Issue #359: update webhook receiving from Stripe

Process the webhook return value for successful, failed and cancelled
payment intents.  Marks the transaction, which should instantly make
the pending funds usable.  Errors are mostly logged, rather than
returned to Stripe, since it's just giving us a notification

Author: Ian Walls

lib/Libki/Controller/API/V2/Transactions/Stripe.pm

@@ -2,6 +2,7 @@ package Libki::Controller::API::V2::Transactions::Stripe;
 
 use Moose;
 use namespace::autoclean;
+use JSON qw(decode_json);
 
 use Libki::Payments::Stripe;
 
@@ -60,17 +61,36 @@ sub checkout : POST Path('checkout') Args(0) {
 
 /api/v2/transactions/stripe/webhook
 
-Returns 200 status on success
+Accepts update on payment intent status
 
 =cut
 
 sub webhook : POST Path('webhook') Args(0) {
     my ( $self, $c ) = @_;
 
+    my $body_fh = $c->request->body;
+    my $payload = do { local $/; <$body_fh> };
+
+    my $json_data;
+    eval {
+        $json_data = decode_json($payload);
+        1;
+    } or do {
+        $c->log->error('Stripe webhook: invalid JSON');
+        $c->response->status(400);
+        $c->response->body('invalid payload');
+        return;
+    };
+
     my $provider = Libki::Payments::Stripe->new;
-    $provider->handle_webhook( c => $c );
+    $provider->handle_webhook(
+        c    => $c,
+        data => $json_data,
+    );
 
     $c->response->status(200);
+    $c->response->content_type('text/plain');
+    $c->response->body('ok');
 }
 
 __PACKAGE__->meta->make_immutable;

lib/Libki/Payments/Stripe.pm

@@ -2,6 +2,7 @@ package Libki::Payments::Stripe;
 
 use Moose;
 use namespace::autoclean;
+use Data::Dumper;
 
 with 'Libki::Payments::Provider';
 
@@ -72,35 +73,60 @@ sub create_checkout {
 =head2 handle_webhook
 
 Receives incoming webhook call from Stripe with payload and signature.
-Updates transaction from pending to successful
+Updates transaction from pending to successful or failed
 
 =cut
 
 sub handle_webhook {
-    require Net::Stripe;
-
     my ( $self, %args ) = @_;
 
-    my $c = $args{c};
+    my $data = $args{data};
+    my $c    = $args{c};
 
-    my $payload   = $c->request->body_data;
-    my $signature = $c->request->header('Stripe-Signature');
+    my $event_type = $data->{type} // '';
+    my $object     = $data->{data}{object} // {};
 
-    my $event = Net::Stripe::Webhook::construct_event(
-        $payload,
-        $signature,
-        $c->setting('StripeWebhookSigningSecret')
-    );
+    return 1 unless $object->{id};
+
+    my $pi_id = $object->{id};
+
+    my $txn = $c->model('DB::Transaction')->find({
+        provider            => 'stripe',
+        provider_payment_id => $pi_id,
+    });
+
+    unless ($txn) {
+        $c->log->warn("Stripe webhook: no transaction for $pi_id");
+        return 1;
+    }
+
+    # Idempotency: don't touch terminal states
+    return 1 if $txn->status =~ /^(succeeded|failed|cancelled)$/;
 
-    if ( $event->type eq 'checkout.session.completed' ) {
-        my $session = $event->data->object;
+    if ( $event_type eq 'payment_intent.succeeded' ) {
 
-        my $txn = $c->model('DB::Transaction')->find({
-            provider => 'stripe',
-            provider_payment_id => $session->id,
+        $txn->update({
+            status => 'succeeded',
         });
 
-        $txn->update({ status => 'succeeded' }) if $txn;
+    }
+    elsif ( $event_type eq 'payment_intent.payment_failed' ) {
+
+        my $reason =
+            $object->{last_payment_error}{message}
+            || 'Payment failed';
+
+        $txn->update({
+            status        => 'failed',
+            failure_reason => $reason,
+        });
+
+    }
+    elsif ( $event_type eq 'payment_intent.canceled' ) {
+
+        $txn->update({
+            status => 'cancelled',
+        });
     }
 
     return 1;