When implementing the Stripe terminal in a device that will be used by
end-users, we need to ensure that it is the server that will validate
the data and not Javascript as is the case in Point of Sale.
Nevertheless, we're using the Javascript SDK for the connection to the
terminal, as we don't want to add a Python dependency to the Odoo server
How the SDK works:
During initialization, we create a terminal via the `create` function.
This function will receive as argument a function that generates a
unique token with a precise lifetime managed by the SDK. These tokens
must be supplied only to trusted devices, such as the kiosk, accessible
only if we have `access_token` from the `pos_config`.
Then, when making a payment, we make a request to the Odoo server to
create a Stripe payment request from the backend, connect the terminal
to the frontend via the `connectReader` function and send it the payment
request via the `collectPaymentMethod` function, passing it the
`client_secret` sent by the Odoo server.
We then use the `processPayment` function once the customer has
presented his payment card to finalize the payment on the terminal.
Finally, we call the `capturePayment` function, which contacts the Odoo
server to validate the amount and payment. If this is the case, it will
mark the order as paid and send a message via websocket to the kiosk to
display the confirmation page.
During these various stages, trust is placed in the server and not in
the frontend.
Stripe Javascript SDK documentation:
https://stripe.com/docs/terminal/references/api/js-sdkclosesodoo/odoo#138646
Signed-off-by: Joseph Caburnay (jcb) <jcb@odoo.com>
Louis (wil)