Merge pull request #12 from PaystackOSS/patch/webhook

Patch/webhook

Author: lukman-paystack

classes/REST/Order_Endpoint.php

@@ -251,17 +251,17 @@ public function handle_update_order( WP_REST_Request $request ) {
 		$response = array(
 			'success' => false,
 		);
-
+		$path = $request->get_route();
+		
+		if($path == "/tribe/tickets/v1/commerce/paystack/order/webhook"){
+			return $this->handle_webhook( $request );
+		}
 		$order_id = $request->get_param( 'reference' );
+		$order = tec_tc_get_order($order_id);
 
-		$order = tec_tc_orders()->by_args( array(
-			'status'           => tribe( Pending::class )->get_wp_slug(),
-			'gateway_order_id' => $order_id,
-		) )->first();
-
-		if ( ! $order ) {
-			return new WP_Error( 'tec-tc-gateway-paystack-nonexistent-order-id', $messages['nonexistent-order-id'], $order );
-		}
+			if (!$order) {
+				return new WP_Error('tec-tc-gateway-paystack-nonexistent-order-id-d', $messages['nonexistent-order-id'], $order);
+			}
 
 		$transaction_status = $request->get_param( 'status' );
 		$transaction_id     = $request->get_param( 'transaction' );
@@ -320,17 +320,25 @@ public function handle_update_order( WP_REST_Request $request ) {
 
 	public function handle_webhook( WP_REST_Request $request ) {
 		// only a post with paystack signature header gets our attention
-		if ( ( strtoupper( $_SERVER['REQUEST_METHOD']) != 'POST' ) || ! array_key_exists( 'x-paystack-signature', $_SERVER ) ) {
-			exit();
+		if ( ( strtoupper( $_SERVER['REQUEST_METHOD']) != 'POST' ) || ! array_key_exists( 'HTTP_X_PAYSTACK_SIGNATURE', $_SERVER ) ) {
+						return new WP_Error( 'tec-tc-gateway-paystack-unauthorized-webhookk', $messages['unauthorized-webhook'], $input );exit();
 		}
+		$response = array(
+			'success' => false,
+		);
 
 		// Retrieve the request's body
 		$input  = @file_get_contents( "php://input" );
 		$client = tribe( Client::class );
-
+		$decodedInput = json_decode($input);
+		$jsonString = json_encode($decodedInput, JSON_UNESCAPED_SLASHES);
+		$jsonString = stripslashes($jsonString);
 		// validate event do all at once to avoid timing attack
-		if( $_SERVER['HTTP_X_PAYSTACK_SIGNATURE'] !== hash_hmac( 'sha512', $input, $client->get_barer_key() ) ) {
-			exit();
+	    $secret = $client->get_barer_key(); // Replace with your actual secret key
+        $hash = hash_hmac('sha512', $jsonString, $secret);
+		$paystackSignature = $_SERVER['HTTP_X_PAYSTACK_SIGNATURE'] ?? '';
+		if( $paystackSignature !== $hash ) {
+			return new WP_Error( 'tec-tc-gateway-paystack-unauthorized-webhook', $messages['unauthorized-webhook'], 'invalid-signature' );
 		}
 
 		http_response_code( 200 );
@@ -339,14 +347,11 @@ public function handle_webhook( WP_REST_Request $request ) {
 		// Do something - that will not take long - with $event
 		$event = json_decode( $input );
 
-		if ( isset( $event->event ) && in_array( $event->event, array( 'transfer.success', 'charge.success' ) ) ) {
+		if ( isset( $event->event ) && in_array( $event->event, array('charge.success' ) ) ) {
 			if ( isset( $event->data ) && isset( $event->data->reference ) && isset( $event->data->status ) && '' !== $event->data->reference ) {
-
-				$order = tec_tc_orders()->by_args( array(
-					'status'           => tribe( Pending::class )->get_wp_slug(),
-					'gateway_order_id' => $event->data->reference,
-				) )->first();
-
+				$order_id = $event->data->reference;
+				$order = tec_tc_get_order($order_id);
+				$response['order_id'] = $order_id;
 				if ( ! $order ) {
 					return new WP_Error( 'tec-tc-gateway-paystack-nonexistent-order-id', $messages['nonexistent-order-id'], $order );
 				}
@@ -359,28 +364,33 @@ public function handle_webhook( WP_REST_Request $request ) {
 				if ( 'success' === $event->data->status ) {
 					// Flag the order as Completed.
 					tribe( Order::class )->modify_status(
-						$order->ID,
+						$order_id,
 						Completed::SLUG,
 						array(
 							'gateway_transaction_id' => $event->data->reference,
 							'gateway_response' => $gateway_repsone,
 						)
 					);
+					$response['success']  = true;
+					$response['order_status']  = 'complete';
 				} else if ( 'failed' === $event->data->status ) {
 
