283 lines
9.6 KiB
Python
283 lines
9.6 KiB
Python
# ruff: noqa: N803
|
|
from datetime import UTC, datetime, timedelta
|
|
import hashlib
|
|
import hmac
|
|
import logging
|
|
import math
|
|
|
|
from fastapi import Depends, Form, HTTPException
|
|
from fastapi.routing import APIRouter
|
|
from sqlalchemy import delete
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from config import cfg
|
|
from core.deps import get_db
|
|
from db.models import Subscription, SubscriptionAddon
|
|
from db.models.orders import OrderStatus
|
|
from db.models.transactions import BalanceTransaction
|
|
from db.models.transactions import BalanceTxType
|
|
from external.pally import BillStatus
|
|
from repositories.invoices import InvoiceRepository
|
|
from repositories.orders import OrderRepository
|
|
from schemas.enums import SubscriptionStatus
|
|
from schemas.invoices import InvoiceStatus
|
|
|
|
router = APIRouter(prefix="/payments/pally")
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
@router.post("/result")
|
|
async def pally_callback( # noqa: PLR0911
|
|
*,
|
|
InvId: str = Form(...),
|
|
OutSum: str = Form(...),
|
|
Commission: str = Form(...),
|
|
TrsId: str = Form(...),
|
|
Status: str = Form(...),
|
|
CurrencyIn: str = Form(...),
|
|
custom: str | None = Form(None),
|
|
SignatureValue: str = Form(...),
|
|
# Optional fields for additional information
|
|
AccountType: str | None = Form(None),
|
|
AccountNumber: str | None = Form(None),
|
|
BalanceAmount: str | None = Form(None),
|
|
BalanceCurrency: str | None = Form(None),
|
|
PayerPhone: str | None = Form(None),
|
|
PayerEmail: str | None = Form(None),
|
|
PayerName: str | None = Form(None),
|
|
PayerComment: str | None = Form(None),
|
|
ErrorCode: int | None = Form(None),
|
|
ErrorMessage: str | None = Form(None),
|
|
session: AsyncSession = Depends(get_db),
|
|
):
|
|
invoice_repo = InvoiceRepository(session)
|
|
orders_repo = OrderRepository(session)
|
|
invoice_id_str = InvId
|
|
|
|
logger.info(
|
|
"Pally webhook received - InvId: %s, OutSum: %s, Commission: %s, TrsId: %s, Status: %s, "
|
|
"CurrencyIn: %s, custom: %s, BalanceAmount: %s, SignatureValue: %s",
|
|
InvId,
|
|
OutSum,
|
|
Commission,
|
|
TrsId,
|
|
Status,
|
|
CurrencyIn,
|
|
custom,
|
|
BalanceAmount,
|
|
SignatureValue,
|
|
)
|
|
|
|
if Status != BillStatus.SUCCESS:
|
|
logger.warning(
|
|
"Non-success payment received - Status: %s, ErrorCode: %s, ErrorMessage: %s, TrsId: %s",
|
|
Status,
|
|
ErrorCode,
|
|
ErrorMessage,
|
|
TrsId,
|
|
)
|
|
|
|
# Validate signature
|
|
raw_string = f"{OutSum}:{InvId}:{cfg.pally_token}"
|
|
expected_signature = hashlib.md5(raw_string.encode("utf-8")).hexdigest().upper()
|
|
|
|
logger.debug("Signature validation for TrsId %s", TrsId)
|
|
|
|
if not hmac.compare_digest(SignatureValue, expected_signature):
|
|
logger.critical(
|
|
"SECURITY ALERT: Invalid signature for TrsId %s - Expected: %s, Received: %s",
|
|
TrsId,
|
|
expected_signature,
|
|
SignatureValue,
|
|
)
|
|
raise HTTPException(403, detail="Invalid signature.")
|
|
|
|
# Only process successful payments
|
|
if Status != BillStatus.SUCCESS:
|
|
logger.info("Bill %s skipped: status=%s", TrsId, Status)
|
|
return "OK"
|
|
|
|
logger.info("Processing successfully paid bill %s", TrsId)
|
|
|
|
# Validate bill ID (from InvId field, which contains the order_id from bill creation)
|
|
if not invoice_id_str or not invoice_id_str.isdigit():
|
|
logger.critical(
|
|
"Invalid or non-numeric bill ID in InvId field for TrsId %s: '%s'",
|
|
TrsId,
|
|
invoice_id_str,
|
|
)
|
|
return "OK"
|
|
|
|
# Find bill in database
|
|
invoice = await invoice_repo.get_by_id(int(invoice_id_str))
|
|
|
|
if not invoice:
|
|
logger.critical("Bill %s not found in database for TrsId %s", invoice_id_str, TrsId)
|
|
return "OK"
|
|
|
|
# Check if already processed
|
|
if invoice.status != InvoiceStatus.ACTIVE:
|
|
logger.warning(
|
|
"Bill %s (TrsId: %s) is already processed with status: %s",
|
|
invoice.id,
|
|
TrsId,
|
|
invoice.status,
|
|
)
|
|
return "OK"
|
|
|
|
try:
|
|
# Handle fee scenarios: use BalanceAmount if available (net amount after fees),
|
|
# otherwise use OutSum (gross amount paid by customer)
|
|
if BalanceAmount is not None:
|
|
