Add Square payment processor, gated behind PAYMENT_PROCESSOR flag (default: stripe)

Consolidates payment processing onto the same Square account already used by
tomtomgames.com and parkerslingshotrentals.com. Collapses the two prior parallel
Stripe flows (hosted Checkout + embedded Elements) into a single Square Web
Payments SDK flow, since Payments API is synchronous and removes the original
reason for two paths.

- includes/square.php: squareApi() cURL helper (mirrors the pattern already
  used on parkerslingshotrentals.com), markSquarePaymentResult() as the single
  source of truth for order completion shared by the sync response, webhook,
  and reconciliation poll - fixes a pre-existing bug where loyalty points were
  only ever awarded from the polling endpoint, never from the webhook.
- api/create-square-payment.php replaces api/create-payment-intent.php;
  api/create-checkout-session.php deleted (no Square equivalent - single flow).
- api/webhook.php rewritten for Squares signature scheme and event types.
- api/payment-status.php repurposed to reconciliation-only fallback.
- payment.php branches on PAYMENT_PROCESSOR so Stripe and Square code coexist
  deployed while dormant - flipping one config constant is the cutover/rollback.
- admin/payments.php: added a Square settings card alongside the existing
  (now legacy-labeled) Stripe card.
- db/schema.sql + live DB: added square_payment_id/square_order_id columns,
  stripe_* columns kept for historical orders.

Not yet cut over - PAYMENT_PROCESSOR still defaults to stripe in
config-secrets.php (outside this repo). Sandbox testing still needed before
flipping to square/production.

api/create-checkout-session.php

@@ -1,129 +0,0 @@
-<?php
-/**
- * Tom's Java Jive - Create Stripe Checkout Session API
- * Uses hosted checkout page (redirects to Stripe)
- */
-
-require_once __DIR__ . '/../includes/functions.php';
-require_once __DIR__ . '/../includes/stripe.php';
-require_once __DIR__ . '/../includes/loyalty.php';
-
-header('Content-Type: application/json');
-
-// Only accept POST
-if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
-    jsonResponse(['error' => 'Method not allowed'], 405);
-}
-
-$input = json_decode(file_get_contents('php://input'), true);
-$orderId = $input['order_id'] ?? '';
-$originUrl = $input['origin_url'] ?? '';
-
-if (empty($orderId)) {
-    jsonResponse(['error' => 'Order ID required'], 400);
-}
-
-if (empty($originUrl)) {
-    $originUrl = SITE_URL;
-}
-
-// Get order
-$order = db()->fetch(
-    "SELECT * FROM orders WHERE order_id = :id",
-    ['id' => $orderId]
-);
-
-if (!$order) {
-    jsonResponse(['error' => 'Order not found'], 404);
-}
-
-if ($order['payment_status'] === 'paid') {
-    jsonResponse(['error' => 'Order already paid'], 400);
-}
-
-// Check if Stripe is configured
-if (!isStripeConfigured()) {
-    // Demo mode - simulate successful payment
-    db()->update('orders',
-        [
-            'payment_status' => 'paid',
-            'order_status' => 'confirmed',
-            'stripe_payment_intent' => 'demo_' . bin2hex(random_bytes(8))
-        ],
-        'order_id = :id',
-        ['id' => $orderId]
-    );
-
-    if (!empty($order['customer_id'])) {
-        loyalty()->awardPoints(
-            $order['customer_id'],
-            (float) $order['total'],
-            'Order #' . $order['order_number'],
-            $orderId
-        );
-    }
-
-    jsonResponse([
-        'demo_mode' => true,
-        'message' => 'Payment simulated (Stripe not configured)',
-        'redirect' => '/order-confirmation.php?order=' . $orderId
-    ]);
-}
-
-// Build line items from order
-$items = json_decode($order['items'], true) ?? [];
-$lineItems = [];
-
-foreach ($items as $item) {
-    $lineItems[] = [
-        'name' => $item['name'],
-        'price' => floatval($item['price']),
-        'quantity' => intval($item['quantity']),
-        'currency' => 'usd'
-    ];
-}
-
-// Add shipping if applicable
-if ($order['shipping_cost'] > 0) {
-    $lineItems[] = [
-        'name' => 'Shipping',
-        'price' => floatval($order['shipping_cost']),
-        'quantity' => 1,
-        'currency' => 'usd'
-    ];
-}
-
-// Build success/cancel URLs
-$successUrl = rtrim($originUrl, '/') . '/order-confirmation.php?order=' . $orderId . '&session_id={CHECKOUT_SESSION_ID}';
-$cancelUrl = rtrim($originUrl, '/') . '/payment.php?order=' . $orderId . '&cancelled=1';
-
-try {
-    $session = stripe()->createCheckoutSession(
-        $lineItems,
-        $successUrl,
-        $cancelUrl,
-        [
-            'customer_email' => $order['customer_email'],
-            'metadata' => [
-                'order_id' => $orderId,
-                'order_number' => $order['order_number']
-            ]
-        ]
-    );
-    
-    // Store checkout session ID
-    db()->update('orders',
-        ['stripe_session_id' => $session['id']],
-        'order_id = :id',
-        ['id' => $orderId]
-    );
-    
-    jsonResponse([
-        'url' => $session['url'],
-        'session_id' => $session['id']
-    ]);
-    
-} catch (Exception $e) {
-    error_log('Stripe Checkout error: ' . $e->getMessage());
-    jsonResponse(['error' => 'Failed to create checkout session: ' . $e->getMessage()], 500);
-}

