119 lines
7.3 KiB
PHP
119 lines
7.3 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Models\User;
|
|
use App\Notifications\AccountUpdate;
|
|
use App\Services\LicenseService;
|
|
use Carbon\Carbon;
|
|
use Illuminate\Http\JsonResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Illuminate\Support\Facades\Http;
|
|
use Illuminate\Support\Str;
|
|
|
|
class PaddleController extends Controller
|
|
{
|
|
public function checkout(Request $r): JsonResponse
|
|
{
|
|
$config = config('tarnax.paddle');
|
|
abort_unless($config['api_key'] && $config['price_id'] && $config['client_token'], 503, 'Checkout is awaiting merchant configuration.');
|
|
$user = $r->user();
|
|
if (! $user->account_token) {
|
|
$user->forceFill(['account_token' => (string) Str::uuid()])->save();
|
|
}
|
|
$base = $config['environment'] === 'production' ? 'https://api.paddle.com' : 'https://sandbox-api.paddle.com';
|
|
$response = Http::withToken($config['api_key'])->timeout(15)->post($base.'/transactions', ['items' => [['price_id' => $config['price_id'], 'quantity' => 1]], 'collection_mode' => 'automatic', 'custom_data' => ['account_token' => $user->account_token]]);
|
|
abort_unless($response->successful(), 502, 'Payment provider unavailable.');
|
|
|
|
return response()->json(['transaction_id' => $response->json('data.id')]);
|
|
}
|
|
|
|
public function webhook(Request $r, LicenseService $licenses): JsonResponse
|
|
{
|
|
$secret = config('tarnax.paddle.webhook_secret');
|
|
abort_unless($secret, 503);
|
|
$parts = [];
|
|
foreach (explode(';', $r->header('Paddle-Signature', '')) as $part) {
|
|
$pair = explode('=', trim($part), 2);
|
|
if (count($pair) === 2) {
|
|
$parts[$pair[0]][] = $pair[1];
|
|
}
|
|
}
|
|
$ts = $parts['ts'][0] ?? '';
|
|
abort_unless(ctype_digit($ts) && abs(time() - (int) $ts) <= 300, 401);
|
|
$expected = hash_hmac('sha256', $ts.':'.$r->getContent(), $secret);
|
|
$valid = false;
|
|
foreach ($parts['h1'] ?? [] as $signature) {
|
|
$valid = $valid || hash_equals($expected, $signature);
|
|
}abort_unless($valid, 401);
|
|
$event = $r->validate(['event_id' => 'required|string|max:100', 'event_type' => 'required|string|max:100', 'occurred_at' => 'required|date', 'data' => 'required|array']);
|
|
DB::transaction(function () use ($event, $licenses) {
|
|
$inserted = DB::table('webhook_events')->insertOrIgnore(['id' => $event['event_id'], 'type' => $event['event_type'], 'processed_at' => now()]);
|
|
if (! $inserted) {
|
|
return;
|
|
}
|
|
$d = $event['data'];
|
|
$type = $event['event_type'];
|
|
$at = Carbon::parse($event['occurred_at']);
|
|
if ($type === 'transaction.completed') {
|
|
abort_unless(($d['status'] ?? '') === 'completed' && ! empty($d['id']), 422);
|
|
DB::table('payment_locks')->insertOrIgnore(['id' => $d['id']]);
|
|
DB::table('payment_locks')->where('id', $d['id'])->lockForUpdate()->first();
|
|
abort_unless(config('tarnax.paddle.price_id'), 503);
|
|
$matching = collect($d['items'] ?? [])->contains(fn ($i) => ($i['price']['id'] ?? null) === config('tarnax.paddle.price_id') && ($i['quantity'] ?? 0) >= 1);
|
|
if (! $matching) {
|
|
return;
|
|
}
|
|
if (DB::table('refund_blocks')->where('transaction_id', $d['id'])->exists()) {
|
|
return;
|
|
}
|
|
$user = User::where('account_token', $d['custom_data']['account_token'] ?? '')->first();
|
|
abort_unless($user, 422, 'Unknown customer.');
