myron/tomsjavajive
1
0
Fork 0
mirror of https://github.com/myronblair/tomsjavajive synced 2026-07-27 16:52:36 -05:00
Code Issues Packages Projects Releases Wiki Activity

Add Square payment processor, gated behind PAYMENT_PROCESSOR flag (default: stripe)

Browse Source 
Consolidates payment processing onto the same Square account already used by
tomtomgames.com and parkerslingshotrentals.com. Collapses the two prior parallel
Stripe flows (hosted Checkout + embedded Elements) into a single Square Web
Payments SDK flow, since Payments API is synchronous and removes the original
reason for two paths.

- includes/square.php: squareApi() cURL helper (mirrors the pattern already
  used on parkerslingshotrentals.com), markSquarePaymentResult() as the single
  source of truth for order completion shared by the sync response, webhook,
  and reconciliation poll - fixes a pre-existing bug where loyalty points were
  only ever awarded from the polling endpoint, never from the webhook.
- api/create-square-payment.php replaces api/create-payment-intent.php;
  api/create-checkout-session.php deleted (no Square equivalent - single flow).
- api/webhook.php rewritten for Squares signature scheme and event types.
- api/payment-status.php repurposed to reconciliation-only fallback.
- payment.php branches on PAYMENT_PROCESSOR so Stripe and Square code coexist
  deployed while dormant - flipping one config constant is the cutover/rollback.
- admin/payments.php: added a Square settings card alongside the existing
  (now legacy-labeled) Stripe card.
- db/schema.sql + live DB: added square_payment_id/square_order_id columns,
  stripe_* columns kept for historical orders.

Not yet cut over - PAYMENT_PROCESSOR still defaults to stripe in
config-secrets.php (outside this repo). Sandbox testing still needed before
flipping to square/production.
This commit is contained in:
Myron Blair
2026-07-05 05:27:19 +00:00
parent a0b8bf2a09
commit 11edf3394f
9 changed files with 610 additions and 540 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/webhook.php
+37 -80
View File
@@ -1,107 +1,65 @@
<?php
/**
* Tom's Java Jive - Stripe Webhook Handler
* Uses cURL-based Stripe integration (no Composer required)
* Tom's Java Jive - Square Webhook Handler
*/
require_once __DIR__ . '/../includes/functions.php';
require_once __DIR__ . '/../includes/stripe.php';
require_once __DIR__ . '/../includes/square.php';
require_once __DIR__ . '/../includes/loyalty.php';
require_once __DIR__ . '/../includes/email.php';
header('Content-Type: application/json');
$payload = file_get_contents('php://input');
$sigHeader = $_SERVER['HTTP_STRIPE_SIGNATURE'] ?? '';
$sigHeader = $_SERVER['HTTP_X_SQUARE_HMACSHA256_SIGNATURE'] ?? '';
$notificationUrl = SITE_URL . '/api/webhook.php';
// Verify webhook signature (if secret is configured)
if (!empty(STRIPE_WEBHOOK_SECRET) && STRIPE_WEBHOOK_SECRET !== 'whsec_your_webhook_secret') {
try {
stripe()->verifyWebhookSignature($payload, $sigHeader, STRIPE_WEBHOOK_SECRET);
$event = json_decode($payload, true);
} catch (Exception $e) {
error_log('Stripe webhook signature verification failed: ' . $e->getMessage());
http_response_code(400);
exit();
}
} else {
$event = json_decode($payload, true);
if (!$event) {
http_response_code(400);
exit();
}
if (empty(SQUARE_WEBHOOK_SIGNATURE_KEY) || SQUARE_WEBHOOK_SIGNATURE_KEY === 'REPLACE_ME') {
error_log('Square webhook signature key not configured - rejecting webhook');
http_response_code(400);
exit();
}
if (!verifySquareWebhookSignature($payload, $sigHeader, $notificationUrl, SQUARE_WEBHOOK_SIGNATURE_KEY)) {
error_log('Square webhook signature verification failed');
http_response_code(400);
exit();
}
$event = json_decode($payload, true);
if (!$event) {
http_response_code(400);
exit();
}
$eventType = $event['type'] ?? '';
$data = $event['data']['object'] ?? [];
switch ($eventType) {
case 'checkout.session.completed':
// Stripe Checkout (hosted page) — metadata is on the session
$orderId = $data['metadata']['order_id'] ?? '';
$paymentIntentId = $data['payment_intent'] ?? '';
if ($orderId && ($data['payment_status'] ?? '') === 'paid') {
db()->update('orders',
[
'payment_status' => 'paid',
'order_status' => 'confirmed',
'stripe_payment_intent' => $paymentIntentId,
],
'order_id = :id',
['id' => $orderId]
);
$order = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId]);
if ($order) {
emailService()->sendOrderConfirmation($order);
}
case 'payment.updated':
case 'payment.created':
$payment = $event['data']['object']['payment'] ?? [];
$paymentId = $payment['id'] ?? '';
$status = $payment['status'] ?? '';
$orderId = $payment['reference_id'] ?? null;
if ($paymentId && $status) {
markSquarePaymentResult($paymentId, $orderId, $status);
}
break;
case 'payment_intent.succeeded':
// Payment Intent flow (embedded/direct) - skip if already confirmed by checkout.session.completed
$paymentIntentId = $data['id'] ?? '';
$orderId = $data['metadata']['order_id'] ?? '';
if ($orderId && ($data['status'] ?? '') === 'succeeded') {
$order = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId]);
if ($order && $order['order_status'] !== 'confirmed') {
db()->update('orders',
[
'payment_status' => 'paid',
'order_status' => 'confirmed',
'stripe_payment_intent' => $paymentIntentId,
],
'order_id = :id',
['id' => $orderId]
);
$order = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId]);
if ($order) {
emailService()->sendOrderConfirmation($order);
}
}
}
break;
case 'payment_intent.payment_failed':
$orderId = $data['metadata']['order_id'] ?? '';
if ($orderId) {
db()->update('orders',
['payment_status' => 'failed'],
'order_id = :id',
['id' => $orderId]
);
}
break;
case 'charge.refunded':
$paymentIntentId = $data['payment_intent'] ?? '';
if ($paymentIntentId) {
case 'refund.updated':
case 'refund.created':
$refund = $event['data']['object']['refund'] ?? [];
$paymentId = $refund['payment_id'] ?? '';
$status = $refund['status'] ?? '';
if ($status === 'COMPLETED' && $paymentId) {
db()->update('orders',
[
'payment_status' => 'refunded',
'order_status' => 'refunded',
],
'stripe_payment_intent = :pi',
['pi' => $paymentIntentId]
'square_payment_id = :pid',
['pid' => $paymentId]
);
}
break;
@@ -109,4 +67,3 @@ switch ($eventType) {
http_response_code(200);
echo json_encode(['received' => true]);