api/create-payment-intent.php

@@ -1,87 +0,0 @@
-<?php
-/**
- * Tom's Java Jive - Create Stripe Payment Intent API
- * Uses cURL-based Stripe integration (no Composer required)
- */
-
-require_once __DIR__ . '/../includes/functions.php';
-require_once __DIR__ . '/../includes/stripe.php';
-
-header('Content-Type: application/json');
-
-// Only accept POST
-if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
-    jsonResponse(['error' => 'Method not allowed'], 405);
-}
-
-$input = json_decode(file_get_contents('php://input'), true);
-$orderId = $input['order_id'] ?? '';
-
-if (empty($orderId)) {
-    jsonResponse(['error' => 'Order ID required'], 400);
-}
-
-// Get order
-$order = db()->fetch(
-    "SELECT * FROM orders WHERE order_id = :id",
-    ['id' => $orderId]
-);
-
-if (!$order) {
-    jsonResponse(['error' => 'Order not found'], 404);
-}
-
-if ($order['payment_status'] === 'paid') {
-    jsonResponse(['error' => 'Order already paid'], 400);
-}
-
-// Check if Stripe is configured
-if (!isStripeConfigured()) {
-    // Demo mode - simulate successful payment
-    db()->update('orders',
-        [
-            'payment_status' => 'paid',
-            'order_status' => 'confirmed',
-            'stripe_payment_intent' => 'demo_' . bin2hex(random_bytes(8))
-        ],
-        'order_id = :id',
-        ['id' => $orderId]
-    );
-    
-    jsonResponse([
-        'demo_mode' => true,
-        'message' => 'Payment simulated (Stripe not configured)',
-        'redirect' => '/order-confirmation.php?order=' . $orderId
-    ]);
-}
-
-// Create Stripe Payment Intent using cURL-based API
-try {
-    $paymentIntent = stripe()->createPaymentIntent(
-        $order['total'],
-        'usd',
-        [
-            'metadata' => [
-                'order_id' => $orderId,
-                'order_number' => $order['order_number']
-            ],
-            'receipt_email' => $order['customer_email'],
-            'description' => 'Order #' . $order['order_number']
-        ]
-    );
-    
-    // Store payment intent ID
-    db()->update('orders',
-        ['stripe_payment_intent' => $paymentIntent['id']],
-        'order_id = :id',
-        ['id' => $orderId]
-    );
-    
-    jsonResponse([
-        'client_secret' => $paymentIntent['client_secret']
-    ]);
-    
-} catch (Exception $e) {
-    error_log('Stripe error: ' . $e->getMessage());
-    jsonResponse(['error' => 'Payment initialization failed: ' . $e->getMessage()], 500);
-}

