feat(payments): Anbieter-Gerüst core/payments mit PayPal Orders v2
- ProviderInterface/AbstractProvider: Vorgang mit Uhrzeit+Session (payment_transactions), Mail und Warenkorb erst nach Zahlung, idempotentes markPaid, Betragsabgleich, shop_event + PG payment_log - Secrets verschluesselt (libsodium) in MySQL, Schluessel ausserhalb Docroot - Cashdesk: ?payment_return/?payment_cancel, Pending-Riegel, zahlung_erst_spaeter() - Backend Zahlart-Editor: Einstellungen speichern (war ohne Empfaenger), Secret-Felder - payment_webhook.php (Standalone), cli.php (init-key, secret, reconcile, status) - PayPal-v2-Blaupause vom Juli entfernt
This commit is contained in:
Thomas Bartelt
@@ -0,0 +1,429 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace Payments;
|
||||
|
||||
/**
|
||||
* Gemeinsamer Unterbau aller Anbieter mit Weiterleitung.
|
||||
*
|
||||
* Hier liegt alles, was 2026 am v1-PayPal muehsam nachgeruestet wurde und fuer
|
||||
* jeden weiteren Anbieter genauso gelten muss:
|
||||
* - Vorgang in payment_transactions mit echter Uhrzeit, Session und Sollbetrag
|
||||
* - Bestellbestaetigung ERST nach eingezogener Zahlung
|
||||
* - Warenkorb ERST nach eingezogener Zahlung leeren (ueber die Session von damals)
|
||||
* - idempotentes "bezahlt": zweite Rueckkehr, Webhook-Race, Abgleicher -- egal wer
|
||||
* zuerst kommt, es passiert genau einmal
|
||||
* - Betragsabgleich gegen den Sollbetrag (Manipulationsschutz)
|
||||
* - Ereignisse fuer den Funnel (shop_event) und Rohprotokoll (Payments\Log)
|
||||
*
|
||||
* Einstellungen kommen aus der Konfigurationsgruppe = module() (Tabelle configuration,
|
||||
* pflegbar im Zahlart-Editor), Zugangsdaten aus Payments\Secrets.
|
||||
*/
|
||||
abstract class AbstractProvider implements ProviderInterface
|
||||
{
|
||||
protected object $base;
|
||||
protected \mysqli $db;
|
||||
|
||||
/** @var array<string,string>|null */
|
||||
private ?array $settings = null;
|
||||
|
||||
public function __construct(object $base)
|
||||
{
|
||||
$this->base = $base;
|
||||
$this->db = $base->db;
|
||||
}
|
||||
|
||||
public function paysAfterRedirect(): bool
|
||||
{
|
||||
return true;
|
||||
}
|
||||
|
||||
// ------------------------------------------------------------ Einstellungen
|
||||
|
||||
/** Wert aus der Konfigurationsgruppe des Anbieters (configuration.group_id = module()). */
|
||||
protected function setting(string $name, string $default = ''): string
|
||||
{
|
||||
if ($this->settings === null) {
|
||||
$this->settings = [];
|
||||
$g = $this->db->real_escape_string($this->module());
|
||||
$res = $this->db->query("SELECT name, setting FROM configuration WHERE group_id='$g'");
|
||||
while ($res && ($row = $res->fetch_assoc())) {
|
||||
$this->settings[(string) $row['name']] = (string) $row['setting'];
|
||||
}
|
||||
}
|
||||
$full = $this->module() . '_' . $name;
|
||||
$v = $this->settings[$full] ?? $this->settings[$name] ?? '';
|
||||
return $v !== '' ? $v : $default;
|
||||
}
|
||||
|
||||
protected function secret(string $name): string
|
||||
{
|
||||
$v = Secrets::get($this->db, $this->module(), $name);
|
||||
if ($v === null || $v === '') {
|
||||
throw new \RuntimeException($this->label() . ': Zugangsdatum "' . $name . '" ist nicht hinterlegt (Backend > Zahlungsarten).');
|
||||
}
|
||||
return $v;
|
||||
}
|
||||
|
||||
protected function shopBaseUrl(): string
|
||||
{
|
||||
if (\defined('MAIN_URL') && MAIN_URL !== '') {
|
||||
return \rtrim((string) MAIN_URL, '/');
|
||||
}
|
||||
return 'https://' . ($_SERVER['SERVER_NAME'] ?? 'localhost');
|
||||
}
|
||||
|
||||
/** Rueckkehr-URLs laufen durch den Cashdesk (Session vorhanden). */
|
||||
protected function returnUrl(): string
|
||||
{
|
||||
return $this->shopBaseUrl() . '/Kasse/?payment_return=' . $this->module();
|
||||
}
|
||||
|
||||
protected function cancelUrl(): string
|
||||
{
|
||||
return $this->shopBaseUrl() . '/Kasse/?payment_cancel=' . $this->module();
|
||||
}
|
||||
|
||||
/** Webhook laeuft OHNE Session ueber den Standalone-Endpunkt. */
|
||||
protected function webhookUrl(): string
|
||||
{
|
||||
return $this->shopBaseUrl() . '/payment_webhook.php?p=' . $this->module();
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------- Vorgang
|
||||
|
||||
/**
|
||||
* Legt den Vorgang an: Referenz beim Anbieter, Sollbetrag, Session, Approve-URL.
