HabitRPG/habitrpg — pull request #4244 by lefnire (2014-11-15 23:09:19+00:00)
Title: fix(paypal): move from classic paypal APIs to paypal REST SDK

I've been getting warnings from Paypal that we're using old insecure APIs. I couldn't find any issues in the modules we're using, but a sure-fire fix is to move to the PayPal-sanctioned npm module (which uses their REST SDK). The old modules were hardly maintained whatsoever. The REST SDK has its limitations compared to the classic APIs, but it's the future for paypal so might as well get started now.

One thing of note. Creating a recurring payment is [three (odd) steps](https://github.com/paypal/PayPal-node-SDK/blob/master/samples/subscription/billing_agreements/create.js#L3):

* Create the billing plan
* Activate the plan (???)
* Subscribe the user to that plan.

Creating the billing plan (step 1) creates the actual subscription definition stored in our PayPal backend *in code*. This is a very strange step, normally services (like stripe) have you define your subscription definitions on their website, and you reference those defs when subscribing users. The main point here is, every time this code is run it will create a new billing plan definition on PayPal's backend, which is bad. To get around that, we list our plans, find one that matches the one defined here, if it exists use it, if not create it. Stupid - anyone think of an alternative way to handle this?