Replace Helcim integration with WooCommerce Stripe
This commit is contained in:
twooey committed
1 parent
197938f482
commit
21038d68ca
23 files changed
+172
-1199
No files matched your search
+1
-1
@@ -43,7 +43,7 @@ $COMPOSE run --rm -T -u www-data wordpress tar -czf - -C /var/www/html/wp-conten
|
||||
> "$BACKUP_DIR/uploads-${TIMESTAMP}.tar.gz"
|
||||
|
||||
echo "==> archiving environment config"
|
||||
# Every API key (Booksrun/Ingram/Helcim/MailerLite/Hardcover), the WP admin
|
||||
# Every API key (Booksrun/Ingram/Stripe/MailerLite/Hardcover), the WP admin
|
||||
# bootstrap credentials, and both DB passwords live ONLY in this one
|
||||
# gitignored host file — losing the host without this backed up loses all of
|
||||
# it, even with the DB dump and uploads intact. Same trust model as the DB
|
||||
|
||||
+56
-15
@@ -67,14 +67,36 @@ printf '%s' "$DB_ROOT_PASSWORD_VALUE" > "$SECRETS_DIR/db_root_password"
|
||||
# exact bug ENVIRONMENT-unset guards elsewhere in this file exist to prevent).
|
||||
HARDCOVER_API_TOKEN_VALUE="$(env_get "$ENV_FILE" HARDCOVER_API_TOKEN)"
|
||||
printf '%s' "$HARDCOVER_API_TOKEN_VALUE" > "$SECRETS_DIR/hardcover_api_token"
|
||||
# Same reasoning/pattern as Hardcover above — optional, written unconditionally.
|
||||
# Payments\HelcimGatewayConfig::is_configured() is false (and the
|
||||
# gateway falls back to fake mode — see HelcimClient) until a real
|
||||
# sandbox token lands in HELCIM_API_TOKEN.
|
||||
HELCIM_API_TOKEN_VALUE="$(env_get "$ENV_FILE" HELCIM_API_TOKEN)"
|
||||
printf '%s' "$HELCIM_API_TOKEN_VALUE" > "$SECRETS_DIR/helcim_api_token"
|
||||
if [[ -z "$HELCIM_API_TOKEN_VALUE" ]]; then
|
||||
echo " (HELCIM_API_TOKEN not set in ${ENV_FILE} — Helcim gateway will install but stay unconfigured)"
|
||||
# Stripe credentials are supplied through .env but mounted into the
|
||||
# containers as files so secret values never become container environment
|
||||
# variables. The official gateway copies them into its WordPress settings.
|
||||
STRIPE_MODE_VALUE="$(env_get "$ENV_FILE" STRIPE_MODE)"
|
||||
STRIPE_MODE_VALUE="${STRIPE_MODE_VALUE:-test}"
|
||||
case "$STRIPE_MODE_VALUE" in
|
||||
test|live) ;;
|
||||
*) echo "STRIPE_MODE must be 'test' or 'live'" >&2; exit 1 ;;
|
||||
esac
|
||||
STRIPE_PUBLISHABLE_KEY_VALUE="$(env_get "$ENV_FILE" STRIPE_PUBLISHABLE_KEY)"
|
||||
STRIPE_SECRET_KEY_VALUE="$(env_get "$ENV_FILE" STRIPE_SECRET_KEY)"
|
||||
STRIPE_WEBHOOK_SECRET_VALUE="$(env_get "$ENV_FILE" STRIPE_WEBHOOK_SECRET)"
|
||||
printf '%s' "$STRIPE_PUBLISHABLE_KEY_VALUE" > "$SECRETS_DIR/stripe_publishable_key"
|
||||
printf '%s' "$STRIPE_SECRET_KEY_VALUE" > "$SECRETS_DIR/stripe_secret_key"
|
||||
printf '%s' "$STRIPE_WEBHOOK_SECRET_VALUE" > "$SECRETS_DIR/stripe_webhook_secret"
|
||||
if [[ -z "$STRIPE_PUBLISHABLE_KEY_VALUE" || -z "$STRIPE_SECRET_KEY_VALUE" ]]; then
|
||||
echo " (Stripe keys not set in ${ENV_FILE} — Stripe will remain disabled)"
|
||||
else
|
||||
if [[ "$STRIPE_PUBLISHABLE_KEY_VALUE" != pk_${STRIPE_MODE_VALUE}_* ]]; then
|
||||
echo "STRIPE_PUBLISHABLE_KEY does not match STRIPE_MODE=${STRIPE_MODE_VALUE}" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ "$STRIPE_SECRET_KEY_VALUE" != sk_${STRIPE_MODE_VALUE}_* && "$STRIPE_SECRET_KEY_VALUE" != rk_${STRIPE_MODE_VALUE}_* ]]; then
|
||||
echo "STRIPE_SECRET_KEY does not match STRIPE_MODE=${STRIPE_MODE_VALUE}" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
if [[ -n "$STRIPE_WEBHOOK_SECRET_VALUE" && "$STRIPE_WEBHOOK_SECRET_VALUE" != whsec_* ]]; then
