# ruff: noqa: N803 from datetime import UTC, datetime, timedelta import hashlib import hmac import logging import math from fastapi import Depends, Form, HTTPException from fastapi.routing import APIRouter from sqlalchemy import delete from sqlalchemy.ext.asyncio import AsyncSession from config import cfg from core.deps import get_db from db.models import Subscription, SubscriptionAddon from db.models.orders import OrderStatus from db.models.transactions import BalanceTransaction from db.models.transactions import BalanceTxType from external.pally import BillStatus from repositories.invoices import InvoiceRepository from repositories.orders import OrderRepository from schemas.enums import SubscriptionStatus from schemas.invoices import InvoiceStatus router = APIRouter(prefix="/payments/pally") logger = logging.getLogger(__name__) @router.post("/result") async def pally_callback( # noqa: PLR0911 *, InvId: str = Form(...), OutSum: str = Form(...), Commission: str = Form(...), TrsId: str = Form(...), Status: str = Form(...), CurrencyIn: str = Form(...), custom: str | None = Form(None), SignatureValue: str = Form(...), # Optional fields for additional information AccountType: str | None = Form(None), AccountNumber: str | None = Form(None), BalanceAmount: str | None = Form(None), BalanceCurrency: str | None = Form(None), PayerPhone: str | None = Form(None), PayerEmail: str | None = Form(None), PayerName: str | None = Form(None), PayerComment: str | None = Form(None), ErrorCode: int | None = Form(None), ErrorMessage: str | None = Form(None), session: AsyncSession = Depends(get_db), ): invoice_repo = InvoiceRepository(session) orders_repo = OrderRepository(session) invoice_id_str = InvId logger.info( "Pally webhook received - InvId: %s, OutSum: %s, Commission: %s, TrsId: %s, Status: %s, " "CurrencyIn: %s, custom: %s, BalanceAmount: %s, SignatureValue: %s", InvId, OutSum, Commission, TrsId, Status, CurrencyIn, custom, BalanceAmount, SignatureValue, ) if Status != BillStatus.SUCCESS: logger.warning( "Non-success payment received - Status: %s, ErrorCode: %s, ErrorMessage: %s, TrsId: %s", Status, ErrorCode, ErrorMessage, TrsId, ) # Validate signature raw_string = f"{OutSum}:{InvId}:{cfg.pally_token}" expected_signature = hashlib.md5(raw_string.encode("utf-8")).hexdigest().upper() logger.debug("Signature validation for TrsId %s", TrsId) if not hmac.compare_digest(SignatureValue, expected_signature): logger.critical( "SECURITY ALERT: Invalid signature for TrsId %s - Expected: %s, Received: %s", TrsId, expected_signature, SignatureValue, ) raise HTTPException(403, detail="Invalid signature.") # Only process successful payments if Status != BillStatus.SUCCESS: logger.info("Bill %s skipped: status=%s", TrsId, Status) return "OK" logger.info("Processing successfully paid bill %s", TrsId) # Validate bill ID (from InvId field, which contains the order_id from bill creation) if not invoice_id_str or not invoice_id_str.isdigit(): logger.critical( "Invalid or non-numeric bill ID in InvId field for TrsId %s: '%s'", TrsId, invoice_id_str, ) return "OK" # Find bill in database invoice = await invoice_repo.get_by_id(int(invoice_id_str)) if not invoice: logger.critical("Bill %s not found in database for TrsId %s", invoice_id_str, TrsId) return "OK" # Check if already processed if invoice.status != InvoiceStatus.ACTIVE: logger.warning( "Bill %s (TrsId: %s) is already processed with status: %s", invoice.id, TrsId, invoice.status, ) return "OK" try: # Handle fee scenarios: use BalanceAmount if available (net amount after fees), # otherwise use OutSum (gross amount paid by customer) if BalanceAmount is not None: # Customer pays fees - BalanceAmount is the net amount credited to merchant credited_amount = int(float(BalanceAmount)) gross_amount = int(float(OutSum)) logger.info( "Customer-pays-fees payment: bill_id=%s, expected=%s, gross_paid=%s, net_credited=%s", invoice.id, invoice.amount, gross_amount, credited_amount, ) # Validate that the net credited amount matches our bill amount if invoice.amount != credited_amount: logger.error( "Net amount mismatch for bill %s (TrsId: %s) - Expected: %s, Net credited: %s, Gross paid: %s", invoice.id, TrsId, invoice.amount, credited_amount, gross_amount, ) return "OK" amount = credited_amount # Credit the net amount (without fees) else: # Standard payment - OutSum should match bill amount exactly amount = int(float(OutSum)) logger.info( "Standard payment: bill_id=%s, expected=%s, received=%s", invoice.id, invoice.amount, amount, ) if invoice.amount != amount: logger.error( "Amount mismatch for bill %s (TrsId: %s) - Expected: %s, Received: %s", invoice.id, TrsId, invoice.amount, amount, ) return "OK" active_orders = await orders_repo.get_active_by_user_id(invoice.creator_id) if not active_orders: logger.critical( "Active order not found for bill %s (TrsId: %s, user_id=%s)", invoice.id, TrsId, invoice.creator_id, ) return "OK" order = active_orders[0] user = invoice.creator subscription = user.subscription now = datetime.now(UTC) logger.info( "Processing payment: bill_id=%s, order_id=%s, user_id=%s, amount=%s", invoice.id, order.id, invoice.creator_id, amount, ) order.status = OrderStatus.PAID invoice.status = InvoiceStatus.PAID if subscription is None: subscription = Subscription( user_id=invoice.creator_id, devices=order.devices, status=SubscriptionStatus.ACTIVE, expires_at=now + timedelta(days=order.duration_days), ) session.add(subscription) await session.flush() else: logger.warning( "Subscription already exists for user_id=%s, updating existing subscription %s", invoice.creator_id, subscription.id, ) subscription.devices = order.devices subscription.status = SubscriptionStatus.ACTIVE subscription.expires_at = max(subscription.expires_at, now) + timedelta( days=order.duration_days ) await session.execute( delete(SubscriptionAddon).where(SubscriptionAddon.subscription_id == subscription.id) ) for addon in order.addons: session.add(SubscriptionAddon(subscription_id=subscription.id, addon_id=addon.addon_id)) # Process referral bonus referal_id = user.referal_id if referal_id is not None: referal_amount = math.floor(amount * (cfg.referal_bonus / 100)) if referal_amount > 0: referal_user = await session.get(type(user), referal_id) if referal_user is not None: session.add( BalanceTransaction( user_id=referal_id, amount=referal_amount, tx_type=BalanceTxType.REFERRAL_BONUS, balance_before=referal_user.balance, balance_after=referal_user.balance + referal_amount, description=f"referral reward for user {invoice.creator_id} (TrsId: {TrsId})", ) ) referal_user.balance += referal_amount logger.info( "Referral bonus processed: referrer_id=%s, amount=%s", referal_id, referal_amount, ) else: logger.warning( "Referrer %s not found for user_id=%s while processing TrsId %s", referal_id, invoice.creator_id, TrsId, ) await session.commit() logger.info("Payment processing completed successfully for TrsId %s", TrsId) except Exception as e: await session.rollback() logger.exception( "CRITICAL ERROR processing payment for TrsId %s, bill_id %s, user_id %s: %s", TrsId, invoice.id, invoice.creator_id, str(e), ) raise HTTPException(500, detail="Payment processing failed.") from e logger.info("Bill %s marked as PAID for TrsId %s", invoice.id, TrsId) return "OK"