basic hook

app/controllers/hooks_controller.rb

@@ -3,6 +3,25 @@
 module DiscourseSubscriptions
   class HooksController < ::ApplicationController
     def create
+      begin
+
+        # payload, sig_header, endpoint_secret
+        event = ::Stripe::Webhook.construct_event(
+          {},
+          'stripe-webhook-signature',
+          'endpoint_secret'
+        )
+
+      rescue JSON::ParserError => e
+        # Invalid payload
+        status 400
+        return
+      rescue Stripe::SignatureVerificationError => e
+        # Invalid signature
+        status 400
+        return
+      end
+
       head 200
     end
   end

config/locales/client.en.yml

@@ -4,6 +4,7 @@ en:
     discourse_subscriptions_extra_nav_subscribe: Show the subscribe button in the primary navigation
     discourse_subscriptions_public_key: Stripe Publishable Key
     discourse_subscriptions_secret_key: Stripe Secret Key
+    discourse_subscriptions_webhook_secret: Stripe Webhook Secret
     discourse_subscriptions_currency: Default Currency Code. This can be overridden when creating a subscription plan.
     discourse_subscriptions_allow_payments: Allow single payments
     errors:

config/settings.yml

@@ -10,6 +10,9 @@ plugins:
   discourse_subscriptions_secret_key:
     default: ''
     client: false
+  discourse_subscriptions_webhook_secret:
+    default: ''
+    client: false
   discourse_subscriptions_allow_payments:
     default: false
     client: true

spec/requests/hooks_controller_spec.rb

@@ -4,8 +4,18 @@ require 'rails_helper'
 
 module DiscourseSubscriptions
   RSpec.describe HooksController do
-    it "responds ok" do
+    it "contructs a webhook event" do
+      ::Stripe::Webhook
+        .expects(:construct_event)
+        .with({}, 'stripe-webhook-signature', 'endpoint_secret')
+        .returns(true)
+
+      headers = {
+        'HTTP_STRIPE_SIGNATURE' => 'stripe-webhook-signature'
+      }
+
       post "/s/hooks.json"
+
       expect(response.status).to eq 200
     end
   end