|
||||
* Schreibt zusaetzlich orders.paypal_token (Backend zeigt das Feld bereits an).
|
||||
*/
|
||||
protected function openTransaction(int $orderId, string $reference, float $amount, string $approveUrl, ?array $raw = null): void
|
||||
{
|
||||
$order = $this->orderById($orderId);
|
||||
$stmt = $this->db->prepare(
|
||||
'INSERT INTO payment_transactions
|
||||
(provider, order_id, order_number, reference, expected_amount, currency, status,
|
||||
approve_url, session_id, customer_id, created_at, updated_at)
|
||||
VALUES (?,?,?,?,?,?,?,?,?,?,NOW(),NOW())
|
||||
ON DUPLICATE KEY UPDATE reference=VALUES(reference), expected_amount=VALUES(expected_amount),
|
||||
status=VALUES(status), approve_url=VALUES(approve_url), session_id=VALUES(session_id), updated_at=NOW()'
|
||||
);
|
||||
if (!$stmt) {
|
||||
throw new \RuntimeException('payment_transactions: ' . $this->db->error);
|
||||
}
|
||||
$module = $this->module();
|
||||
$number = (string) ($order->order_number ?? '');
|
||||
$currency = $this->currency();
|
||||
$status = 'open';
|
||||
$sid = \function_exists('session_id') ? (string) \session_id() : '';
|
||||
$cid = (int) ($order->customer_id ?? 0);
|
||||
$stmt->bind_param('sissdssssi', $module, $orderId, $number, $reference, $amount, $currency, $status, $approveUrl, $sid, $cid);
|
||||
$stmt->execute();
|
||||
$stmt->close();
|
||||
|
||||
$ref = $this->db->real_escape_string($reference);
|
||||
$this->db->query("UPDATE orders SET paypal_token='$ref' WHERE id=$orderId");
|
||||
|
||||
$this->pendingSet($orderId, $reference, $amount, $approveUrl);
|
||||
$this->event('payment_started', $orderId, $number, $amount, $reference, null, $cid);
|
||||
Log::write($module, 'start', $orderId, $number, $reference, 'open', null, $raw);
|
||||
}
|
||||
|
||||
protected function transactionByReference(string $reference): ?object
|
||||
{
|
||||
$stmt = $this->db->prepare('SELECT * FROM payment_transactions WHERE provider=? AND reference=? LIMIT 1');
|
||||
if (!$stmt) {
|
||||
return null;
|
||||
}
|
||||
$m = $this->module();
|
||||
$stmt->bind_param('ss', $m, $reference);
|
||||
$stmt->execute();
|
||||
$row = $stmt->get_result()->fetch_object();
|
||||
$stmt->close();
|
||||
return $row ?: null;
|
||||
}
|
||||
|
||||
protected function transactionByOrder(int $orderId): ?object
|
||||
{
|
||||
$stmt = $this->db->prepare('SELECT * FROM payment_transactions WHERE provider=? AND order_id=? ORDER BY id DESC LIMIT 1');
|
||||
if (!$stmt) {
|
||||
return null;
|
||||
}
|
||||
$m = $this->module();
|
||||
$stmt->bind_param('si', $m, $orderId);
|
||||
$stmt->execute();
|
||||
$row = $stmt->get_result()->fetch_object();
|
||||
$stmt->close();
|
||||
return $row ?: null;
|
||||
}
|
||||
|
||||
/** Offene Vorgaenge fuer den Abgleicher. @return list<object> */
|
||||
protected function openTransactions(int $olderThanMinutes, int $maxAgeHours): array
|
||||
{
|
||||
$stmt = $this->db->prepare(
|
||||
'SELECT * FROM payment_transactions
|
||||
WHERE provider=? AND status IN ("open","pending")
|
||||
AND created_at < DATE_SUB(NOW(), INTERVAL ? MINUTE)
|
||||
AND created_at > DATE_SUB(NOW(), INTERVAL ? HOUR)
|
||||
ORDER BY id'
|
||||
);
|
||||
if (!$stmt) {
|
||||
return [];
|
||||
}
|
||||
$m = $this->module();
|
||||
$stmt->bind_param('sii', $m, $olderThanMinutes, $maxAgeHours);
|
||||
$stmt->execute();
|
||||
$rows = $stmt->get_result()->fetch_all(MYSQLI_ASSOC);
|
||||
$stmt->close();
|
||||
return \array_map(static fn($r) => (object) $r, $rows);
|
||||
}
|
||||
|
||||
protected function setTransactionStatus(string $reference, string $status, ?string $detail = null): void
|
||||
{
|
||||
$stmt = $this->db->prepare('UPDATE payment_transactions SET status=?, detail=?, updated_at=NOW() WHERE provider=? AND reference=?');
|
||||
if ($stmt) {
|
||||
$m = $this->module();
|
||||
$stmt->bind_param('ssss', $status, $detail, $m, $reference);
|
||||
$stmt->execute();
|
||||
$stmt->close();
|
||||
}
|
||||
}
|
||||
|
||||
// ------------------------------------------------------------- bezahlt
|
||||
|
||||
/**
|
||||
* Setzt die Bestellung genau einmal auf bezahlt, gleicht vorher den Betrag ab.
