myron/tomsjavajive
1
0
Fork 0
mirror of https://github.com/myronblair/tomsjavajive synced 2026-07-28 09:12:36 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge square-migration: Stripe to Square payment processor migration, checkout wallet/gift-card redemption, and related bug fixes

Browse Source
This commit is contained in:
Myron Blair
2026-07-05 15:01:30 +00:00
parent a0b8bf2a09 cfbae6e945
commit e02436618c
15 changed files with 1039 additions and 654 deletions
Download Patch File Download Diff File Expand all files Collapse all files
account/rewards.php
+1
View File
@@ -37,6 +37,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['redeem_points'])) {
redirect('/account/rewards.php');
}
$extraHead = '<link rel="stylesheet" href="/assets/css/account.css?v='. filemtime(__DIR__ . '/../assets/css/account.css') .'">';
require_once __DIR__ . '/../includes/header.php';
require_once __DIR__ . '/includes/sidebar.php';
?>
admin/payments.php
+79 -2
View File
@@ -21,6 +21,18 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
setFlash('success', 'Stripe settings updated');
}
if ($section === 'square') {
setSetting('payment_square', [
'enabled' => isset($_POST['square_enabled']),
'sandbox' => isset($_POST['square_sandbox']),
'app_id' => trim($_POST['square_app_id'] ?? ''),
'location_id' => trim($_POST['square_location_id'] ?? ''),
'access_token' => trim($_POST['square_access_token'] ?? ''),
'webhook_signature_key' => trim($_POST['square_webhook_signature_key'] ?? '')
]);
setFlash('success', 'Square settings updated');
}
if ($section === 'methods') {
setSetting('payment_methods', [
'card' => isset($_POST['method_card']),
@@ -43,6 +55,15 @@ $stripe = getSetting('payment_stripe', [
'webhook_secret' => ''
]);
$square = getSetting('payment_square', [
'enabled' => defined('PAYMENT_PROCESSOR') && PAYMENT_PROCESSOR === 'square',
'sandbox' => defined('SQUARE_ENV') && SQUARE_ENV === 'sandbox',
'app_id' => defined('SQUARE_APP_ID') ? SQUARE_APP_ID : '',
'location_id' => defined('SQUARE_LOCATION_ID') ? SQUARE_LOCATION_ID : '',
'access_token' => defined('SQUARE_ACCESS_TOKEN') ? SQUARE_ACCESS_TOKEN : '',
'webhook_signature_key' => defined('SQUARE_WEBHOOK_SIGNATURE_KEY') ? SQUARE_WEBHOOK_SIGNATURE_KEY : ''
]);
$methods = getSetting('payment_methods', [
'card' => true,
'cash' => true,
@@ -72,12 +93,68 @@ $methods = getSetting('payment_methods', [
</div>
<div>
<!-- Stripe Settings -->
<!-- Square Settings -->
<form method="POST">
<input type="hidden" name="section" value="square">
<div class="admin-card">
<div class="admin-card-header">
<h3 class="admin-card-title"><i class="fas fa-square" style="color: #006AFF;"></i> Square</h3>
</div>
<div class="admin-card-body">
<div class="form-group">
<label style="display: flex; align-items: center; gap: 0.5rem; cursor: pointer;">
<input type="checkbox" name="square_enabled" <?= $square['enabled'] ? 'checked' : '' ?>>
Enable Square payments
</label>
</div>
<div class="form-group">
<label style="display: flex; align-items: center; gap: 0.5rem; cursor: pointer;">
<input type="checkbox" name="square_sandbox" <?= $square['sandbox'] ? 'checked' : '' ?>>
Sandbox mode (use sandbox app/location/token)
</label>
</div>
<div class="form-group">
<label class="form-label">Application ID</label>
<input type="text" name="square_app_id" class="form-input"
value="<?= htmlspecialchars($square['app_id']) ?>"
placeholder="sq0idp-...">
</div>
<div class="form-group">
<label class="form-label">Location ID</label>
<input type="text" name="square_location_id" class="form-input"
value="<?= htmlspecialchars($square['location_id']) ?>"
placeholder="L...">
</div>
<div class="form-group">
<label class="form-label">Access Token</label>
<input type="password" name="square_access_token" class="form-input"
value="<?= htmlspecialchars($square['access_token']) ?>"
placeholder="EAAA...">
</div>
<div class="form-group mb-0">
<label class="form-label">Webhook Signature Key</label>
<input type="password" name="square_webhook_signature_key" class="form-input"
value="<?= htmlspecialchars($square['webhook_signature_key']) ?>"
placeholder="...">
<small class="text-muted">From the Square Developer Dashboard's webhook subscription for this site</small>
</div>
<button type="submit" class="btn btn-primary mt-2">Save Square Settings</button>
</div>
</div>
</form>
<!-- Stripe Settings (legacy) -->
<form method="POST">
<input type="hidden" name="section" value="stripe">
<div class="admin-card">
<div class="admin-card-header">
<h3 class="admin-card-title"><i class="fab fa-stripe" style="color: #635BFF;"></i> Stripe</h3>
<h3 class="admin-card-title"><i class="fab fa-stripe" style="color: #635BFF;"></i> Stripe <small class="text-muted">(legacy)</small></h3>
</div>
<div class="admin-card-body">
<div class="form-group">
api/apply-wallet-credit.php
+58
View File
@@ -0,0 +1,58 @@
<?php
/**
* Tom's Java Jive - Apply Wallet Credit / Gift Card at Checkout
*
* Validates and quotes an amount to apply toward the current order total.
* Does NOT deduct wallet balance here - that only happens once the Square
* payment actually succeeds (see markSquarePaymentResult() in
* includes/square.php), so an abandoned checkout never loses a customer's
* real wallet money. A gift card code, if given, is redeemed into wallet
* balance immediately (same as the Wallet page does) since that step is
* safe/reversible-in-spirit - only the *spending* of wallet balance at
* checkout is deferred to payment success.