api/create-square-payment.php

@@ -0,0 +1,94 @@
+<?php
+/**
+ * Tom's Java Jive - Create Square Payment API
+ * Accepts a Web Payments SDK card nonce (source_id) and charges it synchronously.
+ */
+
+require_once __DIR__ . '/../includes/functions.php';
+require_once __DIR__ . '/../includes/square.php';
+require_once __DIR__ . '/../includes/loyalty.php';
+require_once __DIR__ . '/../includes/email.php';
+
+header('Content-Type: application/json');
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    jsonResponse(['error' => 'Method not allowed'], 405);
+}
+
+$input     = json_decode(file_get_contents('php://input'), true);
+$orderId   = $input['order_id'] ?? '';
+$sourceId  = $input['source_id'] ?? '';
+
+if (empty($orderId)) {
+    jsonResponse(['error' => 'Order ID required'], 400);
+}
+
+$order = db()->fetch(
+    "SELECT * FROM orders WHERE order_id = :id",
+    ['id' => $orderId]
+);
+
+if (!$order) {
+    jsonResponse(['error' => 'Order not found'], 404);
+}
+
+if ($order['payment_status'] === 'paid') {
+    jsonResponse(['error' => 'Order already paid'], 400);
+}
+
+// Demo mode - Square not configured
+if (!isSquareConfigured()) {
+    db()->update('orders',
+        [
+            'payment_status'    => 'paid',
+            'order_status'      => 'confirmed',
+            'square_payment_id' => 'demo_' . bin2hex(random_bytes(8)),
+            'payment_method'    => 'square',
+        ],
+        'order_id = :id',
+        ['id' => $orderId]
+    );
+
+    jsonResponse([
+        'demo_mode' => true,
+        'message'   => 'Payment simulated (Square not configured)',
+        'redirect'  => '/order-confirmation.php?order=' . $orderId
+    ]);
+}
+
+if (empty($sourceId)) {
+    jsonResponse(['error' => 'Card details required'], 400);
+}
+
+try {
+    $result  = squareCreatePayment(
+        $sourceId,
+        (float) $order['total'],
+        $orderId,
+        ['note' => 'Order #' . $order['order_number']]
+    );
+    $payment = $result['payment'] ?? [];
+    $status  = $payment['status'] ?? '';
+
+    if ($status === 'COMPLETED') {
+        markSquarePaymentResult($payment['id'], $orderId, 'COMPLETED');
+        jsonResponse([
+            'success'  => true,
+            'redirect' => '/order-confirmation.php?order=' . $orderId
+        ]);
+    }
+
+    // Store the payment id even if not yet completed, so the reconciliation
+    // poll and webhook can find this order by square_payment_id.
+    db()->update('orders',
+        ['square_payment_id' => $payment['id'] ?? null],
+        'order_id = :id',
+        ['id' => $orderId]
+    );
+
+    jsonResponse(['error' => 'Payment was not completed (status: ' . $status . ')'], 400);
+
+} catch (Exception $e) {
+    error_log('Square payment error: ' . $e->getMessage());
+    jsonResponse(['error' => 'Payment failed: ' . $e->getMessage()], 500);
+}

api/payment-status.php

@@ -1,157 +1,93 @@
 <?php
 /**
  * Tom's Java Jive - Check Payment Status API
- * Polls Stripe for payment/checkout session status
+ * Reconciliation-only fallback: Square payments complete synchronously in
+ * create-square-payment.php, so this endpoint only matters if the browser
+ * lost that response after Square had already accepted the charge. It shares
+ * markSquarePaymentResult() with the webhook and the synchronous path so
+ * loyalty points/emails are never duplicated no matter which path resolves first.
  */
 
 require_once __DIR__ . '/../includes/functions.php';
-require_once __DIR__ . '/../includes/stripe.php';
+require_once __DIR__ . '/../includes/square.php';
 require_once __DIR__ . '/../includes/loyalty.php';
+require_once __DIR__ . '/../includes/email.php';
 
 header('Content-Type: application/json');
 