|
||||
* Rueckgabe true, wenn die Bestellung jetzt (oder schon vorher) bezahlt ist.
|
||||
*
|
||||
* Atomar ueber payment_transactions.status: nur wer den Wechsel open/pending -> paid
|
||||
* schafft, loest Mail und Warenkorb aus. Zweite Rueckkehr, Webhook und Abgleicher
|
||||
* laufen dann ins Leere statt in Doppelmails.
|
||||
*/
|
||||
protected function markPaid(string $reference, string $paidAmount, string $paidCurrency, string $captureId, string $payerEmail = '', string $payerId = '', string $source = 'return'): bool
|
||||
{
|
||||
$tx = $this->transactionByReference($reference);
|
||||
if (!$tx) {
|
||||
\error_log($this->label() . ': markPaid ohne Vorgang (' . $reference . ')');
|
||||
return false;
|
||||
}
|
||||
$orderId = (int) $tx->order_id;
|
||||
|
||||
if ($tx->status === 'paid') {
|
||||
return true;
|
||||
}
|
||||
|
||||
if (!$this->amountMatches((string) $tx->expected_amount, $paidAmount, (string) $tx->currency, $paidCurrency)) {
|
||||
$msg = "Betrag weicht ab: erwartet {$tx->expected_amount} {$tx->currency}, gezahlt $paidAmount $paidCurrency";
|
||||
\error_log($this->label() . " BETRAGS-MISMATCH Order $orderId ($reference): $msg");
|
||||
$this->setTransactionStatus($reference, 'mismatch', $msg);
|
||||
$this->event('failed', $orderId, (string) $tx->order_number, (float) $paidAmount, $reference, $captureId, (int) $tx->customer_id, $msg);
|
||||
Log::write($this->module(), 'mismatch', $orderId, (string) $tx->order_number, $reference, 'mismatch', null, null, $msg);
|
||||
return false;
|
||||
}
|
||||
|
||||
// Der eine Schreiber gewinnt.
|
||||
$stmt = $this->db->prepare(
|
||||
'UPDATE payment_transactions SET status="paid", capture_id=?, paid_amount=?, paid_at=NOW(), updated_at=NOW(), detail=?