*/
require_once __DIR__ . '/../includes/functions.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/loyalty.php';
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
jsonResponse(['error' => 'Method not allowed'], 405);
}
if (!CustomerAuth::isLoggedIn()) {
jsonResponse(['error' => 'Please log in to use wallet balance or a gift card'], 401);
}
$customer = CustomerAuth::getFullUser();
$input = json_decode(file_get_contents('php://input'), true);
$orderTotal = (float) ($input['order_total'] ?? 0);
if ($orderTotal <= 0) {
jsonResponse(['error' => 'Invalid order total'], 400);
}
$giftCardCode = trim($input['gift_card_code'] ?? '');
if (!empty($giftCardCode)) {
$redeemResult = loyalty()->redeemGiftCardToWallet($customer['customer_id'], $giftCardCode);
if (!$redeemResult['success']) {
jsonResponse(['error' => $redeemResult['error']], 400);
}
$walletBalance = $redeemResult['new_balance'];
} else {
$fresh = db()->fetch("SELECT wallet_balance FROM customers WHERE customer_id = :id", ['id' => $customer['customer_id']]);
$walletBalance = (float) ($fresh['wallet_balance'] ?? 0);
}
$requested = isset($input['amount']) ? (float) $input['amount'] : $walletBalance;
$applyAmount = max(0, round(min($requested, $walletBalance, $orderTotal), 2));
jsonResponse([
'success' => true,
'apply_amount' => $applyAmount,
'wallet_balance' => $walletBalance,
'new_total' => round($orderTotal - $applyAmount, 2)
]);
api/create-checkout-session.php
-129
View File
@@ -1,129 +0,0 @@
<?php
/**
* Tom's Java Jive - Create Stripe Checkout Session API
* Uses hosted checkout page (redirects to Stripe)
*/
require_once __DIR__ . '/../includes/functions.php';
require_once __DIR__ . '/../includes/stripe.php';
require_once __DIR__ . '/../includes/loyalty.php';
header('Content-Type: application/json');
// Only accept POST
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
jsonResponse(['error' => 'Method not allowed'], 405);
}
$input = json_decode(file_get_contents('php://input'), true);
$orderId = $input['order_id'] ?? '';
$originUrl = $input['origin_url'] ?? '';
if (empty($orderId)) {
jsonResponse(['error' => 'Order ID required'], 400);
}
if (empty($originUrl)) {
$originUrl = SITE_URL;
}
// Get order
$order = db()->fetch(
"SELECT * FROM orders WHERE order_id = :id",
['id' => $orderId]
);
if (!$order) {
jsonResponse(['error' => 'Order not found'], 404);
}
if ($order['payment_status'] === 'paid') {
jsonResponse(['error' => 'Order already paid'], 400);
}
// Check if Stripe is configured
if (!isStripeConfigured()) {
// Demo mode - simulate successful payment
db()->update('orders',
[
'payment_status' => 'paid',
'order_status' => 'confirmed',
'stripe_payment_intent' => 'demo_' . bin2hex(random_bytes(8))
],
'order_id = :id',
['id' => $orderId]
);
if (!empty($order['customer_id'])) {
loyalty()->awardPoints(
$order['customer_id'],
(float) $order['total'],
'Order #' . $order['order_number'],
$orderId
);
}
jsonResponse([
'demo_mode' => true,
'message' => 'Payment simulated (Stripe not configured)',
'redirect' => '/order-confirmation.php?order=' . $orderId
]);
}
// Build line items from order
$items = json_decode($order['items'], true) ?? [];
$lineItems = [];
foreach ($items as $item) {
$lineItems[] = [
'name' => $item['name'],
'price' => floatval($item['price']),
'quantity' => intval($item['quantity']),
'currency' => 'usd'
];
}
// Add shipping if applicable
if ($order['shipping_cost'] > 0) {
$lineItems[] = [
'name' => 'Shipping',
'price' => floatval($order['shipping_cost']),
'quantity' => 1,
'currency' => 'usd'
];
}
// Build success/cancel URLs
$successUrl = rtrim($originUrl, '/') . '/order-confirmation.php?order=' . $orderId . '&session_id={CHECKOUT_SESSION_ID}';
$cancelUrl = rtrim($originUrl, '/') . '/payment.php?order=' . $orderId . '&cancelled=1';
try {
$session = stripe()->createCheckoutSession(
$lineItems,
$successUrl,
$cancelUrl,
[
'customer_email' => $order['customer_email'],
'metadata' => [
'order_id' => $orderId,
'order_number' => $order['order_number']
]
]
);
// Store checkout session ID
db()->update('orders',
['stripe_session_id' => $session['id']],
'order_id = :id',
['id' => $orderId]
);
jsonResponse([
'url' => $session['url'],
'session_id' => $session['id']
]);
} catch (Exception $e) {
error_log('Stripe Checkout error: ' . $e->getMessage());
jsonResponse(['error' => 'Failed to create checkout session: ' . $e->getMessage()], 500);
}
api/create-payment-intent.php
-87
View File
@@ -1,87 +0,0 @@
<?php
/**
* Tom's Java Jive - Create Stripe Payment Intent API
* Uses cURL-based Stripe integration (no Composer required)
*/
require_once __DIR__ . '/../includes/functions.php';
require_once __DIR__ . '/../includes/stripe.php';
header('Content-Type: application/json');
// Only accept POST
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
jsonResponse(['error' => 'Method not allowed'], 405);
}
$input = json_decode(file_get_contents('php://input'), true);
$orderId = $input['order_id'] ?? '';
if (empty($orderId)) {
jsonResponse(['error' => 'Order ID required'], 400);
}
// Get order
$order = db()->fetch(
"SELECT * FROM orders WHERE order_id = :id",
['id' => $orderId]
);
if (!$order) {
jsonResponse(['error' => 'Order not found'], 404);
}
if ($order['payment_status'] === 'paid') {
jsonResponse(['error' => 'Order already paid'], 400);
}
// Check if Stripe is configured
if (!isStripeConfigured()) {
// Demo mode - simulate successful payment
db()->update('orders',
[
'payment_status' => 'paid',
'order_status' => 'confirmed',
'stripe_payment_intent' => 'demo_' . bin2hex(random_bytes(8))
],
'order_id = :id',
['id' => $orderId]
);
jsonResponse([
'demo_mode' => true,
'message' => 'Payment simulated (Stripe not configured)',
'redirect' => '/order-confirmation.php?order=' . $orderId
]);
}
// Create Stripe Payment Intent using cURL-based API
try {
$paymentIntent = stripe()->createPaymentIntent(
$order['total'],
'usd',
[
'metadata' => [
'order_id' => $orderId,
'order_number' => $order['order_number']
],
'receipt_email' => $order['customer_email'],
'description' => 'Order #' . $order['order_number']
]
);
// Store payment intent ID
db()->update('orders',
['stripe_payment_intent' => $paymentIntent['id']],
'order_id = :id',
['id' => $orderId]
);
jsonResponse([
'client_secret' => $paymentIntent['client_secret']
]);
} catch (Exception $e) {
error_log('Stripe error: ' . $e->getMessage());
jsonResponse(['error' => 'Payment initialization failed: ' . $e->getMessage()], 500);
}
api/create-square-payment.php
+94
View File
@@ -0,0 +1,94 @@
<?php
/**
* Tom's Java Jive - Create Square Payment API
* Accepts a Web Payments SDK card nonce (source_id) and charges it synchronously.
*/
require_once __DIR__ . '/../includes/functions.php';
require_once __DIR__ . '/../includes/square.php';
require_once __DIR__ . '/../includes/loyalty.php';
require_once __DIR__ . '/../includes/email.php';
header('Content-Type: application/json');
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
jsonResponse(['error' => 'Method not allowed'], 405);
}
$input = json_decode(file_get_contents('php://input'), true);
$orderId = $input['order_id'] ?? '';
$sourceId = $input['source_id'] ?? '';
if (empty($orderId)) {
jsonResponse(['error' => 'Order ID required'], 400);
}
$order = db()->fetch(
"SELECT * FROM orders WHERE order_id = :id",
['id' => $orderId]
);
if (!$order) {
jsonResponse(['error' => 'Order not found'], 404);
}
if ($order['payment_status'] === 'paid') {
jsonResponse(['error' => 'Order already paid'], 400);
}
// Demo mode - Square not configured
if (!isSquareConfigured()) {
db()->update('orders',
[
'payment_status' => 'paid',
'order_status' => 'confirmed',
'square_payment_id' => 'demo_' . bin2hex(random_bytes(8)),
'payment_method' => 'square',
],
'order_id = :id',
['id' => $orderId]
);
jsonResponse([
'demo_mode' => true,
'message' => 'Payment simulated (Square not configured)',
'redirect' => '/order-confirmation.php?order=' . $orderId
]);
}
if (empty($sourceId)) {
jsonResponse(['error' => 'Card details required'], 400);
}
try {
$result = squareCreatePayment(
$sourceId,
(float) $order['total'],
$orderId,
['note' => 'Order #' . $order['order_number']]
);
$payment = $result['payment'] ?? [];
$status = $payment['status'] ?? '';
if ($status === 'COMPLETED') {
markSquarePaymentResult($payment['id'], $orderId, 'COMPLETED');
jsonResponse([
'success' => true,
'redirect' => '/order-confirmation.php?order=' . $orderId
]);
}
// Store the payment id even if not yet completed, so the reconciliation
// poll and webhook can find this order by square_payment_id.
db()->update('orders',
['square_payment_id' => $payment['id'] ?? null],
'order_id = :id',
['id' => $orderId]
);
jsonResponse(['error' => 'Payment was not completed (status: ' . $status . ')'], 400);
} catch (Exception $e) {
error_log('Square payment error: ' . $e->getMessage());
jsonResponse(['error' => 'Payment failed: ' . $e->getMessage()], 500);
}
api/payment-status.php
+43 -107
View File
@@ -1,157 +1,93 @@
<?php
/**
* Tom's Java Jive - Check Payment Status API
* Polls Stripe for payment/checkout session status
* Reconciliation-only fallback: Square payments complete synchronously in
* create-square-payment.php, so this endpoint only matters if the browser
* lost that response after Square had already accepted the charge. It shares
* markSquarePaymentResult() with the webhook and the synchronous path so
* loyalty points/emails are never duplicated no matter which path resolves first.
