mirror of
https://github.com/hanzoai/commerce.git
synced 2026-10-30 15:08:42 +00:00
zeekay
73b7290e7f
Square keeps an event's created_at across every retry, and the receiver refused anything older than five minutes, so every retry of an event first sent while cloud was down (Recreate, ten rollouts a day) was refused until Square gave up. The verifier now lives in payment/providers/square and needs only the key and the URL; thirdparty/square is the API client and no longer registers itself or verifies anything, so every registry holds one Square type. Replay is stopped by the event id instead: each verified event is recorded once for the whole deployment, keyed on the verifying processor and the event id with an insert-if-absent swap, so a repeat is a duplicate under any path or org. The path names the one processor that verifies, and only one that holds its webhook secret may: an unknown name, or a verifier that needs no secret, is refused rather than tried. The books an event lands in are the verifying account's, else the deployment's brand — never a header or session, which on a replay are the replayer's. An effect that did not land (a store or the ledger did not answer) leaves the delivery open with a 503, so the provider redelivers; it used to be acknowledged and never retried. A settlement reads the payment index before the org's books, because an in-session charge's receipt is in the payer's org. POST /v1/commerce/webhooks/:provider is declared once, in setupRoutes, so standalone and embedded commerce serve the same address; the /v1/billing/webhooks spelling is gone. thirdparty/kms read /v1/kms/orgs/<org>/secrets/..., which cloud no longer serves, and was off in production anyway, so per-org payment credentials never loaded. It is deleted. secrets.Org reads orgs/<org>/<name> through the host's reader, the caller re-pointed at that org with zip.ActingAs so the KMS tenancy check admits it, and payment.Hydrate loads an org's credentials where the org receives the money: storefront checkout, storefront subscriptions and wire, and the brand's bank for the billing wire rail. Hanzo's own billing no longer reads the paying org's credentials; it charges the deployment's account, as it did. The standalone binary reads through hanzoai/kms/sdk/go.
76 lines
2.3 KiB
Go
76 lines
2.3 KiB
Go
// Copyright (c) 2014-present Hanzo AI, Inc.
|
|
// Licensed under MIT OR Apache-2.0. See LICENSE-MIT and LICENSE-APACHE.
|
|
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"strings"
|
|
|
|
"github.com/hanzoai/kms/sdk/go/kmsclient"
|
|
|
|
commerce "github.com/hanzoai/commerce"
|
|
)
|
|
|
|
// secretReader is a standalone commerce's secret plane: Hanzo KMS through
|
|
// hanzoai/kms/sdk/go, as the deployment's machine identity. Embedded in the
|
|
// cloud binary, commerce reads through the host's own KMS handle instead
|
|
// (EmbedConfig.Secrets); this is the same reader for a binary with no host.
|
|
//
|
|
// KMS_URL names the server; unset, there is no reader and commerce reads no
|
|
// secret. Set, the identity is required — KMS_CLIENT_ID, KMS_CLIENT_SECRET and
|
|
// KMS_ORG, exchanged at HANZO_IAM_URL — and a configuration that cannot make a
|
|
// client refuses to boot rather than serving with no credentials.
|
|
func secretReader() (commerce.SecretReader, error) {
|
|
endpoint := strings.TrimSpace(os.Getenv("KMS_URL"))
|
|
if endpoint == "" {
|
|
return nil, nil
|
|
}
|
|
org := strings.TrimSpace(os.Getenv("KMS_ORG"))
|
|
if org == "" {
|
|
return nil, errors.New("KMS_URL is set and KMS_ORG is not: the reader serves one org's material and must know which")
|
|
}
|
|
iam := strings.TrimSpace(os.Getenv("HANZO_IAM_URL"))
|
|
if iam == "" {
|
|
iam = "https://hanzo.id"
|
|
}
|
|
c, err := kmsclient.New(kmsclient.Config{
|
|
Endpoint: endpoint,
|
|
IAMEndpoint: iam,
|
|
ClientID: strings.TrimSpace(os.Getenv("KMS_CLIENT_ID")),
|
|
ClientSecret: strings.TrimSpace(os.Getenv("KMS_CLIENT_SECRET")),
|
|
Org: org,
|
|
})
|
|
if err != nil {
|
|
return nil, fmt.Errorf("kms: %w", err)
|
|
}
|
|
return orgReader{c: c, org: org}, nil
|
|
}
|
|
|
|
// orgReader answers refs under its identity's own org, orgs/<org>/<path>/<name>,
|
|
// and refuses every other: the server folds a read under the credential's org, so
|
|
// a ref naming another org could only ever read this one's.
|
|
type orgReader struct {
|
|
c *kmsclient.Client
|
|
org string
|
|
}
|
|
|
|
func (r orgReader) GetSecret(ctx context.Context, ref string) ([]byte, error) {
|
|
rest, ok := strings.CutPrefix(ref, "orgs/"+r.org+"/")
|
|
if !ok {
|
|
return nil, fmt.Errorf("kms: %q is not under orgs/%s", ref, r.org)
|
|
}
|
|
path, name := "", rest
|
|
if i := strings.LastIndex(rest, "/"); i >= 0 {
|
|
path, name = rest[:i], rest[i+1:]
|
|
}
|
|
v, err := r.c.Get(ctx, path, name)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return []byte(v), nil
|
|
}
|