sync: Zahlungsstrecke, PG-Events, Fatal-Log und PayPal-v2-Blaupause vom Live-Stand 2026-09-13
Deploy to Dev / deploy (push) Successful in 1s
Deploy to Dev / deploy (push) Successful in 1s
This commit is contained in:
Thomas Bartelt
@@ -0,0 +1,250 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace PaypalV2;
|
||||
|
||||
/**
|
||||
* Bindeglied zwischen PayPal-Orders-v2 und dem Shop-Datenmodell.
|
||||
*
|
||||
* Zentralisiert:
|
||||
* - Order-Anlage + Ablage der PayPal-Order-ID (in orders.paypal_token wiederverwendet)
|
||||
* - Capture inkl. Betrags-/Waehrungsabgleich (Manipulationsschutz)
|
||||
* - idempotentes Setzen des Zahlstatus (F5, Doppel-Return, Webhook-Race)
|
||||
*
|
||||
* Erwartet das Shop-"base"-Objekt ($base->db = mysqli).
|
||||
*/
|
||||
final class Gateway
|
||||
{
|
||||
/** @var object Shop-base-Objekt mit ->db (mysqli) */
|
||||
private object $base;
|
||||
|
||||
public function __construct(object $base)
|
||||
{
|
||||
$this->base = $base;
|
||||
}
|
||||
|
||||
/**
|
||||
* Legt eine PayPal-Order an, speichert die Order-ID am Shop-Auftrag und
|
||||
* gibt die Approve-URL zurueck, zu der der Kunde weitergeleitet wird.
|
||||
*/
|
||||
public function createOrderAndGetApprovalUrl(int $shopOrderId, float $charged, string $orderNumber): string
|
||||
{
|
||||
$shopBase = \rtrim((string) Config::get('shop_base_url', 'https://' . ($_SERVER['SERVER_NAME'] ?? '')), '/');
|
||||
$returnUrl = $shopBase . '/core/paypal_v2/return.php';
|
||||
$cancelUrl = $shopBase . '/core/paypal_v2/return.php?cancel=1';
|
||||
|
||||
$orders = new Orders();
|
||||
$res = $orders->create($charged, $orderNumber, (string) $shopOrderId, $returnUrl, $cancelUrl);
|
||||
|
||||
// PayPal-Order-ID am Auftrag ablegen (vorhandene Spalte wiederverwendet)
|
||||
$order = new \Order($this->base);
|
||||
$order->set_order_paypal_token($res['id'], $shopOrderId);
|
||||
|
||||
// Exakt berechneten Betrag fuer den spaeteren Abgleich sichern (best effort;
|
||||
// funktioniert nur, wenn die Spalte paypal_v2_expected_amount existiert).
|
||||
$this->storeExpectedAmount($shopOrderId, $charged);
|
||||
|
||||
return $res['approve_url'];
|
||||
}
|
||||
|
||||
/**
|
||||
* Schliesst die Zahlung anhand der PayPal-Order-ID ab (Return-Flow).
|
||||
*
|
||||
* @return array{ok:bool,order_number:string,order_id:int,message:string}
|
||||
*/
|
||||
public function finalizeByPaypalOrderId(string $paypalOrderId): array
|
||||
{
|
||||
$shopOrder = $this->findOrderByToken($paypalOrderId);
|
||||
if ($shopOrder === null) {
|
||||
return $this->result(false, '', 0, 'Bestellung zu dieser Zahlung nicht gefunden.');
|
||||
}
|
||||
|
||||
$orderId = (int) $shopOrder->id;
|
||||
|
||||
// Bereits bezahlt? -> idempotent OK
|
||||
if ((string) $shopOrder->payment_status === '2') {
|
||||
return $this->result(true, (string) $shopOrder->order_number, $orderId, 'bereits bezahlt');
|
||||
}
|
||||
|
||||
$cap = (new Orders())->capture($paypalOrderId);
|
||||
|
||||
if ($cap['capture_status'] !== 'COMPLETED') {
|
||||
return $this->result(
|
||||
false,
|
||||
(string) $shopOrder->order_number,
|
||||
$orderId,
|
||||
'Zahlung nicht abgeschlossen (' . ($cap['capture_status'] ?: $cap['order_status']) . ').'
