109 lines
2.9 KiB
TypeScript
109 lines
2.9 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { env } from "@/env";
|
|
import { auth } from "@/lib/auth";
|
|
import { sessionUserId } from "@/lib/auth/session-user";
|
|
import { logger } from "@/lib/logger";
|
|
import { prisma } from "@/lib/prisma";
|
|
import {
|
|
createOrder,
|
|
creditsPerUnit,
|
|
isPayPalConfigured,
|
|
PAYPAL_CURRENCY,
|
|
} from "@/lib/services/paypal";
|
|
import { recordCreatedTopup } from "@/lib/services/paypal-topup";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
const MIN_AMOUNT = 1;
|
|
const MAX_AMOUNT = 500;
|
|
|
|
/**
|
|
* POST /api/paypal/create — create a PayPal CAPTURE order for the signed-in user.
|
|
* Body: { amount: number } (in the configured currency, default USD).
|
|
* Returns { id, approveUrl } on success; a clear JSON error otherwise.
|
|
*
|
|
* Auth-gated via auth(): the order is tied to the session, never to a body field.
|
|
*/
|
|
export async function POST(req: Request): Promise<Response> {
|
|
const session = await auth();
|
|
if (!session?.user?.id) {
|
|
return NextResponse.json(
|
|
{ error: "You must be signed in to top up." },
|
|
{ status: 401 },
|
|
);
|
|
}
|
|
const userId = sessionUserId(session.user.id);
|
|
if (!userId) {
|
|
return NextResponse.json({ error: "Invalid session." }, { status: 401 });
|
|
}
|
|
|
|
// Fail fast (and clearly) when the sandbox/live keys aren't set.
|
|
if (!isPayPalConfigured()) {
|
|
return NextResponse.json(
|
|
{
|
|
error:
|
|
"PayPal is not configured. Set PAYPAL_CLIENT_ID and PAYPAL_SECRET.",
|
|
},
|
|
{ status: 503 },
|
|
);
|
|
}
|
|
|
|
let body: unknown;
|
|
try {
|
|
body = await req.json();
|
|
} catch {
|
|
return NextResponse.json({ error: "Invalid JSON body." }, { status: 400 });
|
|
}
|
|
|
|
const raw = (body as { amount?: unknown })?.amount;
|
|
const amount = Math.round(Number(raw) * 100) / 100;
|
|
if (!Number.isFinite(amount) || amount < MIN_AMOUNT || amount > MAX_AMOUNT) {
|
|
return NextResponse.json(
|
|
{
|
|
error: `Enter an amount between ${MIN_AMOUNT} and ${MAX_AMOUNT} ${PAYPAL_CURRENCY}.`,
|
|
},
|
|
{ status: 422 },
|
|
);
|
|
}
|
|
|
|
const credits = Math.floor(amount * creditsPerUnit());
|
|
const base = env.APP_URL.replace(/\/+$/, "");
|
|
|
|
try {
|
|
const order = await createOrder(amount, {
|
|
description: `${env.HOTEL_NAME} top-up: ${credits} credits`,
|
|
returnUrl: `${base}/shop/topup?status=success`,
|
|
cancelUrl: `${base}/shop/topup?status=cancel`,
|
|
});
|
|
|
|
if (!order.approveUrl) {
|
|
return NextResponse.json(
|
|
{ error: "PayPal did not return an approval link. Try again." },
|
|
{ status: 502 },
|
|
);
|
|
}
|
|
|
|
await recordCreatedTopup(
|
|
{ userId, orderId: order.id, amount, currency: PAYPAL_CURRENCY, credits },
|
|
(data) => prisma.websitePaypalTransactions.create({ data }),
|
|
);
|
|
|
|
return NextResponse.json({
|
|
id: order.id,
|
|
approveUrl: order.approveUrl,
|
|
amount,
|
|
currency: PAYPAL_CURRENCY,
|
|
credits,
|
|
});
|
|
} catch (e) {
|
|
logger.error("PayPal create order failed", {
|
|
module: "paypal/create",
|
|
error: (e as Error).message,
|
|
});
|
|
return NextResponse.json(
|
|
{ error: "Could not start the PayPal checkout. Please try again." },
|
|
{ status: 502 },
|
|
);
|
|
}
|
|
}
|