payment-kit 1.18.4 → 1.18.5

package/api/src/integrations/stripe/setup.ts

@@ -2,6 +2,7 @@
 
 import env from '@blocklet/sdk/lib/env';
 
+import Stripe from 'stripe';
 import logger from '../../libs/logger';
 import { STRIPE_API_VERSION, STRIPE_ENDPOINT, STRIPE_EVENTS } from '../../libs/util';
 import { PaymentMethod } from '../../store/models';
@@ -48,3 +49,29 @@ export async function ensureWebhookRegistered() {
     }
   }
 }
+
+// validate stripe keys
+export async function validateStripeKeys(secretKey: string) {
+  try {
+    const stripe = new Stripe(secretKey, { apiVersion: STRIPE_API_VERSION });
+    await stripe.accounts.retrieve();
+    return true;
+  } catch (error) {
+    logger.error('Invalid Stripe API keys:', error);
+    return false;
+  }
+}
+
+// cleanup old stripe webhook
+export async function cleanupStripeWebhook(stripe: Stripe) {
+  try {
+    const { data } = await stripe.webhookEndpoints.list({ limit: 100 });
+    const existingWebhook = data.find((webhook) => webhook.metadata?.appPid === env.appPid);
+    if (existingWebhook) {
+      await stripe.webhookEndpoints.del(existingWebhook.id);
+      logger.info('stripe webhook deleted', { id: existingWebhook.id });
+    }
+  } catch (err) {
+    logger.error('Failed to clean old webhook:', err);
+  }
+}

package/api/src/routes/payment-methods.ts

@@ -7,7 +7,7 @@ import { InferAttributes, Op, WhereOptions } from 'sequelize';
 import cloneDeep from 'lodash/cloneDeep';
 import merge from 'lodash/merge';
 import { Joi } from '@arcblock/validator';
-import { ensureWebhookRegistered } from '../integrations/stripe/setup';
+import { ensureWebhookRegistered, cleanupStripeWebhook, validateStripeKeys } from '../integrations/stripe/setup';
 import logger from '../libs/logger';
 import { authenticate } from '../libs/security';
 import { PaymentCurrency } from '../store/models/payment-currency';
@@ -51,6 +51,10 @@ router.post('/', auth, async (req, res) => {
     if (!raw.settings.stripe?.secret_key) {
       return res.status(400).json({ error: 'stripe secret key is required' });
     }
+    const isValid = await validateStripeKeys(raw.settings.stripe.secret_key);
+    if (!isValid) {
+      return res.status(400).json({ error: 'Invalid Stripe API keys' });
+    }
 
     raw.settings = pick(PaymentMethod.encryptSettings(raw.settings), ['stripe']) as PaymentMethodSettings;
     raw.logo = getUrl('/methods/stripe.png');
@@ -295,7 +299,7 @@ router.put('/:id', auth, async (req, res) => {
     if ('logo' in method.dataValues || raw.logo !== undefined) {
       updateData.logo = raw.logo ?? method.logo;
     }
-    const updateSettings = 'settings' in req.body ? req.body.settings : null;
+    let updateSettings = 'settings' in req.body ? req.body.settings : null;
     if (EVM_CHAIN_TYPES.includes(method.type as string) && updateSettings) {
       const paymentType = method.type as EVMChainType;
       if (!updateSettings[paymentType]?.api_host) {
@@ -322,7 +326,29 @@ router.put('/:id', auth, async (req, res) => {
       }
       updateData.settings = pick(PaymentMethod.encryptSettings(updateSettings), [paymentType]) as PaymentMethodSettings;
     }
+    if (method.type === 'stripe') {
+      if (!updateSettings.stripe?.publishable_key) {
+        return res.status(400).json({ error: 'stripe publishable key is required' });
+      }
+      if (!updateSettings.stripe?.secret_key) {
+        return res.status(400).json({ error: 'stripe secret key is required' });
+      }
+      if (method.settings?.stripe?.secret_key !== updateSettings.stripe.secret_key) {
+        const isValid = await validateStripeKeys(updateSettings.stripe.secret_key);
+        if (!isValid) {
+          return res.status(400).json({ error: 'Invalid Stripe API keys' });
+        }
+        updateSettings.stripe.webhook_signing_secret = null;
+        updateSettings = PaymentMethod.encryptSettings(updateSettings);
+        cleanupStripeWebhook(method.getStripeClient());
+      }
+      updateData.settings = pick(updateSettings, ['stripe']) as PaymentMethodSettings;
+    }
+
     const updatedMethod = await method.update(updateData);
+    if (method.type === 'stripe') {
+      ensureWebhookRegistered().catch(console.error);
+    }
     return res.json(updatedMethod);
   } catch (err) {
     return res.status(400).json({ error: err.message });

