@86d-app/payments 0.0.3 → 0.0.6

package/src/service-impl.ts

@@ -12,8 +12,23 @@ export function createPaymentController(
 	data: ModuleDataService,
 	provider?: PaymentProvider,
 ): PaymentController {
+	/** Sum of all succeeded refund amounts for an intent. */
+	async function totalRefunded(intentId: string): Promise<number> {
+		const refunds = await data.findMany("refund", {
+			where: { paymentIntentId: intentId },
+		});
+		return (refunds as unknown as Refund[]).reduce(
+			(sum, r) => sum + (r.status !== "failed" ? r.amount : 0),
+			0,
+		);
+	}
+
 	return {
 		async createIntent(params) {
+			if (!Number.isInteger(params.amount) || params.amount <= 0) {
+				throw new Error("Amount must be a positive integer");
+			}
+
 			const id = crypto.randomUUID();
 			const now = new Date();
 
@@ -64,6 +79,15 @@ export function createPaymentController(
 			const intent = existing as unknown as PaymentIntent;
 			if (intent.status === "succeeded") return intent;
 
+			const terminalStates: PaymentIntentStatus[] = [
+				"cancelled",
+				"failed",
+				"refunded",
+			];
+			if (terminalStates.includes(intent.status)) {
+				throw new Error(`Cannot confirm intent in '${intent.status}' state`);
+			}
+
 			let newStatus: PaymentIntentStatus = "succeeded";
 			let newProviderMetadata = intent.providerMetadata;
 
@@ -90,6 +114,15 @@ export function createPaymentController(
 			const intent = existing as unknown as PaymentIntent;
 			if (intent.status === "cancelled") return intent;
 
+			const nonCancellable: PaymentIntentStatus[] = [
+				"succeeded",
+				"failed",
+				"refunded",
+			];
+			if (nonCancellable.includes(intent.status)) {
+				throw new Error(`Cannot cancel intent in '${intent.status}' state`);
+			}
+
 			let newProviderMetadata = intent.providerMetadata;
 
 			if (provider && intent.providerIntentId) {
@@ -192,7 +225,22 @@ export function createPaymentController(
 			if (!intent) throw new Error("Payment intent not found");
 			const pi = intent as unknown as PaymentIntent;
 
+			const refundableStates: PaymentIntentStatus[] = ["succeeded", "refunded"];
+			if (!refundableStates.includes(pi.status)) {
+				throw new Error(`Cannot refund intent in '${pi.status}' state`);
+			}
+
 			const refundAmount = params.amount ?? pi.amount;
+			if (refundAmount <= 0) {
+				throw new Error("Refund amount must be positive");
+			}
+
+			const alreadyRefunded = await totalRefunded(params.intentId);
+			if (alreadyRefunded + refundAmount > pi.amount) {
+				throw new Error(
+					`Refund amount ${refundAmount} exceeds remaining refundable amount ${pi.amount - alreadyRefunded}`,
+				);
+			}
 
 			let providerRefundId: string;
 			let refundStatus: Refund["status"] = "succeeded";
@@ -299,6 +347,18 @@ export function createPaymentController(
 			const now = new Date();
 			const refundAmount = params.amount ?? intent.amount;
 
+			// Deduplicate by providerRefundId — webhook retries must be idempotent
+			const existingRefunds = await data.findMany("refund", {
+				where: {
+					paymentIntentId: intent.id,
+					providerRefundId: params.providerRefundId,
+				},
+			});
+			const existing = existingRefunds as unknown as Refund[];
+			if (existing.length > 0) {
+				return { intent, refund: existing[0] };
+			}
+
 			const refundId = crypto.randomUUID();
 			const refund: Refund = {
 				id: refundId,

package/src/store/endpoints/cancel-intent.ts

@@ -5,12 +5,28 @@ export const cancelIntent = createStoreEndpoint(
 	"/payments/intents/:id/cancel",
 	{
 		method: "POST",
-		params: z.object({ id: z.string() }),
+		params: z.object({ id: z.string().max(200) }),
 	},
 	async (ctx) => {
+		const session = ctx.context.session;
+		if (!session) {
+			return { error: "Authentication required", status: 401 };
+		}
+
 		const controller = ctx.context.controllers.payments as PaymentController;
-		const intent = await controller.cancelIntent(ctx.params.id);
-		if (!intent) return { error: "Payment intent not found", status: 404 };
-		return { intent };
+		try {
+			const intent = await controller.cancelIntent(ctx.params.id);
+			if (!intent) return { error: "Payment intent not found", status: 404 };
+
+			if (intent.customerId && intent.customerId !== session.user.id) {
+				return { error: "Payment intent not found", status: 404 };
+			}
+
+			return { intent };
+		} catch (err) {
+			const message =
+				err instanceof Error ? err.message : "Cannot cancel payment";
+			return { error: message, status: 400 };
+		}
 	},
 );

