Move payments into its own Worker #2

1. JTJustin Torre opened this 3 hours ago

   storefront-api has held STRIPE_SECRET_KEY since checkout landed, next to every public route, the admin routes and image uploads. Stripe code was also split across two Workers: storefront-api created intents and storefront-stripe-webhook verified events. This moves all of it into one Worker, storefront-payments, ahead of adding refunds.

   What changes

   • New workers/payments. Its PaymentsService entrypoint has createIntent and cancelIntent; its fetch handler is the webhook at POST /stripe/webhook, moved over unchanged. It holds STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET and settles orders through OrdersService, as before.
   • storefront-api calls payments over a new PAYMENTS service binding. src/payments.ts is now just the Payments interface, which the binding and FakePayments both implement. No stripe import and no Stripe secret are left in src/.
   • workers/stripe-webhook is deleted.
   • Architecture: payments replaces stripe-webhook in system.yaml; storefront-api's edge to Stripe becomes an edge to payments. In the checkout and order fulfilment flows the charge and the webhook steps are rerouted through payments, and there is a new flow for order expiry, which now crosses both Workers.
   • Knowledge base: decision 0010 supersedes 0005, a new payments concept, and updates to the checkout, webhook, local development and testing notes.

   The Visual tab on Files changed shows the system and flow changes.

   Rollout

   1. Deploy storefront-payments and set its two secrets.
   2. Add its /stripe/webhook URL as a second endpoint in the Stripe dashboard, subscribed to payment_intent.succeeded and payment_intent.canceled.
   3. Deploy storefront-api (it needs the payments service to exist for the binding).
   4. Once the old endpoint has had no deliveries for a day, remove it in Stripe and npx wrangler delete storefront-stripe-webhook.

   Both endpoints settling the same event is harmless: markPaid and cancel only move an order forward once.

   Testing

   npm test (49 tests). The webhook tests run against workers/payments/src/webhook.ts, and the Stripe adapter tests against workers/payments/src/stripe.ts. kb check and arch check pass.

2. workers/payments/src/index.ts line 10

   10    return stripePayments(this.env.STRIPE_SECRET_KEY).createIntent(charge);

   1. JTJustin Torre 3 hours ago

      This builds a Stripe client on every call. It is cheap (no network until the request), and it keeps the key read from this.env per request instead of caching a client in module scope across secret rotations. If refunds add more methods, a small private get stripe() would tidy it up.

3. JTJustin Torre reviewed 3 hours ago on e83464eCommented

   Notes for whoever reviews this. The Visual tab is the quickest way in: the system diagram shows stripe-webhook removed and payments added, and in the checkout flow the PaymentIntent step is rerouted from storefront-api to payments with a new PaymentsService step before it. The part I would look at hardest is the rollout order in the description, since the two Workers now bind each other and storefront-api will not deploy until storefront-payments exists. Holding the merge until both Stripe endpoints are registered.

Sign in to comment.