*/
require_once __DIR__ . '/../includes/functions.php';
require_once __DIR__ . '/../includes/stripe.php';
require_once __DIR__ . '/../includes/square.php';
require_once __DIR__ . '/../includes/loyalty.php';
require_once __DIR__ . '/../includes/email.php';
header('Content-Type: application/json');
// Only accept GET
if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
jsonResponse(['error' => 'Method not allowed'], 405);
}
$orderId = $_GET['order_id'] ?? '';
$sessionId = $_GET['session_id'] ?? '';
if (empty($orderId) && empty($sessionId)) {
jsonResponse(['error' => 'Order ID or Session ID required'], 400);
if (empty($orderId)) {
jsonResponse(['error' => 'Order ID required'], 400);
}
// Get order by ID or session
if (!empty($orderId)) {
$order = db()->fetch(
"SELECT * FROM orders WHERE order_id = :id",
['id' => $orderId]
);
} else {
$order = db()->fetch(
"SELECT * FROM orders WHERE stripe_session_id = :session OR stripe_payment_intent = :session",
['session' => $sessionId]
);
}
$order = db()->fetch(
"SELECT * FROM orders WHERE order_id = :id",
['id' => $orderId]
);
if (!$order) {
jsonResponse(['error' => 'Order not found'], 404);
}
// If already marked as paid, return success
if ($order['payment_status'] === 'paid') {
jsonResponse([
'status' => 'complete',
'status' => 'complete',
'payment_status' => 'paid',
'order_id' => $order['order_id'],
'order_number' => $order['order_number'],
'redirect' => '/order-confirmation.php?order=' . $order['order_id']
'order_id' => $order['order_id'],
'order_number' => $order['order_number'],
'redirect' => '/order-confirmation.php?order=' . $order['order_id']
]);
}
// Check if Stripe is configured
if (!isStripeConfigured()) {
if (!isSquareConfigured()) {
jsonResponse([
'status' => 'demo_mode',
'status' => 'demo_mode',
'payment_status' => $order['payment_status'],
'message' => 'Stripe not configured - running in demo mode'
'message' => 'Square not configured - running in demo mode'
]);
}
if (empty($order['square_payment_id'])) {
jsonResponse([
'status' => 'pending',
'payment_status' => $order['payment_status']
]);
}
try {
// Check with Stripe
if (!empty($order['stripe_session_id'])) {
// Check checkout session status
$session = stripe()->getCheckoutSession($order['stripe_session_id']);
$result = squareGetPayment($order['square_payment_id']);
$payment = $result['payment'] ?? [];
$status = $payment['status'] ?? '';
if ($session['payment_status'] === 'paid') {
// Update order
db()->update('orders',
[
'payment_status' => 'paid',
'order_status' => 'confirmed',
'stripe_payment_intent' => $session['payment_intent'] ?? null
],
'order_id = :id',
['id' => $order['order_id']]
);
markSquarePaymentResult($order['square_payment_id'], $order['order_id'], $status);
// Award loyalty points
if (!empty($order['customer_id'])) {
loyalty()->awardPoints(
$order['customer_id'],
(float) $order['total'],
'Order #' . $order['order_number'],
$order['order_id']
);
}
jsonResponse([
'status' => 'complete',
'payment_status' => 'paid',
'order_id' => $order['order_id'],
'order_number' => $order['order_number'],
'redirect' => '/order-confirmation.php?order=' . $order['order_id']
]);
}
$updated = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $order['order_id']]);
if ($updated['payment_status'] === 'paid') {
jsonResponse([
'status' => $session['status'],
'payment_status' => $session['payment_status']
]);
} elseif (!empty($order['stripe_payment_intent'])) {
// Check payment intent status
$paymentIntent = stripe()->getPaymentIntent($order['stripe_payment_intent']);
if ($paymentIntent['status'] === 'succeeded') {
// Update order
db()->update('orders',
[
'payment_status' => 'paid',
'order_status' => 'confirmed'
],
'order_id = :id',
['id' => $order['order_id']]
);
// Award loyalty points
if (!empty($order['customer_id'])) {
loyalty()->awardPoints(
$order['customer_id'],
(float) $order['total'],
'Order #' . $order['order_number'],
$order['order_id']
);
}
jsonResponse([
'status' => 'complete',
'payment_status' => 'paid',
'order_id' => $order['order_id'],
'order_number' => $order['order_number'],
'redirect' => '/order-confirmation.php?order=' . $order['order_id']
]);
}
jsonResponse([
'status' => $paymentIntent['status'],
'payment_status' => 'pending'
'status' => 'complete',
'payment_status' => 'paid',
'order_id' => $updated['order_id'],
'order_number' => $updated['order_number'],
'redirect' => '/order-confirmation.php?order=' . $updated['order_id']
]);
}
// No Stripe reference found
jsonResponse([
'status' => 'pending',
'payment_status' => $order['payment_status']
'status' => $status,
'payment_status' => $updated['payment_status']
]);
} catch (Exception $e) {
error_log('Payment status check error: ' . $e->getMessage());
error_log('Square payment status check error: ' . $e->getMessage());
jsonResponse([
'status' => 'error',
'status' => 'error',
'payment_status' => $order['payment_status'],
'error' => 'Failed to check payment status'
'error' => 'Failed to check payment status'
]);
}
api/redeem-gift-card.php
+10 -73
View File
@@ -7,6 +7,7 @@ header('Content-Type: application/json');
require_once __DIR__ . '/../includes/functions.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/loyalty.php';
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
jsonResponse(['error' => 'Method not allowed'], 405);
@@ -19,79 +20,15 @@ if (!CustomerAuth::isLoggedIn()) {
$customer = CustomerAuth::getFullUser();
$input = json_decode(file_get_contents('php://input'), true);
$code = strtoupper(str_replace(['-', ' '], '', trim($input['code'] ?? '')));
$result = loyalty()->redeemGiftCardToWallet($customer['customer_id'], $input['code'] ?? '');
if (empty($code) || strlen($code) < 8) {
jsonResponse(['error' => 'Invalid gift card code'], 400);
if (!$result['success']) {
jsonResponse(['error' => $result['error']], 400);
}
// Find gift card
$giftCard = db()->fetch(
"SELECT * FROM gift_cards WHERE code = :code AND is_active = 1",
['code' => $code]
);
if (!$giftCard) {
jsonResponse(['error' => 'Gift card not found or already used'], 404);
}
if ($giftCard['current_balance'] <= 0) {
jsonResponse(['error' => 'This gift card has no remaining balance'], 400);
}
if ($giftCard['expires_at'] && strtotime($giftCard['expires_at']) < time()) {
jsonResponse(['error' => 'This gift card has expired'], 400);
}
$amount = $giftCard['current_balance'];
try {
// Start transaction
db()->query("START TRANSACTION");
// Update gift card balance to 0
db()->query(
"UPDATE gift_cards SET current_balance = 0, is_active = 0, updated_at = NOW() WHERE gift_card_id = :id",
['id' => $giftCard['gift_card_id']]
);
// Log gift card transaction
db()->insert('gift_card_transactions', [
'gift_card_id' => $giftCard['gift_card_id'],
'amount' => -$amount,
'balance_after' => 0,
'type' => 'redeem',
'description' => 'Redeemed by customer: ' . $customer['email']
]);
// Add to customer wallet
$newWalletBalance = ($customer['wallet_balance'] ?? 0) + $amount;
db()->query(
"UPDATE customers SET wallet_balance = :balance, updated_at = NOW() WHERE customer_id = :id",
['balance' => $newWalletBalance, 'id' => $customer['customer_id']]
);
// Log wallet transaction
db()->insert('wallet_transactions', [
'transaction_id' => generateId('wt_'),
'customer_id' => $customer['customer_id'],
'amount' => $amount,
'balance_after' => $newWalletBalance,
'type' => 'gift_card',
'description' => 'Gift card redeemed: ' . $code
]);
db()->query("COMMIT");
jsonResponse([
'success' => true,
'amount' => $amount,
'new_balance' => $newWalletBalance,
'message' => formatCurrency($amount) . ' has been added to your wallet!'
]);
} catch (Exception $e) {
db()->query("ROLLBACK");
jsonResponse(['error' => 'Failed to redeem gift card. Please try again.'], 500);
}
jsonResponse([
'success' => true,
'amount' => $result['amount'],
'new_balance' => $result['new_balance'],
'message' => formatCurrency($result['amount']) . ' has been added to your wallet!'
