
+          payment_intent: input.providerCaptureId,
+          amount: input.amountMinor,
+          metadata: this._refundMetadata(input),
+        },
+      });
+      return this._mapRefund(refund, input);
+    } catch (error) {
+      if (this._isDefinitiveRefundRejection(error)) return { state: 'failed' };
+      throw error;
+    }
+  }
+
+  async queryRefund(
+    input: IPayProviderRefundInput,
+    clientOptions: IPayProviderStripeClientOptions,
   ): Promise<IPayProviderRefundSnapshot> {
-    this.app.throw(501, 'Stripe provider is not implemented');
+    const gatewayOptions = this._gatewayOptions(clientOptions);
+    if (!input.providerRefundId)
+      this.app.throw(409, 'Stripe refund has no provider refund identifier');
+    const refund = await this._gateway(clientOptions).retrieveRefund(gatewayOptions, {
+      id: input.providerRefundId,
+    });
+    return this._mapRefund(refund, input);
   }
 
   async verifyWebhook(
-    _input: IPayProviderWebhookInput,
-    _clientOptions: IPayProviderStripeClientOptions,
+    input: IPayProviderWebhookInput,
+    clientOptions: IPayProviderStripeClientOptions,
+  ): Promise<IPayProviderVerifiedWebhook> {
+    const gatewayOptions = this._gatewayOptions(clientOptions);
+    let event: Record<string, unknown>;
+    try {
+      event = asRecord(
+        await this._gateway(clientOptions).constructWebhookEvent(gatewayOptions, input),
+      );
+    } catch (error) {
+      this._throwGatewayError(error);
+    }
+    const eventId = readString(event.id);
+    const eventType = readString(event.type);
+    const resource = asRecord(asRecord(event.data).object);
+    if (!eventId || !eventType || !Object.keys(resource).length) {
+      this.app.throw(400, 'Stripe webhook is invalid');
+    }
+    if (eventType.startsWith('checkout.session.')) {
+      return await this._mapCheckoutWebhook(eventId, eventType, resource, clientOptions);
+    }
+    if (eventType.startsWith('payment_intent.')) {
+      return await this._mapPaymentIntentWebhook(eventId, eventType, resource);
+    }
+    if (eventType.startsWith('refund.')) {
+      return await this._mapRefundWebhook(eventId, eventType, resource);
+    }
+    return { eventId, eventType, ignored: true, summary: { amountMinor: 0, currency: 'USD' } };
+  }
+
+  private async _mapCheckoutWebhook(
+    eventId: string,
+    eventType: string,
+    checkoutSession: Record<string, unknown>,
+    clientOptions: IPayProviderStripeClientOptions,
+  ): Promise<IPayProviderVerifiedWebhook> {
+    const input = await this._inputFromCheckoutSession(checkoutSession);
+    const payment = await this._mapCheckoutSession(checkoutSession, input, clientOptions);
+    if (eventType === 'checkout.session.async_payment_failed') {
+      return {
+        eventId,
+        eventType,
+        paymentSessionId: input.paymentSessionId,
+        payment: { ...payment, state: 'failed' },
+        summary: { amountMinor: input.amountMinor, currency: input.currency },
+      };
+    }
+    if (!['succeeded', 'failed', 'cancelled'].includes(payment.state)) {
+      return {
+        eventId,
+        eventType,
+        ignored: true,
+        summary: { amountMinor: input.amountMinor, currency: input.currency },
+      };
+    }
+    return {
+      eventId,
+      eventType,
+      paymentSessionId: input.paymentSessionId,
+      payment,
+      summary: { amountMinor: input.amountMinor, currency: input.currency },
+    };
+  }
+
+  private async _mapPaymentIntentWebhook(
+    eventId: string,
+    eventType: string,
+    paymentIntent: Record<string, unknown>,
   ): Promise<IPayProviderVerifiedWebhook> {
-    this.app.throw(501, 'Stripe provider is not implemented');
+    const metadata = asRecord(paymentIntent.metadata);
+    const providerCorrelationReference = readString(metadata.providerCorrelationReference);
+    const providerInvoiceReference = readString(metadata.providerInvoiceReference);
+    if (!providerCorrelationReference || !providerInvoiceReference) {
+      this.app.throw(400, 'Stripe PaymentIntent webhook is not correlated');
+    }
+    const session = await this.$scope.pay.model.paymentSession.get({
+      providerCorrelationReference,
+    });
+    if (!session || session.providerInvoiceReference !== providerInvoiceReference) {
+      this.app.throw(400, 'Stripe PaymentIntent webhook is not correlated');
+    }
+    const payment = this._mapPaymentIntent(paymentIntent, {
+      paymentSessionId: session.id,
+      businessReference: session.businessReference,
+      providerInvoiceReference: session.providerInvoiceReference,
+      providerCorrelationReference: session.providerCorrelationReference,
+      idempotencyKey: '',
+      amountMinor: session.amountMinor,
+      currency: session.currency,
+      providerOrderId: session.providerOrderId,
+    });
+    const terminalPayment =
+      eventType === 'payment_intent.payment_failed'
+        ? { ...payment, state: 'failed' as const }
+        : payment;
+    if (!['succeeded', 'failed', 'cancelled'].includes(terminalPayment.state)) {
+      return {
+        eventId,
+        eventType,
+        ignored: true,
