Created Route and Client for Stripe Webhook. Created Stripe Signature… #102
Conversation
…Validator, ProcessWebhookJob, and Storable Event (IssuingAuthorization).
| parse_str(str_replace(',', '&', $signatureHeader), $parsedResult); | ||
|
|
||
| if (! array_key_exists('t', $parsedResult)) { | ||
| Log::info("Stripe webhook doesn't have timestamp"); |
There was a problem hiding this comment.
We probably shouldn't be logging this like this. It'll just show up in the log as that one line with no context around. Maybe this as a code comment for the developer would be better?
| return false; | ||
| } | ||
|
|
||
| if (! array_key_exists('v1', $parsedResult)) { |
There was a problem hiding this comment.
I noticed the key you're checking for is v1, but the log comment suggests it's the signature and the parameter you're checking below is signature. Looking at the stripe docs, it suggests that v1 is correct, but I'm wondering if we shouldn't use the built in libraries to validate this since it's more likely it'll be correct than if we do it all manually.
|
|
||
| $timestamp = $parsedResult['t']; | ||
| $expectedSignature = $parsedResult['signature']; | ||
| $signed_payload = "$timestamp,'.',$payload"; |
There was a problem hiding this comment.
I'm not sure this does what you want, based on reading the Stripe docs. If $timestamp was 1 and $payload was 2, then $signed_payload would be 1,'.',2 instead of what I think should be 1.2. I suspect what you want is $signed_payload = $timestamp . '.' . $payload;
| case 'issuing_authorization.created': | ||
| event(new IssuingAuthorization($payload)); | ||
| // Not Sure what to do to update an authorization if its already been created | ||
| // Would we just add it to the db as another event and handle it somewhere else? |
There was a problem hiding this comment.
More or less, yeah. Depending on what all we want to do with this, it might make sense to talk about an aggregate. For example, we do that for each denhac membership since we need to process events and then make decisions about what to do next.
…Validator, ProcessWebhookJob, and Storable Event (IssuingAuthorization).