]);
api/search-customers.php
+2 -2
View File
@@ -16,10 +16,10 @@ if (strlen($query) < 2) {
$customers = db()->fetchAll(
"SELECT customer_id, email, name, phone, wallet_balance, reward_points
FROM customers
WHERE (email LIKE :q OR name LIKE :q OR phone LIKE :q) AND is_active = 1
WHERE (email LIKE :q1 OR name LIKE :q2 OR phone LIKE :q3) AND is_active = 1
ORDER BY name ASC
LIMIT 20",
['q' => '%' . $query . '%']
['q1' => '%' . $query . '%', 'q2' => '%' . $query . '%', 'q3' => '%' . $query . '%']
);
jsonResponse($customers);
api/webhook.php
+37 -80
View File
@@ -1,107 +1,65 @@
<?php
/**
* Tom's Java Jive - Stripe Webhook Handler
* Uses cURL-based Stripe integration (no Composer required)
* Tom's Java Jive - Square Webhook Handler
*/
require_once __DIR__ . '/../includes/functions.php';
require_once __DIR__ . '/../includes/stripe.php';
require_once __DIR__ . '/../includes/square.php';
require_once __DIR__ . '/../includes/loyalty.php';
require_once __DIR__ . '/../includes/email.php';
header('Content-Type: application/json');
$payload = file_get_contents('php://input');
$sigHeader = $_SERVER['HTTP_STRIPE_SIGNATURE'] ?? '';
$sigHeader = $_SERVER['HTTP_X_SQUARE_HMACSHA256_SIGNATURE'] ?? '';
$notificationUrl = SITE_URL . '/api/webhook.php';
// Verify webhook signature (if secret is configured)
if (!empty(STRIPE_WEBHOOK_SECRET) && STRIPE_WEBHOOK_SECRET !== 'whsec_your_webhook_secret') {
try {
stripe()->verifyWebhookSignature($payload, $sigHeader, STRIPE_WEBHOOK_SECRET);
$event = json_decode($payload, true);
} catch (Exception $e) {
error_log('Stripe webhook signature verification failed: ' . $e->getMessage());
http_response_code(400);
exit();
}
} else {
$event = json_decode($payload, true);
if (!$event) {
http_response_code(400);
exit();
}
if (empty(SQUARE_WEBHOOK_SIGNATURE_KEY) || SQUARE_WEBHOOK_SIGNATURE_KEY === 'REPLACE_ME') {
error_log('Square webhook signature key not configured - rejecting webhook');
http_response_code(400);
exit();
}
if (!verifySquareWebhookSignature($payload, $sigHeader, $notificationUrl, SQUARE_WEBHOOK_SIGNATURE_KEY)) {
error_log('Square webhook signature verification failed');
http_response_code(400);
exit();
}
$event = json_decode($payload, true);
if (!$event) {
http_response_code(400);
exit();
}
$eventType = $event['type'] ?? '';
$data = $event['data']['object'] ?? [];
switch ($eventType) {
case 'checkout.session.completed':
// Stripe Checkout (hosted page) — metadata is on the session
$orderId = $data['metadata']['order_id'] ?? '';
$paymentIntentId = $data['payment_intent'] ?? '';
if ($orderId && ($data['payment_status'] ?? '') === 'paid') {
db()->update('orders',
[
'payment_status' => 'paid',
'order_status' => 'confirmed',
'stripe_payment_intent' => $paymentIntentId,
],
'order_id = :id',
['id' => $orderId]
);
$order = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId]);
if ($order) {
emailService()->sendOrderConfirmation($order);
}
case 'payment.updated':
case 'payment.created':
$payment = $event['data']['object']['payment'] ?? [];
$paymentId = $payment['id'] ?? '';
$status = $payment['status'] ?? '';
$orderId = $payment['reference_id'] ?? null;
if ($paymentId && $status) {
markSquarePaymentResult($paymentId, $orderId, $status);
}
break;
case 'payment_intent.succeeded':
// Payment Intent flow (embedded/direct) - skip if already confirmed by checkout.session.completed
$paymentIntentId = $data['id'] ?? '';
$orderId = $data['metadata']['order_id'] ?? '';
if ($orderId && ($data['status'] ?? '') === 'succeeded') {
$order = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId]);
if ($order && $order['order_status'] !== 'confirmed') {
db()->update('orders',
[
'payment_status' => 'paid',
'order_status' => 'confirmed',
'stripe_payment_intent' => $paymentIntentId,
],
'order_id = :id',
['id' => $orderId]
);
$order = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId]);
if ($order) {
emailService()->sendOrderConfirmation($order);
}
}
}
break;
case 'payment_intent.payment_failed':
$orderId = $data['metadata']['order_id'] ?? '';
if ($orderId) {
db()->update('orders',
['payment_status' => 'failed'],
'order_id = :id',
['id' => $orderId]
);
}
break;
case 'charge.refunded':
$paymentIntentId = $data['payment_intent'] ?? '';
if ($paymentIntentId) {
case 'refund.updated':
case 'refund.created':
$refund = $event['data']['object']['refund'] ?? [];
$paymentId = $refund['payment_id'] ?? '';
$status = $refund['status'] ?? '';
if ($status === 'COMPLETED' && $paymentId) {
db()->update('orders',
[
'payment_status' => 'refunded',
'order_status' => 'refunded',
],
'stripe_payment_intent = :pi',
['pi' => $paymentIntentId]
'square_payment_id = :pid',
['pid' => $paymentId]
);
}
break;
@@ -109,4 +67,3 @@ switch ($eventType) {
http_response_code(200);
echo json_encode(['received' => true]);
checkout.php
+132 -7
View File
@@ -6,6 +6,7 @@
$pageTitle = "Checkout - Tom's Java Jive";
require_once __DIR__ . '/includes/functions.php';
require_once __DIR__ . '/includes/auth.php';
require_once __DIR__ . '/includes/loyalty.php';
$cart = getCart();
if (empty($cart)) {
@@ -50,10 +51,8 @@ if ($shippingSettings['flat_rate_enabled'] ?? true) {
}
}
$total = $subtotal + $shippingCost;
// Get Stripe publishable key
$stripeKey = STRIPE_PUBLISHABLE_KEY;
$preDiscountTotal = $subtotal + $shippingCost;
$processor = defined('PAYMENT_PROCESSOR') ? PAYMENT_PROCESSOR : 'stripe';
$errors = [];
@@ -75,6 +74,18 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (empty($state)) $errors['state'] = 'State is required';
if (empty($zip)) $errors['zip'] = 'ZIP code is required';
// Re-validate any requested wallet credit server-side against the
// customer's current balance - never trust the client-submitted amount.