-// Only accept GET
 if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
     jsonResponse(['error' => 'Method not allowed'], 405);
 }
 
 $orderId = $_GET['order_id'] ?? '';
-$sessionId = $_GET['session_id'] ?? '';
 
-if (empty($orderId) && empty($sessionId)) {
-    jsonResponse(['error' => 'Order ID or Session ID required'], 400);
+if (empty($orderId)) {
+    jsonResponse(['error' => 'Order ID required'], 400);
 }
 
-// Get order by ID or session
-if (!empty($orderId)) {
-    $order = db()->fetch(
-        "SELECT * FROM orders WHERE order_id = :id",
-        ['id' => $orderId]
-    );
-} else {
-    $order = db()->fetch(
-        "SELECT * FROM orders WHERE stripe_session_id = :session OR stripe_payment_intent = :session",
-        ['session' => $sessionId]
-    );
-}
+$order = db()->fetch(
+    "SELECT * FROM orders WHERE order_id = :id",
+    ['id' => $orderId]
+);
 
 if (!$order) {
     jsonResponse(['error' => 'Order not found'], 404);
 }
 
-// If already marked as paid, return success
 if ($order['payment_status'] === 'paid') {
     jsonResponse([
-        'status' => 'complete',
+        'status'         => 'complete',
         'payment_status' => 'paid',
-        'order_id' => $order['order_id'],
-        'order_number' => $order['order_number'],
-        'redirect' => '/order-confirmation.php?order=' . $order['order_id']
+        'order_id'       => $order['order_id'],
+        'order_number'   => $order['order_number'],
+        'redirect'       => '/order-confirmation.php?order=' . $order['order_id']
     ]);
 }
 
-// Check if Stripe is configured
-if (!isStripeConfigured()) {
+if (!isSquareConfigured()) {
     jsonResponse([
-        'status' => 'demo_mode',
+        'status'         => 'demo_mode',
         'payment_status' => $order['payment_status'],
-        'message' => 'Stripe not configured - running in demo mode'
+        'message'        => 'Square not configured - running in demo mode'
+    ]);
+}
+
+if (empty($order['square_payment_id'])) {
+    jsonResponse([
+        'status'         => 'pending',
+        'payment_status' => $order['payment_status']
     ]);
 }
 
 try {
-    // Check with Stripe
-    if (!empty($order['stripe_session_id'])) {
-        // Check checkout session status
-        $session = stripe()->getCheckoutSession($order['stripe_session_id']);
-        
-        if ($session['payment_status'] === 'paid') {
-            // Update order
-            db()->update('orders',
-                [
-                    'payment_status' => 'paid',
-                    'order_status' => 'confirmed',
-                    'stripe_payment_intent' => $session['payment_intent'] ?? null
-                ],
-                'order_id = :id',
-                ['id' => $order['order_id']]
-            );
+    $result  = squareGetPayment($order['square_payment_id']);
+    $payment = $result['payment'] ?? [];
+    $status  = $payment['status'] ?? '';
 
-            // Award loyalty points
-            if (!empty($order['customer_id'])) {
-                loyalty()->awardPoints(
-                    $order['customer_id'],
-                    (float) $order['total'],
-                    'Order #' . $order['order_number'],
-                    $order['order_id']
-                );
-            }
+    markSquarePaymentResult($order['square_payment_id'], $order['order_id'], $status);
 
