Webhook Support #18

mayankamencherla · 2016-11-09T14:03:52Z

No description provided.

…ommerce plug in

…g in

…ore readable

… review

captn3m0 · 2017-06-15T07:27:22Z

razorpay-payments.php

+                    'description' => esc_url( admin_url('admin-post.php') ) . '?action=rzp_webhook',
+                    'label' => __('Enable Razorpay Webhook with the URL listed below.', 'razorpay'),
+                    'default' => 'yes'
+                ),


Add a webhook_action here that decides what we do with the order on payment success. There are multiple scenarios:

Late Authorized (we get payment in authorized status, let the store owner decide)

payment.failed (we can mark as failed) (very tricky, let us leave)

Actual authorized, but post to woocommerce failed (we let store decide)

Store decisions:

Mark the payment as successful, if there is stock/inventory

Inform the store owner?

@captn3m0 Update or Inform store are my 2 options.

captn3m0 · 2017-06-15T07:28:28Z

razorpay-payments.php

 require_once __DIR__.'/razorpay-sdk/Razorpay.php';
 use Razorpay\Api\Api;

 add_action('plugins_loaded', 'woocommerce_razorpay_init', 0);
+add_action('admin_post_nopriv_rzp_webhook', 'razorpay_webhook_init'); // second - admin_post_nopriv


do we need both of these?

@captn3m0 if you want to have both logged in and not logged in users submitting, you have to add both actions!

https://codex.wordpress.org/Plugin_API/Action_Reference/admin_post_(action)

We don't have logged-in-users submitting in this case, it is the razorpay servers

captn3m0 · 2017-06-15T07:28:44Z

razorpay-payments.php

@@ -217,85 +230,12 @@ function get_order_creation_data($order_id)
        **/
        function generate_order_form($redirect_url, $json, $order_id)
        {
+            $checkout_html = file_get_contents(__DIR__.'/js/checkout.phtml');
+            $keys = array("#liveurl#", "#json#", "#redirect_url#");


will need to be rebased against master

@captn3m0 Will do towards the end once we finalize the functionality.

Hard to review, because it does HTML very differently

@captn3m0 Merged

captn3m0 · 2017-06-15T07:29:29Z

includes/razorpay-webhook.php

+
+        $data = json_decode($post, true);
+
+        if ($razorpay->enable_webhook == 'yes' && !empty($data['event']))


make yes into constant, or use a boolean instead if possible

@captn3m0 I believe wordpress needs a yes or no here.

captn3m0 · 2017-06-15T07:30:18Z

includes/razorpay-webhook.php

+        if ($razorpay->enable_webhook == 'yes' && !empty($data['event']))
+        {   
+            // if payment.authorized webhook is enabled, we will update woocommerce about captured payments
+            if ($data['event'] == "payment.authorized")


Check if order is paid at WooCommerce end before running this code. For most payments, that will be the case.

Performing this check after we get the $order object.

if ($order->needs_payment() === false) { return; }

captn3m0 · 2017-06-15T07:30:54Z

includes/razorpay-webhook.php

+                $order = new WC_Order($order_id);
+
+                $key_id = $razorpay->key_id;
+                $key_secret = $razorpay->key_secret;


get the payment id from the order

update the order (mark as successful)

do the same steps as we do in normal payment success flow

@captn3m0 Don't get it? Don't we already mark the order as successful here?

I wrote (1) based on order.paid, so ignore. However, do try to re-use the success/failure code, instead of copying here

captn3m0 · 2017-06-15T07:32:10Z

includes/razorpay-webhook.php

+                $payment = $api->payment->fetch($razorpay_payment_id);
+
+                if ($payment['status'] == 'captured')
+                {


try re-using the existing code here?

@captn3m0 Will have to rebase against master first.

captn3m0 · 2017-06-15T07:35:58Z

razorpay-payments.php

+                    'description' => esc_url( admin_url('admin-post.php') ) . '?action=rzp_webhook',
+                    'label' => __('Enable Razorpay Webhook with the URL listed below.', 'razorpay'),
+                    'default' => 'yes'
+                ),


We need to add instructions about how to configure webhooks on the website. Something like:

Use https://www.woocommerce.com/adlkasd/asfdsaf.php as the Webhook URL here and enable the payment.authorized event only.

We will also need Signature verification in place (add another input for webhook secret (minlength=8))

captn3m0 · 2017-06-15T09:51:20Z

razorpay-payments.php

+function razorpay_webhook_init()
+{
+    new RZP_Webhook();
+}


newline at the end.

