payment-kit 1.18.4 → 1.18.6

package/api/src/integrations/stripe/setup.ts

@@ -2,6 +2,7 @@
 
 import env from '@blocklet/sdk/lib/env';
 
+import Stripe from 'stripe';
 import logger from '../../libs/logger';
 import { STRIPE_API_VERSION, STRIPE_ENDPOINT, STRIPE_EVENTS } from '../../libs/util';
 import { PaymentMethod } from '../../store/models';
@@ -48,3 +49,29 @@ export async function ensureWebhookRegistered() {
     }
   }
 }
+
+// validate stripe keys
+export async function validateStripeKeys(secretKey: string) {
+  try {
+    const stripe = new Stripe(secretKey, { apiVersion: STRIPE_API_VERSION });
+    await stripe.accounts.retrieve();
+    return true;
+  } catch (error) {
+    logger.error('Invalid Stripe API keys:', error);
+    return false;
+  }
+}
+
+// cleanup old stripe webhook
+export async function cleanupStripeWebhook(stripe: Stripe) {
+  try {
+    const { data } = await stripe.webhookEndpoints.list({ limit: 100 });
+    const existingWebhook = data.find((webhook) => webhook.metadata?.appPid === env.appPid);
+    if (existingWebhook) {
+      await stripe.webhookEndpoints.del(existingWebhook.id);
+      logger.info('stripe webhook deleted', { id: existingWebhook.id });
+    }
+  } catch (err) {
+    logger.error('Failed to clean old webhook:', err);
+  }
+}

package/api/src/routes/connect/pay.ts

@@ -27,10 +27,10 @@ export default {
 
   onConnect: async (args: CallbackArgs) => {
     const { userDid, userPk, extraParams } = args;
-    const { checkoutSessionId, connectedDid } = extraParams;
+    const { checkoutSessionId, connectedDid, sessionUserDid } = extraParams;
     const { paymentIntent, paymentCurrency, paymentMethod } = await ensurePaymentIntent(
       checkoutSessionId,
-      connectedDid || userDid
+      connectedDid || sessionUserDid || userDid
     );
     if (!paymentIntent) {
       throw new Error('Payment intent not found');
@@ -87,10 +87,10 @@ export default {
 
   onAuth: async (args: CallbackArgs) => {
     const { request, userDid, claims, extraParams } = args;
-    const { checkoutSessionId, connectedDid } = extraParams;
+    const { checkoutSessionId, connectedDid, sessionUserDid } = extraParams;
     const { checkoutSession, customer, paymentIntent, paymentMethod } = await ensurePaymentIntent(
       checkoutSessionId,
-      connectedDid || userDid
+      connectedDid || sessionUserDid || userDid
     );
     if (!paymentIntent) {
       throw new Error('Payment intent not found');

package/api/src/routes/connect/setup.ts

@@ -30,10 +30,10 @@ export default {
   },
   onConnect: async (args: CallbackArgs) => {
     const { userDid, userPk, extraParams } = args;
-    const { checkoutSessionId, connectedDid } = extraParams;
+    const { checkoutSessionId, connectedDid, sessionUserDid } = extraParams;
     const { paymentMethod, paymentCurrency, checkoutSession, subscription, customer } = await ensureSetupIntent(
       checkoutSessionId,
-      connectedDid || userDid
+      connectedDid || sessionUserDid || userDid
     );
     if (!subscription) {
       throw new Error('Subscription for checkoutSession not found');
@@ -123,9 +123,9 @@ export default {
   },
   onAuth: async (args: CallbackArgs) => {
     const { request, userDid, userPk, claims, extraParams } = args;
-    const { checkoutSessionId, connectedDid } = extraParams;
+    const { checkoutSessionId, connectedDid, sessionUserDid } = extraParams;
     const { setupIntent, checkoutSession, paymentMethod, subscription, invoice, paymentCurrency, customer } =
-      await ensureSetupIntent(checkoutSessionId, connectedDid || userDid);
+      await ensureSetupIntent(checkoutSessionId, connectedDid || sessionUserDid || userDid);
 
     if (!subscription) {
       throw new Error('Subscription for checkoutSession not found');

package/api/src/routes/connect/subscribe.ts

@@ -31,10 +31,10 @@ export default {
   },
   onConnect: async (args: CallbackArgs) => {
     const { userDid, userPk, extraParams } = args;
-    const { checkoutSessionId, connectedDid } = extraParams;
+    const { checkoutSessionId, connectedDid, sessionUserDid } = extraParams;
     const { checkoutSession, paymentMethod, paymentCurrency, subscription, customer } = await ensurePaymentIntent(
       checkoutSessionId,
-      connectedDid || userDid
+      connectedDid || sessionUserDid || userDid
     );
     if (!subscription) {
       throw new Error('Subscription for checkoutSession not found');
@@ -123,10 +123,10 @@ export default {
   },
   onAuth: async (args: CallbackArgs) => {
     const { request, userDid, userPk, claims, extraParams } = args;
-    const { checkoutSessionId, connectedDid } = extraParams;
+    const { checkoutSessionId, connectedDid, sessionUserDid } = extraParams;
     const { checkoutSession, customer, paymentMethod, subscription, paymentCurrency } = await ensurePaymentIntent(
       checkoutSessionId,
-      connectedDid || userDid
+      connectedDid || sessionUserDid || userDid
     );
 
