stripe 11.10.0 → 11.11.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 11.11.0 - 2023-02-16
+* [#1681](https://github.com/stripe/stripe-node/pull/1681) API Updates
+  * Add support for `refund_payment` method on resource `Terminal.Reader`
+  * Add support for new value `name` on enums `BillingPortal.Configuration.features.customer_update.allowed_updates[]`, `BillingPortalConfigurationCreateParams.features.customer_update.allowed_updates[]`, and `BillingPortalConfigurationUpdateParams.features.customer_update.allowed_updates[]`
+  * Add support for `custom_fields` on `Checkout.Session`, `CheckoutSessionCreateParams`, `PaymentLinkCreateParams`, `PaymentLinkUpdateParams`, and `PaymentLink`
+  * Change `Subscription.trial_settings.end_behavior` and `Subscription.trial_settings` to be required
+  * Add support for `interac_present` on `TerminalReaderPresentPaymentMethodParams.testHelpers`
+  * Change type of `TerminalReaderPresentPaymentMethodParams.testHelpers.type` from `literal('card_present')` to `enum('card_present'|'interac_present')`
+  * Add support for `refund_payment` on `Terminal.Reader.action`
+  * Add support for new value `refund_payment` on enum `Terminal.Reader.action.type`
+* [#1683](https://github.com/stripe/stripe-node/pull/1683) Add NextJS webhook sample
+* [#1685](https://github.com/stripe/stripe-node/pull/1685) Add more webhook parsing checks
+* [#1684](https://github.com/stripe/stripe-node/pull/1684) Add infrastructure for mocked tests
+
 ## 11.10.0 - 2023-02-09
 * [#1679](https://github.com/stripe/stripe-node/pull/1679) Enable library to work in worker environments without extra configuration.
 

package/README.md

@@ -331,7 +331,7 @@ Stripe can optionally sign the webhook events it sends to your endpoint, allowin
 
 Please note that you must pass the _raw_ request body, exactly as received from Stripe, to the `constructEvent()` function; this will not work with a parsed (i.e., JSON) request body.
 
-You can find an example of how to use this with [Express](https://expressjs.com/) in the [`examples/webhook-signing`](examples/webhook-signing) folder, but here's what it looks like:
+You can find an example of how to use this with various JavaScript frameworks in [`examples/webhook-signing`](examples/webhook-signing) folder, but here's what it looks like:
 
 ```js
 const event = stripe.webhooks.constructEvent(

package/VERSION

@@ -1 +1 @@
-11.10.0
+11.11.0

package/lib/Webhooks.js

@@ -54,23 +54,30 @@ function createWebhooks(platformFunctions) {
     const signature = {
         EXPECTED_SCHEME: 'v1',
         verifyHeader(encodedPayload, encodedHeader, secret, tolerance, cryptoProvider) {
-            const { decodedHeader: header, decodedPayload: payload, details, } = parseEventDetails(encodedPayload, encodedHeader, this.EXPECTED_SCHEME);
+            const { decodedHeader: header, decodedPayload: payload, details, suspectPayloadType, } = parseEventDetails(encodedPayload, encodedHeader, this.EXPECTED_SCHEME);
             cryptoProvider = cryptoProvider || getCryptoProvider();
             const expectedSignature = cryptoProvider.computeHMACSignature(makeHMACContent(payload, details), secret);
-            validateComputedSignature(payload, header, details, expectedSignature, tolerance);
+            validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType);
             return true;
         },
         async verifyHeaderAsync(encodedPayload, encodedHeader, secret, tolerance, cryptoProvider) {
-            const { decodedHeader: header, decodedPayload: payload, details, } = parseEventDetails(encodedPayload, encodedHeader, this.EXPECTED_SCHEME);
+            const { decodedHeader: header, decodedPayload: payload, details, suspectPayloadType, } = parseEventDetails(encodedPayload, encodedHeader, this.EXPECTED_SCHEME);