-            jsonResponse([
-                'status' => 'complete',
-                'payment_status' => 'paid',
-                'order_id' => $order['order_id'],
-                'order_number' => $order['order_number'],
-                'redirect' => '/order-confirmation.php?order=' . $order['order_id']
-            ]);
-        }
-        
+    $updated = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $order['order_id']]);
+
+    if ($updated['payment_status'] === 'paid') {
         jsonResponse([
-            'status' => $session['status'],
-            'payment_status' => $session['payment_status']
-        ]);
-        
-    } elseif (!empty($order['stripe_payment_intent'])) {
-        // Check payment intent status
-        $paymentIntent = stripe()->getPaymentIntent($order['stripe_payment_intent']);
-        
-        if ($paymentIntent['status'] === 'succeeded') {
-            // Update order
-            db()->update('orders',
-                [
-                    'payment_status' => 'paid',
-                    'order_status' => 'confirmed'
-                ],
-                'order_id = :id',
-                ['id' => $order['order_id']]
-            );
-
-            // Award loyalty points
-            if (!empty($order['customer_id'])) {
-                loyalty()->awardPoints(
-                    $order['customer_id'],
-                    (float) $order['total'],
-                    'Order #' . $order['order_number'],
-                    $order['order_id']
-                );
-            }
-
-            jsonResponse([
-                'status' => 'complete',
-                'payment_status' => 'paid',
-                'order_id' => $order['order_id'],
-                'order_number' => $order['order_number'],
-                'redirect' => '/order-confirmation.php?order=' . $order['order_id']
-            ]);
-        }
-        
-        jsonResponse([
-            'status' => $paymentIntent['status'],
-            'payment_status' => 'pending'
+            'status'         => 'complete',
+            'payment_status' => 'paid',
+            'order_id'       => $updated['order_id'],
+            'order_number'   => $updated['order_number'],
+            'redirect'       => '/order-confirmation.php?order=' . $updated['order_id']
         ]);
     }
-    
-    // No Stripe reference found
+
     jsonResponse([
-        'status' => 'pending',
-        'payment_status' => $order['payment_status']
+        'status'         => $status,
+        'payment_status' => $updated['payment_status']
     ]);
-    
+
 } catch (Exception $e) {
-    error_log('Payment status check error: ' . $e->getMessage());
+    error_log('Square payment status check error: ' . $e->getMessage());
     jsonResponse([
-        'status' => 'error',
+        'status'         => 'error',
         'payment_status' => $order['payment_status'],
-        'error' => 'Failed to check payment status'
+        'error'          => 'Failed to check payment status'
     ]);
 }

api/webhook.php

@@ -1,107 +1,65 @@
 <?php
 /**
- * Tom's Java Jive - Stripe Webhook Handler
- * Uses cURL-based Stripe integration (no Composer required)
+ * Tom's Java Jive - Square Webhook Handler
  */
 
 require_once __DIR__ . '/../includes/functions.php';
-require_once __DIR__ . '/../includes/stripe.php';
+require_once __DIR__ . '/../includes/square.php';
+require_once __DIR__ . '/../includes/loyalty.php';
 require_once __DIR__ . '/../includes/email.php';
 
 header('Content-Type: application/json');
 
 $payload   = file_get_contents('php://input');
-$sigHeader = $_SERVER['HTTP_STRIPE_SIGNATURE'] ?? '';
+$sigHeader = $_SERVER['HTTP_X_SQUARE_HMACSHA256_SIGNATURE'] ?? '';
+$notificationUrl = SITE_URL . '/api/webhook.php';
 
-// Verify webhook signature (if secret is configured)
-if (!empty(STRIPE_WEBHOOK_SECRET) && STRIPE_WEBHOOK_SECRET !== 'whsec_your_webhook_secret') {
-    try {
-        stripe()->verifyWebhookSignature($payload, $sigHeader, STRIPE_WEBHOOK_SECRET);
-        $event = json_decode($payload, true);
-    } catch (Exception $e) {
-        error_log('Stripe webhook signature verification failed: ' . $e->getMessage());
-        http_response_code(400);
-        exit();
-    }
-} else {
-    $event = json_decode($payload, true);
-    if (!$event) {
-        http_response_code(400);
-        exit();
-    }
+if (empty(SQUARE_WEBHOOK_SIGNATURE_KEY) || SQUARE_WEBHOOK_SIGNATURE_KEY === 'REPLACE_ME') {
+    error_log('Square webhook signature key not configured - rejecting webhook');
+    http_response_code(400);
+    exit();
+}
+
+if (!verifySquareWebhookSignature($payload, $sigHeader, $notificationUrl, SQUARE_WEBHOOK_SIGNATURE_KEY)) {
+    error_log('Square webhook signature verification failed');
+    http_response_code(400);
+    exit();
+}
+
+$event = json_decode($payload, true);
+if (!$event) {
+    http_response_code(400);
+    exit();
 }
 