     if (!subscription) {

package/api/src/routes/payment-methods.ts

@@ -7,7 +7,7 @@ import { InferAttributes, Op, WhereOptions } from 'sequelize';
 import cloneDeep from 'lodash/cloneDeep';
 import merge from 'lodash/merge';
 import { Joi } from '@arcblock/validator';
-import { ensureWebhookRegistered } from '../integrations/stripe/setup';
+import { ensureWebhookRegistered, cleanupStripeWebhook, validateStripeKeys } from '../integrations/stripe/setup';
 import logger from '../libs/logger';
 import { authenticate } from '../libs/security';
 import { PaymentCurrency } from '../store/models/payment-currency';
@@ -51,6 +51,10 @@ router.post('/', auth, async (req, res) => {
     if (!raw.settings.stripe?.secret_key) {
       return res.status(400).json({ error: 'stripe secret key is required' });
     }
+    const isValid = await validateStripeKeys(raw.settings.stripe.secret_key);
+    if (!isValid) {
+      return res.status(400).json({ error: 'Invalid Stripe API keys' });
+    }
 
     raw.settings = pick(PaymentMethod.encryptSettings(raw.settings), ['stripe']) as PaymentMethodSettings;
     raw.logo = getUrl('/methods/stripe.png');
@@ -295,7 +299,7 @@ router.put('/:id', auth, async (req, res) => {
     if ('logo' in method.dataValues || raw.logo !== undefined) {
       updateData.logo = raw.logo ?? method.logo;
     }
-    const updateSettings = 'settings' in req.body ? req.body.settings : null;
+    let updateSettings = 'settings' in req.body ? req.body.settings : null;
     if (EVM_CHAIN_TYPES.includes(method.type as string) && updateSettings) {
       const paymentType = method.type as EVMChainType;
       if (!updateSettings[paymentType]?.api_host) {
@@ -322,7 +326,29 @@ router.put('/:id', auth, async (req, res) => {
       }
       updateData.settings = pick(PaymentMethod.encryptSettings(updateSettings), [paymentType]) as PaymentMethodSettings;
     }
+    if (method.type === 'stripe') {
+      if (!updateSettings.stripe?.publishable_key) {
+        return res.status(400).json({ error: 'stripe publishable key is required' });
+      }
+      if (!updateSettings.stripe?.secret_key) {
+        return res.status(400).json({ error: 'stripe secret key is required' });
+      }
+      if (method.settings?.stripe?.secret_key !== updateSettings.stripe.secret_key) {
+        const isValid = await validateStripeKeys(updateSettings.stripe.secret_key);
+        if (!isValid) {
+          return res.status(400).json({ error: 'Invalid Stripe API keys' });
+        }
+        updateSettings.stripe.webhook_signing_secret = null;
+        updateSettings = PaymentMethod.encryptSettings(updateSettings);
+        cleanupStripeWebhook(method.getStripeClient());
+      }
+      updateData.settings = pick(updateSettings, ['stripe']) as PaymentMethodSettings;
+    }
+
     const updatedMethod = await method.update(updateData);
+    if (method.type === 'stripe') {
+      ensureWebhookRegistered().catch(console.error);
+    }
     return res.json(updatedMethod);
   } catch (err) {
     return res.status(400).json({ error: err.message });

package/api/src/store/models/payment-method.ts

@@ -175,15 +175,21 @@ export class PaymentMethod extends Model<InferAttributes<PaymentMethod>, InferCr
       throw new Error('payment method config insufficient for stripe');
     }
 
-    if (stripeClients.has(this.id)) {
-      return stripeClients.get(this.id) as Stripe;
+    const { secret_key: secretKey } = PaymentMethod.decryptSettings(this.settings).stripe || {};
+    if (!secretKey) {
+      throw new Error('stripe secret key is required');
     }
+    const clientKey = `${this.id}:${secretKey}`;
+    const existingClient = stripeClients.get(clientKey) as Stripe;
 
-    try {
-      const settings = PaymentMethod.decryptSettings(this.settings);
-      const client = new Stripe(settings.stripe?.secret_key as string, { apiVersion: STRIPE_API_VERSION });
-      stripeClients.set(this.id, client);
+    if (existingClient) {
+      return existingClient;
+    }
 
