ghost 5.115.0 → 5.115.1

package/core/server/services/stripe/StripeService.js

@@ -0,0 +1,175 @@
+const WebhookManager = require('./WebhookManager');
+const StripeAPI = require('./StripeAPI');
+const StripeMigrations = require('./StripeMigrations');
+const WebhookController = require('./WebhookController');
+const DomainEvents = require('@tryghost/domain-events');
+const {StripeLiveEnabledEvent, StripeLiveDisabledEvent} = require('./events');
+const SubscriptionEventService = require('./services/webhook/SubscriptionEventService');
+const InvoiceEventService = require('./services/webhook/InvoiceEventService');
+const CheckoutSessionEventService = require('./services/webhook/CheckoutSessionEventService');
+
+/**
+ * @typedef {object} IStripeServiceConfig
+ * @prop {string} secretKey The Stripe secret key
+ * @prop {string} publicKey The Stripe publishable key
+ * @prop {boolean} enablePromoCodes Whether to enable promo codes
+ * @prop {boolean} enableAutomaticTax Whether to enable automatic tax
+ * @prop {string} checkoutSessionSuccessUrl The URL to redirect to after successful checkout
+ * @prop {string} checkoutSessionCancelUrl The URL to redirect to if checkout is cancelled
+ * @prop {string} checkoutSetupSessionSuccessUrl The URL to redirect to after successful setup session
+ * @prop {string} checkoutSetupSessionCancelUrl The URL to redirect to if setup session is cancelled
+ * @prop {boolean} testEnv Whether this is a test environment
+ * @prop {string} webhookSecret The Stripe webhook secret
+ * @prop {string} webhookHandlerUrl The URL to handle Stripe webhooks
+ */
+
+/**
+ * The `StripeService` contains the core logic for Ghost's Stripe integration.
+
+ */
+module.exports = class StripeService {
+    /**
+     * @param {object} deps
+     * @param {*} deps.labs
+     * @param {*} deps.membersService
+     * @param {*} deps.donationService
+     * @param {*} deps.staffService
+     * @param {import('./WebhookManager').StripeWebhook} deps.StripeWebhook
+     * @param {object} deps.models
+     * @param {object} deps.models.Product
+     * @param {object} deps.models.StripePrice
+     * @param {object} deps.models.StripeCustomerSubscription
+     * @param {object} deps.models.StripeProduct
+     * @param {object} deps.models.MemberStripeCustomer
+     * @param {object} deps.models.Offer
+     * @param {object} deps.models.Settings
+     */
+    constructor({
+        labs,
+        membersService,
+        donationService,
+        staffService,
+        StripeWebhook,
+        models
+    }) {
+        const api = new StripeAPI({labs});
+        const migrations = new StripeMigrations({
+            models,
+            api
+        });
+
+        const webhookManager = new WebhookManager({
+            StripeWebhook,
+            api
+        });
+
+        const subscriptionEventService = new SubscriptionEventService({
+            get memberRepository(){
+                return membersService.api.members;
+            }
+        });
+
+        const invoiceEventService = new InvoiceEventService({
+            api,
+            get memberRepository(){
+                return membersService.api.members;
+            },
+            get eventRepository(){
+                return membersService.api.events;
+            },
+            get productRepository(){
+                return membersService.api.productRepository;
+            }
+        });
+
+        const checkoutSessionEventService = new CheckoutSessionEventService({
+            api,
+            get memberRepository(){
+                return membersService.api.members;
+            },
+            get productRepository(){
+                return membersService.api.productRepository;
+            },
+            get eventRepository(){
+                return membersService.api.events;
+            },
+            get donationRepository(){
+                return donationService.repository;
+            },
+            get staffServiceEmails(){
+                return staffService.api.emails;
+            },
+            sendSignupEmail(email){
+                return membersService.api.sendEmailWithMagicLink({
+                    email,
+                    requestedType: 'signup-paid',
+                    options: {
+                        forceEmailType: true
+                    },
+                    tokenData: {}
+                });
+            }
+        });
+
+        const webhookController = new WebhookController({
+            webhookManager,
+            subscriptionEventService,
+            invoiceEventService,
+            checkoutSessionEventService
+        });
+
+        this.models = models;
+        this.api = api;
+        this.webhookManager = webhookManager;
+        this.migrations = migrations;
+        this.webhookController = webhookController;
+    }
+
+    async connect() {
+        DomainEvents.dispatch(StripeLiveEnabledEvent.create({message: 'Stripe Live Mode Enabled'}));
+    }
+
+    async disconnect() {
+        await this.models.Product.forge().query().update({
+            monthly_price_id: null,
+            yearly_price_id: null
+        });
+        await this.models.StripePrice.forge().query().del();
+        await this.models.StripeProduct.forge().query().del();
+        await this.models.MemberStripeCustomer.forge().query().del();
+        await this.models.Offer.forge().query().update({
+            stripe_coupon_id: null
+        });
+        await this.webhookManager.stop();
+
+        this.api.configure(null);
+
+        DomainEvents.dispatch(StripeLiveDisabledEvent.create({message: 'Stripe Live Mode Disabled'}));
+    }
+
+    /**
+     * Configures the Stripe API and registers the webhook with Stripe
+     * @param {IStripeServiceConfig} config
+     */
+    async configure(config) {
+        this.api.configure({
+            secretKey: config.secretKey,
+            publicKey: config.publicKey,
+            enablePromoCodes: config.enablePromoCodes,
+            get enableAutomaticTax() {
+                return config.enableAutomaticTax;
+            },
+            checkoutSessionSuccessUrl: config.checkoutSessionSuccessUrl,
+            checkoutSessionCancelUrl: config.checkoutSessionCancelUrl,
+            checkoutSetupSessionSuccessUrl: config.checkoutSetupSessionSuccessUrl,
+            checkoutSetupSessionCancelUrl: config.checkoutSetupSessionCancelUrl,
+            testEnv: config.testEnv
+        });
+
+        await this.webhookManager.configure({
+            webhookSecret: config.webhookSecret,
+            webhookHandlerUrl: config.webhookHandlerUrl
+        });
+        await this.webhookManager.start();
+    }
+};

