Files
zeekay 73b7290e7f square: one webhook route and one verifier; secrets come from the host's KMS
Square keeps an event's created_at across every retry, and the receiver
refused anything older than five minutes, so every retry of an event
first sent while cloud was down (Recreate, ten rollouts a day) was refused
until Square gave up. The verifier now lives in payment/providers/square
and needs only the key and the URL; thirdparty/square is the API client
and no longer registers itself or verifies anything, so every registry
holds one Square type.

Replay is stopped by the event id instead: each verified event is
recorded once for the whole deployment, keyed on the verifying processor
and the event id with an insert-if-absent swap, so a repeat is a
duplicate under any path or org. The path names the one processor that
verifies, and only one that holds its webhook secret may: an unknown name,
or a verifier that needs no secret, is refused rather than tried.
The books an event lands in are the verifying account's, else the
deployment's brand — never a header or session, which on a replay are the
replayer's. An effect that did not land (a store or the ledger did not
answer) leaves the delivery open with a 503, so the provider redelivers;
it used to be acknowledged and never retried. A settlement reads the
payment index before the org's books, because an in-session charge's
receipt is in the payer's org.

POST /v1/commerce/webhooks/:provider is declared once, in setupRoutes, so
standalone and embedded commerce serve the same address; the
/v1/billing/webhooks spelling is gone.

thirdparty/kms read /v1/kms/orgs/<org>/secrets/..., which cloud no longer
serves, and was off in production anyway, so per-org payment credentials
never loaded. It is deleted. secrets.Org reads orgs/<org>/<name> through
the host's reader, the caller re-pointed at that org with zip.ActingAs so
the KMS tenancy check admits it, and payment.Hydrate loads an org's
credentials where the org receives the money: storefront checkout,
storefront subscriptions and wire, and the brand's bank for the billing
wire rail. Hanzo's own billing no longer reads the paying org's
credentials; it charges the deployment's account, as it did. The
standalone binary reads through hanzoai/kms/sdk/go.
2026-10-19 09:12:56 -07:00

120 lines
4.7 KiB
Go

package processor
import (
"context"
"github.com/hanzoai/money"
"github.com/hanzoai/commerce/models/types/currency"
)
// PaymentProcessor is the interface all payment processors must implement
type PaymentProcessor interface {
// Type returns the processor type
Type() ProcessorType
// Charge processes a payment
Charge(ctx context.Context, req PaymentRequest) (*PaymentResult, error)
// Authorize authorizes a payment without capturing
Authorize(ctx context.Context, req PaymentRequest) (*PaymentResult, error)
// Capture captures a previously authorized payment
// Capture takes a money.Amount, not a bare Cents, because a capture that
// cannot name its currency is one every gateway has to guess at — and they
// guessed USD, so a JPY authorization was captured at a hundredth of its
// value and a EUR one went out labelled USD. Same reasoning, and the same
// fix, as RefundRequest.Amount.
Capture(ctx context.Context, transactionID string, amount money.Amount) (*PaymentResult, error)
// Refund processes a refund
Refund(ctx context.Context, req RefundRequest) (*RefundResult, error)
// GetTransaction retrieves transaction details
GetTransaction(ctx context.Context, txID string) (*Transaction, error)
// ValidateWebhook validates an incoming webhook
ValidateWebhook(ctx context.Context, payload []byte, signature string) (*WebhookEvent, error)
// SupportedCurrencies returns currencies this processor supports
SupportedCurrencies() []currency.Type
// IsAvailable checks if processor is configured and available
IsAvailable(ctx context.Context) bool
}
// WebhookReceiver is a processor that can verify its own inbound deliveries,
// because it holds the secret they are signed with. The webhook route asks only
// a processor that is one and says so: a verifier that needs no secret, or one
// with nothing configured, never admits an event.
type WebhookReceiver interface {
ReceivesWebhooks() bool
}
// CryptoProcessor extends PaymentProcessor with crypto-specific methods
type CryptoProcessor interface {
PaymentProcessor
// GenerateAddress mints a custody destination for a customer.
//
// It returns a Wallet rather than a bare address because an address alone
// is only half a custody record: it says where funds land, not which wallet
// the signer must be asked to spend from. Returning one value made losing
// the other the DEFAULT — the MPC processor parsed wallet_id off the keygen
// response and dropped it on the floor, so deposits could be credited and
// never swept.
GenerateAddress(ctx context.Context, customerID string, chain string) (Wallet, error)
// GetBalance returns the balance for an address
GetBalance(ctx context.Context, address string, chain string) (*Balance, error)
// EstimateFee estimates transaction fees for a payment
EstimateFee(ctx context.Context, req PaymentRequest) (currency.Cents, error)
// SupportedChains returns the list of supported blockchain networks
SupportedChains() []string
}
// SubscriptionProcessor extends PaymentProcessor with subscription methods
type SubscriptionProcessor interface {
PaymentProcessor
// CreateSubscription creates a recurring subscription
CreateSubscription(ctx context.Context, req SubscriptionRequest) (*Subscription, error)
// GetSubscription retrieves subscription details
GetSubscription(ctx context.Context, subscriptionID string) (*Subscription, error)
// CancelSubscription cancels a subscription
CancelSubscription(ctx context.Context, subscriptionID string, immediately bool) error
// UpdateSubscription modifies a subscription
UpdateSubscription(ctx context.Context, subscriptionID string, req SubscriptionUpdate) (*Subscription, error)
// ListSubscriptions lists subscriptions for a customer
ListSubscriptions(ctx context.Context, customerID string) ([]*Subscription, error)
}
// CustomerProcessor extends PaymentProcessor with customer management
type CustomerProcessor interface {
PaymentProcessor
// CreateCustomer creates a customer in the processor
CreateCustomer(ctx context.Context, email, name string, metadata map[string]interface{}) (string, error)
// GetCustomer retrieves customer details
GetCustomer(ctx context.Context, customerID string) (map[string]interface{}, error)
// UpdateCustomer updates customer details
UpdateCustomer(ctx context.Context, customerID string, updates map[string]interface{}) error
// DeleteCustomer removes a customer
DeleteCustomer(ctx context.Context, customerID string) error
// AddPaymentMethod adds a payment method to a customer
AddPaymentMethod(ctx context.Context, customerID, token string) (string, error)
// RemovePaymentMethod removes a payment method
RemovePaymentMethod(ctx context.Context, customerID, paymentMethodID string) error
}