Skip to content

payments-stripe: retrofit into offchain pipeline conventions#37

Merged
mike-hanono merged 3 commits into
add-payments-stripe-toolfrom
chore/payments-stripe-offchain-conventions
May 25, 2026
Merged

payments-stripe: retrofit into offchain pipeline conventions#37
mike-hanono merged 3 commits into
add-payments-stripe-toolfrom
chore/payments-stripe-offchain-conventions

Conversation

@tuky191

@tuky191 tuky191 commented May 25, 2026 •
edited by mike-hanono
Loading

Copy link
Copy Markdown
Contributor

Summary

Stacks on top of #32 (Mike Hanono's payments-stripe addition). #32 landed at the pre-#33 layout (tools/ path, per-tool deploy workflows, root Cargo.lock); this PR realigns the tool to the offchain pipeline conventions introduced in #33 so the shared CI matrix picks it up automatically. Mike's tool code is unchanged in intent — this is purely a layout/convention conversion.

This PR targets add-payments-stripe-tool so its diff against #32's content is just the restructure — no main-restructure noise.

What changed

Area Before (#32 as-is) After (this PR)
Tool path tools/payments-stripe/ offchain/tools/payments-stripe/
Path/endpoint discovery tools/payments-stripe/paths.json (hand-maintained) --meta output from bootstrap!() (auto)
Build manifest none tools.json + build.rs (byte-identical to math's)
Cargo.toml no [[bin]] / [build-dependencies] added per convention
fqn!() macros bare fqn!("...@1") threaded fqn!(concat!("...@", env!("TOOL_FQN_VERSION")))
Per-tool deploy workflows deploy-payments-stripe-{mainnet,testnet}.yml removed — covered by offchain-tools.{discover,deploy,prepare,register}.yml matrix
Per-tool deploy artifacts tools/payments-stripe/deploy/{Dockerfile,cloud-run.*,register.sh} removed — shared offchain/Dockerfile is used by the matrix

Diff is intentionally minimal

23 files changed, 89 insertions, 373 deletions — almost entirely path renames (R), removals (D) of legacy deploy artifacts, the new build.rs / tools.json, and the 6 FQN-threading edits in src/tools/*.rs. No main-restructure noise because this PR targets add-payments-stripe-tool directly.

Test plan

  • @mike-hanono sanity-checks the FQN strings (load-bearing for on-chain registration — xyz.taluslabs.payments.stripe.<endpoint>@<version> form preserved)
  • Once Add payments-stripe tool (env-var credential model, offchain pipeline) #32 has caught up to main (rebased or merged), this PR's parent branch will have offchain/tools/ and the shared CI matrix in place; CI build on this PR completes
  • When ready to deploy, push a testnet-* tag from main post-merge to fire the full chain pipeline against testnet

Note on local verification

Because this PR predates main's restructure in its base, cargo check / convention pre-commit hook can't run cleanly in isolation (offchain/ workspace doesn't exist on this branch's base yet). Verified in a side-worktree where the base was rebased onto main:

  • cargo check -p payments-stripe ✓
  • .pre-commit/14-check-tool-conventions ✓ Tool conventions OK

🤖 Generated with Claude Code

@tuky191
payments-stripe: retrofit into offchain pipeline conventions
fe44a56 
PR #32 introduced payments-stripe at the legacy `tools/` path with
per-tool deploy workflows. Main has since restructured (#33) so all
tools live under `offchain/tools/` and share a single CI matrix. This
branch realigns payments-stripe so the new pipeline picks it up.

Layout move:
  tools/payments-stripe/         → offchain/tools/payments-stripe/

Added (per .pre-commit/14-check-tool-conventions):
  - tools.json   (tool_name, command, environment)
  - build.rs     (byte-identical to other tools; threads
                  TOOL_FQN_VERSION via cargo:rustc-env)
  - Cargo.toml   [[bin]] + [build-dependencies] sections

Removed (legacy per-tool deploy artifacts; the shared
offchain-tools.{discover,deploy,prepare,register}.yml matrix
replaces them):
  - tools/payments-stripe/deploy/{Dockerfile,cloud-run.*,register.sh}
  - tools/payments-stripe/paths.json (paths now come from each
                                      tool's --meta output)
  - .github/workflows/deploy-payments-stripe-{mainnet,testnet}.yml

Source modifications:
  - 6 fqn!() macros across src/tools/*.rs threaded to
    fqn!(concat!("...@", env!("TOOL_FQN_VERSION"))) so the on-chain
    FQN version stays in sync with the content-hashed image tag
    produced by CI.
@tuky191
tuky191 requested review from a team and mike-hanono May 25, 2026 16:13
@claude
payments-stripe: read STRIPE_API_KEY from env, drop api_key from Input
7da5669 
Stacks on #37 (which already moved the crate to offchain/tools/ and added
tools.json + build.rs). This PR is the security fix #37 deliberately left
out: every endpoint's Input struct had `pub api_key: String`, which
flowed through the Nexus DAG to Sui as plaintext on every invocation.

