GithubHelp home page GithubHelp logo

stripe-samples / accept-a-payment Goto Github PK

View Code? Open in Web Editor NEW
577.0 577.0 461.0 27.93 MB

Learn how to accept a payment from customers around the world with a variety of payment methods.

License: MIT License

Ruby 8.70% Java 2.57% Kotlin 4.84% Swift 2.91% HTML 8.32% JavaScript 32.75% TypeScript 7.79% PHP 14.20% CSS 8.64% Python 2.33% C# 2.63% Go 2.38% Hack 0.32% Vue 1.42% Shell 0.20%

accept-a-payment's People

Contributors

alexbudgh avatar aliriaz-stripe avatar bensnell-stripe avatar bonsanto-stripe avatar bpj-stripe avatar brendanm-stripe avatar ccen-stripe avatar cecilphillip avatar cecilphillip-stripe avatar charlesw-stripe avatar charliegerard-stripe avatar cjavilla-stripe avatar dependabot[bot] avatar erinkavanaugh-stripe avatar github-actions[bot] avatar hibariya avatar hideokamoto-stripe avatar joshnuss avatar karlr-stripe avatar kevinpeters-stripe avatar kndarp avatar kronthto avatar liammcarthur avatar paulasjes-stripe avatar rafapaliwoda-stripe avatar seanzhang-stripe avatar sj-stripe avatar skyler-stripe avatar thorsten-stripe avatar thorwebdev avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

accept-a-payment's Issues

Add disclaimers and restrictions to index and detail views

We need to communicate restrictions like (don't really need to cover all, but most would be good):

  • only works for Stripe accounts in MY
  • only works with X and Y currencies
  • only works for X currencies on Stripe accounts in X countries
  • only works with https
  • only works with specific MCC

Auto merge Dependabot PRs on CI success

By this PR the CI workflow runs on Dependabot PRs, too. I believe it's good if we can auto-merge those of CI succeeded because then we can ignore lots of PRs and only care about failed ones.

If this sounds good, I'd like to work on it. I think we can do that by doing a similar thing as automerge.yml when all the CI jobs succeed on a Dependabot PR.

📝 When I work on it, I want to know if we should keep the automerge.yml. I'm not sure the reason why currently they are being auto-merged immediately.

README Documentation Update Required

Bug report

Documentation update:

config.ini should be updated to .env in accept-a-payment/prebuilt-checkout-page/server/php/README.md

Describe the bug

The accept-a-payment/prebuilt-checkout-page/server/php/README.md references config.ini instead of .env.

Also make a note that .env.example is above the server folder and the copied .env should be in the server folder.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

Navigate to https://github.com/stripe-samples/accept-a-payment/tree/main/prebuilt-checkout-page/server/php to see the README.md.

Expected behavior

config.ini should be changed to .env and config.ini.sample to .env.example.

Screenshots

System information

Additional context

[Android] Move PaymentIntent creation into a central method

The `set-output` command is deprecated

Description

The set-output became deprecated and now CI outputs warning messages like this:

Warning: The set-output command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/

According to the announcement, we have to migrate to the new syntax by 31st May 2023.

https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/

To Reproduce

It occurs when CI runs.
Here's an example: https://github.com/stripe-samples/accept-a-payment/actions/runs/3297935428

Expected behavior

No deprecation messages.

setapikey

Uncaught Error: Class "Stripe\Stripe" not found

Fjrj

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

Yemen

Bug reportY

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

[email protected]

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

The Swift UI custom payment flow sample does not run in Xcode 14

Attempting to run the custom-payment-flow/client/ios-swiftui sample in Xcode 14 throws two instances of the following error:

Stored properties cannot be marked potentially unavailable with '@available'

There's also the following warning:

'IndexDistance' is deprecated: All index distances are now of type Int

Captured on 2022-10-14 at 10 58 42@2x

no vue example/template via CLI

Bug report

Describe the bug

The Vue example is not available via the CLI, but I do think it's in the source code

To Reproduce

stripe samples create accept-a-payment
# then select:
payment-element

Expected behavior

vue should be an option

Screenshots

image

System information

  • OS: macOS

Error 404 in http://localhost:3000/card

Bug report

Describe the bug

When the html server is up and running and go to card section the console throw a 404 not found.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to http://localhost:3000/card
  2. Show the devtools > network
  3. See error

Expected behavior

Should not throw a 404 error

Screenshots

image

System information

  • OS: Windows
  • Browser: Google Chrome
  • Server environment: TypeScript

Cv19

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

1NONLYTG

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

Log errors using error_log() instead of using echo to display them

echo json_encode(['error' => ['message' => $e->getError()->message]]);

As a best practice it's probably better to use error_log() to write error information to the PHP error log rather than echo it to the output. Two instances of where this needs to change are referenced above.

