updates

rsync-studio-licensing/app/Services/Payments/LemonSqueezyWebhookVerifier.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Payments;
 
 use Illuminate\Http\Request;
@@ -10,8 +11,12 @@ final class LemonSqueezyWebhookVerifier implements WebhookVerifier
     {
         $secret = (string) config('rsync-studio.lemon_squeezy.webhook_secret');
         $signature = (string) $request->header('X-Signature');
-        if ($secret === '' || $signature === '') throw new RuntimeException('Lemon Squeezy webhook verification is not configured.');
-        $expected = hash_hmac('sha256',$rawBody,$secret);
-        if (!hash_equals($expected,$signature)) throw new RuntimeException('Lemon Squeezy webhook signature is invalid.');
+        if ($secret === '' || $signature === '') {
+            throw new RuntimeException('Lemon Squeezy webhook verification is not configured.');
+        }
+        $expected = hash_hmac('sha256', $rawBody, $secret);
+        if (! hash_equals($expected, $signature)) {
+            throw new RuntimeException('Lemon Squeezy webhook signature is invalid.');
+        }
     }
 }

rsync-studio-licensing/app/Services/Payments/PaddleClient.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace App\Services\Payments;
+
+use Illuminate\Http\Client\Response;
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+
+final class PaddleClient
+{
+    public function customer(?string $customerID): ?array
+    {
+        if (! $customerID || ! config('rsync-studio.paddle.api_key')) {
+            return null;
+        }
+
+        $response = $this->request()->get('/customers/'.$customerID);
+
+        if (! $response->successful()) {
+            return null;
+        }
+        $data = $response->json('data');
+
+        return is_array($data) ? $data : null;
+    }
+
+    public function updateSubscriptionPrice(string $subscriptionID, string $priceID): array
+    {
+        $this->requireWritableConfiguration();
+
+        $response = $this->request()->patch('/subscriptions/'.$subscriptionID, [
+            'proration_billing_mode' => 'prorated_immediately',
+            'items' => [[
+                'price_id' => $priceID,
+                'quantity' => 1,
+            ]],
+        ]);
+
+        return $this->subscriptionData($response, 'Paddle could not update the subscription.');
+    }
+
+    public function cancelSubscriptionImmediately(string $subscriptionID): array
+    {
+        $this->requireWritableConfiguration();
+
+        $response = $this->request()->post('/subscriptions/'.$subscriptionID.'/cancel', [
+            'effective_from' => 'immediately',
+        ]);
+
+        return $this->subscriptionData($response, 'Paddle could not cancel the subscription.');
+    }
+
+    private function request()
+    {
+        return Http::baseUrl((string) config('rsync-studio.paddle.api_url'))
+            ->withToken((string) config('rsync-studio.paddle.api_key'))
+            ->acceptJson()
+            ->timeout(15);
+    }
+
+    private function requireWritableConfiguration(): void
+    {
+        if (trim((string) config('rsync-studio.paddle.api_key')) === '') {
+            throw new RuntimeException('Paddle subscription management is not configured.');
+        }
+    }
+
+    private function subscriptionData(Response $response, string $fallback): array
+    {
+        if (! $response->successful()) {
+            $detail = trim((string) ($response->json('error.detail') ?? ''));
+            throw new RuntimeException($detail !== '' ? $detail : $fallback);
+        }
+
+        $data = $response->json('data');
+        if (! is_array($data)) {
+            throw new RuntimeException($fallback);
+        }
+
+        return $data;
+    }
+}

rsync-studio-licensing/app/Services/Payments/PaddleWebhookVerifier.php

@@ -1,4 +1,5 @@
 <?php
+
 namespace App\Services\Payments;
 
