Ti Ext Payregister Laravel Package

Technical Evaluation

Architecture Fit

The ti-ext-payregister package (v4.1.2) maintains strong alignment with Laravel’s service provider pattern, event-driven workflows, and queue-based async processing, but introduces critical security constraints that may impact integration flexibility. The hardened Stripe webhook validation (mandatory signing secret) reinforces PCI compliance but requires upfront configuration rigor.

Key Strengths (Updated):

• Enforced Security: Mandatory Stripe webhook secrets prevent replay attacks and unauthorized event processing, aligning with Laravel’s security best practices.
• Decoupled Gateway Design: Unchanged—each provider remains encapsulated, enabling easy swapping (e.g., Stripe → Mollie).
• Offsite Mode: Still reduces PCI scope, but now requires stricter validation for webhook endpoints.
• Event-Driven Extensibility: Webhook events are now more secure but may require adjustments to custom listeners.

Updated Misalignment:

• Webhook Secret Dependency: The mandatory Stripe secret introduces a breaking change for integrations relying on dynamic or shared webhook endpoints (e.g., multi-tenant setups).
• TastyIgniter-Specific: Assumes ti-ext-* module system; vanilla Laravel may need adapter layers for config/admin panels.
• Frontend UX: Offsite redirects remain incompatible with SPA/instant-checkout flows.

Integration Feasibility

• Laravel Compatibility:
  • PHP 8.1+ required (unchanged).
  • Stripe SDK v12+ enforced for webhook validation (check composer.json).
  • No database schema changes, but Mollie’s payment_logs table is still optional.
• Gateway-Specific Setup:
  • Stripe:
    • Mandatory: STRIPE_WEBHOOK_SECRET in .env (now hard requirement).
    • Action: Copy secret from Stripe Dashboard → config/payregister.php → stripe.webhook_secret.
  • Mollie: Unchanged (Omnipay-based, no secret enforcement).
  • Authorize.Net/PayPal: May need custom validation if not using Stripe’s SDK.
• Webhook Handling:
  • Critical Change: Webhooks without secrets are rejected (previously logged or ignored).
  • Impact: Existing StripeWebhookController must validate secrets before dispatching events.

Feasibility Risks (Updated):

Technical Risk

Key Questions for TPM (Updated)

1. Security & Compliance:

   • How are Stripe webhook secrets currently managed? (Manual .env edits? Version-controlled?)
   • Are there multi-tenant or shared webhook endpoints that conflict with the mandatory secret requirement?

2. Infrastructure:

   • Is the webhook endpoint (e.g., /stripe-webhook) behind a WAF? (e.g., Cloudflare, AWS ALB)
   • Can the team implement a circuit breaker for webhook failures without downtime?

3. Provider Strategy:

   • Will other gateways (e.g., Square, PayPal) require similar secret enforcement? (Likely no, but document gaps.)
   • Is the team prepared to rotate secrets every 6 months as per Stripe’s recommendation?

4. Migration Impact:

   • Are there existing custom webhook listeners that need to be updated to handle rejected events gracefully?
   • How will the team test webhook validation in staging vs. production?

5. Operational Impact:

   • Who will monitor webhook failures post-deployment? (e.g., Sentry, Laravel Horizon)
   • Is there a rollback plan if the new validation breaks existing integrations?

Integration Approach

Stack Fit

The package remains optimized for Laravel, but v4.1.2 introduces security constraints that require adjustments to the stack:

• Service Providers: Unchanged—gateways register as Laravel services.
• Events/Listeners: Critical: Custom listeners must now validate secrets before processing.
• Queues: Unchanged, but failed webhook jobs may spike due to validation errors.
• Middleware: New Requirement: Add Stripe secret validation middleware (e.g., StripeWebhookMiddleware).
• Blade/Middleware: Offsite mode unchanged, but webhook routes must be secured.

Compatibility Matrix (Updated):

Migration Path (Updated)

Phase 1: Prep & Security Hardening (1 Week)

1. Secret Configuration:

   • Action: Copy STRIPE_WEBHOOK_SECRET from Stripe Dashboard to .env:

     STRIPE_WEBHOOK_SECRET=whsec_...
     

   • Action: Update config/payregister.php:

     'stripe' => [
         'webhook_secret' => env('STRIPE_WEBHOOK_SECRET'),
         'mode' => 'offsite', // or 'inline'
     ],
     

   • Tooling: Use Laravel Envoy to automate secret rotation:

     @servers(['web'])
     task rotate-stripe-secret
         cd /var/www
         git pull
         php artisan config:clear
         # Trigger secret rotation via Stripe Dashboard
     endtask
     

2. Middleware Implementation:

   • Action: Create app/Http/Middleware/StripeWebhookMiddleware.php:

     namespace App\Http\Middleware;
     use Closure;
     use Stripe\