Expose a webhook endpoint to which Stripe may send payment notifications
Stripe supports HTTPS-based notifications for various events: https://stripe.com/docs/webhooks
Expose an endpoint which can receive such notifications pertaining to successful charges which accepts a description of a charge and can extract a voucher from the metadata property.
- The endpoint must be exposed over HTTPS (using an externally supplied certificate).
- The implementation must discard (without other processing) notifications without a valid signature.
- The implementation must discard (without other processing) duplicate valid notifications.
- The voucher and amount (including currency) from valid notifications must be made readily accessible to downstream application code (eg for insertion into an active/valid voucher database).
- The distinctive Stripe components should be factored so as not to preclude the addition of future payment processors with a different interface.
It is not necessary to provide support for registering the endpoint as a webhook. It's not clear which piece will eventually be in charge of that. There is a Terraform module for Stripe which may be a better approach than having this software be responsible for the registration.