|
||||
);
|
||||
}
|
||||
|
||||
if (!$this->amountMatches($shopOrder, $cap['amount'], $cap['currency'], $orderId, $paypalOrderId)) {
|
||||
return $this->result(false, (string) $shopOrder->order_number, $orderId, 'Betrag stimmt nicht ueberein.');
|
||||
}
|
||||
|
||||
$this->markPaid($orderId, $cap);
|
||||
|
||||
return $this->result(true, (string) $shopOrder->order_number, $orderId, 'ok');
|
||||
}
|
||||
|
||||
/**
|
||||
* Bestaetigt eine Zahlung aus einem verifizierten Webhook-Event
|
||||
* (PAYMENT.CAPTURE.COMPLETED). Idempotent.
|
||||
*
|
||||
* @param array<mixed> $resource Das "resource"-Objekt des Webhook-Events (die Capture)
|
||||
*/
|
||||
public function confirmFromWebhookCapture(array $resource): bool
|
||||
{
|
||||
$shopOrderId = (int) ($resource['custom_id'] ?? 0);
|
||||
if ($shopOrderId <= 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$shopOrder = $this->findOrderById($shopOrderId);
|
||||
if ($shopOrder === null) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if ((string) $shopOrder->payment_status === '2') {
|
||||
return true; // schon bezahlt
|
||||
}
|
||||
|
||||
if (($resource['status'] ?? '') !== 'COMPLETED') {
|
||||
return false;
|
||||
}
|
||||
|
||||
$amount = (string) ($resource['amount']['value'] ?? '');
|
||||
$currency = (string) ($resource['amount']['currency_code'] ?? '');
|
||||
if (!$this->amountMatches($shopOrder, $amount, $currency, $shopOrderId, 'webhook')) {
|
||||
return false;
|
||||
}
|
||||
|
||||
$this->markPaid($shopOrderId, [
|
||||
'capture_id' => (string) ($resource['id'] ?? ''),
|
||||
'payer_email' => '',
|
||||
'payer_id' => '',
|
||||
]);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------- intern
|
||||
|
||||
/** @param array{capture_id?:string,payer_email?:string,payer_id?:string} $cap */
|
||||
private function markPaid(int $orderId, array $cap): void
|
||||
{
|
||||
$db = $this->base->db;
|
||||
$order = new \Order($this->base);
|
||||
|
||||
// payment_status = 2 (bezahlt) – identisch zur Legacy-Semantik
|
||||
$order->set_billing_status('2', $orderId);
|
||||
$order->set_payment_date(\date('Y-m-d'), $orderId);
|
||||
|
||||
$capId = $db->real_escape_string((string) ($cap['capture_id'] ?? ''));
|
||||
$email = $db->real_escape_string((string) ($cap['payer_email'] ?? ''));
|
||||
$payer = $db->real_escape_string((string) ($cap['payer_id'] ?? ''));
|
||||
|
||||
$sql = "UPDATE orders SET paypal_transaction_id='$capId'";
|
||||
if ($email !== '') {
|
||||
$sql .= ", paypal_email='$email'";
|
||||
}
|
||||
if ($payer !== '') {
|
||||
$sql .= ", paypal_payerid='$payer'";
|
||||
}
|
||||
$sql .= ' WHERE id=' . $orderId;
|
||||
|
||||
$db->query($sql);
|
||||
}
|
||||
|
||||
/**
|
||||
* Prueft, ob der gezahlte Betrag zum erwarteten Betrag des Auftrags passt.
|
||||
* Erwartet wird primaer paypal_v2_expected_amount, ersatzweise orders.order_total.