 use Illuminate\Http\Request;
@@ -10,15 +11,28 @@ final class PaddleWebhookVerifier implements WebhookVerifier
     {
         $secret = (string) config('rsync-studio.paddle.webhook_secret');
         $header = (string) $request->header('Paddle-Signature');
-        if ($secret === '' || $header === '') throw new RuntimeException('Paddle webhook verification is not configured.');
+        if ($secret === '' || $header === '') {
+            throw new RuntimeException('Paddle webhook verification is not configured.');
+        }
         $parts = [];
-        foreach (explode(';', $header) as $part) { [$k,$v] = array_pad(explode('=',trim($part),2),2,null); if ($k && $v) $parts[$k][]=$v; }
-        $ts = isset($parts['ts'][0]) ? (int)$parts['ts'][0] : 0;
+        foreach (explode(';', $header) as $part) {
+            [$k,$v] = array_pad(explode('=', trim($part), 2), 2, null);
+            if ($k && $v) {
+                $parts[$k][] = $v;
+            }
+        }
+        $ts = isset($parts['ts'][0]) ? (int) $parts['ts'][0] : 0;
         $signatures = $parts['h1'] ?? [];
-        $tolerance = max(1,(int)config('rsync-studio.paddle.timestamp_tolerance',300));
-        if (!$ts || abs(time()-$ts)>$tolerance) throw new RuntimeException('Paddle webhook timestamp is outside the allowed tolerance.');
+        $tolerance = max(1, (int) config('rsync-studio.paddle.timestamp_tolerance', 300));
+        if (! $ts || abs(time() - $ts) > $tolerance) {
+            throw new RuntimeException('Paddle webhook timestamp is outside the allowed tolerance.');
+        }
         $expected = hash_hmac('sha256', $ts.':'.$rawBody, $secret);
-        foreach ($signatures as $signature) if (hash_equals($expected,$signature)) return;
+        foreach ($signatures as $signature) {
+            if (hash_equals($expected, $signature)) {
+                return;
+            }
+        }
         throw new RuntimeException('Paddle webhook signature is invalid.');
     }
 }

rsync-studio-licensing/app/Services/Payments/PurchaseProvisioner.php

@@ -1,47 +1,246 @@
 <?php
+
 namespace App\Services\Payments;
 
 use App\Models\License;
 use App\Models\LicenseProduct;
 use App\Services\Licensing\LicenseIssuer;
+use Illuminate\Support\Carbon;
 use RuntimeException;
 
 final class PurchaseProvisioner
 {
-    public function __construct(private LicenseIssuer $issuer) {}
+    public function __construct(private LicenseIssuer $issuer, private PaddleClient $paddle) {}
 
     public function provision(string $provider, array $event): void
     {
-        $normalized = match ($provider) {
-            'paddle' => $this->fromPaddle($event),
-            'lemon-squeezy' => $this->fromLemonSqueezy($event),
-            default => throw new RuntimeException('Unsupported payment provider.'),
-        };
-        if ($normalized['action'] === 'ignore') return;
-        if ($normalized['action'] === 'revoke') {
-            License::where('payment_provider',$provider)->where('external_order_id',$normalized['orderID'])->whereNull('revoked_at')->update(['revoked_at'=>now(),'revoke_reason'=>'Payment refunded or reversed']);
+        if ($provider === 'paddle') {
+            $this->provisionPaddle($event);
+
             return;
         }
-        $product = LicenseProduct::where('payment_provider',$provider)->where(function($q) use($normalized){ $q->where('external_price_id',$normalized['priceID'])->orWhere('external_product_id',$normalized['productID']); })->where('active',true)->first();
-        if (!$product) throw new RuntimeException('No active licence product maps to this payment item.');
-        $this->issuer->issue($product,$normalized['name'],$normalized['email'],$provider,$normalized['orderID'],$normalized['customerID'], true);
+
+        if ($provider === 'lemon-squeezy') {
+            $this->provisionLemonSqueezy($event);
+
+            return;
+        }
+
+        throw new RuntimeException('Unsupported payment provider.');
     }
 
-    private function fromPaddle(array $e): array
+    private function provisionPaddle(array $event): void
     {
-        $type=(string)($e['event_type']??''); $d=$e['data']??[];
-        if (in_array($type,['transaction.refunded','transaction.canceled'],true)) return ['action'=>'revoke','orderID'=>(string)($d['id']??''),'priceID'=>'','productID'=>'','name'=>null,'email'=>null,'customerID'=>null];
-        if ($type!=='transaction.completed') return ['action'=>'ignore'];
-        $item=$d['items'][0]??[]; $price=$item['price']??[]; $product=$price['product_id']??($item['product_id']??null);
-        return ['action'=>'issue','orderID'=>(string)($d['id']??''),'priceID'=>(string)($price['id']??($item['price_id']??'')),'productID'=>(string)($product??''),'name'=>$d['custom_data']['customer_name']??null,'email'=>$d['custom_data']['customer_email']??null,'customerID'=>isset($d['customer_id'])?(string)$d['customer_id']:null];
+        $type = (string) ($event['event_type'] ?? '');
+        $data = $event['data'] ?? [];
+
+        if (str_starts_with($type, 'subscription.')) {
+            $this->syncPaddleSubscription($type, $data);
+
+            return;
+        }
+
+        if ($type === 'transaction.completed') {
+            $this->syncPaddleTransaction($data);
+
+            return;
+        }
+
+        if ($type === 'transaction.refunded') {
+            $transactionID = (string) ($data['id'] ?? '');
+            if ($transactionID !== '') {
+                License::where('payment_provider', 'paddle')
+                    ->where('external_order_id', $transactionID)
+                    ->whereNull('external_subscription_id')
+                    ->whereNull('revoked_at')
+                    ->update(['revoked_at' => now(), 'revoke_reason' => 'Payment refunded']);
+            }
+        }
     }
 