Ok

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

Brooklyn

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

Checkout Page Code (Question)

Hi,

When I use the examples provided in this repository and others, after hitting checkout, I get redirected to checkout.stripe.com (below is screenshot) Is the code for this page posted somewhere as I could not find it? I would like to host this page myself with some minor modification -

StripeCheckoutPage

If this is not a right place for this question, could you please point me to the appropriate contact.

Thanks,
Karthik

Possible alternatives for producing cleaner/easier to read and write output

This isn't an issue per se, it's more of a "here's what's possible" kind of thing and a recommendation.

echo "<p>Payment " . $paymentIntent->id . " has status: " . $paymentIntent->status . '</p>';
echo "<a href='/afterpay-clearpay.php'>Try Afterpay/Clearpay again</a><br>";
echo "<a href='/'>Restart demo</a>";

The code above uses echo statements, which work fine, but there are some other approaches that might be a better fit.

The first alternative is heredoc syntax, which would look like this:

<<<HEREDOC
<p>Payment $paymentIntent->id has status: $paymentIntent->status</p>
<a href="/afterpay-clearpay.php">Try Afterpay/Clearpay again</a><br>
<a href="/">Restart demo</a>
HEREDOC;

That's somewhat easier to read and write, and a bit more forgiving about getting the syntax exactly right by avoiding all the concatenation. You also don't need to worry about mixing and matching single and double quotes.

You can also drop out of PHP back to HTML:

?>
<p>Payment <?php echo $paymentIntent->id; ?> has status: <?php echo $paymentIntent->status; ?></p>
<a href="/afterpay-clearpay.php">Try Afterpay/Clearpay again</a><br>
<a href="/">Restart demo</a>
<?php

For this particular bit I probably would have used heredoc syntax because of how easy it is to include object properties inline.

Stride

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

0

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

Investigating failing CI runs

According to the outputs of the webservers, the CI does not get the right secret API key these days. I guess the Stripe CLI process is failing due to the same reason. Could you check if the secrets below are set?

  • TEST_STRIPE_PUBLISHABLE_KEY
  • TEST_STRIPE_SECRET_KEY

The output of the webserver (Ruby): https://github.com/stripe-samples/accept-a-payment/runs/4062828436#step:6:118

web_1       | Your secret API key (STRIPE_SECRET_KEY) is configured incorrectly or
web_1       | doesn't match the expected format.  You can find your API keys in the Stripe
web_1       | dashboard here: https://dashboard.stripe.com/test/apikeys. Then update
web_1       | the .env file.

stripe process seems exited abnormally: https://github.com/stripe-samples/accept-a-payment/runs/4062828436#step:6:84

                  Name                                Command               State    Ports
------------------------------------------------------------------------------------------
accept-a-payment_runner_1                  /work/sample-ci/docker/run ...   Up            
accept-a-payment_runner_run_f839113385d7   /bin/sh -c true                  Exit 0        
accept-a-payment_stripe_1                  /bin/ash -c /bin/stripe -- ...   Exit 1        
accept-a-payment_web_1                     /work/sample-ci/docker/rub ...   Exit 0  

accept_payment

{
"name": "accept-a-payment",
"configureDotEnv": true,
"integrations": [
{
"name": "payment-element",
"clients": ["html", "react-cra"],
"servers": [
"ruby",
"node",
"python",
"php",
"java",
"go",
"dotnet",
"node-typescript"
]
},
{
"name": "prebuilt-checkout-page",
"clients": ["html", "react-cra", "vue-cva"],
"servers": [
"ruby",
"node",
"python",
"php",
"java",
"go",
"dotnet"
]
},
{
"name": "custom-payment-flow",
"clients": ["html", "react-cra", "ios", "android-kotlin", "ios-swiftui"],
"servers": [
"ruby",
"node",
"python",
"php",
"java",
"go",
"dotnet",
"node-typescript"
]
}
]
}
stripe-cli-1.8.11.zip

Add

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

Only accept minimum info?

Should we always collect name? email? minimum?

If we only collect the minimum, that's most likely to help with conversion optimization.

If we don't collect name or email, then the user might be curious about how to pass billing details.

Add polling or delay to return pages

Some of the redirect payment methods like grabpay will redirect before the payment is done processing. Let's add a poll with setInterval to refetch the payment intent and display a simple log of statuses until success.

Improve consistency of error handling in shared.php

In shared.php errors are handled in several different ways:

  • Sometimes HTML is displayed with a 200 status code
  • Sometimes plain text is displayed with a 500 status code
  • Sometimes JSON is displayed with a 500 status code

A single approach to error handling should be chosen and used throughout for consistency.