package/core/server/services/stripe/WebhookController.js

@@ -0,0 +1,100 @@
+const logging = require('@tryghost/logging');
+
+module.exports = class WebhookController {
+    /**
+     * @param {object} deps
+     * @param {import('./WebhookManager')} deps.webhookManager
+     * @param {import('./services/webhook/CheckoutSessionEventService')} deps.checkoutSessionEventService
+     * @param {import('./services/webhook/SubscriptionEventService')} deps.subscriptionEventService
+     * @param {import('./services/webhook/InvoiceEventService')} deps.invoiceEventService
+     */
+    constructor(deps) {
+        this.checkoutSessionEventService = deps.checkoutSessionEventService;
+        this.subscriptionEventService = deps.subscriptionEventService;
+        this.invoiceEventService = deps.invoiceEventService;
+        this.webhookManager = deps.webhookManager;
+        this.handlers = {
+            'customer.subscription.deleted': this.subscriptionEvent,
+            'customer.subscription.updated': this.subscriptionEvent,
+            'customer.subscription.created': this.subscriptionEvent,
+            'invoice.payment_succeeded': this.invoiceEvent,
+            'checkout.session.completed': this.checkoutSessionEvent
+        };
+    }
+
+    /**
+     * Handles a Stripe webhook event.
+     * - Parses the webhook event
+     * - Delegates the event to the appropriate handler
+     * - Returns a 200 response to Stripe to confirm receipt of the event, or an error response if the event is not handled or if an error occurs
+     * @param {import('express').Request} req
+     * @param {import('express').Response} res
+     * @returns {Promise<void>}
+     */
+    async handle(req, res) {
+        if (!req.body || !req.headers['stripe-signature']) {
+            res.writeHead(400);
+            return res.end();
+        }
+        let event;
+        try {
+            event = this.webhookManager.parseWebhook(req.body, req.headers['stripe-signature']);
+        } catch (err) {
+            logging.error(err);
+            res.writeHead(401);
+            return res.end();
+        }
+
+        logging.info(`Handling webhook ${event.type}`);
+        try {
+            await this.handleEvent(event);
+            res.writeHead(200);
+            res.end();
+        } catch (err) {
+            logging.error(`Error handling webhook ${event.type}`, err);
+            res.writeHead(err.statusCode || 500);
+            res.end();
+        }
+    }
+
+    /**
+     * Accepts a webhook's event payload and delegates it to the appropriate handler based on the event type
+     * @private
+     * @param {import('stripe').Stripe.Event} event
+     * @returns {Promise<void>}
+     */
+    async handleEvent(event) {
+        if (!this.handlers[event.type]) {
+            return;
+        }
+
+        await this.handlers[event.type].call(this, event.data.object);
+    }
+
+    /**
+     * Delegates any `customer.subscription.*` events to the `subscriptionEventService`
+     * @param {import('stripe').Stripe.Subscription} subscription
+     * @private
+     */
+    async subscriptionEvent(subscription) {
+        await this.subscriptionEventService.handleSubscriptionEvent(subscription);
+    }
+
+    /**
+     * Delegates any `invoice.*` events to the `invoiceEventService`
+     * @param {import('stripe').Stripe.Invoice} invoice
+     * @private
+     */
+    async invoiceEvent(invoice) {
+        await this.invoiceEventService.handleInvoiceEvent(invoice);
+    }
+
+    /**
+     * Delegates any `checkout.session.*` events to the `checkoutSessionEventService`
+     * @param {import('stripe').Stripe.Checkout.Session} session
+     * @private
+     */
+    async checkoutSessionEvent(session) {
+        await this.checkoutSessionEventService.handleEvent(session);
+    }
+};

