piekarnikgosipl/orders/order.go

package orders

import (
	"crypto/rand"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"log"
	"math"
	"net/http"
	"piekarnikgosipl/data"
	"strconv"
	"strings"
	"unicode"

	"github.com/stripe/stripe-go/v82"
	"github.com/stripe/stripe-go/v82/checkout/session"
	"github.com/stripe/stripe-go/v82/webhook"
)

const retainer = 5000 // 50zł

type listItem struct {
	id    string
	count int // count multiplied by 100 to allow for half item purchases
}

type order struct {
	name  string
	phone string
	items []listItem
}

func InitStripe(secret string) { stripe.Key = secret }

func parseFloat(input string) (int, error) {
	val, err := strconv.ParseFloat(input, 64)
	if err != nil {
		return 0, fmt.Errorf("Invalid float format")
	}

	if val < 0 || val > 100 {
		return 0, fmt.Errorf("Value must be between 0 and 100")
	}

	doubled := val * 2
	if math.Abs(doubled-math.Round(doubled)) > 1e-9 {
		return 0, fmt.Errorf("Value must be a multiple of 0.5")
	}

	return int(math.Round(val * 100)), nil
}

func validName(name string) bool {
	if name == "" || len(name) > 100 {
		return false
	}
	return strings.IndexFunc(name, unicode.IsControl) == -1
}

func parseOrder(r *http.Request) (order, error) {
	var o order
	var err error
	var errorList []error
	o.name = strings.TrimSpace(r.PostFormValue("name"))
	if !validName(o.name) {
		errorList = append(errorList, fmt.Errorf("Invalid name"))
	}
	o.phone, err = parsePhone(r.PostFormValue("phone"))
	if err != nil {
		errorList = append(errorList, err)
	}
	for _, item := range data.Swieta {
		count, err := parseFloat(r.PostFormValue(item.Id))
		if err != nil {
			errorList = append(errorList, fmt.Errorf("Can't parse the count for %v: %v", item.Name, err))
			continue
		}
		if count%10 == 5 && !item.Halveable {
			errorList = append(errorList, fmt.Errorf("This item can't be bought in fractions %v", item.Name))
			continue
		}
		o.items = append(o.items, listItem{item.Id, count})
	}
	return o, errors.Join(errorList...)
}

func newOrderID() string {
	b := make([]byte, 8)
	rand.Read(b)
	return hex.EncodeToString(b)
}

func startCheckout(w http.ResponseWriter, r *http.Request, o order) {
	id := newOrderID()
	log.Println("ORDER_PENDING", id, o)

	s, err := session.New(&stripe.CheckoutSessionParams{
		Mode:              stripe.String("payment"),
		ClientReferenceID: stripe.String(id),
		Locale:            stripe.String("pl"),
		LineItems: []*stripe.CheckoutSessionLineItemParams{{
			Quantity: stripe.Int64(1),
			PriceData: &stripe.CheckoutSessionLineItemPriceDataParams{
				Currency:   stripe.String("pln"),
				UnitAmount: stripe.Int64(retainer),
				ProductData: &stripe.CheckoutSessionLineItemPriceDataProductDataParams{
					Name: stripe.String("Zaliczka na zamówienie " + id),
				},
			},
		}},
		SuccessURL: stripe.String("https://piekarnikgosi.pl/dziekujemy"),
		CancelURL:  stripe.String("https://piekarnikgosi.pl/"),
	})
	if err != nil {
		log.Println("ORDER_STRIPE_ERROR", id, err)
		http.Error(w, "payment error", http.StatusInternalServerError)
		return
	}
	if r.Header.Get("HX-Request") == "true" {
		w.Header().Set("HX-Redirect", s.URL)
		w.WriteHeader(http.StatusOK)
		return
	}
	http.Redirect(w, r, s.URL, http.StatusSeeOther)
}

func OrderHandler(w http.ResponseWriter, r *http.Request) {
	o, err := parseOrder(r)
	if err != nil {
		log.Println("ORDER_INVALID", o, err)
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}
	startCheckout(w, r, o)
}

func WebhookHandler(secret string) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 65536))
		if err != nil {
			http.Error(w, "bad body", http.StatusBadRequest)
			return
		}
		event, err := webhook.ConstructEventWithOptions(body, r.Header.Get("Stripe-Signature"), secret,
			webhook.ConstructEventOptions{IgnoreAPIVersionMismatch: true})
		if err != nil {
			http.Error(w, "bad signature", http.StatusBadRequest)
			return
		}

		if event.Type != "checkout.session.completed" && event.Type != "checkout.session.async_payment_succeeded" {
			w.WriteHeader(http.StatusOK)
			return
		}

		var s stripe.CheckoutSession
		if err := json.Unmarshal(event.Data.Raw, &s); err != nil {
			http.Error(w, "bad event", http.StatusBadRequest)
			return
		}

		switch {
		case s.PaymentStatus != stripe.CheckoutSessionPaymentStatusPaid:
			log.Println("ORDER_NOT_YET_PAID", s.ClientReferenceID, s.ID, s.PaymentStatus)
		case s.AmountTotal != retainer || s.Currency != stripe.CurrencyPLN:
			log.Println("ORDER_PAYMENT_MISMATCH", s.ClientReferenceID, s.ID, s.AmountTotal, s.Currency)
		default:
			log.Println("ORDER_PAID", s.ClientReferenceID, s.ID)
		}
		w.WriteHeader(http.StatusOK)
	}
}