puffin-app/server/routes/checkout.js
Matt bc9e2d3782
All checks were successful
Build and Push Docker Images / docker (push) Successful in 1m22s
Implement comprehensive Stripe security fixes and production deployment
CRITICAL SECURITY FIXES:
- Add webhook secret validation to prevent signature bypass
- Implement idempotency protection across all webhook handlers
- Add atomic database updates to prevent race conditions
- Improve CORS security with origin validation and logging
- Remove .env from git tracking to protect secrets

STRIPE INTEGRATION:
- Add support for checkout.session.expired webhook event
- Add Stripe publishable key to environment configuration
- Fix webhook handlers with proper idempotency checks
- Update Order model with atomic updatePaymentAndStatus method
- Add comprehensive logging for webhook processing

DEPLOYMENT ARCHITECTURE:
- Split into two Docker images (frontend-latest, backend-latest)
- Update CI/CD to build separate frontend and backend images
- Configure backend on port 3801 (internal 3001)
- Add production-ready docker-compose.yml
- Remove redundant docker-compose.portainer.yml
- Update nginx configuration for both frontend and backend

DOCUMENTATION:
- Add PRODUCTION-SETUP.md with complete deployment guide
- Add docs/stripe-security-fixes.md with security audit details
- Add docs/stripe-checkout-sessions.md with integration docs
- Add docs/stripe-webhooks.md with webhook configuration
- Update .env.example with all required variables including Stripe publishable key

CONFIGURATION:
- Consolidate to single .env.example template
- Update .gitignore to protect all .env variants
- Add server/Dockerfile for backend container
- Update DEPLOYMENT.md with new architecture

🔒 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-30 12:18:57 +01:00

178 lines
4.9 KiB
JavaScript

import express from 'express';
import { stripe } from '../config/stripe.js';
import { Order } from '../models/Order.js';
const router = express.Router();
// Portfolio pricing configuration (price per ton in USD)
const PORTFOLIO_PRICING = {
1: 15, // Balanced portfolio
2: 18, // High-impact portfolio
3: 20 // Premium portfolio
};
// Processing fee percentage
const PROCESSING_FEE_PERCENT = 0.03; // 3%
/**
* Calculate pricing with processing fee
* @param {number} tons - Number of tons
* @param {number} portfolioId - Portfolio ID
* @returns {Object} Pricing breakdown
*/
function calculatePricing(tons, portfolioId) {
const pricePerTon = PORTFOLIO_PRICING[portfolioId] || 18; // Default to $18/ton
const baseAmount = Math.round(tons * pricePerTon * 100); // Convert to cents
const processingFee = Math.round(baseAmount * PROCESSING_FEE_PERCENT);
const totalAmount = baseAmount + processingFee;
return {
baseAmount,
processingFee,
totalAmount,
pricePerTon
};
}
/**
* POST /api/checkout/create-session
* Create a Stripe Checkout Session
*/
router.post('/create-session', async (req, res) => {
try {
const { tons, portfolioId, customerEmail } = req.body;
// Validation
if (!tons || tons <= 0) {
return res.status(400).json({ error: 'Invalid tons value' });
}
if (!portfolioId || ![1, 2, 3].includes(portfolioId)) {
return res.status(400).json({ error: 'Invalid portfolio ID' });
}
// Calculate pricing
const { baseAmount, processingFee, totalAmount, pricePerTon } = calculatePricing(tons, portfolioId);
// Create line items for Stripe
const lineItems = [
{
price_data: {
currency: 'usd',
product_data: {
name: `Carbon Offset - ${tons} tons`,
description: `Portfolio ${portfolioId} at $${pricePerTon}/ton`,
// images: ['https://puffinoffset.com/images/carbon-offset.png'], // Optional: Add your logo when available
},
unit_amount: baseAmount, // Base amount in cents
},
quantity: 1,
},
{
price_data: {
currency: 'usd',
product_data: {
name: 'Processing Fee (3%)',
description: 'Transaction processing fee',
},
unit_amount: processingFee, // Processing fee in cents
},
quantity: 1,
},
];
// Create Stripe Checkout Session
const session = await stripe.checkout.sessions.create({
payment_method_types: ['card'],
line_items: lineItems,
mode: 'payment',
success_url: `${process.env.FRONTEND_URL}/checkout/success?session_id={CHECKOUT_SESSION_ID}`,
cancel_url: `${process.env.FRONTEND_URL}/checkout/cancel`,
customer_email: customerEmail,
metadata: {
tons: tons.toString(),
portfolioId: portfolioId.toString(),
baseAmount: baseAmount.toString(),
processingFee: processingFee.toString(),
},
});
// Store order in database
const order = Order.create({
stripeSessionId: session.id,
customerEmail: customerEmail || null,
tons,
portfolioId,
baseAmount,
processingFee,
totalAmount,
currency: 'USD',
});
console.log(`✅ Created checkout session: ${session.id}`);
console.log(` Order ID: ${order.id}`);
console.log(` Amount: $${(totalAmount / 100).toFixed(2)} (${tons} tons @ $${pricePerTon}/ton + 3% fee)`);
res.json({
sessionId: session.id,
url: session.url,
orderId: order.id,
});
} catch (error) {
console.error('❌ Checkout session creation error:', error);
res.status(500).json({
error: 'Failed to create checkout session',
message: error.message,
});
}
});
/**
* GET /api/checkout/session/:sessionId
* Retrieve checkout session details
*/
router.get('/session/:sessionId', async (req, res) => {
try {
const { sessionId } = req.params;
// Get order from database
const order = Order.findBySessionId(sessionId);
if (!order) {
return res.status(404).json({ error: 'Order not found' });
}
// Get Stripe session (optional - for additional details)
const session = await stripe.checkout.sessions.retrieve(sessionId);
res.json({
order: {
id: order.id,
tons: order.tons,
portfolioId: order.portfolio_id,
baseAmount: order.base_amount,
processingFee: order.processing_fee,
totalAmount: order.total_amount,
currency: order.currency,
status: order.status,
wrenOrderId: order.wren_order_id,
createdAt: order.created_at,
},
session: {
paymentStatus: session.payment_status,
customerEmail: session.customer_details?.email,
},
});
} catch (error) {
console.error('❌ Session retrieval error:', error);
res.status(500).json({
error: 'Failed to retrieve session',
message: error.message,
});
}
});
export default router;