+        summary: { amountMinor: session.amountMinor, currency: session.currency },
+      };
+    }
+    return {
+      eventId,
+      eventType,
+      paymentSessionId: session.id,
+      payment: terminalPayment,
+      summary: { amountMinor: session.amountMinor, currency: session.currency },
+    };
+  }
+
+  private async _mapRefundWebhook(
+    eventId: string,
+    eventType: string,
+    refundResource: Record<string, unknown>,
+  ): Promise<IPayProviderVerifiedWebhook> {
+    const refundId = readString(refundResource.id);
+    const metadata = asRecord(refundResource.metadata);
+    const providerCorrelationReference = readString(metadata.providerCorrelationReference);
+    if (!refundId || !providerCorrelationReference) {
+      this.app.throw(400, 'Stripe refund webhook is not correlated');
+    }
+    const refund = await this.$scope.pay.model.refundOperation.get({
+      providerCorrelationReference,
+    });
+    if (!refund) this.app.throw(400, 'Stripe refund webhook is not correlated');
+    const session = await this.$scope.pay.model.paymentSession.getById(refund.paymentSessionId);
+    if (!session?.providerCaptureId) this.app.throw(409, 'Stripe refund webhook payment conflicts');
+    const snapshot = this._mapRefund(refundResource, {
+      paymentSessionId: session.id,
+      refundOperationId: refund.id,
+      businessReference: refund.businessReference,
+      providerInvoiceReference: refund.providerInvoiceReference,
+      providerCorrelationReference: refund.providerCorrelationReference,
+      idempotencyKey: '',
+      amountMinor: refund.amountMinor,
+      currency: refund.currency,
+      providerCaptureId: session.providerCaptureId,
+      providerRefundId: refundId,
+    });
+    return {
+      eventId,
+      eventType,
+      refundOperationId: refund.id,
+      refund: snapshot,
+      summary: { amountMinor: refund.amountMinor, currency: refund.currency },
+    };
+  }
+
+  private async _inputFromCheckoutSession(
+    checkoutSession: Record<string, unknown>,
+  ): Promise<IPayProviderPaymentInput> {
+    const metadata = asRecord(checkoutSession.metadata);
+    const providerCorrelationReference = readString(metadata.providerCorrelationReference);
+    const providerInvoiceReference = readString(metadata.providerInvoiceReference);
+    const providerOrderId = readString(checkoutSession.id);
+    if (!providerCorrelationReference || !providerInvoiceReference || !providerOrderId) {
+      this.app.throw(400, 'Stripe Checkout Session is not correlated');
+    }
+    const session = await this.$scope.pay.model.paymentSession.get({
+      providerCorrelationReference,
+    });
+    if (!session || session.providerInvoiceReference !== providerInvoiceReference) {
+      this.app.throw(400, 'Stripe Checkout Session is not correlated');
+    }
+    return {
+      paymentSessionId: session.id,
+      businessReference: session.businessReference,
+      providerInvoiceReference: session.providerInvoiceReference,
+      providerCorrelationReference: session.providerCorrelationReference,
+      idempotencyKey: '',
+      amountMinor: session.amountMinor,
+      currency: session.currency,
+      providerOrderId,
+    };
+  }
+
+  private _mapCheckoutSession(
+    checkoutSession: unknown,
+    input: IPayProviderPaymentInput,
+    clientOptions: IPayProviderStripeClientOptions,
+    requireRedirect = false,
+  ): IPayProviderPaymentSnapshot {
+    const record = asRecord(checkoutSession);
+    const providerOrderId = readString(record.id);
+    const amountMinor = readInteger(record.amount_total);
+    const currency = readString(record.currency)?.toUpperCase();
+    const metadata = asRecord(record.metadata);
+    if (
+      !providerOrderId ||
+      (input.providerOrderId && input.providerOrderId !== providerOrderId) ||
+      amountMinor !== input.amountMinor ||
+      currency !== input.currency ||
+      readString(record.client_reference_id) !== input.providerCorrelationReference ||
+      readString(metadata.providerCorrelationReference) !== input.providerCorrelationReference ||
+      readString(metadata.providerInvoiceReference) !== input.providerInvoiceReference ||
+      !this._matchesEnvironment(record, clientOptions)
+    ) {
+      this.app.throw(409, 'Stripe Checkout Session facts conflict with the payment session');
+    }
+    const paymentIntent = asRecord(record.payment_intent);
+    const paymentIntentId =
+      readString(record.payment_intent) ?? readString(paymentIntent.id) ?? undefined;
+    if (paymentIntentId && Object.keys(paymentIntent).length) {
+      return this._mapPaymentIntent(paymentIntent, { ...input, providerOrderId }, providerOrderId);
+    }
+    if (record.status === 'expired') {
+      return { state: 'cancelled', providerPaymentId: providerOrderId, providerOrderId };
+    }
+    if (record.payment_status === 'paid' && paymentIntentId) {
+      return {
+        state: 'succeeded',
+        providerPaymentId: paymentIntentId,
+        providerOrderId,
+        providerCaptureId: paymentIntentId,
+        nextAction: { kind: 'completed' },
+      };
+    }
+    const url = readString(record.url);
