Monorepo for Aesthetic.Computer
aesthetic.computer
blank: use MongoDB secrets collection for Stripe webhook secret
Follows existing pattern (shopify, paypal, billing) of storing secrets
in db.collection("secrets") instead of Netlify env vars.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
+24
-7
+1
-1
system/netlify.toml
+1
-1
system/netlify.toml
···
93
93
included_env_vars = ["NETLIFY_DEV", "CONTEXT", "AUTH0_M2M_CLIENT_ID", "AUTH0_M2M_SECRET", "SOTCE_STRIPE_API_PRIV_KEY", "SOTCE_STRIPE_API_PUB_KEY"]
94
94
[functions.blank]
95
95
external_node_modules = ["stripe", "nodemailer"]
96
-
included_env_vars = ["CONTEXT", "STRIPE_API_TEST_PRIV_KEY", "STRIPE_API_PRIV_KEY", "STRIPE_ENDPOINT_DEV_SECRET", "STRIPE_ENDPOINT_BLANK_SECRET", "MONGODB_URI", "SMTP_SERVER", "SMTP_USER", "SMTP_PASS"]
96
+
included_env_vars = ["CONTEXT", "STRIPE_API_TEST_PRIV_KEY", "STRIPE_API_PRIV_KEY", "STRIPE_ENDPOINT_DEV_SECRET", "MONGODB_URI", "SMTP_SERVER", "SMTP_USER", "SMTP_PASS"]
97
97
[functions.print]
98
98
external_node_modules = ["got", "stripe", "nodemailer"]
99
99
included_env_vars = ["CONTEXT", "PRINTFUL_API_TOKEN", "STRIPE_API_TEST_PRIV_KEY", "STRIPE_API_PRIV_KEY", "STRIPE_ENDPOINT_DEV_SECRET", "STRIPE_ENDPOINT_SECRET"]
+23
-6
system/netlify/functions/blank.mjs
+23
-6
system/netlify/functions/blank.mjs
···
12
12
import { respond } from "../../backend/http.mjs";
13
13
import { email } from "../../backend/email.mjs";
14
14
import { authorize } from "../../backend/authorization.mjs";
15
+
import { connect } from "../../backend/database.mjs";
15
16
16
17
const dev = process.env.CONTEXT === "dev";
18
+
19
+
// Cache secrets from MongoDB
20
+
let cachedSecrets = null;
21
+
async function getSecrets() {
22
+
if (cachedSecrets) return cachedSecrets;
23
+
const { db } = await connect();
24
+
const secrets = await db.collection("secrets").findOne({ _id: "blank" });
25
+
if (!secrets) throw new Error("Blank secrets not found in database");
26
+
cachedSecrets = secrets;
27
+
return cachedSecrets;
28
+
}
17
29
const stripeKey = dev
18
30
? process.env.STRIPE_API_TEST_PRIV_KEY
19
31
: process.env.STRIPE_API_PRIV_KEY;
···
230
242
return respond(400, { error: "Missing stripe-signature header" });
231
243
}
232
244
233
-
const secret = dev
234
-
? process.env.STRIPE_ENDPOINT_DEV_SECRET
235
-
: process.env.STRIPE_ENDPOINT_BLANK_SECRET;
245
+
let secret;
246
+
try {
247
+
const secrets = await getSecrets();
248
+
secret = dev
249
+
? process.env.STRIPE_ENDPOINT_DEV_SECRET
250
+
: secrets.stripeWebhookSecret;
251
+
} catch (err) {
252
+
return respond(500, { message: `Secrets Error: ${err.message}` });
253
+
}
236
254
237
255
let hookEvent;
238
256
try {
···
264
282
265
283
// Store order in MongoDB
266
284
try {
267
-
const { connect } = await import("../../backend/database.mjs");
268
-
const database = await connect();
269
-
const orders = database.db.collection("blank-orders");
285
+
const { db } = await connect();
286
+
const orders = db.collection("blank-orders");
270
287
271
288
await orders.insertOne({
272
289
stripeSessionId: session.id,