How Can I Secure My FlutterFlow App's Payment Data

1const { onCall, onRequest, HttpsError } = require('firebase-functions/v2/https');
2const { defineSecret } = require('firebase-functions/params');
3const { initializeApp } = require('firebase-admin/app');
4const { getFirestore } = require('firebase-admin/firestore');
5const Stripe = require('stripe');
6
7initializeApp();
8
9const stripeSecretKey = defineSecret('STRIPE_SECRET_KEY');
10const stripeWebhookSecret = defineSecret('STRIPE_WEBHOOK_SECRET');
11
12// Create Stripe Checkout session
13exports.createCheckoutSession = onCall(
14  { secrets: [stripeSecretKey] },
15  async (request) => {
16    const uid = request.auth?.uid;
17    if (!uid) throw new HttpsError('unauthenticated', 'Sign in required');
18    const { priceId, successUrl, cancelUrl } = request.data;
19    const stripe = new Stripe(stripeSecretKey.value());
20    const db = getFirestore();
21
22    const userDoc = await db.collection('users').doc(uid).get();
23    let customerId = userDoc.data()?.stripeCustomerId;
24    if (!customerId) {
25      const customer = await stripe.customers.create({ metadata: { firebaseUid: uid } });
26      customerId = customer.id;
27      await db.collection('users').doc(uid).update({ stripeCustomerId: customerId });
28    }
29
30    const session = await stripe.checkout.sessions.create({
31      customer: customerId,
32      mode: 'payment',
33      line_items: [{ price: priceId, quantity: 1 }],
34      success_url: successUrl,
35      cancel_url: cancelUrl,
36      payment_intent_data: { metadata: { firebaseUid: uid } },
37    });
38
39    // Log only safe identifiers, never full session object
40    console.log('Checkout session created:', session.id, 'for user:', uid);
41    return { sessionUrl: session.url, sessionId: session.id };
42  }
43);
44
45// Handle Stripe webhooks with signature verification
46exports.stripeWebhook = onRequest(
47  { secrets: [stripeSecretKey, stripeWebhookSecret], rawBody: true },
48  async (req, res) => {
49    const sig = req.headers['stripe-signature'];
50    if (!sig) return res.status(400).send('Missing stripe-signature header');
51
52    const stripe = new Stripe(stripeSecretKey.value());
53    let event;
54    try {
55      event = stripe.webhooks.constructEvent(
56        req.rawBody, sig, stripeWebhookSecret.value()
57      );
58    } catch (err) {
59      console.error('Webhook verification failed:', err.message);
60      return res.status(400).send(`Webhook Error: ${err.message}`);
61    }
62
63    const db = getFirestore();
64
65    if (event.type === 'checkout.session.completed') {
66      const session = event.data.object;
67      const customerId = session.customer;
68      const amountTotal = session.amount_total;
69      const currency = session.currency;
70
71      // Retrieve payment method details (only safe metadata)
72      let last4 = null;
73      let brand = null;
74      if (session.payment_intent) {
75        const pi = await stripe.paymentIntents.retrieve(session.payment_intent, {
76          expand: ['payment_method'],
77        });
78        last4 = pi.payment_method?.card?.last4 || null;
79        brand = pi.payment_method?.card?.brand || null;
80      }
81
82      const usersRef = db.collection('users');
83      const query = await usersRef
84        .where('stripeCustomerId', '==', customerId).limit(1).get();
85
86      if (!query.empty) {
87        const userRef = query.docs[0].ref;
88        await userRef.update({ hasPaid: true, lastPaymentAt: new Date() });
89        await userRef.collection('payments').add({
90          sessionId: session.id,
91          amount: amountTotal,
92          currency,
93          last4,
94          brand,
95          paidAt: new Date(),
96        });
97      }
98
99      console.log('Payment completed for customer:', customerId, 'amount:', amountTotal);
100    }
101
102    res.json({ received: true });
103  }
104);