             cryptoProvider = cryptoProvider || getCryptoProvider();
             const expectedSignature = await cryptoProvider.computeHMACSignatureAsync(makeHMACContent(payload, details), secret);
-            return validateComputedSignature(payload, header, details, expectedSignature, tolerance);
+            return validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType);
         },
     };
     function makeHMACContent(payload, details) {
         return `${details.timestamp}.${payload}`;
     }
     function parseEventDetails(encodedPayload, encodedHeader, expectedScheme) {
+        if (!encodedPayload) {
+            throw new StripeSignatureVerificationError(encodedHeader, encodedPayload, {
+                message: 'No webhook payload was provided.',
+            });
+        }
+        const suspectPayloadType = typeof encodedPayload != 'string' &&
+            !(encodedPayload instanceof Uint8Array);
         const textDecoder = new TextDecoder('utf8');
         const decodedPayload = encodedPayload instanceof Uint8Array
             ? textDecoder.decode(encodedPayload)
@@ -82,6 +89,11 @@ function createWebhooks(platformFunctions) {
         if (Array.isArray(encodedHeader)) {
             throw new Error('Unexpected: An array was passed as a header, which should not be possible for the stripe-signature header.');
         }
+        if (encodedHeader == null || encodedHeader == '') {
+            throw new StripeSignatureVerificationError(encodedHeader, encodedPayload, {
+                message: 'No stripe-signature header value was provided.',
+            });
+        }
         const decodedHeader = encodedHeader instanceof Uint8Array
             ? textDecoder.decode(encodedHeader)
             : encodedHeader;
@@ -100,16 +112,26 @@ function createWebhooks(platformFunctions) {
             decodedPayload,
             decodedHeader,
             details,
+            suspectPayloadType,
         };
     }
-    function validateComputedSignature(payload, header, details, expectedSignature, tolerance) {
+    function validateComputedSignature(payload, header, details, expectedSignature, tolerance, suspectPayloadType) {
         const signatureFound = !!details.signatures.filter(platformFunctions.secureCompare.bind(platformFunctions, expectedSignature)).length;
         if (!signatureFound) {
-            // @ts-ignore
+            if (suspectPayloadType) {
+                throw new StripeSignatureVerificationError(header, payload, {
+                    message: 'Webhook payload must be provided as a string or a Buffer (https://nodejs.org/api/buffer.html) instance representing the _raw_ request body.' +
+                        'Payload was provided as a parsed JavaScript object instead. \n' +
+                        'Signature verification is impossible without access to the original signed material. \n' +
+                        'Learn more about webhook signing and explore webhook integration examples for various frameworks at ' +
+                        'https://github.com/stripe/stripe-node#webhook-signing',
+                });
+            }
             throw new StripeSignatureVerificationError(header, payload, {
                 message: 'No signatures found matching the expected signature for payload.' +
-                    ' Are you passing the raw request body you received from Stripe?' +
-                    ' https://github.com/stripe/stripe-node#webhook-signing',
+                    ' Are you passing the raw request body you received from Stripe? \n' +
+                    'Learn more about webhook signing and explore webhook integration examples for various frameworks at ' +
+                    'https://github.com/stripe/stripe-node#webhook-signing',
             });
         }
         const timestampAge = Math.floor(Date.now() / 1000) - details.timestamp;

