Support Strong Customer Authentication using Stripe with PaymentIntent

[mraerino]

Fixes #179

- Summary

New payments flow

• Client: Create a payment method and pass that to POST /orders/:order_id/payments
• Server: Create a PaymentIntent with the payment method from the client - report back if the payment needs more actions (including the client secret for the payment intent)
• Client: Completes additional action and calls POST /payments/:payment_id/confirm
• Server: Responds with the result of checking if the transaction is completed, updates payment status on order

API docs for updated/new endpoints

POST /orders/:order_id/payments (updated)

Payload:

{
  "provider": "stripe",
  "stripe_payment_method_id": "<the id>"
}

Response: Transaction object
(state if 3D secure is pending)

{
  "id": "...", // transaction id
  "order_id": "...",
  "invoice_number": "...",
  "processor_id": "...",
  "user_id": "...",
  "amount": "...",
  "currency": "...",
  "status": "pending",
  "type": "...",
  "created_at": "...",
  "provider_metadata": {
    "payment_intent_secret": "<client secret>"
  }
}

POST /payments/:payment_id/confirm (new)

(payment id from previous response)

Payload: none

Response:

{
  "id": "...",
  "order_id": "...",
  "invoice_number": "...",
  "processor_id": "...",
  "user_id": "...",
  "amount": "...",
  "currency": "...",
  "status": "paid",
  "type": "...",
  "created_at": "..."
}

- Test plan

TBD

- Description for the changelog

Support Strong Customer Authentication using Stripe with PaymentIntent

- A picture of a cute animal (not mandatory but encouraged)

[rybit]

So I'd cut this. I think that anything _secret makes me nervous. Like is it going to leak to the customer? logs? is that ok?

If you cut this then I think that you can also simplify the PaymentPendingError b/c this is the only place I saw the metadata field used.

[mraerino]

This is actually required behaviour for the new Stripe flow to work.
This "secret" is supposed to be passed to the client. It is not being saved to the database with the transaction because I disabled that field using sql:"-"

I'm using the metadata field so the payment provider impl stays generic.

See:

• https://stripe.com/docs/payments/payment-intents/web#passing-to-client
• https://stripe.com/docs/payments/payment-intents/web-manual#creating-with-manual-confirmation

[rybit]

small things but generally I like it.