+    try {
+      stripeClients.delete(this.id);
+      const client = new Stripe(secretKey, { apiVersion: STRIPE_API_VERSION });
+      stripeClients.set(clientKey, client);
       return client as Stripe;
     } catch (e) {
       return {} as Stripe;

package/blocklet.yml

@@ -14,7 +14,7 @@ repository:
   type: git
   url: git+https://github.com/blocklet/payment-kit.git
 specVersion: 1.2.8
-version: 1.18.4
+version: 1.18.6
 logo: logo.png
 files:
   - dist

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "payment-kit",
-  "version": "1.18.4",
+  "version": "1.18.6",
   "scripts": {
     "dev": "blocklet dev --open",
     "eject": "vite eject",
@@ -53,11 +53,11 @@
     "@arcblock/validator": "^1.19.9",
     "@blocklet/js-sdk": "^1.16.38",
     "@blocklet/logger": "^1.16.38",
-    "@blocklet/payment-react": "1.18.4",
+    "@blocklet/payment-react": "1.18.6",
     "@blocklet/sdk": "^1.16.38",
     "@blocklet/ui-react": "^2.11.34",
-    "@blocklet/uploader": "^0.1.66",
-    "@blocklet/xss": "^0.1.22",
+    "@blocklet/uploader": "^0.1.67",
+    "@blocklet/xss": "^0.1.23",
     "@mui/icons-material": "^5.16.6",
     "@mui/lab": "^5.0.0-alpha.173",
     "@mui/material": "^5.16.6",
@@ -121,7 +121,7 @@
   "devDependencies": {
     "@abtnode/types": "^1.16.38",
     "@arcblock/eslint-config-ts": "^0.3.3",
-    "@blocklet/payment-types": "1.18.4",
+    "@blocklet/payment-types": "1.18.6",
     "@types/cookie-parser": "^1.4.7",
     "@types/cors": "^2.8.17",
     "@types/debug": "^4.1.12",
@@ -167,5 +167,5 @@
       "parser": "typescript"
     }
   },
-  "gitHead": "003d3b762bc9e3e224e4814dea95ff02d014868d"
+  "gitHead": "784ba57910d780a44d0792ef503b666ee8f8d9c3"
 }

package/src/components/subscription/portal/actions.tsx

@@ -140,7 +140,7 @@ export function SubscriptionActionsInner({
   const { t, locale } = useLocaleContext();
   const { reset, getValues } = useFormContext();
   const navigate = useNavigate();
-  const { connect } = usePaymentContext();
+  const { connect, session } = usePaymentContext();
   const [subs, setSubscription] = useState(subscription);
   const { checkUnpaidInvoices } = useUnpaidInvoicesCheckForSubscription(subscription.id, true);
   const action = getSubscriptionAction(subs, actionProps ?? {});
@@ -239,7 +239,7 @@ export function SubscriptionActionsInner({
       saveConnect: false,
       action: 'delegation',
       prefix: joinURL(getPrefix(), '/api/did'),
-      extraParams: { subscriptionId: subscription.id },
+      extraParams: { subscriptionId: subscription.id, sessionUserDid: session.user.did },
       onSuccess: () => {
         connect.close();
         Toast.success(t('customer.delegation.success'));
@@ -286,7 +286,7 @@ export function SubscriptionActionsInner({
           saveConnect: false,
           action: 'overdraft-protection',
           prefix: joinURL(getPrefix(), '/api/did'),
-          extraParams: { subscriptionId: subscription.id, amount },
+          extraParams: { subscriptionId: subscription.id, amount, sessionUserDid: session.user.did },
           onSuccess: () => {
             connect.close();
             Toast.success(t('customer.overdraftProtection.settingSuccess'));

package/src/pages/admin/settings/payment-methods/edit.tsx

@@ -73,6 +73,9 @@ export default function PaymentMethodEdit({ onClose, value }: { onClose: () => v
             'settings.base.explorer_host',
             'settings.ethereum.api_host',
             'settings.ethereum.explorer_host',
+            'settings.stripe.publishable_key',
+            'settings.stripe.secret_key',
+            'settings.stripe.dashboard',
           ]}
         />
       </FormProvider>

package/src/pages/customer/subscription/change-plan.tsx

@@ -53,7 +53,7 @@ export default function CustomerSubscriptionChangePlan() {
   const navigate = useNavigate();
   const { id } = useParams() as { id: string };
   const { t, locale } = useLocaleContext();
-  const { connect } = usePaymentContext();
+  const { connect, session } = usePaymentContext();
   const [searchParams] = useSearchParams();
   const redirectUrl = searchParams.get('redirectUrl');
   const confirmRef = useRef<HTMLButtonElement>(null);
@@ -164,6 +164,7 @@ export default function CustomerSubscriptionChangePlan() {
             extraParams: {
               invoiceId: result.data.pending_update?.updates?.latest_invoice_id,
               subscriptionId: result.data.id,
+              sessionUserDid: session?.user?.did,
             },
             onSuccess: () => {
               setState({ paid: true, paying: false });