EpicNext-Cms/src/lib/services/paypal.ts

// PayPal v2 REST helper (Orders API) for the top-up flow. SDK-free: uses the
// global fetch only. Credentials and base URL come from process.env because they
// are not declared in src/env.ts:
//   PAYPAL_CLIENT_ID   – REST app client id
//   PAYPAL_SECRET      – REST app secret
//   PAYPAL_API         – API base, defaults to the sandbox host
//   PAYPAL_CURRENCY    – ISO currency for orders, defaults to USD
//   PAYPAL_CREDITS_PER_USD – credits granted per 1.00 unit, defaults to 100
//
// The website has no dedicated balance column (see prisma/schema.prisma — User
// carries `credits`, the in-game wallet), so a top-up credits the buyer's
// `credits` wallet via sendCurrency(), exactly like the voucher flow.

export const PAYPAL_API =
  process.env.PAYPAL_API?.replace(/\/+$/, "") ?? "https://api-m.sandbox.paypal.com";

export const PAYPAL_CURRENCY = (process.env.PAYPAL_CURRENCY ?? "USD").toUpperCase();

/** Credits granted per 1.00 of the order currency (configurable, sane default). */
export function creditsPerUnit(): number {
  const n = Number(process.env.PAYPAL_CREDITS_PER_USD ?? "100");
  return Number.isFinite(n) && n > 0 ? n : 100;
}

export class PayPalConfigError extends Error {}

function credentials(): { clientId: string; secret: string } {
  const clientId = process.env.PAYPAL_CLIENT_ID;
  const secret = process.env.PAYPAL_SECRET;
  if (!clientId || !secret) {
    throw new PayPalConfigError(
      "PayPal is not configured. Set PAYPAL_CLIENT_ID and PAYPAL_SECRET.",
    );
  }
  return { clientId, secret };
}

/** True when both PayPal credentials are present. */
export function isPayPalConfigured(): boolean {
  return Boolean(process.env.PAYPAL_CLIENT_ID && process.env.PAYPAL_SECRET);
}

/** OAuth2 client-credentials token (short-lived; we fetch one per request). */
async function getAccessToken(): Promise<string> {
  const { clientId, secret } = credentials();
  const basic = Buffer.from(`${clientId}:${secret}`).toString("base64");
  const res = await fetch(`${PAYPAL_API}/v1/oauth2/token`, {
    method: "POST",
    headers: {
      Authorization: `Basic ${basic}`,
      "Content-Type": "application/x-www-form-urlencoded",
    },
    body: "grant_type=client_credentials",
    cache: "no-store",
  });
  if (!res.ok) {
    const body = await res.text().catch(() => "");
    throw new Error(`PayPal auth failed (${res.status}): ${body.slice(0, 300)}`);
  }
  const json = (await res.json()) as { access_token?: string };
  if (!json.access_token) throw new Error("PayPal auth returned no access_token.");
  return json.access_token;
}

export interface CreatedOrder {
  id: string;
  approveUrl: string | null;
}

/**
 * Create a CAPTURE order for `amount` of the configured currency. Returns the
 * order id and the payer approval URL (rel === "approve") to redirect to.
 */
export async function createOrder(
  amount: number,
  opts: { description?: string; returnUrl?: string; cancelUrl?: string } = {},
): Promise<CreatedOrder> {
  const token = await getAccessToken();
  const value = amount.toFixed(2);

  const res = await fetch(`${PAYPAL_API}/v2/checkout/orders`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${token}`,
      "Content-Type": "application/json",
    },
    cache: "no-store",
    body: JSON.stringify({
      intent: "CAPTURE",
      purchase_units: [
        {
          amount: { currency_code: PAYPAL_CURRENCY, value },
          description: opts.description?.slice(0, 127),
        },
      ],
      application_context: {
        shipping_preference: "NO_SHIPPING",
        user_action: "PAY_NOW",
        ...(opts.returnUrl ? { return_url: opts.returnUrl } : {}),
        ...(opts.cancelUrl ? { cancel_url: opts.cancelUrl } : {}),
      },
    }),
  });

  if (!res.ok) {
    const body = await res.text().catch(() => "");
    throw new Error(`PayPal create order failed (${res.status}): ${body.slice(0, 300)}`);
  }

  const json = (await res.json()) as {
    id: string;
    links?: { rel: string; href: string }[];
  };
  const approveUrl =
    json.links?.find((l) => l.rel === "approve" || l.rel === "payer-action")?.href ?? null;
  return { id: json.id, approveUrl };
}

export interface CaptureResult {
  id: string;
  status: string;
  amount: number;
  currency: string;
  captureId: string | null;
  payerEmail: string | null;
}

/** Capture a previously-approved order id. */
export async function captureOrder(orderId: string): Promise<CaptureResult> {
  const token = await getAccessToken();
  const res = await fetch(`${PAYPAL_API}/v2/checkout/orders/${encodeURIComponent(orderId)}/capture`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${token}`,
      "Content-Type": "application/json",
    },
    cache: "no-store",
  });

  if (!res.ok) {
    const body = await res.text().catch(() => "");
    throw new Error(`PayPal capture failed (${res.status}): ${body.slice(0, 300)}`);
  }

  const json = (await res.json()) as {
    id: string;
    status: string;
    payer?: { email_address?: string };
    purchase_units?: {
      payments?: {
        captures?: {
          id: string;
          amount?: { value?: string; currency_code?: string };
        }[];
      };
    }[];
  };

  const capture = json.purchase_units?.[0]?.payments?.captures?.[0];
  const amount = capture?.amount?.value ? Number(capture.amount.value) : 0;
  const currency = capture?.amount?.currency_code ?? PAYPAL_CURRENCY;

  return {
    id: json.id,
    status: json.status,
    amount,
    currency,
    captureId: capture?.id ?? null,
    payerEmail: json.payer?.email_address ?? null,
  };
}