package/src/store/endpoints/confirm-intent.ts

@@ -5,12 +5,28 @@ export const confirmIntent = createStoreEndpoint(
 	"/payments/intents/:id/confirm",
 	{
 		method: "POST",
-		params: z.object({ id: z.string() }),
+		params: z.object({ id: z.string().max(200) }),
 	},
 	async (ctx) => {
+		const session = ctx.context.session;
+		if (!session) {
+			return { error: "Authentication required", status: 401 };
+		}
+
 		const controller = ctx.context.controllers.payments as PaymentController;
-		const intent = await controller.confirmIntent(ctx.params.id);
-		if (!intent) return { error: "Payment intent not found", status: 404 };
-		return { intent };
+		try {
+			const intent = await controller.confirmIntent(ctx.params.id);
+			if (!intent) return { error: "Payment intent not found", status: 404 };
+
+			if (intent.customerId && intent.customerId !== session.user.id) {
+				return { error: "Payment intent not found", status: 404 };
+			}
+
+			return { intent };
+		} catch (err) {
+			const message =
+				err instanceof Error ? err.message : "Cannot confirm payment";
+			return { error: message, status: 400 };
+		}
 	},
 );

package/src/store/endpoints/create-intent.ts

@@ -8,18 +8,31 @@ export const createIntent = createStoreEndpoint(
 		body: z.object({
 			amount: z.number().int().positive(),
 			currency: z.string().max(3).optional(),
-			email: z.string().email().optional(),
-			orderId: z.string().optional(),
-			checkoutSessionId: z.string().optional(),
-			metadata: z.record(z.string(), z.unknown()).optional(),
+			email: z.string().email().max(320).optional(),
+			orderId: z.string().max(200).optional(),
+			checkoutSessionId: z.string().max(200).optional(),
+			metadata: z
+				.record(
+					z
+						.string()
+						.max(100)
+						.regex(/^[\w.-]+$/),
+					z.unknown(),
+				)
+				.refine((obj) => Object.keys(obj).length <= 20, {
+					message: "Metadata must have at most 20 keys",
+				})
+				.optional(),
 		}),
 	},
 	async (ctx) => {
 		const controller = ctx.context.controllers.payments as PaymentController;
+		// Use session email when authenticated to prevent spoofing
+		const email = ctx.context.session?.user.email ?? ctx.body.email;
 		const intent = await controller.createIntent({
 			amount: ctx.body.amount,
 			currency: ctx.body.currency,
-			email: ctx.body.email,
+			email,
 			orderId: ctx.body.orderId,
 			checkoutSessionId: ctx.body.checkoutSessionId,
 			metadata: ctx.body.metadata,

package/src/store/endpoints/delete-method.ts

@@ -5,12 +5,22 @@ export const deletePaymentMethod = createStoreEndpoint(
 	"/payments/methods/:id",
 	{
 		method: "DELETE",
-		params: z.object({ id: z.string() }),
+		params: z.object({ id: z.string().max(200) }),
 	},
 	async (ctx) => {
+		const session = ctx.context.session;
+		if (!session) {
+			return { error: "Authentication required", status: 401 };
+		}
+
 		const controller = ctx.context.controllers.payments as PaymentController;
 		const method = await controller.getPaymentMethod(ctx.params.id);
 		if (!method) return { error: "Payment method not found", status: 404 };
+
+		if (method.customerId && method.customerId !== session.user.id) {
+			return { error: "Payment method not found", status: 404 };
+		}
+
 		const deleted = await controller.deletePaymentMethod(ctx.params.id);
 		return { deleted };
 	},

package/src/store/endpoints/get-intent.ts

@@ -5,7 +5,7 @@ export const getIntent = createStoreEndpoint(
 	"/payments/intents/:id",
 	{
 		method: "GET",
-		params: z.object({ id: z.string() }),
+		params: z.object({ id: z.string().max(200) }),
 	},
 	async (ctx) => {
 		const controller = ctx.context.controllers.payments as PaymentController;

package/src/store/endpoints/list-methods.ts

@@ -1,17 +1,19 @@
-import { createStoreEndpoint, z } from "@86d-app/core";
+import { createStoreEndpoint } from "@86d-app/core";
 import type { PaymentController } from "../../service";
 
 export const listPaymentMethods = createStoreEndpoint(
 	"/payments/methods",
 	{
 		method: "GET",
-		query: z.object({
-			customerId: z.string(),
-		}),
 	},
 	async (ctx) => {
+		const session = ctx.context.session;
+		if (!session) {
+			return { error: "Authentication required", status: 401 };
+		}
+
 		const controller = ctx.context.controllers.payments as PaymentController;
-		const methods = await controller.listPaymentMethods(ctx.query.customerId);
+		const methods = await controller.listPaymentMethods(session.user.id);
 		return { methods };
 	},
 );