$walletAmountUsed = 0;
if ($customer && !empty($_POST['wallet_amount_used'])) {
$requestedWallet = (float) $_POST['wallet_amount_used'];
$freshCustomer = db()->fetch("SELECT wallet_balance FROM customers WHERE customer_id = :id", ['id' => $customer['customer_id']]);
$currentBalance = (float) ($freshCustomer['wallet_balance'] ?? 0);
$walletAmountUsed = max(0, round(min($requestedWallet, $currentBalance, $preDiscountTotal), 2));
}
$total = round($preDiscountTotal - $walletAmountUsed, 2);
if (empty($errors)) {
// Create order
$orderId = generateId('ord_');
@@ -111,6 +122,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
'items' => json_encode($orderItems),
'subtotal' => $subtotal,
'shipping_cost' => $shippingCost,
'wallet_amount_used' => $walletAmountUsed,
'total' => $total,
'shipping_address' => json_encode([
'address' => $address,
@@ -120,7 +132,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
'country' => 'USA'
]),
'shipping_method' => 'standard',
'payment_method' => 'stripe',
'payment_method' => $processor,
'payment_status' => 'pending',
'order_status' => 'pending'
]);
@@ -167,6 +179,7 @@ require_once __DIR__ . '/includes/header.php';
<h1 style="margin-bottom: 2rem;">Checkout</h1>
<form method="POST" action="" id="checkout-form">
<input type="hidden" name="wallet_amount_used" id="wallet_amount_used" value="0">
<div class="checkout-layout">
<!-- Customer & Shipping Info -->
@@ -263,6 +276,38 @@ require_once __DIR__ . '/includes/header.php';
</div>
</div>
<?php if ($customer): ?>
<!-- Wallet / Gift Card -->
<div class="card mb-2">
<div class="card-header">
<h3 style="margin: 0;">Wallet &amp; Gift Cards</h3>
</div>
<div class="card-body">
<p class="text-muted" style="font-size: 0.875rem; margin-bottom: 1rem;">
Wallet balance: <strong id="wallet-balance-display"><?= formatCurrency($customer['wallet_balance'] ?? 0) ?></strong>
</p>
<?php if (($customer['wallet_balance'] ?? 0) > 0): ?>
<button type="button" id="apply-wallet-btn" class="btn btn-secondary mb-1">
<i class="fas fa-wallet"></i> Apply Wallet Balance
</button>
<?php endif; ?>
<div class="form-group" style="display: flex; gap: 0.5rem; align-items: flex-end;">
<div style="flex: 1;">
<label class="form-label">Gift Card Code</label>
<input type="text" id="gift-card-code" class="form-input"
placeholder="XXXX-XXXX-XXXX" style="text-transform: uppercase;">
</div>
<button type="button" id="apply-gift-card-btn" class="btn btn-secondary">Apply</button>
</div>
<div id="wallet-message" style="margin-top: 0.5rem;"></div>
<div id="wallet-applied-row" style="display: none; margin-top: 0.5rem; font-weight: 600;">
Applied: <span id="wallet-applied-amount"></span>
<button type="button" id="remove-wallet-btn" class="btn btn-secondary" style="margin-left: 0.5rem; padding: 0.15rem 0.6rem; font-size: 0.8rem;">Remove</button>
</div>
</div>
</div>
<?php endif; ?>
<!-- Order Notes -->
<div class="card">
<div class="card-header">
@@ -313,12 +358,16 @@ require_once __DIR__ . '/includes/header.php';
<?php endif; ?>
</span>
</div>
<div class="checkout-summary-row" id="wallet-discount-row" style="display: none;">
<span>Wallet / Gift Card</span>
<span id="wallet-discount-amount" class="text-success"></span>
</div>
<hr style="margin: 1rem 0;">
<div class="checkout-summary-total">
<span>Total</span>
<span><?= formatCurrency($total) ?></span>
<span id="checkout-total-display"><?= formatCurrency($preDiscountTotal) ?></span>
</div>
<button type="submit" class="btn btn-primary btn-lg btn-block mt-2">
@@ -330,7 +379,7 @@ require_once __DIR__ . '/includes/header.php';
</a>
<p class="secure-badge">
<i class="fas fa-lock"></i> Secure checkout powered by Stripe
<i class="fas fa-lock"></i> Secure checkout powered by <?= $processor === 'square' ? 'Square' : 'Stripe' ?>
</p>
</div>
</div>
@@ -339,4 +388,80 @@ require_once __DIR__ . '/includes/header.php';
</div>
</section>
<?php if ($customer): ?>
<script>
const ORDER_TOTAL_PRE_DISCOUNT = <?= json_encode($preDiscountTotal) ?>;
const CURRENCY_SYMBOL = <?= json_encode(defined('TJJ_CURRENCY_SYMBOL') ? TJJ_CURRENCY_SYMBOL : '$') ?>;
function fmt(amount) {
return CURRENCY_SYMBOL + Number(amount).toFixed(2);
}
function showWalletMessage(msg, isError) {
const el = document.getElementById('wallet-message');
el.textContent = msg;
el.style.color = isError ? 'var(--color-error)' : 'var(--color-success)';
}
function applyWalletResult(data) {
document.getElementById('wallet_amount_used').value = data.apply_amount;
document.getElementById('checkout-total-display').textContent = fmt(data.new_total);
document.getElementById('wallet-balance-display').textContent = fmt(data.wallet_balance);
if (data.apply_amount > 0) {
document.getElementById('wallet-discount-row').style.display = '';
document.getElementById('wallet-discount-amount').textContent = '-' + fmt(data.apply_amount);
document.getElementById('wallet-applied-row').style.display = '';
document.getElementById('wallet-applied-amount').textContent = fmt(data.apply_amount);
} else {
document.getElementById('wallet-discount-row').style.display = 'none';
document.getElementById('wallet-applied-row').style.display = 'none';
}
}
async function applyCredit(body) {
try {
const response = await fetch('/api/apply-wallet-credit.php', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify(Object.assign({ order_total: ORDER_TOTAL_PRE_DISCOUNT }, body))
});
const data = await response.json();
if (data.error) {
showWalletMessage(data.error, true);
return;
}
showWalletMessage('Applied ' + fmt(data.apply_amount) + ' to your order.', false);
applyWalletResult(data);
} catch (err) {
showWalletMessage('Failed to apply credit. Please try again.', true);
}
}
const applyWalletBtn = document.getElementById('apply-wallet-btn');
if (applyWalletBtn) {
applyWalletBtn.addEventListener('click', function() {
applyCredit({});
});
}
document.getElementById('apply-gift-card-btn').addEventListener('click', function() {
const code = document.getElementById('gift-card-code').value.trim();
if (!code) {
showWalletMessage('Enter a gift card code first.', true);
return;
}
applyCredit({ gift_card_code: code });
});
document.getElementById('remove-wallet-btn').addEventListener('click', function() {
document.getElementById('wallet_amount_used').value = 0;
document.getElementById('checkout-total-display').textContent = fmt(ORDER_TOTAL_PRE_DISCOUNT);
document.getElementById('wallet-discount-row').style.display = 'none';
document.getElementById('wallet-applied-row').style.display = 'none';
showWalletMessage('', false);
});
</script>
<?php endif; ?>
<?php require_once __DIR__ . '/includes/footer.php'; ?>
db/schema.sql
+2
View File
@@ -326,6 +326,8 @@ CREATE TABLE `orders` (
`order_status` enum('pending','confirmed','processing','shipped','delivered','cancelled','refunded') DEFAULT 'pending',
`stripe_session_id` varchar(255) DEFAULT NULL,
`stripe_payment_intent` varchar(255) DEFAULT NULL,
`square_payment_id` varchar(255) DEFAULT NULL,
`square_order_id` varchar(255) DEFAULT NULL,
`tracking_number` varchar(100) DEFAULT NULL,
`tracking_url` varchar(500) DEFAULT NULL,
`notes` text DEFAULT NULL,
includes/loyalty.php
+82 -2
View File
@@ -150,10 +150,10 @@ class LoyaltyProgram {
db()->query(
"UPDATE customers SET
reward_points = reward_points + :points,
lifetime_points = COALESCE(lifetime_points, 0) + :points,
lifetime_points = COALESCE(lifetime_points, 0) + :points2,
updated_at = NOW()
WHERE customer_id = :id",
['points' => $totalPoints, 'id' => $customerId]
['points' => $totalPoints, 'points2' => $totalPoints, 'id' => $customerId]
);
$newBalance = db()->fetch(
@@ -417,6 +417,86 @@ class LoyaltyProgram {
'new_customer_bonus' => $newCustomerBonus
];
}
/**
* Redeem a gift card code into wallet balance. Shared by the Wallet page
* and checkout so both go through the same transaction logic instead of
* duplicating it.
