Class: Mpp::Methods::Stripe::ChargeIntent

Inherits:
Object
  • Object
show all
Defined in:
lib/mpp/methods/stripe/charge_intent.rb

Overview

Server-side charge intent that verifies payment via Stripe PaymentIntents. Requires the ‘stripe` gem.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(secret_key:, api_base: Defaults::STRIPE_API_BASE, client: nil) ⇒ ChargeIntent

Returns a new instance of ChargeIntent.



14
15
16
17
18
19
 
# File 'lib/mpp/methods/stripe/charge_intent.rb', line 14

def initialize(secret_key:, api_base: Defaults::STRIPE_API_BASE, client: nil)
  @name = "charge"
  @secret_key = secret_key
  @api_base = api_base
  @client = client
end

Instance Attribute Details

#name ⇒ Object (readonly)

Returns the value of attribute name.



12
13
14
 
# File 'lib/mpp/methods/stripe/charge_intent.rb', line 12

def name
  @name
end

Instance Method Details

#verify(credential, request) ⇒ Object 



21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
 
# File 'lib/mpp/methods/stripe/charge_intent.rb', line 21

def verify(credential, request)
  # Check challenge expiry
  challenge_expires = credential.challenge.expires
  if challenge_expires
    expires = Time.iso8601(challenge_expires.gsub("Z", "+00:00"))
    raise Mpp::VerificationError, "Request has expired" if expires < Time.now.utc
  end

  payload_data = credential.payload
  unless payload_data.is_a?(Hash) && payload_data.key?("spt")
    raise Mpp::VerificationError, "Invalid credential payload: missing spt"
  end

  spt = payload_data["spt"]
  credential_external_id = payload_data["externalId"]
  request_external_id = request["externalId"]
  if !request_external_id.nil? && credential_external_id != request_external_id
    raise Mpp::InvalidChallengeError.new(
      challenge_id: credential.challenge.id,
      reason: "credential externalId does not match request externalId"
    )
  end

  method_details = request["methodDetails"]
  method_details = {} unless method_details.is_a?(Hash)

  # Enforce the payment method types allowlist from the challenge
  payment_method_types = method_details["paymentMethodTypes"]
  unless payment_method_types.is_a?(Array) &&
      payment_method_types.any? &&
      payment_method_types.all? { |type| type.is_a?(String) && !type.strip.empty? }
    raise Mpp::VerificationError, "Invalid or missing methodDetails.paymentMethodTypes"
  end

  # Build PaymentIntent params
  params = {
    amount: Integer(request["amount"]),
    currency: request["currency"],
    shared_payment_granted_token: spt,
    confirm: true,
    payment_method_types: payment_method_types
  }

  # Include metadata from methodDetails if present
  if method_details["metadata"].is_a?(Hash)
    params[:metadata] = method_details["metadata"].transform_values(&:to_s)
  end

  unless @client
    begin
      Kernel.require "stripe"
    rescue LoadError
      raise "stripe gem is required for Stripe charge verification. Install with: gem install stripe"
    end
  end

  begin
    client = @client || ::Stripe::StripeClient.new(@secret_key)
    result = client.v1.payment_intents.create(
      params,
      {idempotency_key: stripe_idempotency_key(credential)}
    )
  rescue => e
    raise Mpp::VerificationError, e.message
  end

  # https://docs.stripe.com/error-low-level#idempotency
  if result.respond_to?(:last_response) &&
      result.last_response&.headers&.[]("idempotent-replayed") == "true"
    raise Mpp::VerificationError, "Payment has already been processed."
  end

  pi_id = result.id
  status = result.status

  if status == "requires_action"
    raise Mpp::PaymentActionRequiredError.new(reason: "PaymentIntent #{pi_id} requires action")
  end

  unless status == "succeeded"
    raise Mpp::VerificationError, "PaymentIntent #{pi_id} has status: #{status}"
  end

  Mpp::Receipt.success(pi_id, method: "stripe", external_id: request_external_id)
end