package/core/server/services/stripe/WebhookManager.js

@@ -0,0 +1,175 @@
+/**
+ * @typedef {import('stripe').Stripe.WebhookEndpointCreateParams.EnabledEvent} WebhookEvent
+ * @typedef {import('./StripeAPI')} StripeAPI
+ */
+
+/**
+ * @typedef {object} StripeWebhookModel
+ * @prop {string} webhook_id
+ * @prop {string} secret
+ */
+
+/**
+ * @typedef {object} StripeWebhook
+ * @prop {(data: StripeWebhookModel) => Promise<void>} save
+ * @prop {() => Promise<StripeWebhookModel>} get
+ */
+
+module.exports = class WebhookManager {
+    /**
+     * @param {object} deps
+     * @param {StripeWebhook} deps.StripeWebhook
+     * @param {StripeAPI} deps.api
+     */
+    constructor({
+        StripeWebhook,
+        api
+    }) {
+        /** @private */
+        this.StripeWebhook = StripeWebhook;
+        /** @private */
+        this.api = api;
+        /** @private */
+        this.config = null;
+        /** @private */
+        this.webhookSecret = null;
+        /**
+         * @private
+         * @type {'network'|'local'}
+         */
+        this.mode = 'network';
+    }
+
+    /** @type {WebhookEvent[]} */
+    static events = [
+        'checkout.session.completed',
+        'customer.subscription.deleted',
+        'customer.subscription.updated',
+        'customer.subscription.created',
+        'invoice.payment_succeeded'
+    ];
+
+    /**
+     * Deletes the Stripe Webhook Endpoint and saves null values for the webhook ID and secret.
+     * 
+     * @returns {Promise<boolean>}
+     */
+    async stop() {
+        if (this.mode !== 'network') {
+            return;
+        }
+
+        try {
+            const existingWebhook = await this.StripeWebhook.get();
+            if (existingWebhook.webhook_id) {
+                await this.api.deleteWebhookEndpoint(existingWebhook.webhook_id);
+            }
+            await this.StripeWebhook.save({
+                webhook_id: null,
+                secret: null
+            });
+            return true;
+        } catch (err) {
+            return false;
+        }
+    }
+
+    /**
+     * Starts the Stripe Webhook Endpoint and saves the webhook ID and secret.
+     * 
+     * @returns {Promise<void>}
+     */
+    async start() {
+        if (this.mode !== 'network') {
+            return;
+        }
+        const existingWebhook = await this.StripeWebhook.get();
+
+        const webhook = await this.setupWebhook(existingWebhook.webhook_id, existingWebhook.secret);
+
+        await this.StripeWebhook.save({
+            webhook_id: webhook.id,
+            secret: webhook.secret
+        });
+
+        this.webhookSecret = webhook.secret;
+    }
+
+    /**
+     * Configures the Stripe Webhook Manager.
+     * @param {object} config
+     * @param {string} [config.webhookSecret] An optional webhook secret for use with stripe-cli, passing this will ensure a webhook is not created in Stripe
+     * @param {string} config.webhookHandlerUrl The URL which the Webhook should hit
+     *
+     * @returns {Promise<void>}
+     */
+    async configure(config) {
+        this.config = config;
+        if (config.webhookSecret) {
+            this.webhookSecret = config.webhookSecret;
+            this.mode = 'local';
+        }
+    }
+
+    /**
+     * Setup a new Stripe Webhook Endpoint.
+     * - If the webhook exists, delete it and create a new one
+     * - If the webhook does not exist, create a new one
+     * 
+     * @param {string} [id]
+     * @param {string} [secret]
+     * @param {object} [opts]
+     * @param {boolean} [opts.forceCreate]
+     * @param {boolean} [opts.skipDelete]
+     *
+     * @returns {Promise<{id: string, secret: string}>}
+     */
+    async setupWebhook(id, secret, opts = {}) {
+        if (!id || !secret || opts.forceCreate) {
+            if (id && !opts.skipDelete) {
+                try {
+                    await this.api.deleteWebhookEndpoint(id);
+                } catch (err) {
+                    // Continue
+                }
+            }
+            const webhook = await this.api.createWebhookEndpoint(
+                this.config.webhookHandlerUrl,
+                WebhookManager.events
+            );
+            return {
+                id: webhook.id,
+                secret: webhook.secret
+            };
+        } else {
+            try {
+                await this.api.updateWebhookEndpoint(
+                    id,
+                    this.config.webhookHandlerUrl,
+                    WebhookManager.events
+                );
+
+                return {
+                    id,
+                    secret
+                };
+            } catch (err) {
+                if (err.code === 'resource_missing') {
+                    return this.setupWebhook(id, secret, {skipDelete: true, forceCreate: true});
+                }
+                return this.setupWebhook(id, secret, {skipDelete: false, forceCreate: true});
+            }
+        }
+    }
+
+    /**
+     * Parse a Stripe Webhook event.
+     * 
+     * @param {string} body
+     * @param {string} signature
+     * @returns {import('stripe').Stripe.Event}
+     */
+    parseWebhook(body, signature) {
+        return this.api.parseWebhook(body, signature, this.webhookSecret);
+    }
+};