+    if (requireRedirect && !url) this.app.throw(502, 'Stripe did not return a Checkout URL');
+    return {
+      state: 'requires_action',
+      providerPaymentId: providerOrderId,
+      providerOrderId,
+      ...(url && { nextAction: { kind: 'redirect' as const, url } }),
+    };
+  }
+
+  private _mapPaymentIntent(
+    paymentIntent: Record<string, unknown>,
+    input: IPayProviderPaymentInput,
+    providerOrderId = input.providerOrderId,
+  ): IPayProviderPaymentSnapshot {
+    const providerPaymentId = readString(paymentIntent.id);
+    const amountMinor = readInteger(paymentIntent.amount);
+    const currency = readString(paymentIntent.currency)?.toUpperCase();
+    const metadata = asRecord(paymentIntent.metadata);
+    if (
+      !providerPaymentId ||
+      amountMinor !== input.amountMinor ||
+      currency !== input.currency ||
+      readString(metadata.providerCorrelationReference) !== input.providerCorrelationReference ||
+      readString(metadata.providerInvoiceReference) !== input.providerInvoiceReference
+    ) {
+      this.app.throw(409, 'Stripe PaymentIntent facts conflict with the payment session');
+    }
+    const status = readString(paymentIntent.status);
+    if (status === 'succeeded') {
+      return {
+        state: 'succeeded',
+        providerPaymentId,
+        providerOrderId,
+        providerCaptureId: providerPaymentId,
+        nextAction: { kind: 'completed' },
+      };
+    }
+    if (status === 'processing') return { state: 'processing', providerPaymentId, providerOrderId };
+    if (status === 'canceled') return { state: 'cancelled', providerPaymentId, providerOrderId };
+    if (status === 'requires_payment_method')
+      return { state: 'failed', providerPaymentId, providerOrderId };
+    return { state: 'requires_action', providerPaymentId, providerOrderId };
+  }
+
+  private _mapRefund(refund: unknown, input: IPayProviderRefundInput): IPayProviderRefundSnapshot {
+    const record = asRecord(refund);
+    const providerRefundId = readString(record.id);
+    const amountMinor = readInteger(record.amount);
+    const currency = readString(record.currency)?.toUpperCase();
+    const metadata = asRecord(record.metadata);
+    const paymentIntent = readString(record.payment_intent);
+    if (
+      !providerRefundId ||
+      (input.providerRefundId && input.providerRefundId !== providerRefundId) ||
+      amountMinor !== input.amountMinor ||
+      currency !== input.currency ||
+      paymentIntent !== input.providerCaptureId ||
+      readString(metadata.providerCorrelationReference) !== input.providerCorrelationReference ||
+      readString(metadata.providerInvoiceReference) !== input.providerInvoiceReference
+    ) {
+      this.app.throw(409, 'Stripe refund facts conflict with the refund operation');
+    }
+    const status = readString(record.status);
+    if (status === 'succeeded') return { state: 'succeeded', providerRefundId };
+    if (status === 'failed') return { state: 'failed', providerRefundId };
+    if (status === 'canceled') return { state: 'cancelled', providerRefundId };
+    return { state: 'pending', providerRefundId };
+  }
+
+  private _paymentMetadata(input: IPayProviderPaymentInput): Record<string, string> {
+    return {
+      paymentSessionId: String(input.paymentSessionId),
+      providerCorrelationReference: input.providerCorrelationReference,
+      providerInvoiceReference: input.providerInvoiceReference,
+    };
+  }
+
+  private _refundMetadata(input: IPayProviderRefundInput): Record<string, string> {
+    return {
+      paymentSessionId: String(input.paymentSessionId),
+      refundOperationId: String(input.refundOperationId),
+      providerCorrelationReference: input.providerCorrelationReference,
+      providerInvoiceReference: input.providerInvoiceReference,
+    };
+  }
+
+  private _gateway(clientOptions: IPayProviderStripeClientOptions): IStripeGateway {
+    return clientOptions.gateway ?? createStripeGateway();
+  }
+
+  private _gatewayOptions(clientOptions: IPayProviderStripeClientOptions): IStripeGatewayOptions {
+    const secretKey = clientOptions.secretCredential;
+    const webhookSecret = clientOptions.secretWebhook;
+    if (!secretKey || !webhookSecret) this.app.throw(503, 'Stripe is not fully configured');
+    return { secretKey, webhookSecret };
+  }
+
+  private _matchesEnvironment(
+    value: Record<string, unknown>,
+    clientOptions: IPayProviderStripeClientOptions,
+  ): boolean {
+    const livemode = value.livemode;
+    return typeof livemode !== 'boolean' || livemode === (clientOptions.environment === 'live');
+  }
+
+  private _isDefinitiveRefundRejection(error: unknown): boolean {
+    return isStripeDefinitiveRejection(error);
+  }
+
+  private _throwTerminalPaymentFailure(error: unknown): never {
+    if (isStripeDefinitiveRejection(error)) {
+      throw new ProviderOperationFailure(
+        'stripe_request_rejected',
+        'Stripe rejected the payment request',
+      );
+    }
+    throw error;
+  }
+
+  private _throwGatewayError(error: unknown): never {
+    if (error instanceof StripeGatewayError) this.app.throw(error.status, error.message);
+    throw error;
   }
 }
 
