Moheeb Zara
5ca7ee6e29
Pin [email protected] (exact). lib/stripe/client.ts: per-request getStripe with the pinned apiVersion (server-only, never global/client). Helpers in lib/stripe/config.ts (plain server module — they take the admin client so they must NOT be 'use server' exports): store/read the secret key + webhook signing secret in the AES-256-GCM secrets vault (door pattern), getStripeConfig. lib/actions/stripe.ts (actions only): getStripeSettings (status only, never returns secrets) + saveStripeSettings (write-only secrets, integrations.config upsert). Zod stripeSettingsSchema.
11 lines
543 B
TypeScript
11 lines
543 B
TypeScript
// Server-only. Per-space OWN keys (NOT Connect): a fresh client is created
|
|
// per request with that space's decrypted secret key. Never memoize a global
|
|
// client and never expose the key to the browser. The API version is pinned
|
|
// in lib/stripe-logic so an SDK/API bump is a deliberate, reviewed change.
|
|
import Stripe from 'stripe'
|
|
import { STRIPE_API_VERSION } from '@/lib/stripe-logic'
|
|
|
|
export function getStripe(secretKey: string): Stripe {
|
|
return new Stripe(secretKey, { apiVersion: STRIPE_API_VERSION as Stripe.LatestApiVersion })
|
|
}
|