I don't like doing everything in the constructor here

@captn3m0 Using only $api in the constructor. IE. $api.

captn3m0 · 2017-06-15T09:51:48Z

includes/razorpay-webhook.php

@@ -0,0 +1,78 @@
+<?php
+
+require_once __DIR__.'/../razorpay-payments.php';


Found a couple of nice suggestions on how to do webhooks in wordpress cleanly:

https://wordpress.stackexchange.com/questions/178090/best-way-for-plugin-to-accept-posts

https://wordpress.stackexchange.com/questions/126572/trying-to-avoid-including-wp-load-php/126582#126582

We should do an early die as well, so other plugins and wordpress does not interfere with our webhooks.

@captn3m0 I tried adding an endpoint. Although, I think using admin post is the way to go, I remember not finding results with the approach above.

We want to give a absolute URL to the user that they can enter in the Razorpay dashboard in the settings page.

captn3m0 · 2017-06-15T14:13:42Z

includes/razorpay-webhook.php

+    protected $razorpay; 
+
+    protected $keyId;
+    protected $keySecret;


this looks duplication. What about creating a WC_Razorpay_Webhook instance in our primary class and using that?

@captn3m0 As discussed just pulling out the $api from getRazorpayApiInstance()

captn3m0 · 2017-06-16T06:50:05Z

js/checkout.phtml

@@ -0,0 +1,71 @@
+<script src="#liveurl#"></script>


This file is not needed

captn3m0 · 2017-06-16T06:50:38Z

razorpay-payments.php

+require_once __DIR__.'/includes/razorpay-webhook.php';
+require_once __DIR__.'/razorpay-sdk/Razorpay.php';
+
+if ( ! defined( 'ABSPATH' ) )


The ABSPATH check should be the first thing in the file

captn3m0 · 2017-06-16T06:50:54Z

razorpay-payments.php

@@ -44,6 +51,10 @@ public function __construct()
            $this->key_secret = $this->settings['key_secret'];
            $this->payment_action = $this->settings['payment_action'];

+            $this->enable_webhook = $this->settings['enable_webhook'];
+
+            $this->liveurl = 'https://checkout.razorpay.com/v1/checkout.js';


captn3m0 · 2017-06-16T06:51:37Z

razorpay-payments.php

@@ -44,6 +51,10 @@ public function __construct()
            $this->key_secret = $this->settings['key_secret'];
            $this->payment_action = $this->settings['payment_action'];

+            $this->enable_webhook = $this->settings['enable_webhook'];


This broke the last time we did a release with payment_action. We had to ask users to visit settings and submit it again so it entered the database. Have a default value here, so it doesn't give errors.

@captn3m0 the enable_webhook setting has a default in the settings set to yes

We had that for payment_capture as well, and it broke. Can you try deleting the entry from your database and checking if it raises a notice?

captn3m0 · 2017-06-16T06:51:59Z

razorpay-payments.php

+                    'description' =>  __('Would you like our webhooks to update your store, or inform you so that you can update it yourself?', 'razorpay'),
+                    'default' => 'update',
+                    'options' => array(
+                        'update' => 'Update Store',


This is very confusing. Needs helper text about what each option does.

captn3m0 · 2017-06-16T06:52:40Z

razorpay-payments.php

+                'webhook_secret' => array(
+                    'title' => __('Webhook Secret', 'razorpay'),
+                    'type' => 'text',
+                    'description' => __('Webhook secret is used for webhook signature verification. This has to match the one added <a href="https://dashboard.razorpay.com/#/app/webhooks">here</a>', 'razorpay')


There should be some helper guide about how to integrate the webhook properly. Perhaps link them to a page on the repo wiki on github?

@captn3m0 Will add it after creating the wiki

captn3m0 · 2017-06-16T06:53:05Z

razorpay-payments.php

@@ -371,86 +404,6 @@ private function enqueueCheckoutScripts($data)
        function generateOrderForm($redirectUrl, $data)
        {
            $this->enqueueCheckoutScripts($data);
-
-            return <<<EOT
-<form name='razorpayform' action="$redirectUrl" method="POST">


Why are we removing this?

@captn3m0 My bad. Added it.

captn3m0 · 2017-06-16T07:59:05Z

razorpay-payments.php

@@ -44,6 +51,8 @@ public function __construct()
            $this->key_secret = $this->settings['key_secret'];
            $this->payment_action = $this->settings['payment_action'];

+            $this->enable_webhook = $this->settings['enable_webhook'] ?? 'yes';


Null coalescing is only PHP7.0

captn3m0 · 2017-06-16T10:27:45Z

razorpay-payments.php

+                ),
+                'webhook_action' => array(
+                    'title' => __('Webhook Action', 'razorpay'),
+                    'type' => 'select',


I don't see webhook_action being used anywhere

captn3m0 · 2017-06-16T10:28:00Z

includes/razorpay-webhook.php

+                $success = false;
+                $errorMessage = 'The payment has failed.';
+
+                if ($payment['status'] === 'captured')