-declare module 'vona-module-a-pay' {
-  export interface IPayProviderRecord {
-    'pay-stripe:stripe': IPayProviderOptionsStripe;
+function isStripeDefinitiveRejection(error: unknown): boolean {
+  if (error instanceof StripeGatewayError) return error.status >= 400 && error.status < 500;
+  const type = (error as Record<string, unknown> | undefined)?.type;
+  return [
+    'StripeInvalidRequestError',
+    'StripeIdempotencyError',
+    'StripeAuthenticationError',
+    'StripePermissionError',
+  ].includes(type as string);
+}
+
+function assertStripeMoney(amountMinor: number, currency: string) {
+  if (!Number.isSafeInteger(amountMinor) || amountMinor <= 0 || currency !== 'USD') {
+    throw new Error('Stripe supports only positive USD minor-unit amounts');
   }
 }
+
+function asRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' ? (value as Record<string, unknown>) : {};
+}
+
+function readString(value: unknown): string | undefined {
+  return typeof value === 'string' && value ? value : undefined;
+}
+
+function readInteger(value: unknown): number | undefined {
+  return typeof value === 'number' && Number.isSafeInteger(value) ? value : undefined;
+}

package/vona/src/suite-vendor/a-pay/modules/pay-stripe/src/index.ts

@@ -1,2 +1,3 @@
+export type { IPayProviderStripeClientOptions } from './bean/payProvider.stripe.ts';
 export * from './types/index.ts';
 export * from './.metadata/index.ts';