|
||||
WHERE provider=? AND reference=? AND status IN ("open","pending")'
|
||||
);
|
||||
if (!$stmt) {
|
||||
return false;
|
||||
}
|
||||
$m = $this->module();
|
||||
$amt = (float) $paidAmount;
|
||||
$stmt->bind_param('sdsss', $captureId, $amt, $source, $m, $reference);
|
||||
$stmt->execute();
|
||||
$won = $stmt->affected_rows === 1;
|
||||
$stmt->close();
|
||||
if (!$won) {
|
||||
return $this->transactionByReference($reference)?->status === 'paid';
|
||||
}
|
||||
|
||||
$cap = $this->db->real_escape_string($captureId);
|
||||
$eml = $this->db->real_escape_string($payerEmail);
|
||||
$pid = $this->db->real_escape_string($payerId);
|
||||
$this->db->query(
|
||||
"UPDATE orders SET payment_status=2, payment_date=CURDATE(), paypal_transaction_id='$cap'"
|
||||
. ($payerEmail !== '' ? ", paypal_email='$eml'" : '')
|
||||
. ($payerId !== '' ? ", paypal_payerid='$pid'" : '')
|
||||
. " WHERE id=$orderId"
|
||||
);
|
||||
|
||||
$this->clearCart((string) $tx->session_id);
|
||||
$this->sendOrderConfirmation($orderId, (int) $tx->customer_id);
|
||||
$this->pendingClear();
|
||||
$this->event('paid', $orderId, (string) $tx->order_number, (float) $paidAmount, $reference, $captureId, (int) $tx->customer_id, 'via ' . $source);
|
||||
return true;
|
||||
}
|
||||
|
||||
/** Kunde hat abgebrochen oder der Anbieter hat den Vorgang verworfen. */
|
||||
protected function markCancelled(string $reference, string $why, string $source = 'cancel'): void
|
||||
{
|
||||
$tx = $this->transactionByReference($reference);
|
||||
if (!$tx || $tx->status === 'paid') {
|
||||
return;
|
||||
}
|
||||
$this->setTransactionStatus($reference, 'cancelled', $why);
|
||||
$orderId = (int) $tx->order_id;
|
||||
// 6 = storniert (wie v1-PayPal im Cancel-Zweig)
|
||||
$this->db->query("UPDATE orders SET order_status=6 WHERE id=$orderId AND payment_status<>2");
|
||||
$this->pendingClear();
|
||||
$this->event('cancelled', $orderId, (string) $tx->order_number, (float) $tx->expected_amount, $reference, null, (int) $tx->customer_id, $why . ' (' . $source . ')');
|
||||
Log::write($this->module(), 'cancel', $orderId, (string) $tx->order_number, $reference, 'cancelled', null, null, $why);
|
||||
}
|
||||
|
||||
protected function amountMatches(string $expected, string $paid, string $expCur, string $paidCur): bool
|
||||
{
|
||||
return \number_format((float) $expected, 2, '.', '') === \number_format((float) $paid, 2, '.', '')
|
||||
&& \strtoupper($expCur) === \strtoupper($paidCur);
|
||||
}
|
||||
|
||||
protected function currency(): string
|
||||
{
|
||||
return \strtoupper($this->setting('currency', 'EUR'));
|
||||
}
|
||||
|
||||
// --------------------------------------------------------- Shop-Anbindung
|
||||
|
||||
protected function orderById(int $orderId): object
|
||||
{
|
||||
$res = $this->db->query("SELECT * FROM orders WHERE id=$orderId LIMIT 1");
|
||||
$row = $res ? $res->fetch_object() : null;
|
||||
if (!$row) {
|
||||
throw new \RuntimeException('Bestellung ' . $orderId . ' nicht gefunden.');
|
||||
}
|
||||
return $row;
|
||||
}
|
||||
|
||||
/** Lieferadresse der Bestellung fuer den Anbieter (Kaeufer-/Verkaeuferschutz). */
|
||||
protected function shippingAddress(object $order): array
|
||||
{
|
||||
$iso = 'DE';
|
||||
$cid = (int) ($order->shipping_country ?? 0);
|
||||
if ($cid > 0) {
|
||||
$res = $this->db->query("SELECT iso_code_2 FROM countries WHERE id=$cid");
|
||||
$r = $res ? $res->fetch_object() : null;
|
||||
if ($r && \strlen((string) $r->iso_code_2) === 2) {
|
||||
$iso = \strtoupper((string) $r->iso_code_2);
|
||||
}
|
||||
}
|
||||
return [
|
||||
'name' => \trim(((string) ($order->shipping_firstname ?? '')) . ' ' . ((string) ($order->shipping_surname ?? ''))),
|
||||
'company' => (string) ($order->shipping_company ?? ''),
|
||||
'street' => \trim(((string) ($order->shipping_street ?? '')) . ' ' . ((string) ($order->shipping_house_number ?? ''))),
|
||||
'zip' => (string) ($order->shipping_zip_code ?? ''),
|
||||
'city' => (string) ($order->shipping_city ?? ''),
|
||||
'country' => $iso,
|
||||
'email' => (string) ($order->customer_email ?? ''),
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Warenkorb leeren -- ueber die Session von damals UND die aktuelle. Der Kunde kann
|
||||
* mit einer neuen Session zurueckkommen (Safari/iOS), der Webhook hat gar keine.
