Marie
96aef62ae4
Fixes https://github.com/twentyhq/core-team-issues/issues/1956 **Problem** Within an app, the `.yarn/releases/` folder contains executable Yarn binaries that run when executing any yarn command (`.yarnrc` file indicates yarn path to be `.yarn/releases/yarn-4.9.2.cjs `.) This is a supply chain attack vector: a malicious actor could submit a PR with a compromised `yarn-4.9.2.cjs binary`, which would execute arbitrary code on developers' machines or CI systems. **Fix** Actually, thanks to Corepack, we don't need to store and execute this binary. Corepack can be seen as the manager of a package manager: in `package.json` we indicate a packageManager version like `"packageManager": "yarn@4.9.2"`, and when executing `yarn` Corepack will securely fetch the verified version from npm, avoiding the risk of executing a compromised binary committed to the repository. This was already in our app's package.json template but we were not using it! We can now - remove the folder containing the binary from our app template base-application (that is scaffolded when creating an app through cli), `.yarn/releases/`, and remove `yarnPath: .yarn/releases/yarn-4.9.2.cjs` from its .yarnrc - remove them from the community apps that were already published in the repo - add .yarn to gitignore **Tested** This has been tested and works for app created in the repo, outside the repo, and existing apps in the repo
Stripe synchronizer
Synchronizes customers from Stripe to Twenty
Requirements
- an
apiKey- go to Settings > API & Webhooks to generate one - Stripe secret API key - available in Stripe workbench
Setup
- Synchronize app
cd packages/twenty-apps/community/stripe-synchronizer
yarn auth
yarn sync
- Go to Stripe > Workbench > Webhooks and add webhook:
- events: customer.subscription.created and customer.subscription.updated
- webhook endpoint
- destination:
{TWENTY_URL}/s/webhook/stripe, e.g. https://workspace.twenty.com/s/webhook/stripe
- Go to Twenty > Settings > Integrations > Stripe synchronizer > Settings and add values
Flow
- Retrieve Stripe webhook
- Check if it's either subscription created or updated, if not, exit
- Read customer ID, sub status and quantity from webhook
- Read customer data from Stripe API, if business name is empty, exit
- Check if customer company exists in Twenty, if not, create it
- Check if related person exists in Twenty, if not, create it and link to company
Notes
- app synchronizes only new customers, those created before start of app won't be synchronized unless they're updated
- customers will be added to Twenty People object only if their name and email are filled with data, otherwise app will throw an error
Todo
- add validation of signature key from Stripe to ensure that incoming request is valid (possible once request headers are exposed to serverless functions)
- update app so it'll use provided Twenty generated object with native types from workspace once extending objects is possible