package/lib/resources/Accounts.js

@@ -41,67 +41,67 @@ module.exports = StripeResource.extend({
         method: 'DELETE',
         fullPath: '/v1/accounts/{account}',
     }),
-    reject: stripeMethod({
+    createExternalAccount: stripeMethod({
         method: 'POST',
-        fullPath: '/v1/accounts/{account}/reject',
+        fullPath: '/v1/accounts/{account}/external_accounts',
     }),
-    retrieveCapability: stripeMethod({
-        method: 'GET',
-        fullPath: '/v1/accounts/{account}/capabilities/{capability}',
+    createLoginLink: stripeMethod({
+        method: 'POST',
+        fullPath: '/v1/accounts/{account}/login_links',
     }),
-    updateCapability: stripeMethod({
+    createPerson: stripeMethod({
         method: 'POST',
-        fullPath: '/v1/accounts/{account}/capabilities/{capability}',
+        fullPath: '/v1/accounts/{account}/persons',
+    }),
+    deleteExternalAccount: stripeMethod({
+        method: 'DELETE',
+        fullPath: '/v1/accounts/{account}/external_accounts/{id}',
+    }),
+    deletePerson: stripeMethod({
+        method: 'DELETE',
+        fullPath: '/v1/accounts/{account}/persons/{person}',
     }),
     listCapabilities: stripeMethod({
         method: 'GET',
         fullPath: '/v1/accounts/{account}/capabilities',
         methodType: 'list',
     }),
-    createExternalAccount: stripeMethod({
-        method: 'POST',
+    listExternalAccounts: stripeMethod({
+        method: 'GET',
         fullPath: '/v1/accounts/{account}/external_accounts',
+        methodType: 'list',
     }),
-    retrieveExternalAccount: stripeMethod({
+    listPersons: stripeMethod({
         method: 'GET',
-        fullPath: '/v1/accounts/{account}/external_accounts/{id}',
+        fullPath: '/v1/accounts/{account}/persons',
+        methodType: 'list',
     }),
-    updateExternalAccount: stripeMethod({
+    reject: stripeMethod({
         method: 'POST',
-        fullPath: '/v1/accounts/{account}/external_accounts/{id}',
+        fullPath: '/v1/accounts/{account}/reject',
     }),
-    listExternalAccounts: stripeMethod({
+    retrieveCapability: stripeMethod({
         method: 'GET',
-        fullPath: '/v1/accounts/{account}/external_accounts',
-        methodType: 'list',
+        fullPath: '/v1/accounts/{account}/capabilities/{capability}',
     }),
-    deleteExternalAccount: stripeMethod({
-        method: 'DELETE',
+    retrieveExternalAccount: stripeMethod({
+        method: 'GET',
         fullPath: '/v1/accounts/{account}/external_accounts/{id}',
     }),
-    createLoginLink: stripeMethod({
-        method: 'POST',
-        fullPath: '/v1/accounts/{account}/login_links',
-    }),
-    createPerson: stripeMethod({
-        method: 'POST',
-        fullPath: '/v1/accounts/{account}/persons',
-    }),
     retrievePerson: stripeMethod({
         method: 'GET',
         fullPath: '/v1/accounts/{account}/persons/{person}',
     }),
-    updatePerson: stripeMethod({
+    updateCapability: stripeMethod({
         method: 'POST',
-        fullPath: '/v1/accounts/{account}/persons/{person}',
+        fullPath: '/v1/accounts/{account}/capabilities/{capability}',
     }),
-    listPersons: stripeMethod({
-        method: 'GET',
-        fullPath: '/v1/accounts/{account}/persons',
-        methodType: 'list',
+    updateExternalAccount: stripeMethod({
+        method: 'POST',
+        fullPath: '/v1/accounts/{account}/external_accounts/{id}',
     }),
-    deletePerson: stripeMethod({
-        method: 'DELETE',
+    updatePerson: stripeMethod({
+        method: 'POST',
         fullPath: '/v1/accounts/{account}/persons/{person}',
     }),
 });

package/lib/resources/ApplicationFees.js

@@ -16,6 +16,11 @@ module.exports = StripeResource.extend({
         method: 'POST',
         fullPath: '/v1/application_fees/{id}/refunds',