Shouldn't we be capturing the payment in case it was authorized?

captn3m0 · 2017-06-16T13:44:28Z

razorpay-payments.php

+            }
+
+            $this->webhook_secret = $this->settings['webhook_secret'];
+


default value needed.

captn3m0 · 2017-06-16T13:48:05Z

includes/razorpay-webhook.php

+
+        $this->api = $this->razorpay->getRazorpayApiInstance();
+
+        $this->auto_capture_webhook();


have a public process function instead, and call the appropriate method depending on the event (payment_authorized in our case). Makes it pluggable for subscriptions

captn3m0 · 2017-06-16T13:48:22Z

includes/razorpay-webhook.php

+                //
+                // If the webhook secret isn't set on wordpress, return
+                //
+                if (isset($razorpayWebhookSecret) === false)


isset will be true for empty strings

captn3m0 · 2017-06-16T13:49:03Z

includes/razorpay-webhook.php

+            if ($data['event'] === "payment.authorized")
+            {
+                global $woocommerce;
+                $orderId = $data['payload']['payment']['entity']['notes']['woocommerce_order_id'];


Use $order->receipt instead. I'm not very sure if we have order entity there.

@captn3m0 As discussed let us leave as is

captn3m0 · 2017-06-16T13:50:24Z

includes/razorpay-webhook.php

+                $order = new WC_Order($orderId);
+
+                // Move this to the base class as well
+                if ($order->needs_payment() === false)


We need the same check on the other side as well, right?

…er status to success

captn3m0

test all the cases thoroughly before doing a squash merge

captn3m0 · 2017-06-16T14:05:28Z

includes/razorpay-webhook.php

+    {
+        $post = file_get_contents('php://input');
+
+        $data = json_decode($post, true);


test it against an empty post body

@captn3m0 Handled. Tested.
razorpay-webhook.php - process function.
We check for whether data has event set.

This will break if the body is empty or non-valid JSON

@captn3m0 If it is empty, it will return null. But yeah, if it isn't a valid json, it'll break.

Either ways, json_last_error will be anything but 0 if json_decode failed for whatever reason. So I'll add that.

Valid json without event key will also break

@captn3m0 How? We're doing an empty check on line 32!

captn3m0 · 2017-06-16T14:06:34Z

includes/razorpay-webhook.php

+            // If the payment is only authorized, we capture it
+            // If the merchant has enabled auto capture
+            //
+            $payment->capture(array('amount' => $amount));


we can't capture with the amount from the webhook, we need to capture with the order entity in WC

@captn3m0 Made getOrderAmountAsInteger public

captn3m0 · 2017-06-16T14:07:24Z

razorpay-payments.php

+                    'label' => __('Enable Razorpay Webhook <a href="https://dashboard.razorpay.com/#/app/webhooks">here</a> with the URL listed below.', 'razorpay'),
+                    'default' => 'yes'
+                ),
+                'webhook_secret' => array(


Let us make it mandatory if the webhook is enabled.

@captn3m0 How about generating a random timestamp based string and storing that as a default value?

We can add instructions on how to set up the secret, ie, by copying the string we generated into the dashboard, or by creating another one and storing it in both of the locations.

I like this idea, but there are complications around when you generate this secret. You don't want to do it every time they open or submit the settings page.

@captn3m0 Right, I had thought of the case as well. What then, we'll just leave it to null then?

captn3m0 · 2017-06-16T14:08:48Z

razorpay-payments.php

+        }
+
+        protected function redirectUser($order)
+        {


in the early return case, $this->msg is not set

@captn3m0 You're right. My bad. Added the code below:

if ($order->needs_payment() === false) { $razorpayPaymentId = $order->get_transaction_id(); $this->updateOrder($order, true, null, $razorpayPaymentId); $this->redirectUser($order); }

@captn3m0 This should be good to go unless the $razorpayPaymentId isn't set. Do we handle that case too? If the order is already marked paid by the webhook, then surely the $razorpayPaymentId should be saved right?

Do we need to update the order at all in that case?

@captn3m0 You don't.
I moved
$this->add_notice($this->msg['message'], $this->msg['class']);
to
public function updateOrder(& $order, $success, $errorMessage, $razorpayPaymentId)

Won't the order be updated twice in that case? The payment note gets added twice, right?

@captn3m0 Changed this.

…yment using webhook

captn3m0 · 2017-06-19T04:00:14Z

razorpay-sdk/src/Utility.php

    {
-        $actualSignature = hash_hmac(self::SHA256, $payload, Api::getSecret());
+        if (isset($webhookSecret) === true)


This will always return true.

@captn3m0 Changed this to empty() === false
Also, default is set to ''.

