stripe verify

etc/mnml.SAMPLE.env

@@ -1,6 +0,0 @@
-#!/bin/bash
-
-export MNML_USER=$(whoami)
-export MNML_PG_PASSWORD=$(openssl rand -base64 16)
-export MNML_PG_HOST="localhost"
-

etc/mnml/gs.conf

@@ -5,3 +5,4 @@ MAIL_DOMAIN=vinyl.mnml.gg
 MAIL_PASSWORD=mmmmmmmmmmmmmmmm
 
 STRIPE_SECRET=shhhhhhhhhh
+STRIPE_WH_SECRET=SHHHHHHH

server/src/payments.rs

@@ -230,10 +230,31 @@ fn process_stripe_event(event: Event, pool: &PgPool) -> Result<String, Error> {
 }
 
 pub fn stripe(req: &mut Request) -> IronResult<Response> {
-    let state = req.get::<Readable<State>>().unwrap();
-    let event = match req.get::<bodyparser::Struct<Event>>() {
-        Ok(Some(b)) => b,
-        _ => return Err(IronError::from(MnmlHttpError::BadRequest)),
+    let webhook_secret = env::var("STRIPE_WH_SECRET").ok();
+    let state= req.get::<Readable<State>>().unwrap();
+
+    let event = match webhook_secret {
+        // prod mode
+        Some(s) => {
+            let mut payload = String::new();
+            req.body.read_to_string(&mut payload)
+                .or(Err(IronError::from(MnmlHttpError::BadRequest)))?;
+
+            let sig = match req.headers.get_raw("Stripe-Signature") {
+                Some(s) => String::from_utf8(s[0].clone())
+                    .or(Err(IronError::from(MnmlHttpError::BadRequest)))?,
+                None => return Err(IronError::from(MnmlHttpError::BadRequest)),
+            };
+
+            stripe::Webhook::construct_event(payload, sig, s)
+                .or(Err(IronError::from(MnmlHttpError::BadRequest)))?
+        },
+
+        // dev server
+        None => match req.get::<bodyparser::Struct<Event>>() {
+            Ok(Some(b)) => b,
+            _ => return Err(IronError::from(MnmlHttpError::BadRequest)),
+        },
     };
 
     match process_stripe_event(event, &state.pool) {