     }),
+    listRefunds: stripeMethod({
+        method: 'GET',
+        fullPath: '/v1/application_fees/{id}/refunds',
+        methodType: 'list',
+    }),
     retrieveRefund: stripeMethod({
         method: 'GET',
         fullPath: '/v1/application_fees/{fee}/refunds/{id}',
@@ -24,9 +29,4 @@ module.exports = StripeResource.extend({
         method: 'POST',
         fullPath: '/v1/application_fees/{fee}/refunds/{id}',
     }),
-    listRefunds: stripeMethod({
-        method: 'GET',
-        fullPath: '/v1/application_fees/{id}/refunds',
-        methodType: 'list',
-    }),
 });

package/lib/resources/CreditNotes.js

@@ -20,6 +20,11 @@ module.exports = StripeResource.extend({
         fullPath: '/v1/credit_notes',
         methodType: 'list',
     }),
+    listLineItems: stripeMethod({
+        method: 'GET',
+        fullPath: '/v1/credit_notes/{credit_note}/lines',
+        methodType: 'list',
+    }),
     listPreviewLineItems: stripeMethod({
         method: 'GET',
         fullPath: '/v1/credit_notes/preview/lines',
@@ -33,9 +38,4 @@ module.exports = StripeResource.extend({
         method: 'POST',
         fullPath: '/v1/credit_notes/{id}/void',
     }),
-    listLineItems: stripeMethod({
-        method: 'GET',
-        fullPath: '/v1/credit_notes/{credit_note}/lines',
-        methodType: 'list',
-    }),
 });

package/lib/resources/Customers.js

@@ -28,98 +28,98 @@ module.exports = StripeResource.extend({
         method: 'POST',
         fullPath: '/v1/customers/{customer}/funding_instructions',
     }),
+    createBalanceTransaction: stripeMethod({
+        method: 'POST',
+        fullPath: '/v1/customers/{customer}/balance_transactions',
+    }),
+    createSource: stripeMethod({
+        method: 'POST',
+        fullPath: '/v1/customers/{customer}/sources',
+    }),
+    createTaxId: stripeMethod({
+        method: 'POST',
+        fullPath: '/v1/customers/{customer}/tax_ids',
+    }),
     deleteDiscount: stripeMethod({
         method: 'DELETE',
         fullPath: '/v1/customers/{customer}/discount',
     }),
+    deleteSource: stripeMethod({
+        method: 'DELETE',
+        fullPath: '/v1/customers/{customer}/sources/{id}',
+    }),
+    deleteTaxId: stripeMethod({
+        method: 'DELETE',
+        fullPath: '/v1/customers/{customer}/tax_ids/{id}',
+    }),
     listPaymentMethods: stripeMethod({
         method: 'GET',
         fullPath: '/v1/customers/{customer}/payment_methods',
         methodType: 'list',
     }),
-    retrievePaymentMethod: stripeMethod({
+    listBalanceTransactions: stripeMethod({
         method: 'GET',
-        fullPath: '/v1/customers/{customer}/payment_methods/{payment_method}',
+        fullPath: '/v1/customers/{customer}/balance_transactions',
+        methodType: 'list',
     }),
-    search: stripeMethod({
+    listCashBalanceTransactions: stripeMethod({
         method: 'GET',
-        fullPath: '/v1/customers/search',
-        methodType: 'search',
+        fullPath: '/v1/customers/{customer}/cash_balance_transactions',
+        methodType: 'list',
     }),
-    retrieveCashBalance: stripeMethod({
+    listSources: stripeMethod({
         method: 'GET',
-        fullPath: '/v1/customers/{customer}/cash_balance',
+        fullPath: '/v1/customers/{customer}/sources',
+        methodType: 'list',
     }),
-    updateCashBalance: stripeMethod({
-        method: 'POST',
-        fullPath: '/v1/customers/{customer}/cash_balance',
+    listTaxIds: stripeMethod({
+        method: 'GET',
+        fullPath: '/v1/customers/{customer}/tax_ids',
+        methodType: 'list',
     }),
-    createBalanceTransaction: stripeMethod({
-        method: 'POST',
-        fullPath: '/v1/customers/{customer}/balance_transactions',
+    retrievePaymentMethod: stripeMethod({
+        method: 'GET',