-    private function fromLemonSqueezy(array $e): array
+    private function syncPaddleSubscription(string $type, array $data): void
     {
-        $type=(string)($e['meta']['event_name']??''); $a=$e['data']['attributes']??[];
-        $order=(string)($e['data']['id']??($a['order_id']??''));
-        if (in_array($type,['order_refunded','subscription_expired'],true)) return ['action'=>'revoke','orderID'=>$order,'priceID'=>'','productID'=>'','name'=>null,'email'=>null,'customerID'=>null];
-        if (!in_array($type,['order_created','subscription_created'],true)) return ['action'=>'ignore'];
-        return ['action'=>'issue','orderID'=>$order,'priceID'=>(string)($a['variant_id']??''),'productID'=>(string)($a['product_id']??''),'name'=>$a['user_name']??null,'email'=>$a['user_email']??null,'customerID'=>isset($a['customer_id'])?(string)$a['customer_id']:null];
+        $subscriptionID = (string) ($data['id'] ?? '');
+        if ($subscriptionID === '') {
+            throw new RuntimeException('Paddle subscription webhook has no subscription ID.');
+        }
+
+        $status = (string) ($data['status'] ?? '');
+        $item = $this->firstRecurringItem($data['items'] ?? []);
+        $price = $item['price'] ?? [];
+        $priceID = (string) ($price['id'] ?? $item['price_id'] ?? '');
+        $productID = (string) ($price['product_id'] ?? $item['product_id'] ?? '');
+
+        $license = License::where('payment_provider', 'paddle')
+            ->where('external_subscription_id', $subscriptionID)
+            ->first();
+
+        if (! $license) {
+            $product = $this->mappedProduct('paddle', $priceID, $productID);
+            $custom = is_array($data['custom_data'] ?? null) ? $data['custom_data'] : [];
+            $customer = $this->paddle->customer($this->nullableString($data['customer_id'] ?? null));
+            [$license] = $this->issuer->issue(
+                $product,
+                $this->nullableString($custom['customer_name'] ?? $custom['name'] ?? $customer['name'] ?? null),
+                $this->nullableString($custom['customer_email'] ?? $custom['email'] ?? $customer['email'] ?? null),
+                'paddle',
+                $this->nullableString($data['transaction_id'] ?? null),
+                $this->nullableString($data['customer_id'] ?? null),
+                true,
+            );
+            $license->external_subscription_id = $subscriptionID;
+        } elseif ($priceID !== '' && $priceID !== $license->external_price_id) {
+            // Upgrades/downgrades change the entitlement attached to the existing key.
+            $product = $this->mappedProduct('paddle', $priceID, $productID);
+            $license->license_product_id = $product->id;
+            $license->edition = $product->edition;
+            $license->activation_limit = $product->activation_limit;
+            $license->max_major_version = $product->max_major_version;
+        }
+
+        $periodEnd = $data['current_billing_period']['ends_at'] ?? null;
+        $scheduled = $data['scheduled_change'] ?? null;
+        $cancelAt = is_array($scheduled) && ($scheduled['action'] ?? null) === 'cancel'
+            ? ($scheduled['effective_at'] ?? null)
+            : null;
+
+        $license->external_customer_id = $this->nullableString($data['customer_id'] ?? null) ?? $license->external_customer_id;
+        $license->external_price_id = $priceID !== '' ? $priceID : $license->external_price_id;
+        $license->subscription_status = $status !== '' ? $status : $license->subscription_status;
+        $license->current_period_ends_at = $periodEnd ? Carbon::parse($periodEnd) : $license->current_period_ends_at;
+        $license->cancel_scheduled_at = $cancelAt ? Carbon::parse($cancelAt) : null;
+
+        if (in_array($status, ['active', 'trialing'], true)) {
+            $license->revoked_at = null;
+            $license->revoke_reason = null;
+            // Trialing/active subscriptions remain valid through the current period.
+            $license->expires_at = $periodEnd ? Carbon::parse($periodEnd) : null;
+        } elseif ($status === 'past_due') {
+            // Do not instantly kill a licence on the first failed renewal. Preserve the
+            // period Paddle says is current; a later canceled event ends entitlement.
+            $license->expires_at = $periodEnd ? Carbon::parse($periodEnd) : ($license->expires_at ?? now()->addDays(7));
+        } elseif (in_array($status, ['canceled', 'paused'], true)) {
+            $license->expires_at = now();
+            $license->revoked_at = now();
+            $license->revoke_reason = $status === 'paused' ? 'Subscription paused' : 'Subscription canceled';
+        }
+
+        $license->save();
+    }
+
+    private function syncPaddleTransaction(array $data): void
