1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
// Allow missing docs in this module - stripe integration is internal
//! Stripe Webhook Handler Module
//!
//! This module provides secure, production-ready Stripe webhook handling for SaaS
//! subscription services. It implements:
//!
//! - **Signature Verification**: HMAC-SHA256 validation of the `stripe-signature` header
//! - **Idempotency**: Deduplication of webhook deliveries using event IDs
//! - **Async Processing**: Non-blocking webhook handling with background task execution
//! - **Event Handling**: Support for subscription, invoice, and customer events
//! - **Error Recovery**: Configurable retry logic with exponential backoff
//!
//! # Architecture
//!
//! ```text
//! Request -> Signature Verify -> Idempotency Check -> Ack (200) -> Async Process
//! | | |
//! v v v
//! 400/401 202 (already) Background Task
//! ```
//!
//! # Security
//!
//! - CONS-003 COMPLIANT: Webhook signing secret loaded from environment
//! - Constant-time signature comparison to prevent timing attacks
//! - Raw body parsing to ensure signature verification works correctly
//!
//! # Example
//!
//! ```rust,no_run
//! use reasonkit_web::stripe::{
//! stripe_webhook_router, CustomerEvent, InvoiceEvent, StripeWebhookConfig,
//! StripeWebhookState, SubscriptionEvent, SubscriptionHandler,
//! };
//! use std::sync::Arc;
//!
//! #[tokio::main]
//! async fn main() -> anyhow::Result<()> {
//! let config = StripeWebhookConfig::from_env()?;
//! let handler = Arc::new(MySubscriptionHandler);
//! let (state, processor_handle) = StripeWebhookState::new(config, handler);
//!
//! // Run background processing loop
//! tokio::spawn(async move {
//! processor_handle.run().await;
//! });
//!
//! let _app = stripe_webhook_router(Arc::new(state));
//! // ... serve with axum
//! Ok(())
//! }
//!
//! struct MySubscriptionHandler;
//!
//! #[async_trait::async_trait]
//! impl SubscriptionHandler for MySubscriptionHandler {
//! async fn on_subscription_created(&self, _event: &SubscriptionEvent) -> anyhow::Result<()> {
//! Ok(())
//! }
//!
//! async fn on_subscription_updated(&self, _event: &SubscriptionEvent) -> anyhow::Result<()> {
//! Ok(())
//! }
//!
//! async fn on_subscription_deleted(&self, _event: &SubscriptionEvent) -> anyhow::Result<()> {
//! Ok(())
//! }
//!
//! async fn on_payment_succeeded(&self, _event: &InvoiceEvent) -> anyhow::Result<()> {
//! Ok(())
//! }
//!
//! async fn on_payment_failed(&self, _event: &InvoiceEvent) -> anyhow::Result<()> {
//! Ok(())
//! }
//!
//! async fn on_customer_created(&self, _event: &CustomerEvent) -> anyhow::Result<()> {
//! Ok(())
//! }
//! }
//! ```
// Re-export commonly used items
pub use StripeWebhookConfig;
pub use ;
pub use ;
pub use ;
pub use ;
pub use ;
pub use SignatureVerifier;