|
||||
*/
|
||||
protected function clearCart(string $originalSessionId): void
|
||||
{
|
||||
$ids = [];
|
||||
if ($originalSessionId !== '') {
|
||||
$ids[$originalSessionId] = true;
|
||||
}
|
||||
if (\function_exists('session_id') && \session_id() !== '') {
|
||||
$ids[\session_id()] = true;
|
||||
}
|
||||
foreach (\array_keys($ids) as $sid) {
|
||||
$s = $this->db->real_escape_string((string) $sid);
|
||||
$this->db->query("DELETE FROM shopping_cart_items WHERE session_id='$s'");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Bestellbestaetigung ausloesen (Ticket-Event 3). Fehler werden protokolliert und
|
||||
* geschluckt: das Geld ist eingezogen, eine Ausnahme wuerde dem Kunden eine
|
||||
* Fehlerseite fuer eine erfolgreiche Bestellung zeigen.
|
||||
*/
|
||||
protected function sendOrderConfirmation(int $orderId, int $customerId): void
|
||||
{
|
||||
try {
|
||||
if (!\class_exists('Cs_ticket')) {
|
||||
$docroot = \defined('ROOT_DIR') ? \rtrim((string) ROOT_DIR, '/') : \dirname(__DIR__, 2);
|
||||
require_once $docroot . '/core/cs_ticket.class.php';
|
||||
}
|
||||
$ticket = new \Cs_ticket($this->base);
|
||||
$ticket->event(3, $customerId, $orderId);
|
||||
Log::write($this->module(), 'mail', $orderId, null, null, 'sent');
|
||||
} catch (\Throwable $e) {
|
||||
\error_log($this->label() . ': Bestellbestaetigung fuer Order ' . $orderId . ' fehlgeschlagen: ' . $e->getMessage());
|
||||
Log::write($this->module(), 'mail', $orderId, null, null, 'failed', null, null, $e->getMessage());
|
||||
}
|
||||
}
|
||||
|
||||
// ------------------------------------------------------ Session-Riegel
|
||||
|
||||
/** Offener Vorgang in der Session: Riegel gegen zweite Bestellung per Zurueck-Taste. */
|
||||
protected function pendingSet(int $orderId, string $reference, float $amount, string $approveUrl): void
|
||||
{
|
||||
if (\session_status() !== PHP_SESSION_ACTIVE) {
|
||||
return;
|
||||
}
|
||||
$_SESSION['easyshop']['payment_pending'] = [
|
||||
'module' => $this->module(),
|
||||
'reference' => $reference,
|
||||
'order_id' => $orderId,
|
||||
'total' => \round($amount, 2),
|
||||
'approve_url' => $approveUrl,
|
||||
'time' => \time(),
|
||||
];
|
||||
}
|
||||
|
||||
protected function pendingClear(): void
|
||||
{
|
||||
if (\session_status() === PHP_SESSION_ACTIVE) {
|
||||
unset($_SESSION['easyshop']['payment_pending']);
|
||||
}
|
||||
}
|
||||
|
||||
/** Ist die Bestellung des offenen Vorgangs bezahlt? (fuer den Cashdesk-Riegel) */
|
||||
public function isPaid(int $orderId): bool
|
||||
{
|
||||
$res = $this->db->query("SELECT payment_status FROM orders WHERE id=$orderId");
|
||||
$r = $res ? $res->fetch_object() : null;
|
||||
return $r && (string) $r->payment_status === '2';
|
||||
}
|
||||
|
||||
// --------------------------------------------------------------- Events
|
||||
|
||||
protected function event(string $name, ?int $orderId, ?string $orderNumber, ?float $amount, ?string $reference, ?string $transactionId, ?int $customerId, ?string $detail = null): void
|
||||
{
|
||||
if (!\function_exists('shop_event')) {
|
||||
return;
|
||||
}
|
||||
\shop_event($name, [
|
||||
'order_id' => $orderId,
|
||||
'order_number' => $orderNumber,
|
||||
'payment_method' => $this->paymentMethodId(),
|
||||
'betrag' => $amount,
|
||||
'paypal_token' => $reference,
|
||||
'transaction_id' => $transactionId,
|
||||
'customer_id' => $customerId,
|
||||
'detail' => \trim($this->module() . ': ' . (string) $detail),
|
||||
]);
|
||||
}
|
||||
|
||||
private ?int $pmId = null;
|
||||
|
||||
protected function paymentMethodId(): ?int
|
||||
{
|
||||
if ($this->pmId === null) {
|
||||
$m = $this->db->real_escape_string($this->module());
|
||||
$res = $this->db->query("SELECT id FROM payment_methods WHERE module='$m' LIMIT 1");
|
||||
$r = $res ? $res->fetch_object() : null;
|
||||
$this->pmId = $r ? (int) $r->id : 0;
|
||||
}
|
||||
return $this->pmId ?: null;
|
||||
}
|
||||
|
||||
public function secretFields(): array
|
||||
{
|
||||
return [];
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user