Files
zeekay 73b7290e7f square: one webhook route and one verifier; secrets come from the host's KMS
Square keeps an event's created_at across every retry, and the receiver
refused anything older than five minutes, so every retry of an event
first sent while cloud was down (Recreate, ten rollouts a day) was refused
until Square gave up. The verifier now lives in payment/providers/square
and needs only the key and the URL; thirdparty/square is the API client
and no longer registers itself or verifies anything, so every registry
holds one Square type.

Replay is stopped by the event id instead: each verified event is
recorded once for the whole deployment, keyed on the verifying processor
and the event id with an insert-if-absent swap, so a repeat is a
duplicate under any path or org. The path names the one processor that
verifies, and only one that holds its webhook secret may: an unknown name,
or a verifier that needs no secret, is refused rather than tried.
The books an event lands in are the verifying account's, else the
deployment's brand — never a header or session, which on a replay are the
replayer's. An effect that did not land (a store or the ledger did not
answer) leaves the delivery open with a 503, so the provider redelivers;
it used to be acknowledged and never retried. A settlement reads the
payment index before the org's books, because an in-session charge's
receipt is in the payer's org.

POST /v1/commerce/webhooks/:provider is declared once, in setupRoutes, so
standalone and embedded commerce serve the same address; the
/v1/billing/webhooks spelling is gone.

thirdparty/kms read /v1/kms/orgs/<org>/secrets/..., which cloud no longer
serves, and was off in production anyway, so per-org payment credentials
never loaded. It is deleted. secrets.Org reads orgs/<org>/<name> through
the host's reader, the caller re-pointed at that org with zip.ActingAs so
the KMS tenancy check admits it, and payment.Hydrate loads an org's
credentials where the org receives the money: storefront checkout,
storefront subscriptions and wire, and the brand's bank for the billing
wire rail. Hanzo's own billing no longer reads the paying org's
credentials; it charges the deployment's account, as it did. The
standalone binary reads through hanzoai/kms/sdk/go.
2026-10-19 09:12:56 -07:00