package/api/src/store/models/payment-method.ts

@@ -175,15 +175,21 @@ export class PaymentMethod extends Model<InferAttributes<PaymentMethod>, InferCr
       throw new Error('payment method config insufficient for stripe');
     }
 
-    if (stripeClients.has(this.id)) {
-      return stripeClients.get(this.id) as Stripe;
+    const { secret_key: secretKey } = PaymentMethod.decryptSettings(this.settings).stripe || {};
+    if (!secretKey) {
+      throw new Error('stripe secret key is required');
     }
+    const clientKey = `${this.id}:${secretKey}`;
+    const existingClient = stripeClients.get(clientKey) as Stripe;
 
-    try {
-      const settings = PaymentMethod.decryptSettings(this.settings);
-      const client = new Stripe(settings.stripe?.secret_key as string, { apiVersion: STRIPE_API_VERSION });
-      stripeClients.set(this.id, client);
+    if (existingClient) {
+      return existingClient;
+    }
 
+    try {
+      stripeClients.delete(this.id);
+      const client = new Stripe(secretKey, { apiVersion: STRIPE_API_VERSION });
+      stripeClients.set(clientKey, client);
       return client as Stripe;
     } catch (e) {
       return {} as Stripe;

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.18.4
+version: 1.18.5
 logo: logo.png
 files:
   - dist

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payment-kit",
-  "version": "1.18.4",
+  "version": "1.18.5",
   "scripts": {
     "dev": "blocklet dev --open",
     "eject": "vite eject",
@@ -53,7 +53,7 @@
     "@arcblock/validator": "^1.19.9",
     "@blocklet/js-sdk": "^1.16.38",
     "@blocklet/logger": "^1.16.38",
-    "@blocklet/payment-react": "1.18.4",
+    "@blocklet/payment-react": "1.18.5",
     "@blocklet/sdk": "^1.16.38",
     "@blocklet/ui-react": "^2.11.34",
     "@blocklet/uploader": "^0.1.66",
@@ -121,7 +121,7 @@
   "devDependencies": {
     "@abtnode/types": "^1.16.38",
     "@arcblock/eslint-config-ts": "^0.3.3",
-    "@blocklet/payment-types": "1.18.4",
+    "@blocklet/payment-types": "1.18.5",
     "@types/cookie-parser": "^1.4.7",
     "@types/cors": "^2.8.17",
     "@types/debug": "^4.1.12",
@@ -167,5 +167,5 @@
       "parser": "typescript"
     }
   },
-  "gitHead": "003d3b762bc9e3e224e4814dea95ff02d014868d"
+  "gitHead": "83cca0f1ac5814964c8bedd04f34a3a2a986f554"
 }

package/src/pages/admin/settings/payment-methods/edit.tsx

@@ -73,6 +73,9 @@ export default function PaymentMethodEdit({ onClose, value }: { onClose: () => v
             'settings.base.explorer_host',
             'settings.ethereum.api_host',
             'settings.ethereum.explorer_host',
+            'settings.stripe.publishable_key',
+            'settings.stripe.secret_key',
+            'settings.stripe.dashboard',
           ]}
         />
       </FormProvider>