+        fullPath: '/v1/customers/{customer}/payment_methods/{payment_method}',
     }),
     retrieveBalanceTransaction: stripeMethod({
         method: 'GET',
         fullPath: '/v1/customers/{customer}/balance_transactions/{transaction}',
     }),
-    updateBalanceTransaction: stripeMethod({
-        method: 'POST',
-        fullPath: '/v1/customers/{customer}/balance_transactions/{transaction}',
-    }),
-    listBalanceTransactions: stripeMethod({
+    retrieveCashBalance: stripeMethod({
         method: 'GET',
-        fullPath: '/v1/customers/{customer}/balance_transactions',
-        methodType: 'list',
+        fullPath: '/v1/customers/{customer}/cash_balance',
     }),
     retrieveCashBalanceTransaction: stripeMethod({
         method: 'GET',
         fullPath: '/v1/customers/{customer}/cash_balance_transactions/{transaction}',
     }),
-    listCashBalanceTransactions: stripeMethod({
+    retrieveSource: stripeMethod({
         method: 'GET',
-        fullPath: '/v1/customers/{customer}/cash_balance_transactions',
-        methodType: 'list',
+        fullPath: '/v1/customers/{customer}/sources/{id}',
     }),
-    createSource: stripeMethod({
-        method: 'POST',
-        fullPath: '/v1/customers/{customer}/sources',
+    retrieveTaxId: stripeMethod({
+        method: 'GET',
+        fullPath: '/v1/customers/{customer}/tax_ids/{id}',
     }),
-    retrieveSource: stripeMethod({
+    search: stripeMethod({
         method: 'GET',
-        fullPath: '/v1/customers/{customer}/sources/{id}',
+        fullPath: '/v1/customers/search',
+        methodType: 'search',
     }),
-    updateSource: stripeMethod({
+    updateBalanceTransaction: stripeMethod({
         method: 'POST',
-        fullPath: '/v1/customers/{customer}/sources/{id}',
+        fullPath: '/v1/customers/{customer}/balance_transactions/{transaction}',
     }),
-    listSources: stripeMethod({
-        method: 'GET',
-        fullPath: '/v1/customers/{customer}/sources',
-        methodType: 'list',
+    updateCashBalance: stripeMethod({
+        method: 'POST',
+        fullPath: '/v1/customers/{customer}/cash_balance',
     }),
-    deleteSource: stripeMethod({
-        method: 'DELETE',
+    updateSource: stripeMethod({
+        method: 'POST',
         fullPath: '/v1/customers/{customer}/sources/{id}',
     }),
     verifySource: stripeMethod({
         method: 'POST',
         fullPath: '/v1/customers/{customer}/sources/{id}/verify',
     }),
-    createTaxId: stripeMethod({
-        method: 'POST',
-        fullPath: '/v1/customers/{customer}/tax_ids',
-    }),
-    retrieveTaxId: stripeMethod({
-        method: 'GET',
-        fullPath: '/v1/customers/{customer}/tax_ids/{id}',
-    }),
-    listTaxIds: stripeMethod({
-        method: 'GET',
-        fullPath: '/v1/customers/{customer}/tax_ids',
-        methodType: 'list',
-    }),
-    deleteTaxId: stripeMethod({
-        method: 'DELETE',
-        fullPath: '/v1/customers/{customer}/tax_ids/{id}',
-    }),
 });

package/lib/resources/Invoices.js

@@ -28,6 +28,11 @@ module.exports = StripeResource.extend({
         method: 'POST',
         fullPath: '/v1/invoices/{invoice}/finalize',
     }),
+    listLineItems: stripeMethod({
+        method: 'GET',
+        fullPath: '/v1/invoices/{invoice}/lines',
+        methodType: 'list',
+    }),
     listUpcomingLines: stripeMethod({
         method: 'GET',
         fullPath: '/v1/invoices/upcoming/lines',
@@ -58,9 +63,4 @@ module.exports = StripeResource.extend({
         method: 'POST',
         fullPath: '/v1/invoices/{invoice}/void',
     }),
-    listLineItems: stripeMethod({
-        method: 'GET',
-        fullPath: '/v1/invoices/{invoice}/lines',
-        methodType: 'list',
-    }),
 });

package/lib/resources/Terminal/Readers.js

@@ -36,6 +36,10 @@ module.exports = StripeResource.extend({
         method: 'POST',