208 lines
5.9 KiB
Go

package workflows
import (
"context"
"fmt"
"time"
"github.com/hanzoai/commerce/billing/engine"
"github.com/hanzoai/commerce/datastore"
"github.com/hanzoai/commerce/models/billinginvoice"
"github.com/hanzoai/commerce/models/plan"
"github.com/hanzoai/commerce/models/subscription"
)
// Activity parameter and result types
type TransitionParams struct {
OrgName string `json:"orgName"`
SubscriptionId string `json:"subscriptionId"`
NewStatus string `json:"newStatus"`
}
type CancelParams struct {
OrgName string `json:"orgName"`
SubscriptionId string `json:"subscriptionId"`
AtPeriodEnd bool `json:"atPeriodEnd"`
}
type ChangePlanParams struct {
OrgName string `json:"orgName"`
SubscriptionId string `json:"subscriptionId"`
NewPlanId string `json:"newPlanId"`
Prorate bool `json:"prorate"`
}
type RenewalParams struct {
OrgName string `json:"orgName"`
SubscriptionId string `json:"subscriptionId"`
}
type RenewalResult struct {
Success bool `json:"success"`
InvoiceId string `json:"invoiceId"`
NextPeriodEnd time.Time `json:"nextPeriodEnd"`
}
type CollectInvoiceParams struct {
OrgName string `json:"orgName"`
InvoiceId string `json:"invoiceId"`
}
type CollectionActivityResult struct {
Success bool `json:"success"`
}
type MarkUncollectibleParams struct {
OrgName string `json:"orgName"`
InvoiceId string `json:"invoiceId"`
}
// BillingActivities holds dependencies for activity implementations.
type BillingActivities struct {
// Prepaid resolves an org's prepaid money — credits, then the balance on the
// one ledger — injected from the billing package to avoid circular imports.
// nil collects from the card alone.
Prepaid func(ctx context.Context, orgName string) engine.Prepaid
// ChargeProvider charges the subscription's vaulted card for whatever prepaid
// money did not cover (injected like Prepaid to avoid import cycles). nil
// keeps the prepaid-only waterfall — the workflow driver leaves it unset
// unless it can build a per-org charger.
ChargeProvider engine.ProviderCharger
}
// TransitionSubscriptionActivity updates a subscription's status.
func (a *BillingActivities) TransitionSubscriptionActivity(ctx context.Context, params TransitionParams) error {
db := orgDB(ctx, params.OrgName)
sub := subscription.New(db)
if err := sub.GetById(params.SubscriptionId); err != nil {
return fmt.Errorf("subscription not found: %w", err)
}
sub.Status = subscription.Status(params.NewStatus)
return sub.Update()
}
// CancelSubscriptionActivity cancels a subscription.
func (a *BillingActivities) CancelSubscriptionActivity(ctx context.Context, params CancelParams) error {
db := orgDB(ctx, params.OrgName)
sub := subscription.New(db)
if err := sub.GetById(params.SubscriptionId); err != nil {
return fmt.Errorf("subscription not found: %w", err)
}
if err := engine.CancelSubscription(sub, params.AtPeriodEnd); err != nil {
return err
}
return sub.Update()
}
// ChangePlanActivity changes a subscription's plan.
func (a *BillingActivities) ChangePlanActivity(ctx context.Context, params ChangePlanParams) error {
db := orgDB(ctx, params.OrgName)
sub := subscription.New(db)
if err := sub.GetById(params.SubscriptionId); err != nil {
return fmt.Errorf("subscription not found: %w", err)
}
plan := newPlan(db)
if err := plan.GetById(params.NewPlanId); err != nil {
return fmt.Errorf("plan not found: %w", err)
}
_, err := engine.ChangePlan(sub, plan, params.Prorate)
if err != nil {
return err
}
return sub.Update()
}
// RenewSubscriptionActivity generates an invoice and attempts collection.
func (a *BillingActivities) RenewSubscriptionActivity(ctx context.Context, params RenewalParams) (*RenewalResult, error) {
db := orgDB(ctx, params.OrgName)
sub := subscription.New(db)
if err := sub.GetById(params.SubscriptionId); err != nil {
return nil, fmt.Errorf("subscription not found: %w", err)
}
inv, result, err := engine.RenewSubscription(ctx, db, sub, a.prepaid(ctx, params.OrgName), a.ChargeProvider)
if err != nil {
return nil, err
}
if err := sub.Update(); err != nil {
return nil, fmt.Errorf("failed to update subscription: %w", err)
}
return &RenewalResult{
Success: result.Success,
InvoiceId: inv.Id(),
NextPeriodEnd: sub.PeriodEnd,
}, nil
}
// CollectInvoiceActivity attempts to collect payment on an invoice.
func (a *BillingActivities) CollectInvoiceActivity(ctx context.Context, params CollectInvoiceParams) (*CollectionActivityResult, error) {
db := orgDB(ctx, params.OrgName)
inv := billinginvoice.New(db)
if err := inv.GetById(params.InvoiceId); err != nil {
return nil, fmt.Errorf("invoice not found: %w", err)
}
result, err := engine.CollectInvoice(ctx, db, inv, a.prepaid(ctx, params.OrgName), a.ChargeProvider)
if err != nil {
return nil, err
}
if err := inv.Update(); err != nil {
return nil, fmt.Errorf("failed to update invoice: %w", err)
}
return &CollectionActivityResult{Success: result.Success}, nil
}
// MarkUncollectibleActivity marks an invoice as uncollectible.
func (a *BillingActivities) MarkUncollectibleActivity(ctx context.Context, params MarkUncollectibleParams) error {
db := orgDB(ctx, params.OrgName)
inv := billinginvoice.New(db)
if err := inv.GetById(params.InvoiceId); err != nil {
return fmt.Errorf("invoice not found: %w", err)
}
if err := inv.MarkUncollectible(); err != nil {
return err
}
return inv.Update()
}
// prepaid is the org's prepaid money, or nil when none was injected.
func (a *BillingActivities) prepaid(ctx context.Context, orgName string) engine.Prepaid {
if a.Prepaid == nil {
return nil
}
return a.Prepaid(ctx, orgName)
}
// orgDB creates a datastore scoped to an org namespace.
func orgDB(ctx context.Context, orgName string) *datastore.Datastore {
db := datastore.New(ctx)
if orgName != "" {
db.SetNamespace(orgName)
}
return db
}
// newPlan creates a new plan model for lookup.
func newPlan(db *datastore.Datastore) *plan.Plan {
return plan.New(db)
}