formancehq · paul-nicolas · May 14, 2025 · May 14, 2025
@@ -18,9 +18,9 @@ import (
 //go:generate mockgen -source client.go -destination client_generated.go -package client . Client
 type Client interface {
 	GetMerchantAccounts(ctx context.Context, pageNumber, pageSize int32) ([]management.Merchant, error)
-	CreateWebhook(ctx context.Context, url string, connectorID string) error
+	CreateWebhook(ctx context.Context, url string, connectorID string) (CreateWebhookResponse, error)
 	VerifyWebhookBasicAuth(basicAuth *models.BasicAuth) bool
-	VerifyWebhookHMAC(item webhook.NotificationItem) bool
+	VerifyWebhookHMAC(item webhook.NotificationItem, hmacKey string) bool
 	DeleteWebhook(ctx context.Context, connectorID string) error
 	TranslateWebhook(req string) (*webhook.Webhook, error)
 }
@@ -34,7 +34,6 @@ type client struct {
 	companyID string
 
 	standardWebhook *management.Webhook
-	hmacKey         string
 }
 
 func New(

@@ -51,17 +51,21 @@
 	return nil
 }
 
-func (c *client) CreateWebhook(ctx context.Context, url string, connectorID string) error {
+type CreateWebhookResponse struct {
+	HMACKey string
+}
+
+func (c *client) CreateWebhook(ctx context.Context, url string, connectorID string) (CreateWebhookResponse, error) {
 	if c.standardWebhook != nil {
-		return nil
+		return CreateWebhookResponse{}, nil
 	}
 
 	if err := c.searchWebhook(ctx, connectorID); err != nil {
-		return err
+		return CreateWebhookResponse{}, err
 	}
 
 	if c.standardWebhook != nil {
-		return nil
+		return CreateWebhookResponse{}, nil
 	}
 
 	req := management.CreateCompanyWebhookRequest{
@@ -88,21 +92,22 @@
 			CreateCompanyWebhookRequest(req),
 	)
 	if err != nil {
-		return c.wrapSDKError(err, raw.StatusCode)
+		return CreateWebhookResponse{}, c.wrapSDKError(err, raw.StatusCode)
 	}
 
 	hmac, raw, err := c.client.Management().WebhooksCompanyLevelApi.GenerateHmacKey(
 		metrics.OperationContext(ctx, "create_hook_hmac_key"),
 		c.client.Management().WebhooksCompanyLevelApi.GenerateHmacKeyInput(c.companyID, *webhook.Id),
 	)
 	if err != nil {
-		return c.wrapSDKError(err, raw.StatusCode)
+		return CreateWebhookResponse{}, c.wrapSDKError(err, raw.StatusCode)
 	}
 
 	c.standardWebhook = &webhook
-	c.hmacKey = hmac.HmacKey
 
-	return nil
+	return CreateWebhookResponse{
+		HMACKey: hmac.HmacKey,
+	}, nil
 }
 
 func (c *client) VerifyWebhookBasicAuth(basicAuth *models.BasicAuth) bool {
@@ -118,8 +123,8 @@
 	return false
 }
 
-func (c *client) VerifyWebhookHMAC(item webhook.NotificationItem) bool {
-	return hmacvalidator.ValidateHmac(item.NotificationRequestItem, c.hmacKey)
+func (c *client) VerifyWebhookHMAC(item webhook.NotificationItem, hmacKey string) bool {
+	return hmacvalidator.ValidateHmac(item.NotificationRequestItem, hmacKey)
 }
 
 func (c *client) DeleteWebhook(ctx context.Context, connectorID string) error {

@@ -16,6 +16,10 @@
 	"github.com/formancehq/payments/internal/models"
 )
 
+const (
+	webhookHMACMetadataKey = "hmac_key"
+)
+
 type supportedWebhook struct {
 	urlPath string
 	fn      func(context.Context, models.TranslateWebhookRequest) (models.TranslateWebhookResponse, error)
@@ -44,12 +48,19 @@
 		return configs, err
 	}
 