*/
public function redeemGiftCardToWallet(string $customerId, string $rawCode): array {
$code = strtoupper(str_replace(['-', ' '], '', trim($rawCode)));
if (empty($code) || strlen($code) < 8) {
return ['success' => false, 'error' => 'Invalid gift card code'];
}
$giftCard = db()->fetch(
"SELECT * FROM gift_cards WHERE code = :code AND is_active = 1",
['code' => $code]
);
if (!$giftCard) {
return ['success' => false, 'error' => 'Gift card not found or already used'];
}
if ($giftCard['current_balance'] <= 0) {
return ['success' => false, 'error' => 'This gift card has no remaining balance'];
}
if ($giftCard['expires_at'] && strtotime($giftCard['expires_at']) < time()) {
return ['success' => false, 'error' => 'This gift card has expired'];
}
$customer = db()->fetch("SELECT wallet_balance FROM customers WHERE customer_id = :id", ['id' => $customerId]);
if (!$customer) {
return ['success' => false, 'error' => 'Customer not found'];
}
$amount = $giftCard['current_balance'];
try {
db()->query("START TRANSACTION");
db()->query(
"UPDATE gift_cards SET current_balance = 0, is_active = 0 WHERE gift_card_id = :id",
['id' => $giftCard['gift_card_id']]
);
db()->insert('gift_card_transactions', [
'gift_card_id' => $giftCard['gift_card_id'],
'amount' => -$amount,
'balance_after' => 0,
'type' => 'redemption',
]);
$newWalletBalance = (float) $customer['wallet_balance'] + $amount;
db()->query(
"UPDATE customers SET wallet_balance = :balance, updated_at = NOW() WHERE customer_id = :id",
['balance' => $newWalletBalance, 'id' => $customerId]
);
db()->insert('wallet_transactions', [
'transaction_id' => generateId('wt_'),
'customer_id' => $customerId,
'amount' => $amount,
'balance_after' => $newWalletBalance,
'type' => 'deposit',
'description' => 'Gift card redeemed: ' . $code
]);
db()->query("COMMIT");
return [
'success' => true,
'amount' => $amount,
'new_balance' => $newWalletBalance
];
} catch (Exception $e) {
db()->query("ROLLBACK");
return ['success' => false, 'error' => 'Failed to redeem gift card. Please try again.'];
}
}
}
// Helper function
includes/square.php
+160
View File
@@ -0,0 +1,160 @@
<?php
/**
* Tom's Java Jive - Square Integration (cURL-based, no SDK required)
*/
function squareApi(string $method, string $path, array $body = []): array {
$base = (defined('SQUARE_ENV') && SQUARE_ENV === 'sandbox')
? 'https://connect.squareupsandbox.com/v2'
: 'https://connect.squareup.com/v2';
$ch = curl_init($base . $path);
$opts = [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_TIMEOUT => 30,
CURLOPT_SSL_VERIFYPEER => true,
CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'Authorization: Bearer ' . SQUARE_ACCESS_TOKEN,
'Square-Version: 2024-01-18',
],
];
if ($method !== 'GET') {
$opts[CURLOPT_CUSTOMREQUEST] = $method;
$opts[CURLOPT_POSTFIELDS] = json_encode($body ?: new stdClass());
}
curl_setopt_array($ch, $opts);
$resp = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$err = curl_error($ch);
curl_close($ch);
if ($err) {
throw new Exception('Square API connection error: ' . $err);
}
$decoded = json_decode($resp ?: '{}', true);
if (!empty($decoded['errors'])) {
$msg = $decoded['errors'][0]['detail'] ?? ($decoded['errors'][0]['code'] ?? 'Unknown Square error');
throw new Exception($msg);
}
if ($httpCode >= 400) {
throw new Exception('Square API error (HTTP ' . $httpCode . ')');
}
return $decoded;
}
/**
* Create a payment. $sourceId is the nonce from the Web Payments SDK's tokenize() call.
*/
function squareCreatePayment(string $sourceId, float $amount, string $referenceId, array $options = []): array {
$body = [
'source_id' => $sourceId,
'idempotency_key' => $referenceId . '_' . bin2hex(random_bytes(8)),
'amount_money' => [
'amount' => (int) round($amount * 100),
'currency' => 'USD',
],
'location_id' => SQUARE_LOCATION_ID,
'autocomplete' => true,
'reference_id' => $referenceId,
];
if (!empty($options['note'])) {
$body['note'] = $options['note'];
}
return squareApi('POST', '/payments', $body);
}
function squareGetPayment(string $paymentId): array {
return squareApi('GET', '/payments/' . $paymentId);
}
function isSquareConfigured(): bool {
return defined('SQUARE_ACCESS_TOKEN') && defined('SQUARE_APP_ID') && defined('SQUARE_LOCATION_ID')
&& !empty(SQUARE_ACCESS_TOKEN) && !empty(SQUARE_APP_ID) && !empty(SQUARE_LOCATION_ID)
&& SQUARE_ACCESS_TOKEN !== 'REPLACE_ME';
}
/**
* Square's webhook signature: base64(HMAC-SHA256(notification_url . raw_body, signature_key)).
* The notification URL must exactly match what's configured in the Square Dashboard subscription.
*/
function verifySquareWebhookSignature(string $payload, string $signature, string $notificationUrl, string $signatureKey): bool {
if (empty($signatureKey) || empty($signature)) {
return false;
}
$expected = base64_encode(hash_hmac('sha256', $notificationUrl . $payload, $signatureKey, true));
return hash_equals($expected, $signature);
}
/**
* Single source of truth for "an order's Square payment resolved" — called from the
* synchronous create-payment response, the webhook, and the reconciliation poll, so
* loyalty points/emails are never awarded or sent more than once regardless of which
* path resolves the order first.
*/
function markSquarePaymentResult(string $paymentId, ?string $orderId, string $status): void {
$order = $orderId
? db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $orderId])
: db()->fetch("SELECT * FROM orders WHERE square_payment_id = :pid", ['pid' => $paymentId]);
if (!$order) {
return;
}
if ($status === 'COMPLETED') {
if ($order['order_status'] !== 'confirmed') {
db()->update('orders',
[
'payment_status' => 'paid',
'order_status' => 'confirmed',
'square_payment_id' => $paymentId,
'payment_method' => 'square',
],
'order_id = :id',
['id' => $order['order_id']]
);
if (!empty($order['customer_id'])) {
loyalty()->awardPoints(
$order['customer_id'],
(float) $order['total'],
'Order #' . $order['order_number'],
$order['order_id']
);
}
if (!empty($order['wallet_amount_used']) && (float) $order['wallet_amount_used'] > 0 && !empty($order['customer_id'])) {
$walletAmount = (float) $order['wallet_amount_used'];
$cust = db()->fetch("SELECT wallet_balance FROM customers WHERE customer_id = :id", ['id' => $order['customer_id']]);
if ($cust) {
$newBalance = max(0, (float) $cust['wallet_balance'] - $walletAmount);
db()->update('customers', ['wallet_balance' => $newBalance], 'customer_id = :id', ['id' => $order['customer_id']]);
db()->insert('wallet_transactions', [
'transaction_id' => generateId('wt_'),
'customer_id' => $order['customer_id'],
'amount' => -$walletAmount,
'balance_after' => $newBalance,
'type' => 'purchase',
'description' => 'Applied to Order #' . $order['order_number'],
]);
}
}
$updated = db()->fetch("SELECT * FROM orders WHERE order_id = :id", ['id' => $order['order_id']]);
if ($updated) {
emailService()->sendOrderConfirmation($updated);
}
}
} elseif (in_array($status, ['FAILED', 'CANCELED'], true)) {
db()->update('orders',
['payment_status' => 'failed'],
'order_id = :id',
['id' => $order['order_id']]
);
}
}
payment.php
+280 -106
View File
@@ -1,13 +1,20 @@
<?php
/**
* Tom's Java Jive - Payment Page (Stripe)
* Supports both PaymentIntent (card element) and Checkout Session (redirect) flows
* Tom's Java Jive - Payment Page
* Supports Stripe (legacy) or Square, gated by the PAYMENT_PROCESSOR constant.