 $eventType = $event['type'] ?? '';
-$data      = $event['data']['object'] ?? [];
 
 switch ($eventType) {
 
-    case 'checkout.session.completed':
-        // Stripe Checkout (hosted page) — metadata is on the session
-        $orderId         = $data['metadata']['order_id'] ?? '';
-        $paymentIntentId = $data['payment_intent'] ?? '';
-        if ($orderId && ($data['payment_status'] ?? '') === 'paid') {
-            db()->update('orders',
-                [
-                    'payment_status'        => 'paid',
-                    'order_status'          => 'confirmed',
-                    'stripe_payment_intent' => $paymentIntentId,
-                ],
-                'order_id = :id',
-                ['id' => $orderId]
-            );
-            $order = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId]);
-            if ($order) {
-                emailService()->sendOrderConfirmation($order);
-            }
+    case 'payment.updated':
+    case 'payment.created':
+        $payment   = $event['data']['object']['payment'] ?? [];
+        $paymentId = $payment['id'] ?? '';
+        $status    = $payment['status'] ?? '';
+        $orderId   = $payment['reference_id'] ?? null;
+        if ($paymentId && $status) {
+            markSquarePaymentResult($paymentId, $orderId, $status);
         }
         break;
 
-    case 'payment_intent.succeeded':
-        // Payment Intent flow (embedded/direct) - skip if already confirmed by checkout.session.completed
-        $paymentIntentId = $data['id'] ?? '';
-        $orderId         = $data['metadata']['order_id'] ?? '';
-        if ($orderId && ($data['status'] ?? '') === 'succeeded') {
-            $order = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId]);
-            if ($order && $order['order_status'] !== 'confirmed') {
-                db()->update('orders',
-                    [
-                        'payment_status'        => 'paid',
-                        'order_status'          => 'confirmed',
-                        'stripe_payment_intent' => $paymentIntentId,
-                    ],
-                    'order_id = :id',
-                    ['id' => $orderId]
-                );
-                $order = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId]);
-                if ($order) {
-                    emailService()->sendOrderConfirmation($order);
-                }
-            }
-        }
-        break;
-
-    case 'payment_intent.payment_failed':
-        $orderId = $data['metadata']['order_id'] ?? '';
-        if ($orderId) {
-            db()->update('orders',
-                ['payment_status' => 'failed'],
-                'order_id = :id',
-                ['id' => $orderId]
-            );
-        }
-        break;
-
-    case 'charge.refunded':
-        $paymentIntentId = $data['payment_intent'] ?? '';
-        if ($paymentIntentId) {
+    case 'refund.updated':
+    case 'refund.created':
+        $refund    = $event['data']['object']['refund'] ?? [];
+        $paymentId = $refund['payment_id'] ?? '';
+        $status    = $refund['status'] ?? '';
+        if ($status === 'COMPLETED' && $paymentId) {
             db()->update('orders',
                 [
                     'payment_status' => 'refunded',
                     'order_status'   => 'refunded',
                 ],
-                'stripe_payment_intent = :pi',
-                ['pi' => $paymentIntentId]
+                'square_payment_id = :pid',
+                ['pid' => $paymentId]
             );
         }
         break;
@@ -109,4 +67,3 @@ switch ($eventType) {
 
 http_response_code(200);
 echo json_encode(['received' => true]);
-