# Customer pays fees - BalanceAmount is the net amount credited to merchant
|
|
credited_amount = int(float(BalanceAmount))
|
|
gross_amount = int(float(OutSum))
|
|
|
|
logger.info(
|
|
"Customer-pays-fees payment: bill_id=%s, expected=%s, gross_paid=%s, net_credited=%s",
|
|
invoice.id,
|
|
invoice.amount,
|
|
gross_amount,
|
|
credited_amount,
|
|
)
|
|
|
|
# Validate that the net credited amount matches our bill amount
|
|
if invoice.amount != credited_amount:
|
|
logger.error(
|
|
"Net amount mismatch for bill %s (TrsId: %s) - Expected: %s, Net credited: %s, Gross paid: %s",
|
|
invoice.id,
|
|
TrsId,
|
|
invoice.amount,
|
|
credited_amount,
|
|
gross_amount,
|
|
)
|
|
return "OK"
|
|
|
|
amount = credited_amount # Credit the net amount (without fees)
|
|
|
|
else:
|
|
# Standard payment - OutSum should match bill amount exactly
|
|
amount = int(float(OutSum))
|
|
|
|
logger.info(
|
|
"Standard payment: bill_id=%s, expected=%s, received=%s",
|
|
invoice.id,
|
|
invoice.amount,
|
|
amount,
|
|
)
|
|
|
|
if invoice.amount != amount:
|
|
logger.error(
|
|
"Amount mismatch for bill %s (TrsId: %s) - Expected: %s, Received: %s",
|
|
invoice.id,
|
|
TrsId,
|
|
invoice.amount,
|
|
amount,
|
|
)
|
|
return "OK"
|
|
|
|
active_orders = await orders_repo.get_active_by_user_id(invoice.creator_id)
|
|
if not active_orders:
|
|
logger.critical(
|
|
"Active order not found for bill %s (TrsId: %s, user_id=%s)",
|
|
invoice.id,
|
|
TrsId,
|
|
invoice.creator_id,
|
|
)
|
|
return "OK"
|
|
|
|
order = active_orders[0]
|
|
user = invoice.creator
|
|
subscription = user.subscription
|
|
now = datetime.now(UTC)
|
|
|
|
logger.info(
|
|
"Processing payment: bill_id=%s, order_id=%s, user_id=%s, amount=%s",
|
|
invoice.id,
|
|
order.id,
|
|
invoice.creator_id,
|
|
amount,
|
|
)
|
|
|
|
order.status = OrderStatus.PAID
|
|
invoice.status = InvoiceStatus.PAID
|
|
|
|
if subscription is None:
|
|
subscription = Subscription(
|
|
user_id=invoice.creator_id,
|
|
devices=order.devices,
|
|
status=SubscriptionStatus.ACTIVE,
|
|
expires_at=now + timedelta(days=order.duration_days),
|
|
)
|
|
session.add(subscription)
|
|
await session.flush()
|
|
else:
|
|
logger.warning(
|
|
"Subscription already exists for user_id=%s, updating existing subscription %s",
|
|
invoice.creator_id,
|
|
subscription.id,
|
|
)
|
|
subscription.devices = order.devices
|
|
subscription.status = SubscriptionStatus.ACTIVE
|
|
subscription.expires_at = max(subscription.expires_at, now) + timedelta(
|
|
days=order.duration_days
|
|
)
|
|
await session.execute(
|
|
delete(SubscriptionAddon).where(SubscriptionAddon.subscription_id == subscription.id)
|
|
)
|
|
|
|
for addon in order.addons:
|
|
session.add(SubscriptionAddon(subscription_id=subscription.id, addon_id=addon.addon_id))
|
|
|
|
# Process referral bonus
|
|
referal_id = user.referal_id
|
|
if referal_id is not None:
|
|
referal_amount = math.floor(amount * (cfg.referal_bonus / 100))
|
|
if referal_amount > 0:
|
|
referal_user = await session.get(type(user), referal_id)
|
|
if referal_user is not None:
|
|
session.add(
|
|
BalanceTransaction(
|
|
user_id=referal_id,
|
|
amount=referal_amount,
|
|
tx_type=BalanceTxType.REFERRAL_BONUS,
|
|
balance_before=referal_user.balance,
|
|
balance_after=referal_user.balance + referal_amount,
|
|
description=f"referral reward for user {invoice.creator_id} (TrsId: {TrsId})",
|
|
)
|
|
)
|
|
referal_user.balance += referal_amount
|
|
|
|
logger.info(
|
|
"Referral bonus processed: referrer_id=%s, amount=%s",
|
|
referal_id,
|
|
referal_amount,
|
|
)
|
|
else:
|
|
logger.warning(
|
|
"Referrer %s not found for user_id=%s while processing TrsId %s",
|
|
referal_id,
|
|
invoice.creator_id,
|
|
TrsId,
|
|
)
|
|
|
|
await session.commit()
|
|
|
|
logger.info("Payment processing completed successfully for TrsId %s", TrsId)
|
|
|
|
except Exception as e:
|
|
await session.rollback()
|
|
logger.exception(
|
|
"CRITICAL ERROR processing payment for TrsId %s, bill_id %s, user_id %s: %s",
|
|
TrsId,
|
|
invoice.id,
|
|
invoice.creator_id,
|
|
str(e),
|
|
)
|
|
raise HTTPException(500, detail="Payment processing failed.") from e
|
|
|
|
logger.info("Bill %s marked as PAID for TrsId %s", invoice.id, TrsId)
|
|
|
|
return "OK"
|