 
 					// Flag the order as Completed.
 					tribe( Order::class )->modify_status(
-						$order->ID,
+						$order_id,
 						Denied::SLUG,
 						array(
 							'gateway_transaction_id' => $event->data->reference,
 							'gateway_response'  => $gateway_repsone,
 						)
 					);
+					$response['success']  = true;
+					$response['order_status']  = 'denied';
 				}
 			}
 		}
+		return new WP_REST_Response( $response );
 		exit();
 	}
 

classes/class-gateway.php

@@ -32,7 +32,7 @@ class Gateway extends Abstract_Gateway {
 	/**
 	 * @inheritDoc
 	 */
-	protected static $supported_currencies = array( 'NGN', 'GHS', 'USD', 'KES', 'CZK', 'ZAR', 'XOF' );
+	protected static $supported_currencies = array( 'NGN', 'GHS', 'USD', 'KES', 'ZAR', 'XOF', 'EGP' );
 
 	/**
 	 * @inheritDoc
@@ -116,7 +116,7 @@ public function filter_admin_notices() {
 	 */
 	public function render_unsupported_currency_notice() {
 		$notice_header = esc_html__( 'Paystack doesn\'t support your selected currency', 'paystack-for-events-calendar' );
-		$notice_text = esc_html__( 'Paystack does not support your store currency. Kindly set it to either NGN (₦), GHS (₵), USD ($), KES (KSh), ZAR (R), or XOF (CFA)', 'paystack-for-events-calendar' );
+		$notice_text = esc_html__( 'Paystack does not support your store currency. Kindly set it to either NGN (₦), GHS (₵), USD ($), KES (KSh), ZAR (R), XOF (CFA), or EGP (£) ', 'paystack-for-events-calendar' );
 
 		return sprintf(
 			'<p><strong>%1$s</strong></p><p>%2$s</p>',

paystack-tec.php

@@ -4,7 +4,7 @@
  * Plugin URI:	https://github.com/PaystackOSS/plugin-the-events-calendar
  * Description:	Add-on for The Event Calendar that allows you to accept payments for event tickets via Paystack
  * Author:		Paystack
- * Version: 	1.0.3
+ * Version: 	1.0.5
  * Author URI: 	https://paystack.com/
  * License: 	GPL3
  * Text Domain: paystack-for-events-calendar
@@ -19,7 +19,7 @@
 define( 'PS_TEC_PATH', plugin_dir_path( __FILE__ ) );
 define( 'PS_TEC_CORE', __FILE__ );
 define( 'PS_TEC_URL', plugin_dir_url( __FILE__ ) );
-define( 'PS_TEC_VER', '1.0.3' );
+define( 'PS_TEC_VER', '1.0.5' );
 
 /* ======================= Below is the Plugin Class init ========================= */
 require_once PS_TEC_PATH . '/classes/class-core.php';

readme.txt

@@ -3,7 +3,7 @@ Contributors: paystack, feedmymedia, krugazul, lightspeed, kaneahabagale
 Tags: the events calendar, paystack, payment gateway
 Requires at least: 5.8.6
 Tested up to: 6.2.2
-Stable tag: 1.0.4
+Stable tag: 1.0.5
 Requires PHP: 8.0 and higher
 License: GPL3
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
@@ -46,6 +46,9 @@ When you go to the Settings Page to get your API keys, please note the mode that
 
 == Changelog ==
 
+= 1.0.5 =
+* Bug fixes
+
 = 1.0.4 =
 * Compatibility with WordPress 6.2.2 and PHP 8.1.17