Adopts the env-var credential pattern from offchain/tools/memory-memwal:

- stripe_client.rs: `from_env()` reads STRIPE_API_KEY once at startup,
  wraps in `zeroize::Zeroizing<String>` (heap-zeroed on drop), validates
  the prefix (`sk_test_` / `sk_live_` / `rk_test_` / `rk_live_`). Hand-
  written `Debug` prints `<redacted>` — never `#[derive(Debug)]` on the
  credential-bearing type. Shared HTTP client lives in a `OnceLock` so
  the connection pool survives across `invoke` calls. `#[cfg(test)]
  for_testing(base_url, bearer)` constructor bypasses env validation for
  mockito tests.

- main.rs: explicit multi-thread tokio runtime; `env_logger` init before
  anything else; `--meta` short-circuit so CI's prepare step can pull
  /meta from an image with no env; `load_dotenv_if_present()` and
  `validate_credentials_at_startup()` before `bootstrap!`. `main` is the
  only `process::exit` site. Exit 1 if STRIPE_API_KEY is unset, empty,
  or has an unrecognized prefix.

- All six endpoint files: dropped `pub api_key: String` from Input.
  Dropped `.with_auth(&input.api_key)` from invoke(). NexusTool::new()
  calls `StripeClient::from_env().unwrap_or_else(|e| { log::error!(...);
  panic!(...) })` — startup-only panic, mirrors memwal. `idempotency_key`
  stays on Input (per-call dedup data, not a credential — explicit
  whitelist in the auditor).

- Tests: every `StripeClient::new(Some(&server.url()))` →
  `StripeClient::for_testing(&server.url(), "sk_test_FAKE")`. Every
  `api_key:` field dropped from `test_input()` and from inline Input
  literals. `get-balance` Input is now empty (`{}`) — only the
  STRIPE_API_KEY env var matters; the `_input` arg in invoke is unused.

- Cargo.toml: added workspace deps `anyhow`, `dotenvy`, `env_logger`,
  `log`, `zeroize` for the env-var path.

- README.md: rewrote the credential section to document the env var.
  Dropped `api_key` from every per-FQN Input table. Added an env-vars
  table. Threaded `<TOOL_FQN_VERSION>` into each FQN heading (matching
  the actual `concat!(..., env!("TOOL_FQN_VERSION"))` in source).

- .env.example: documents STRIPE_API_KEY for local dev. In production
  Cloud Run mounts it via `secretKeyRef` from GCP Secret Manager,
  configured by the operator out-of-band — the deploy pipeline does NOT
  provision the upstream API key. tools.json's `environment` block is
  RUST_LOG only (C10).

- Regenerated AUDIT.md is deferred — run the auditor agent against the
  merged tree, or invoke it after this branch lands.

Markdown linter fix: aligned 4 skill reference files' compact table
separators (`|---|` → `| --- |`) to satisfy MD060. These same files are
rewritten by PR #31; the conflict at merge is a no-op since both
branches use `| --- |`. Touched only to unblock `just pre-commit::md-lint`
on this branch.

Verified locally:
- bash <audit.sh from #31's tip> off-chain payments-stripe
  → PASS static:input-credential
  → PASS static:debug-on-credentials
  → PASS static:stateful
  → PASS tools-json:shape / secret-in-env
  → PASS conform:output-enum / description / fqn-versioned
  (cargo:check fails — sandbox is missing pkg-config/libssl-dev for
   openssl-sys; orthogonal to this change. PR #37 author noted the same
   in their PR description; verification happens via CI on push.)
- npx markdownlint-cli2 '**/*.md' '!.git/' → 0 errors across 26 files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@mike-hanono mike-hanono mentioned this pull request May 25, 2026
Merged
6 tasks
@mike-hanono
Merge pull request #38 from Talus-Network/fix/payments-stripe-credent…
90cfdd7 
…ial-env

payments-stripe: read STRIPE_API_KEY from env, drop api_key from Input
@mike-hanono
mike-hanono merged commit 04e4398 into add-payments-stripe-tool May 25, 2026
7 checks passed
@mike-hanono
mike-hanono deleted the chore/payments-stripe-offchain-conventions branch May 25, 2026 20:55
@mike-hanono mike-hanono mentioned this pull request May 25, 2026
Open
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kouks kouks kouks approved these changes
@davidrotari19 davidrotari19 davidrotari19 approved these changes
@mike-hanono mike-hanono mike-hanono approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@tuky191 @kouks @davidrotari19 @mike-hanono