Payment

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

Improve code that handles config.ini not existing

if(!file_exists('../config.ini')) {
echo "<p>Make a copy of <code>config.ini.sample</code> and name it <code>config.ini</code>, then populate the variables.</p>";
echo "<p>It should look something like the following, but contain your <a href='https://dashboard.stripe.com/test/apikeys'>API keys</a> and a <a href='https://stripe.com/docs/api/prices/create'>Price ID</a>.:</p>";
echo "<pre>";
echo "stripe_secret_key = sk_test_1234...\n";
echo "stripe_publishable_key = pk_test_1234...\n";
echo "stripe_webhook_secret = whsec_1234...\n";
echo "price = price_123...\n";
echo "domain = http://localhost:4242\n";
echo "</pre>";
echo "<hr>";
echo "You can use this command to get started:<br>";
echo "<pre>cp config.ini.sample config.ini</pre>";
exit;
}

There's no need for all these echo statements and worrying about quote types and inserting newlines manually, you can instead drop out of PHP and spit out HTML:

 if(!file_exists('../config.ini')) {
   ?>
   <p>Make a copy of <code>config.ini.sample</code> and name it <code>config.ini</code>, then populate the variables.</p> 
   <p>It should look something like the following, but contain your <a href="https://dashboard.stripe.com/test/apikeys">API keys</a> and a <a href="https://stripe.com/docs/api/prices/create">Price ID</a>.:</p>
   <pre>stripe_secret_key = sk_test_1234...
stripe_publishable_key = pk_test_1234...
stripe_webhook_secret = whsec_1234...
price = price_123...
domain = http://localhost:4242</pre>
   <hr>
   <p>You can use this command to get started:</p>
   <pre>cp config.ini.sample config.ini</pre>
   <?php
   exit; 
 } 

Figure out the best return_url for all redirects

Couple options:

  1. They could all return to the same route as the payment method with ?return=true query string
  2. They could all return to a common return path like /return
    a. I think every single one will refetch the payment intent and display the status
    b. This might not be perfect tho, in case a future payment method requires something else on return keeping them separate is safer?

How do we want to refetch state? poll with set/clear interval?

How should we build the return URL? Thinking we might want to use window.location.

[Discussion] Upgrade Stripe API versions

Summary

Upgrade API version on each server side examples.

Context

Several example apps are not using the latest API.
We may need to think about upgrading these API versions.
https://github.com/stripe-samples/accept-a-payment/search?q=apiVersion
https://github.com/stripe-samples/accept-a-payment/search?q=%222020-08-27%22

Workflow

  • List the files writing non-latest API version.
  • Make a new PR to upgrade it for each files/examples.
  • Run the unit/e2e test and merge this PR after passing it.

Lists

  • custom-payment-flow/server/php
  • custom-payment-flow/server/python
  • custom-payment-flow/server/ruby
  • payment-element/server/note-typescript
  • payment-element/server/python
  • payment-element/server/ruby
  • prebuilt/checkout-page/server/python
  • prebuilt/checkout-page/server/ruby

DÖKÜMANDA ÖDEME

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

?????

stripe-sample-code (9).zip

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

Hello

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

Stripe imtegration

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

[Discussion] Add the error code & type to the API response

Summary

Add the error code and error type from the Stripe API to the API response.

example:

    return res.status(400).send({
      error: {
        message: e.message,
+       code: e.code,
+       type: e.type,  
      },
    });

Background

Some testing codes are using an error message from the Stripe API.
But when the error message is changed, it will be failed. And we need to update the test code to follow its updates.
example: https://github.com/stripe-samples/accept-a-payment/pull/1382/files

We can reduce these tasks when we use the error code and type instead of the error message.

DÖKÜMAN 1

Bug report

Describe the bug

A clear and concise description of what the bug is.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

  • OS: [e.g. macOS, Windows]
  • Browser (if applies) [e.g. chrome, safari]
  • Server environment [e.g. Go, Java, Node, PHP, Python, Ruby, TypeScript]

Additional context

Add any other context about the problem here.

apple pay / google pay / payment request button

Thinking we might want to combine the payment request button for the web and just call it payment-request.html and payment-request.js

Unfortunately, all of the payment request demos have so many restrictions around https and having cards setup in chrome / google pay settings that it'll be hard for anyone to test locally.

Proposal: Allow CI to run tests safely for PRs from non-maintainer of stripe-samples

Hi, I have a proposal to improve the CI. I appreciate your comments.

The Problem

Currently, we cannot run CI properly for PRs from non-maintainers since they don't have permission to read the secrets which are mandatory to run the tests. Because of that, we have to merge first before checking the result of the CI and it's inconvenient for everyone.