*/
$pageTitle = "Payment - Tom's Java Jive";
require_once __DIR__ . '/includes/functions.php';
require_once __DIR__ . '/includes/auth.php';
require_once __DIR__ . '/includes/stripe.php';
$processor = defined('PAYMENT_PROCESSOR') ? PAYMENT_PROCESSOR : 'stripe';
if ($processor === 'square') {
require_once __DIR__ . '/includes/square.php';
} else {
require_once __DIR__ . '/includes/stripe.php';
}
$orderId = $_GET['order'] ?? $_SESSION['pending_order_id'] ?? '';
$cancelled = isset($_GET['cancelled']);
@@ -16,7 +23,6 @@ if (empty($orderId)) {
redirect('/cart.php');
}
// Get order
$order = db()->fetch(
"SELECT * FROM orders WHERE order_id = :id",
['id' => $orderId]
@@ -26,16 +32,20 @@ if (!$order) {
redirect('/cart.php');
}
// If already paid, redirect to confirmation
if ($order['payment_status'] === 'paid') {
clearCart();
redirect('/order-confirmation.php?order=' . $orderId);
}
$stripePublishableKey = STRIPE_PUBLISHABLE_KEY;
$stripeConfigured = isStripeConfigured();
$total = $order['total'];
if ($processor === 'square') {
$squareConfigured = isSquareConfigured();
} else {
$stripePublishableKey = STRIPE_PUBLISHABLE_KEY;
$stripeConfigured = isStripeConfigured();
}
require_once __DIR__ . '/includes/header.php';
?>
@@ -62,42 +72,95 @@ require_once __DIR__ . '/includes/header.php';
</p>
</div>
<?php if (!$stripeConfigured): ?>
<!-- Demo Mode - No Stripe Keys -->
<div class="alert alert-info mb-2">
<i class="fas fa-info-circle"></i> <strong>Demo Mode:</strong> Stripe is not configured. Click below to simulate a successful payment.
</div>
<form id="demo-payment-form">
<button type="submit" id="demo-submit" class="btn btn-primary btn-lg btn-block">
<span id="demo-text">Complete Demo Payment <?= formatCurrency($total) ?></span>
<span id="demo-spinner" style="display: none;">
<span class="loading"></span> Processing...
</span>
</button>
</form>
<?php else: ?>
<!-- Stripe Payment Options -->
<div class="payment-options mb-2">
<button type="button" id="checkout-btn" class="btn btn-primary btn-lg btn-block mb-1">
<i class="fas fa-credit-card"></i> Pay with Stripe Checkout
</button>
<p class="text-muted text-center" style="font-size: 0.875rem;">or enter card details below</p>
</div>
<form id="payment-form">
<div class="form-group">
<label class="form-label">Card Details</label>
<div id="card-element" style="padding: 0.75rem; border: 1px solid var(--color-border); border-radius: var(--radius-md);"></div>
<div id="card-errors" class="form-error" style="margin-top: 0.5rem;"></div>
<?php if ($processor === 'square'): ?>
<?php if (!$squareConfigured): ?>
<div class="alert alert-info mb-2">
<i class="fas fa-info-circle"></i> <strong>Demo Mode:</strong> Square is not configured. Click below to simulate a successful payment.
</div>
<form id="demo-payment-form">
<button type="submit" id="demo-submit" class="btn btn-primary btn-lg btn-block">
<span id="demo-text">Complete Demo Payment <?= formatCurrency($total) ?></span>
<span id="demo-spinner" style="display: none;">
<span class="loading"></span> Processing...
</span>
</button>
</form>
<?php else: ?>
<div class="payment-options mb-2" style="display: flex; gap: 0.5rem;">
<button type="button" id="pay-tab-card" class="btn btn-primary" style="flex: 1;">
<i class="fas fa-credit-card"></i> Card
</button>
<button type="button" id="pay-tab-giftcard" class="btn btn-secondary" style="flex: 1;">
<i class="fas fa-gift"></i> Gift Card
</button>
</div>
<button type="submit" id="submit-button" class="btn btn-secondary btn-lg btn-block">
<span id="button-text">Pay <?= formatCurrency($total) ?></span>
<span id="spinner" style="display: none;">
<span class="loading"></span> Processing...
</span>
</button>
</form>
<form id="payment-form">
<div class="form-group">
<label class="form-label">Card Details</label>
<div id="card-element" style="padding: 0.75rem; border: 1px solid var(--color-border); border-radius: var(--radius-md);"></div>
<div id="card-errors" class="form-error" style="margin-top: 0.5rem;"></div>
</div>
<button type="submit" id="submit-button" class="btn btn-secondary btn-lg btn-block">
<span id="button-text">Pay <?= formatCurrency($total) ?></span>
<span id="spinner" style="display: none;">
<span class="loading"></span> Processing...
</span>
</button>
</form>
<form id="gift-card-payment-form" style="display: none;">
<div class="form-group">
<label class="form-label">Square Gift Card</label>
<div id="gift-card-element" style="padding: 0.75rem; border: 1px solid var(--color-border); border-radius: var(--radius-md);"></div>
<div id="gift-card-errors" class="form-error" style="margin-top: 0.5rem;"></div>
</div>
<button type="submit" id="gift-card-submit-button" class="btn btn-secondary btn-lg btn-block">
<span id="gift-card-button-text">Pay <?= formatCurrency($total) ?></span>
<span id="gift-card-spinner" style="display: none;">
<span class="loading"></span> Processing...
</span>
</button>
</form>
<?php endif; ?>
<?php else: ?>
<?php if (!$stripeConfigured): ?>
<div class="alert alert-info mb-2">
<i class="fas fa-info-circle"></i> <strong>Demo Mode:</strong> Stripe is not configured. Click below to simulate a successful payment.
</div>
<form id="demo-payment-form">
<button type="submit" id="demo-submit" class="btn btn-primary btn-lg btn-block">
<span id="demo-text">Complete Demo Payment <?= formatCurrency($total) ?></span>
<span id="demo-spinner" style="display: none;">
<span class="loading"></span> Processing...
</span>
</button>
</form>
<?php else: ?>
<div class="payment-options mb-2">
<button type="button" id="checkout-btn" class="btn btn-primary btn-lg btn-block mb-1">
<i class="fas fa-credit-card"></i> Pay with Stripe Checkout
</button>
<p class="text-muted text-center" style="font-size: 0.875rem;">or enter card details below</p>
</div>
<form id="payment-form">
<div class="form-group">
<label class="form-label">Card Details</label>
<div id="card-element" style="padding: 0.75rem; border: 1px solid var(--color-border); border-radius: var(--radius-md);"></div>
<div id="card-errors" class="form-error" style="margin-top: 0.5rem;"></div>
</div>
<button type="submit" id="submit-button" class="btn btn-secondary btn-lg btn-block">
<span id="button-text">Pay <?= formatCurrency($total) ?></span>
<span id="spinner" style="display: none;">
<span class="loading"></span> Processing...