         fullPath: '/v1/terminal/readers/{reader}/process_setup_intent',
     }),
+    refundPayment: stripeMethod({
+        method: 'POST',
+        fullPath: '/v1/terminal/readers/{reader}/refund_payment',
+    }),
     setReaderDisplay: stripeMethod({
         method: 'POST',
         fullPath: '/v1/terminal/readers/{reader}/set_reader_display',

package/lib/resources/Transfers.js

@@ -24,6 +24,11 @@ module.exports = StripeResource.extend({
         method: 'POST',
         fullPath: '/v1/transfers/{id}/reversals',
     }),
+    listReversals: stripeMethod({
+        method: 'GET',
+        fullPath: '/v1/transfers/{id}/reversals',
+        methodType: 'list',
+    }),
     retrieveReversal: stripeMethod({
         method: 'GET',
         fullPath: '/v1/transfers/{transfer}/reversals/{id}',
@@ -32,9 +37,4 @@ module.exports = StripeResource.extend({
         method: 'POST',
         fullPath: '/v1/transfers/{transfer}/reversals/{id}',
     }),
-    listReversals: stripeMethod({
-        method: 'GET',
-        fullPath: '/v1/transfers/{id}/reversals',
-        methodType: 'list',
-    }),
 });

package/lib/stripe.common.js

@@ -30,7 +30,8 @@ const RequestSender = require("./RequestSender");
 const HttpClient = require("./net/HttpClient");
 const CryptoProvider = require("./crypto/CryptoProvider");
 const createWebhooks = require("./Webhooks");
-function createStripe(platformFunctions) {
+const defaultRequestSenderFactory = (stripe) => new RequestSender(stripe, StripeResource.MAX_BUFFERED_REQUEST_METRICS);
+function createStripe(platformFunctions, requestSender = defaultRequestSenderFactory) {
     Stripe.PACKAGE_VERSION = require('../package.json').version;
     Stripe.USER_AGENT = Object.assign({ bindings_version: Stripe.PACKAGE_VERSION, lang: 'node', publisher: 'stripe', uname: null, typescript: false }, determineProcessUserAgentProperties());
     Stripe.StripeResource = StripeResource;
@@ -94,7 +95,7 @@ function createStripe(platformFunctions) {
         this.webhooks = createWebhooks(platformFunctions);
         this._prevRequestMetrics = [];
         this._enableTelemetry = props.telemetry !== false;
-        this._requestSender = new RequestSender(this, Stripe.StripeResource.MAX_BUFFERED_REQUEST_METRICS);
+        this._requestSender = requestSender(this);
         // Expose StripeResource on the instance too
         // @ts-ignore
         this.StripeResource = Stripe.StripeResource;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stripe",
-  "version": "11.10.0",
+  "version": "11.11.0",
   "description": "Stripe API wrapper",
   "keywords": [
     "stripe",

package/types/Accounts.d.ts

@@ -4,11 +4,13 @@ declare module 'stripe' {
   namespace Stripe {
     /**
      * This is an object representing a Stripe account. You can retrieve it to see
-     * properties on the account like its current e-mail address or if the account is
-     * enabled yet to make live charges.
+     * properties on the account like its current requirements or if the account is
+     * enabled to make live charges or receive payouts.
      *
-     * Some properties, marked below, are available only to platforms that want to
-     * [create and manage Express or Custom accounts](https://stripe.com/docs/connect/accounts).
+     * For Custom accounts, the properties below are always returned. For other accounts, some properties are returned until that
+     * account has started to go through Connect Onboarding. Once you create an [Account Link](https://stripe.com/docs/api/account_links)
+     * for a Standard or Express account, some parameters are no longer returned. These are marked as **Custom Only** or **Custom and Express**
+     * below. Learn about the differences [between accounts](https://stripe.com/docs/connect/accounts).
      */
     interface Account {
       /**