package/vona/src/suite-vendor/a-pay/modules/pay-stripe/src/lib/stripeGateway.ts

@@ -0,0 +1,85 @@
+import Stripe from 'stripe';
+
+export interface IStripeGatewayOptions {
+  secretKey: string;
+  webhookSecret: string;
+}
+
+export const StripeRequestTimeoutMilliseconds = 15_000;
+
+export interface IStripeGateway {
+  createCheckoutSession(options: IStripeGatewayOptions, input: unknown): Promise<unknown>;
+  retrieveCheckoutSession(options: IStripeGatewayOptions, input: unknown): Promise<unknown>;
+  createRefund(options: IStripeGatewayOptions, input: unknown): Promise<unknown>;
+  retrieveRefund(options: IStripeGatewayOptions, input: unknown): Promise<unknown>;
+  constructWebhookEvent(
+    options: IStripeGatewayOptions,
+    input: { rawBody?: string; headers: Record<string, string | string[] | undefined> },
+  ): Promise<unknown>;
+}
+
+export class StripeGatewayError extends Error {
+  constructor(
+    readonly status: number,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+export function createStripeGateway(): IStripeGateway {
+  return {
+    async createCheckoutSession(options, input) {
+      const request = input as {
+        body: Stripe.Checkout.SessionCreateParams;
+        idempotencyKey: string;
+      };
+      return await createClient(options).checkout.sessions.create(request.body, {
+        idempotencyKey: request.idempotencyKey,
+      });
+    },
+    async retrieveCheckoutSession(options, input) {
+      const request = input as { id: string };
+      return await createClient(options).checkout.sessions.retrieve(request.id, {
+        expand: ['payment_intent'],
+      });
+    },
+    async createRefund(options, input) {
+      const request = input as { body: Stripe.RefundCreateParams; idempotencyKey: string };
+      return await createClient(options).refunds.create(request.body, {
+        idempotencyKey: request.idempotencyKey,
+      });
+    },
+    async retrieveRefund(options, input) {
+      const request = input as { id: string };
+      return await createClient(options).refunds.retrieve(request.id);
+    },
+    async constructWebhookEvent(options, input) {
+      const signature = getHeader(input.headers, 'stripe-signature');
+      if (!input.rawBody || !signature) {
+        throw new StripeGatewayError(401, 'Stripe webhook signature is invalid');
+      }
+      try {
+        return createClient(options).webhooks.constructEvent(
+          input.rawBody,
+          signature,
+          options.webhookSecret,
+        );
+      } catch {
+        throw new StripeGatewayError(401, 'Stripe webhook signature is invalid');
+      }
+    },
+  };
+}
+
+function createClient(options: IStripeGatewayOptions) {
+  return new Stripe(options.secretKey, {
+    maxNetworkRetries: 0,
+    timeout: StripeRequestTimeoutMilliseconds,
+  });
+}
+
+function getHeader(headers: Record<string, string | string[] | undefined>, key: string) {
+  const value = headers[key];
+  return Array.isArray(value) ? value[0] : value;
+}

package/vona/src/suite-vendor/a-pay/modules/pay-stripe/src/types/index.ts

@@ -1,7 +1,9 @@
 declare module 'vona' {
   export interface VonaConfigEnv {
+    STRIPE_ENVIRONMENT: 'sandbox' | 'live' | undefined;
     STRIPE_SECRET_KEY: string | undefined;
     STRIPE_WEBHOOK_SECRET: string | undefined;
+    STRIPE_MERCHANT_REFERENCE: string | undefined;
   }
 }
 

package/vona/src/suite-vendor/a-pay/package.json

@@ -1,15 +1,15 @@
 {
   "name": "vona-suite-a-pay",
-  "version": "5.0.5",
+  "version": "5.0.6",
   "description": "",
   "author": "",
   "files": [],
   "type": "module",
   "dependencies": {
-    "vona-module-a-pay": "^5.0.5",
-    "vona-module-pay-mock": "^5.0.5",
-    "vona-module-pay-paypal": "^5.0.5",
-    "vona-module-pay-stripe": "^5.0.5"
+    "vona-module-a-pay": "^5.0.6",
+    "vona-module-pay-mock": "^5.0.6",
+    "vona-module-pay-paypal": "^5.0.6",
+    "vona-module-pay-stripe": "^5.0.6"
   },
   "title": "a-pay"
 }

package/vona/src/suite-vendor/a-vona/modules/a-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-core",
-  "version": "5.1.49",
+  "version": "5.1.50",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-permission/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-permission",
-  "version": "5.1.15",
+  "version": "5.1.16",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-permission/src/bean/bean.permission.ts

@@ -153,6 +153,7 @@ export class BeanPermission extends BeanBase {
     const isAuthenticated = this.bean.passport.isAuthenticated;
     if (!options.public && !isAuthenticated) return false;
     if (!isAuthenticated) return true;
+    if (!this.bean.passport.isAccountActive) return false;
     if (options.activated === true && !this.bean.passport.isActivated) return false;
     if (options.activated === false && this.bean.passport.isActivated) return false;
     return true;