|
|
$purchase = DB::table('purchases')->where('transaction_id', $d['id'])->lockForUpdate()->first();
|
|
if ($purchase && ($purchase->status === 'refunded' || Carbon::parse($purchase->provider_updated_at)->gte($at))) {
|
|
return;
|
|
}
|
|
$id = $purchase?->id ?? DB::table('purchases')->insertGetId(['user_id' => $user->id, 'provider' => 'paddle', 'transaction_id' => $d['id'], 'subscription_id' => $d['subscription_id'] ?? null, 'status' => 'completed', 'total' => (int) ($d['details']['totals']['grand_total'] ?? 0), 'currency' => $d['currency_code'] ?? 'USD', 'provider_updated_at' => $at, 'created_at' => now(), 'updated_at' => now()]);
|
|
$licenses->issue($user->id, $id);
|
|
if (! empty($d['subscription_id'])) {
|
|
$state = DB::table('subscription_states')->where('id', $d['subscription_id'])->first();
|
|
if ($state && ! in_array($state->status, ['active', 'trialing'])) {
|
|
DB::table('licenses')->where('purchase_id', $id)->update(['status' => 'revoked']);
|
|
}
|
|
}
|
|
$user->notify(new AccountUpdate('Your Tarnax license is ready', 'Your purchase has been confirmed. Your license and downloads are in your account.', url('/account'), 'purchase-confirmed'));
|
|
}
|
|
if ($type === 'adjustment.updated' || $type === 'adjustment.created') {
|
|
if (($d['status'] ?? '') !== 'approved' || ! in_array($d['action'] ?? '', ['refund', 'chargeback', 'chargeback_warning'])) {
|
|
return;
|
|
}
|
|
abort_unless(! empty($d['transaction_id']), 422);
|
|
DB::table('payment_locks')->insertOrIgnore(['id' => $d['transaction_id']]);
|
|
DB::table('payment_locks')->where('id', $d['transaction_id'])->lockForUpdate()->first();
|
|
DB::table('refund_blocks')->updateOrInsert(['transaction_id' => $d['transaction_id']], ['occurred_at' => $at]);
|
|
$purchase = DB::table('purchases')->where('transaction_id', $d['transaction_id'])->lockForUpdate()->first();
|
|
if ($purchase) {
|
|
DB::table('purchases')->where('id', $purchase->id)->update(['status' => 'refunded', 'provider_updated_at' => $at, 'updated_at' => now()]);
|
|
DB::table('licenses')->where('purchase_id', $purchase->id)->update(['status' => 'revoked', 'updated_at' => now()]);
|
|
}
|
|
}
|
|
if (str_starts_with($type, 'subscription.') && ! empty($d['id']) && in_array($d['status'] ?? '', ['active', 'trialing', 'canceled', 'paused', 'past_due'])) {
|
|
DB::table('subscription_states')->insertOrIgnore(['id' => $d['id'], 'status' => $d['status'], 'occurred_at' => $at]);
|
|
$state = DB::table('subscription_states')->where('id', $d['id'])->lockForUpdate()->first();
|
|
if (Carbon::parse($state->occurred_at)->gt($at)) {
|
|
return;
|
|
}
|
|
DB::table('subscription_states')->where('id', $d['id'])->update(['status' => $d['status'], 'occurred_at' => $at]);
|
|
$purchases = DB::table('purchases')->where('subscription_id', $d['id'])->where('status', '!=', 'refunded')->lockForUpdate()->get();
|
|
foreach ($purchases as $purchase) {
|
|
DB::table('licenses')->where('purchase_id', $purchase->id)->update(['status' => in_array($d['status'], ['active', 'trialing']) ? 'active' : 'revoked', 'updated_at' => now()]);
|
|
DB::table('purchases')->where('id', $purchase->id)->update(['status' => $d['status'], 'provider_updated_at' => $at, 'updated_at' => now()]);
|
|
}
|
|
}
|
|
}, 3);
|
|
|
|
return response()->json(['received' => true]);
|
|
}
|
|
}
|