@mayankamencherla I'd pointed this out, and you'd mentioned you fixed it 👎

captn3m0 · 2017-06-19T06:27:24Z

includes/razorpay-webhook.php

+    {
+        $post = file_get_contents('php://input');
+
+        $data = json_decode($post, true);


This will break if the body is empty or non-valid JSON

captn3m0 · 2017-06-19T06:28:12Z

includes/razorpay-webhook.php

+                                                                $_SERVER['HTTP_X_RAZORPAY_SIGNATURE'],
+                                                                $razorpayWebhookSecret);
+                }
+                catch (Exception $e)


Don't catch all exceptions and we need to log here.

@captn3m0 write_log(['message' => $e->getMessage()]);

captn3m0

Please do a squash merge and then a beta release

mayankamencherla added 14 commits October 19, 2016 12:23

Orders API with auto-capture is now successfully integrated with wooc…

f4a869d

…ommerce plug in

Woocommerce plug-in has a working implementation of orders - API

8b7b382

Style guide comments have been incorporated into this woocommerce plu…

783a84f

…g in

Order creation now happens over multiple functions, and the code is m…

c71cf92

…ore readable

Fixes tiny bug when it comes to capturing form data

0139073

Alpha version of webhook code

a11e2a1

Using admin_post_nopriv to handle non-logged in users. Code ready for…

52c4bfc

… review

Style guide comments fixed

6e3c7b1

Fixed style guide comments and hash equals

3e1095f

Using wordpress polyfill for hash equals

775a9c4

Cleaned up code and added an includes folder

5968cd8

Removed .DS_Store

499b2c9

Removed unnecessary includes

0151696

Cleaned up authorize flow

aa35c0e

mayankamencherla requested a review from captn3m0 June 9, 2017 08:16

captn3m0 suggested changes Jun 15, 2017

View reviewed changes

Added additional webhook settings, ie. webhook_action and webhook_secret

4780844

captn3m0 reviewed Jun 15, 2017

View reviewed changes

mayankamencherla changed the base branch from razorpay_sdk to master June 15, 2017 20:34

mayankamencherla and others added 2 commits June 16, 2017 02:14

Merge branch 'master' into webhooks

588955b

[webhooks] Reduced reused code in the webhooks class

d4288fa

captn3m0 changed the title ~~Alpha version of webhook code~~ Webhook Support Jun 16, 2017

captn3m0 reviewed Jun 16, 2017

View reviewed changes

mayankamencherla added 2 commits June 16, 2017 12:52

[webhooks] Namespacing webhook url to rzp_wc_webhooks

a40f163

[webhooks] Added a link to the razorpay wiki on the wiki page

44ec014

mayankamencherla force-pushed the webhooks branch from a6126f7 to 44ec014 Compare June 16, 2017 07:51

[webhooks] Undid the changes from a bad merge commit

0e7889e

mayankamencherla force-pushed the webhooks branch from 1ebef76 to 0e7889e Compare June 16, 2017 07:56

captn3m0 reviewed Jun 16, 2017

View reviewed changes

[webhooks] Removed redirection for webhook flow

576023c

captn3m0 reviewed Jun 16, 2017

View reviewed changes

[webhooks] When the payment is auth state, we capture it using webhooks

4282134

mayankamencherla force-pushed the webhooks branch from 223aecf to 4282134 Compare June 16, 2017 12:47

[webhooks] Razorpay webhook signature verification code added

276cfc6

captn3m0 reviewed Jun 16, 2017

View reviewed changes

[webhooks] Redirecting user to success page after webhook updates ord…

ed0dc40

…er status to success

mayankamencherla force-pushed the webhooks branch from 523fde1 to ed0dc40 Compare June 16, 2017 14:05

captn3m0 suggested changes Jun 16, 2017

View reviewed changes

[webhooks] Using order amount instead of webhook amount to capture pa…

5880654

…yment using webhook

captn3m0 reviewed Jun 19, 2017

View reviewed changes

Returning early if post body isn't a valid json

5178b87

captn3m0 approved these changes Jun 19, 2017

View reviewed changes

mayankamencherla merged commit bd78c5a into master Jun 19, 2017

captn3m0 deleted the webhooks branch June 19, 2017 10:46


		$data = json_decode($post, true);

		if ($razorpay->enable_webhook == 'yes' && !empty($data['event']))

		@@ -0,0 +1,78 @@
		<?php

		require_once __DIR__.'/../razorpay-payments.php';


		$this->api = $this->razorpay->getRazorpayApiInstance();

		$this->auto_capture_webhook();

Webhook Support #18

Webhook Support #18

Conversation

mayankamencherla commented Nov 9, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

captn3m0 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mayankamencherla Jun 17, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mayankamencherla Jun 17, 2017 •

edited

Loading