+    {
+        $subscriptionID = $this->nullableString($data['subscription_id'] ?? null);
+        $transactionID = (string) ($data['id'] ?? '');
+
+        // Recurring purchases are provisioned from subscription events because those
+        // events contain the authoritative trial/status/current-period state.
+        if ($subscriptionID) {
+            License::where('payment_provider', 'paddle')
+                ->where('external_subscription_id', $subscriptionID)
+                ->whereNull('external_order_id')
+                ->update(['external_order_id' => $transactionID ?: null]);
+
+            return;
+        }
+
+        // Keep support for any future one-time Paddle licence product.
+        $item = $data['items'][0] ?? [];
+        $price = $item['price'] ?? [];
+        $priceID = (string) ($price['id'] ?? $item['price_id'] ?? '');
+        $productID = (string) ($price['product_id'] ?? $item['product_id'] ?? '');
+        $product = $this->mappedProduct('paddle', $priceID, $productID);
+        $custom = is_array($data['custom_data'] ?? null) ? $data['custom_data'] : [];
+        $customer = $this->paddle->customer($this->nullableString($data['customer_id'] ?? null));
+
+        $this->issuer->issue(
+            $product,
+            $this->nullableString($custom['customer_name'] ?? $custom['name'] ?? $customer['name'] ?? null),
+            $this->nullableString($custom['customer_email'] ?? $custom['email'] ?? $customer['email'] ?? null),
+            'paddle',
+            $transactionID,
+            $this->nullableString($data['customer_id'] ?? null),
+            true,
+        );
+    }
+
+    private function provisionLemonSqueezy(array $event): void
+    {
+        $type = (string) ($event['meta']['event_name'] ?? '');
+        $attributes = $event['data']['attributes'] ?? [];
+        $order = (string) ($event['data']['id'] ?? $attributes['order_id'] ?? '');
+
+        if (in_array($type, ['order_refunded', 'subscription_expired'], true)) {
+            License::where('payment_provider', 'lemon-squeezy')
+                ->where('external_order_id', $order)
+                ->whereNull('revoked_at')
+                ->update(['revoked_at' => now(), 'revoke_reason' => 'Payment refunded or subscription expired']);
+
+            return;
+        }
+
+        if (! in_array($type, ['order_created', 'subscription_created'], true)) {
+            return;
+        }
+
+        $product = $this->mappedProduct(
+            'lemon-squeezy',
+            (string) ($attributes['variant_id'] ?? ''),
+            (string) ($attributes['product_id'] ?? ''),
+        );
+
+        $this->issuer->issue(
+            $product,
+            $this->nullableString($attributes['user_name'] ?? null),
+            $this->nullableString($attributes['user_email'] ?? null),
+            'lemon-squeezy',
+            $order,
+            $this->nullableString($attributes['customer_id'] ?? null),
+            true,
+        );
+    }
+
+    private function mappedProduct(string $provider, string $priceID, string $productID): LicenseProduct
+    {
+        // Price IDs are the authoritative mapping because monthly and annual prices
+        // intentionally share the same Paddle product ID.
+        if ($priceID !== '') {
+            $product = LicenseProduct::where('payment_provider', $provider)
+                ->where('external_price_id', $priceID)
+                ->where('active', true)
+                ->first();
+        } else {
+            $product = LicenseProduct::where('payment_provider', $provider)
+                ->where('external_product_id', $productID)
+                ->where('active', true)
+                ->first();
+        }
+
+        if (! $product) {
+            throw new RuntimeException("No active licence product maps to {$provider} price {$priceID} / product {$productID}.");
+        }
+
+        return $product;
+    }
+
+    private function firstRecurringItem(array $items): array
+    {
+        foreach ($items as $item) {
+            if (($item['recurring'] ?? true) === true) {
+                return $item;
+            }
+        }
+
+        return $items[0] ?? [];
+    }
+
+    private function nullableString(mixed $value): ?string
+    {
+        if (! is_scalar($value)) {
+            return null;
+        }
+        $value = trim((string) $value);
+
+        return $value === '' ? null : $value;
     }
 }

rsync-studio-licensing/app/Services/Payments/WebhookVerifier.php

@@ -1,4 +1,10 @@
 <?php
+
 namespace App\Services\Payments;
+
 use Illuminate\Http\Request;
-interface WebhookVerifier { public function verify(Request $request, string $rawBody): void; }
+
+interface WebhookVerifier
+{
+    public function verify(Request $request, string $rawBody): void;
+}