|
||||
*/
|
||||
private function amountMatches(object $shopOrder, string $paidAmount, string $paidCurrency, int $orderId, string $ref): bool
|
||||
{
|
||||
$expectedRaw = $shopOrder->paypal_v2_expected_amount ?? null;
|
||||
if ($expectedRaw === null || $expectedRaw === '') {
|
||||
$expectedRaw = $shopOrder->order_total;
|
||||
}
|
||||
|
||||
$expected = \number_format((float) $expectedRaw, 2, '.', '');
|
||||
$paid = \number_format((float) $paidAmount, 2, '.', '');
|
||||
$currency = (string) Config::get('currency', 'EUR');
|
||||
|
||||
$ok = ($paid === $expected) && (\strtoupper($paidCurrency) === \strtoupper($currency));
|
||||
|
||||
if (!$ok) {
|
||||
\error_log(
|
||||
"PayPal v2 BETRAGS-MISMATCH (order $orderId, ref $ref): "
|
||||
. "erwartet $expected $currency, erhalten $paid $paidCurrency"
|
||||
);
|
||||
}
|
||||
|
||||
return $ok;
|
||||
}
|
||||
|
||||
private function findOrderByToken(string $paypalOrderId): ?object
|
||||
{
|
||||
$db = $this->base->db;
|
||||
$token = $db->real_escape_string($paypalOrderId);
|
||||
$res = $db->query(
|
||||
"SELECT id, order_number, order_total, payment_status, "
|
||||
. $this->expectedAmountSelect()
|
||||
. " FROM orders WHERE paypal_token = '$token' LIMIT 1"
|
||||
);
|
||||
return ($res && $res->num_rows > 0) ? $res->fetch_object() : null;
|
||||
}
|
||||
|
||||
private function findOrderById(int $orderId): ?object
|
||||
{
|
||||
$db = $this->base->db;
|
||||
$res = $db->query(
|
||||
"SELECT id, order_number, order_total, payment_status, "
|
||||
. $this->expectedAmountSelect()
|
||||
. " FROM orders WHERE id = $orderId LIMIT 1"
|
||||
);
|
||||
return ($res && $res->num_rows > 0) ? $res->fetch_object() : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Liefert das SELECT-Fragment fuer den erwarteten Betrag. Existiert die
|
||||
* optionale Spalte nicht, wird NULL selektiert (Fallback auf order_total).
|
||||
*/
|
||||
private function expectedAmountSelect(): string
|
||||
{
|
||||
return $this->columnExists('paypal_v2_expected_amount')
|
||||
? 'paypal_v2_expected_amount'
|
||||
: 'NULL AS paypal_v2_expected_amount';
|
||||
}
|
||||
|
||||
private function storeExpectedAmount(int $orderId, float $charged): void
|
||||
{
|
||||
if (!$this->columnExists('paypal_v2_expected_amount')) {
|
||||
return;
|
||||
}
|
||||
$db = $this->base->db;
|
||||
$val = \number_format($charged, 2, '.', '');
|
||||
$db->query("UPDATE orders SET paypal_v2_expected_amount='$val' WHERE id=$orderId");
|
||||
}
|
||||
|
||||
/** @var array<string,bool> */
|
||||
private static array $colCache = [];
|
||||
|
||||
private function columnExists(string $column): bool
|
||||
{
|
||||
if (isset(self::$colCache[$column])) {
|
||||
return self::$colCache[$column];
|
||||
}
|
||||
$db = $this->base->db;
|
||||
$col = $db->real_escape_string($column);
|
||||
$res = $db->query("SHOW COLUMNS FROM orders LIKE '$col'");
|
||||
return self::$colCache[$column] = ($res && $res->num_rows > 0);
|
||||
}
|
||||
|
||||
/**
|
||||
* @return array{ok:bool,order_number:string,order_id:int,message:string}
|
||||
*/
|
||||
private function result(bool $ok, string $orderNumber, int $orderId, string $message): array
|
||||
{
|
||||
return ['ok' => $ok, 'order_number' => $orderNumber, 'order_id' => $orderId, 'message' => $message];
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user