A Possible Solution

I think we can change the current CI workflow and make those failed CI jobs retryable with the right permission for only maintainers.

  • Change to trigger CI with pull_request_target event instead of pull_request so that the job can read the secrets.
  • Because pull_request_target triggers jobs with write permissions, that cannot be granted unconditionally. We make the workflow check if the user who triggered the event is in the list of the maintainers before running the tests.
    • We create and maintain a list of maintainers who can run tests.
    • If the job wasn't triggered by one of the maintainers, abort before running the tests.
    • If the job was triggered by one of the maintainers, run tests as ever.

The following chart illustrates how CI runs tests or aborts.

flowchart LR
A[Start CI] --> B{Triggered by a maintainter?}
B -->|Yes| C[Checkout Code]
C --> D[Run the tests w/ write permissons]
D --> E[End]
B -->|No| F[Abort]
F --> E

The workflow will be like the screenshot below. All the jobs will depend on the require-permission job and this job checkus if the job was triggered by a maintainer.

An Implementation

I created a PR to implement it: #1612

How to Use It: A Typical Scenario

  1. A non-maintainer opens a pull request to stripe-samples/accept-a-payment
  2. CI runs but it aborts before running the tests since the pull request author is not in the mainainers list (like this)
  3. One of the maintainers review the pull request and confirm it's harmless
  4. The maintainer re-runs the aborted CI run
  5. CI runs again and since the job is triggered by one of the maintainers this time, the CI runs all the tests with right permissions

Working Examples

📝 Note that in my fork, I made myself (hibariya) as a maintainer for testing.

This example shows that if a non-maintainer opened the PR, the CI aborts. The CI is failing on the require-permission job.
hibariya#1315

This example shows that if a maintainer re-ran the aborted CI like the above, it runs tests. You can confirm that the latest run is triggered by a maintainer (me) here.
hibariya#1317

This example shows that if a maintainer opened the PR, the CI runs tests as ever.
hibariya#1316

This example shows that if a maintainer pushed commits to the main branch, the CI runs tests as ever.
hibariya@3bc03ab

The List of Maintainers

I'm thinking of maintaining the list as an ordinary environment variable in the ci.yml so far.

Another Solution: "safe to test" label

This article suggests using labels to run jobs triggered by pull_request_target safely.

https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

However, it also says it should be a temporary solution since it could lead to race conditions.

Note that this kind of label based verification is still prone to a race condition in which the attacker may push new changes after the workflow was approved (labeled), but has not started yet.

The proposal of this issue does not introduce these kinds of race conditions since it requires retrying the job that is associated with a known commit.

OXXO voucher email

Hello,

This is not a bug report, it's a feature request, as per WC customer support:

Currently, the OXXO voucher barcode and ref. number are not included in the order confirmation email (to customer). The voucher only appears as a (Stripe hosted) pop-up after order completion, and there’s no more reference to it, or way to retrieve it.

A logic step would be: as the customer has to go physically to a store, scan the voucher (or provide ref. number), the voucher should be made easily available to the user (i.e. to send it together with the order confirmation email); or at least the unique URL to the hosted Stripe voucher page. Currently, the only option is to print the voucher (not sure who actually prints these days, specially mobile-first users).

We've been in contact with Stripe developers, and it's already baked in their solution, it just needs to be integrated into the plugin. Here are the guidelines and references to make it easier for you:

_I totally understand the need of making the payment process more efficient and practical. There is indeed an option to email the voucher link to your customers, but you may need to have access to edit the integration made by your platform WooCommerce.

Stripe sends a payment_intent.requires_action event when an OXXO voucher is created successfully. If you need to email your customers the voucher link, you can retrieve the PaymentIntent to get the link upon receiving the event. The hosted_voucher_url field in payment_intent.next_action.oxxo_display_details contains the link to the voucher.

You can see this information in our Docs here:
https://stripe.com/docs/payments/oxxo/accept-a-payment?platform=web#optional:-email-voucher-link-to-your-customer

Setting up OXXO payment instructions in Spanish by passing the instructions parameter:
https://stripe.com/docs/payments/oxxo/accept-a-payment?platform=web#oxxo-payment-instructions_

Hopefully, you can make this happen in near future, as it's only logical for a smooth and practical process.
Thanks

payment-element cross origin error

Bug report

payment-element cross origin error

Describe the bug

I use payment-element for stripe pay. but when I click the card number input, the console print error "lookup.js:279 Uncaught DOMException: Blocked a frame with origin "https://js.stripe.com" from accessing a cross-origin frame."

Screenshots

image

System information

  • OS: [macOS]
  • Browser [chrome]

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.