|
||||
echo "STRIPE_WEBHOOK_SECRET must start with whsec_" >&2
|
||||
exit 1
|
||||
fi
|
||||
# Same pattern again — optional, written unconditionally.
|
||||
# Integration\BooksRunAdapter::is_configured() is false until a real key
|
||||
@@ -90,7 +112,7 @@ printf '%s' "$BOOKSRUN_FTP_PASSWORD_VALUE" > "$SECRETS_DIR/booksrun_ftp_password
|
||||
# unreadable to them. The containing directory (700, above) is what
|
||||
# actually keeps other host users out; these just need to be world-readable
|
||||
# within that already-restricted directory.
|
||||
chmod 644 "$SECRETS_DIR/db_password" "$SECRETS_DIR/db_root_password" "$SECRETS_DIR/hardcover_api_token" "$SECRETS_DIR/helcim_api_token" "$SECRETS_DIR/booksrun_api_key" "$SECRETS_DIR/booksrun_ftp_password"
|
||||
chmod 644 "$SECRETS_DIR/db_password" "$SECRETS_DIR/db_root_password" "$SECRETS_DIR/hardcover_api_token" "$SECRETS_DIR/stripe_publishable_key" "$SECRETS_DIR/stripe_secret_key" "$SECRETS_DIR/stripe_webhook_secret" "$SECRETS_DIR/booksrun_api_key" "$SECRETS_DIR/booksrun_ftp_password"
|
||||
|
||||
echo "==> building and starting ${ENVIRONMENT}"
|
||||
$COMPOSE up -d --build
|
||||
@@ -133,15 +155,34 @@ echo "==> installing/activating theme (Blocksy — free; Book Store starter site
|
||||
$WP theme install blocksy --activate
|
||||
|
||||
echo "==> installing/activating required plugins"
|
||||
# helcim-commerce-for-woocommerce (the off-the-shelf, immediate-charge-
|
||||
# only plugin) is deliberately NOT installed here anymore — Payments\
|
||||
# HelcimGateway (shipped inside bookstore-core) replaces it with a
|
||||
# preauth-then-capture flow built directly against HelcimPay.js. See
|
||||
# design doc Appendix B's revised decision.
|
||||
$WP plugin install woocommerce redis-cache blocksy-companion --activate
|
||||
$WP plugin install woocommerce woocommerce-gateway-stripe redis-cache blocksy-companion --activate
|
||||
$WP plugin activate bookstore-core
|
||||
$WP redis enable || true
|
||||
|
||||
# The distributor workflow depends on Stripe authorizing at checkout and
|
||||
# capturing later when SupplierOrderJob moves the order to Processing.
|
||||
# Read the mounted files inside the container so credentials never appear in
|
||||
# this command line or deployment logs.
|
||||
echo "==> configuring Stripe from ${ENV_FILE} (authorize and capture later)"
|
||||
$WP eval '
|
||||
$read_secret = static function (string $env): string {
|
||||
$path = getenv($env);
|
||||
return $path && is_readable($path) ? trim((string) file_get_contents($path)) : "";
|
||||
};
|
||||
$mode = getenv("STRIPE_MODE") === "live" ? "live" : "test";
|
||||
$publishable = $read_secret("STRIPE_PUBLISHABLE_KEY_FILE");
|
||||
$secret = $read_secret("STRIPE_SECRET_KEY_FILE");
|
||||
$webhook = $read_secret("STRIPE_WEBHOOK_SECRET_FILE");
|
||||
$settings = get_option("woocommerce_stripe_settings", []);
|
||||
$settings["enabled"] = $publishable !== "" && $secret !== "" ? "yes" : "no";
|
||||
$settings["capture"] = "no";
|
||||
$settings["testmode"] = $mode === "test" ? "yes" : "no";
|
||||
$settings[$mode === "test" ? "test_publishable_key" : "publishable_key"] = $publishable;
|
||||
$settings[$mode === "test" ? "test_secret_key" : "secret_key"] = $secret;
|
||||
$settings[$mode === "test" ? "test_webhook_secret" : "webhook_secret"] = $webhook;
|
||||
update_option("woocommerce_stripe_settings", $settings);
|
||||
'
|
||||
|
||||
echo "==> enabling WooCommerce HPOS (custom order tables)"
|
||||
$WP option update woocommerce_custom_orders_table_enabled yes
|
||||
$WP option update woocommerce_custom_orders_table_data_sync_enabled yes
|
||||
|
||||
Reference in new issue
Block a user