package/core/server/services/stripe/events/StripeLiveDisabledEvent.js

@@ -0,0 +1,23 @@
+/**
+ * @typedef {object} StripeLiveDisabledEventData
+ * @prop {string?} message
+ */
+
+module.exports = class StripeLiveDisabledEvent {
+    /**
+     * @param {StripeLiveDisabledEventData} data
+     * @param {Date} timestamp
+     */
+    constructor(data, timestamp) {
+        this.data = data;
+        this.timestamp = timestamp;
+    }
+
+    /**
+     * @param {StripeLiveDisabledEventData} data
+     * @param {Date} [timestamp]
+     */
+    static create(data, timestamp) {
+        return new StripeLiveDisabledEvent(data, timestamp || new Date);
+    }
+};

package/core/server/services/stripe/events/StripeLiveEnabledEvent.js

@@ -0,0 +1,23 @@
+/**
+ * @typedef {object} StripeLiveEnabledEventData
+ * @prop {string} message
+ */
+
+module.exports = class StripeLiveEnabledEvent {
+    /**
+     * @param {StripeLiveEnabledEventData} data
+     * @param {Date} timestamp
+     */
+    constructor(data, timestamp) {
+        this.data = data;
+        this.timestamp = timestamp;
+    }
+
+    /**
+     * @param {StripeLiveEnabledEventData} data
+     * @param {Date} [timestamp]
+     */
+    static create(data, timestamp) {
+        return new StripeLiveEnabledEvent(data, timestamp || new Date);
+    }
+};

package/core/server/services/stripe/events/index.js

@@ -0,0 +1,4 @@
+module.exports = {
+    StripeLiveEnabledEvent: require('./StripeLiveEnabledEvent'),
+    StripeLiveDisabledEvent: require('./StripeLiveDisabledEvent')
+};

package/core/server/services/stripe/service.js

@@ -1,5 +1,5 @@
 const _ = require('lodash');
-const StripeService = require('@tryghost/members-stripe-service');
+const StripeService = require('./StripeService');
 const logging = require('@tryghost/logging');
 const membersService = require('../members');
 const config = require('../../../shared/config');