+	resp, err := p.client.CreateWebhook(ctx, url, req.ConnectorID)
+	if err != nil {
+		return configs, err
+	}
+
 	configs = append(configs, models.PSPWebhookConfig{
 		Name:    name,
 		URLPath: standardConfig.urlPath,
+		Metadata: map[string]string{
+			webhookHMACMetadataKey: resp.HMACKey,
+		},
 	})
 
-	err = p.client.CreateWebhook(ctx, url, req.ConnectorID)
 	return configs, err
 }
 
@@ -64,7 +75,7 @@
 	}
 
 	for _, item := range *webhooks.NotificationItems {
-		if !p.client.VerifyWebhookHMAC(item) {
+		if !p.client.VerifyWebhookHMAC(item, req.Config.Metadata[webhookHMACMetadataKey]) {
 			return models.VerifyWebhookResponse{}, fmt.Errorf("invalid HMAC: %w", models.ErrWebhookVerification)
 		}
 	}

@@ -65,11 +65,12 @@ var _ = Describe("Adyen Plugin Accounts", func() {
 			}
 
 			expectedURL := "http://localhost:8080/test/standard"
-			m.EXPECT().CreateWebhook(gomock.Any(), expectedURL, req.ConnectorID).Return(nil)
+			m.EXPECT().CreateWebhook(gomock.Any(), expectedURL, req.ConnectorID).Return(client.CreateWebhookResponse{HMACKey: "test"}, nil)
 
 			configs, err := plg.CreateWebhooks(ctx, req)
 			Expect(err).To(BeNil())
 			Expect(configs.Configs).To(HaveLen(1))
+			Expect(configs.Configs[0].Metadata[webhookHMACMetadataKey]).To(Equal("test"))
 		})
 	})
 
@@ -105,6 +106,9 @@ var _ = Describe("Adyen Plugin Accounts", func() {
 			req := models.VerifyWebhookRequest{
 				Config: &models.WebhookConfig{
 					Name: "standard",
+					Metadata: map[string]string{
+						webhookHMACMetadataKey: "test",
+					},
 				},
 				Webhook: models.PSPWebhook{
 					BasicAuth: &models.BasicAuth{
@@ -132,6 +136,9 @@ var _ = Describe("Adyen Plugin Accounts", func() {
 			req := models.VerifyWebhookRequest{
 				Config: &models.WebhookConfig{
 					Name: "standard",
+					Metadata: map[string]string{
+						webhookHMACMetadataKey: "test",
+					},
 				},
 				Webhook: models.PSPWebhook{
 					QueryValues: map[string][]string{},
@@ -142,7 +149,7 @@ var _ = Describe("Adyen Plugin Accounts", func() {
 
 			m.EXPECT().VerifyWebhookBasicAuth(req.Webhook.BasicAuth).Return(true)
 			m.EXPECT().TranslateWebhook(string(req.Webhook.Body)).Return(&w, nil)
-			m.EXPECT().VerifyWebhookHMAC(gomock.Any()).Return(false)
+			m.EXPECT().VerifyWebhookHMAC(gomock.Any(), "test").Return(false)
 
 			resp, err := plg.VerifyWebhook(ctx, req)
 			Expect(err).ToNot(BeNil())
@@ -157,6 +164,9 @@ var _ = Describe("Adyen Plugin Accounts", func() {
 			req := models.VerifyWebhookRequest{
 				Config: &models.WebhookConfig{
 					Name: "standard",
+					Metadata: map[string]string{
+						webhookHMACMetadataKey: "test",
+					},
 				},
 				Webhook: models.PSPWebhook{
 					QueryValues: map[string][]string{},
@@ -167,7 +177,7 @@ var _ = Describe("Adyen Plugin Accounts", func() {
 
 			m.EXPECT().VerifyWebhookBasicAuth(req.Webhook.BasicAuth).Return(true)
 			m.EXPECT().TranslateWebhook(string(req.Webhook.Body)).Return(&w, nil)
-			m.EXPECT().VerifyWebhookHMAC(gomock.Any()).Return(true)
+			m.EXPECT().VerifyWebhookHMAC(gomock.Any(), "test").Return(true)
 
 			resp, err := plg.VerifyWebhook(ctx, req)
 			Expect(err).To(BeNil())