</span>
</button>
</form>
<?php endif; ?>
<?php endif; ?>
<div id="payment-message" style="display: none; margin-top: 1rem;"></div>
@@ -110,9 +173,12 @@ require_once __DIR__ . '/includes/header.php';
</div>
</section>
<?php if ($processor === 'square' && $squareConfigured): ?>
<script src="<?= (defined('SQUARE_ENV') && SQUARE_ENV === 'sandbox') ? 'https://sandbox.web.squarecdn.com/v1/square.js' : 'https://web.squarecdn.com/v1/square.js' ?>"></script>
<?php endif; ?>
<script>
const orderId = '<?= $orderId ?>';
const stripeConfigured = <?= $stripeConfigured ? 'true' : 'false' ?>;
const messageEl = document.getElementById('payment-message');
function showMessage(message, type = 'info') {
@@ -121,88 +187,205 @@ function showMessage(message, type = 'info') {
messageEl.innerHTML = `<i class="fas fa-${type === 'error' ? 'exclamation-circle' : 'check-circle'}"></i> ${message}`;
}
<?php if (!$stripeConfigured): ?>
// Demo mode payment
const demoForm = document.getElementById('demo-payment-form');
demoForm.addEventListener('submit', async function(e) {
e.preventDefault();
const btn = document.getElementById('demo-submit');
const text = document.getElementById('demo-text');
const spinner = document.getElementById('demo-spinner');
btn.disabled = true;
text.style.display = 'none';
spinner.style.display = 'inline';
try {
const response = await fetch('/api/create-payment-intent.php', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ order_id: orderId })
});
const data = await response.json();
if (data.demo_mode && data.redirect) {
showMessage('Payment simulated successfully! Redirecting...', 'success');
setTimeout(() => window.location.href = data.redirect, 1000);
} else if (data.error) {
showMessage(data.error, 'error');
function wireDemoForm(endpoint) {
const demoForm = document.getElementById('demo-payment-form');
demoForm.addEventListener('submit', async function(e) {
e.preventDefault();
const btn = document.getElementById('demo-submit');
const text = document.getElementById('demo-text');
const spinner = document.getElementById('demo-spinner');
btn.disabled = true;
text.style.display = 'none';
spinner.style.display = 'inline';
try {
const response = await fetch(endpoint, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ order_id: orderId })
});
const data = await response.json();
if (data.demo_mode && data.redirect) {
showMessage('Payment simulated successfully! Redirecting...', 'success');
setTimeout(() => window.location.href = data.redirect, 1000);
} else if (data.error) {
showMessage(data.error, 'error');
btn.disabled = false;
text.style.display = 'inline';
spinner.style.display = 'none';
}
} catch (err) {
showMessage('Payment failed. Please try again.', 'error');
btn.disabled = false;
text.style.display = 'inline';
spinner.style.display = 'none';
}
});
}
<?php if ($processor === 'square'): ?>
<?php if (!$squareConfigured): ?>
wireDemoForm('/api/create-square-payment.php');
<?php else: ?>
// Square Web Payments SDK
let squareCard, squareGiftCard;
const squarePayments = window.Square.payments('<?= SQUARE_APP_ID ?>', '<?= SQUARE_LOCATION_ID ?>');
(async function initSquare() {
squareCard = await squarePayments.card();
await squareCard.attach('#card-element');
})();
const cardTab = document.getElementById('pay-tab-card');
const giftCardTab = document.getElementById('pay-tab-giftcard');
const cardForm = document.getElementById('payment-form');
const giftCardForm = document.getElementById('gift-card-payment-form');
let giftCardInitialized = false;
cardTab.addEventListener('click', function() {
cardTab.className = 'btn btn-primary';
giftCardTab.className = 'btn btn-secondary';
cardForm.style.display = '';
giftCardForm.style.display = 'none';
});
giftCardTab.addEventListener('click', async function() {
cardTab.className = 'btn btn-secondary';
giftCardTab.className = 'btn btn-primary';
cardForm.style.display = 'none';
giftCardForm.style.display = '';
if (!giftCardInitialized) {
giftCardInitialized = true;
squareGiftCard = await squarePayments.giftCard();
await squareGiftCard.attach('#gift-card-element');
}
});
giftCardForm.addEventListener('submit', async function(e) {
e.preventDefault();
const submitBtn = document.getElementById('gift-card-submit-button');
const buttonText = document.getElementById('gift-card-button-text');
const spinner = document.getElementById('gift-card-spinner');
submitBtn.disabled = true;
buttonText.style.display = 'none';
spinner.style.display = 'inline';
document.getElementById('gift-card-errors').textContent = '';
try {
const tokenResult = await squareGiftCard.tokenize();
if (tokenResult.status !== 'OK') {
const msg = (tokenResult.errors && tokenResult.errors[0] && tokenResult.errors[0].message) || 'Gift card validation failed';
document.getElementById('gift-card-errors').textContent = msg;
submitBtn.disabled = false;
buttonText.style.display = 'inline';
spinner.style.display = 'none';
return;
}
const response = await fetch('/api/create-square-payment.php', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ order_id: orderId, source_id: tokenResult.token })
});
const data = await response.json();
if (data.error) {
showMessage(data.error, 'error');
submitBtn.disabled = false;
buttonText.style.display = 'inline';
spinner.style.display = 'none';
return;
}
if (data.success && data.redirect) {
showMessage('Payment successful! Redirecting...', 'success');
setTimeout(() => window.location.href = data.redirect, 1000);
}
} catch (err) {
showMessage('Payment failed. Please try again.', 'error');
btn.disabled = false;
text.style.display = 'inline';
console.error(err);
submitBtn.disabled = false;
buttonText.style.display = 'inline';
spinner.style.display = 'none';
}
});
const form = document.getElementById('payment-form');
const submitButton = document.getElementById('submit-button');
const buttonText = document.getElementById('button-text');
const spinner = document.getElementById('spinner');
form.addEventListener('submit', async function(e) {
e.preventDefault();
submitButton.disabled = true;
buttonText.style.display = 'none';
spinner.style.display = 'inline';
document.getElementById('card-errors').textContent = '';
try {
const tokenResult = await squareCard.tokenize();
if (tokenResult.status !== 'OK') {
const msg = (tokenResult.errors && tokenResult.errors[0] && tokenResult.errors[0].message) || 'Card validation failed';
document.getElementById('card-errors').textContent = msg;
submitButton.disabled = false;
buttonText.style.display = 'inline';
spinner.style.display = 'none';
return;
}
const response = await fetch('/api/create-square-payment.php', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ order_id: orderId, source_id: tokenResult.token })
});
const data = await response.json();
if (data.demo_mode && data.redirect) {
window.location.href = data.redirect;
return;
}
if (data.error) {
showMessage(data.error, 'error');
submitButton.disabled = false;
buttonText.style.display = 'inline';
spinner.style.display = 'none';
return;
}
if (data.success && data.redirect) {
showMessage('Payment successful! Redirecting...', 'success');
setTimeout(() => window.location.href = data.redirect, 1000);
}
} catch (err) {
showMessage('Payment failed. Please try again.', 'error');
console.error(err);
submitButton.disabled = false;
buttonText.style.display = 'inline';
spinner.style.display = 'none';
}
});
<?php endif; ?>
<?php else: ?>
<?php if (!$stripeConfigured): ?>
wireDemoForm('/api/create-payment-intent.php');
<?php else: ?>
// Stripe initialized
const stripe = Stripe('<?= $stripePublishableKey ?>');
const elements = stripe.elements();
const cardElement = elements.create('card', {
style: {
base: {
fontSize: '16px',
color: '#1B1B1B',
'::placeholder': { color: '#9CA3AF' }
}
}
style: { base: { fontSize: '16px', color: '#1B1B1B', '::placeholder': { color: '#9CA3AF' } } }
});
cardElement.mount('#card-element');
// Handle validation errors
cardElement.on('change', function(event) {
const displayError = document.getElementById('card-errors');
if (event.error) {
displayError.textContent = event.error.message;
} else {
displayError.textContent = '';
}
displayError.textContent = event.error ? event.error.message : '';
});
// Stripe Checkout button (redirect to hosted page)
document.getElementById('checkout-btn').addEventListener('click', async function() {
this.disabled = true;
this.innerHTML = '<span class="loading"></span> Redirecting to Stripe...';
try {
const response = await fetch('/api/create-checkout-session.php', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
order_id: orderId,
origin_url: window.location.origin
})
body: JSON.stringify({ order_id: orderId, origin_url: window.location.origin })
});
const data = await response.json();
if (data.demo_mode && data.redirect) {
window.location.href = data.redirect;
} else if (data.url) {
@@ -219,7 +402,6 @@ document.getElementById('checkout-btn').addEventListener('click', async function
}
});
// PaymentIntent form (inline card element)
const form = document.getElementById('payment-form');
const submitButton = document.getElementById('submit-button');
const buttonText = document.getElementById('button-text');
@@ -227,25 +409,20 @@ const spinner = document.getElementById('spinner');
form.addEventListener('submit', async function(e) {
e.preventDefault();
submitButton.disabled = true;
buttonText.style.display = 'none';
spinner.style.display = 'inline';
try {
const response = await fetch('/api/create-payment-intent.php', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ order_id: orderId })
});
const data = await response.json();
if (data.demo_mode && data.redirect) {
window.location.href = data.redirect;
return;
}
if (data.error) {
showMessage(data.error, 'error');
submitButton.disabled = false;
@@ -253,8 +430,6 @@ form.addEventListener('submit', async function(e) {
spinner.style.display = 'none';
return;
}
// Confirm payment with Stripe
const { error, paymentIntent } = await stripe.confirmCardPayment(data.client_secret, {
payment_method: {
card: cardElement,
@@ -264,14 +439,12 @@ form.addEventListener('submit', async function(e) {
}
}
});
if (error) {
showMessage(error.message, 'error');
} else if (paymentIntent.status === 'succeeded') {
showMessage('Payment successful! Redirecting...', 'success');
setTimeout(() => window.location.href = '/order-confirmation.php?order=' + orderId, 1000);
}
} catch (err) {
showMessage('Payment failed. Please try again.', 'error');
console.error(err);
@@ -282,6 +455,7 @@ form.addEventListener('submit', async function(e) {
}
});
<?php endif; ?>
<?php endif; ?>
</script>
<?php require_once __DIR__ . '/includes/footer.php'; ?>