path: root/postgresqleu/stripepayment/views.py

from django.http import HttpResponse, HttpResponseRedirect
from django.shortcuts import get_object_or_404, render
from django.db import transaction
from django.views.decorators.csrf import csrf_exempt
from django.conf import settings

from datetime import datetime, timedelta, date
import json
import hmac
import hashlib
from decimal import Decimal

from postgresqleu.invoices.models import Invoice, InvoicePaymentMethod
from postgresqleu.invoices.util import InvoiceManager
from postgresqleu.invoices.util import is_managed_bank_account
from postgresqleu.invoices.util import register_pending_bank_matcher
from postgresqleu.accounting.util import create_accounting_entry
from postgresqleu.mailqueue.util import send_simple_mail

from .models import StripeCheckout, StripeRefund, StripePayout, StripeLog
from .models import ReturnAuthorizationStatus
from .api import StripeApi
from .util import process_stripe_checkout


@transaction.atomic
def invoicepayment_secret(request, paymentmethod, invoiceid, secret):
    method = get_object_or_404(InvoicePaymentMethod, pk=paymentmethod, active=True)
    invoice = get_object_or_404(Invoice, pk=invoiceid, deleted=False, finalized=True, recipient_secret=secret)

    pm = method.get_implementation()

    api = StripeApi(pm)

    try:
        co = StripeCheckout.objects.get(invoiceid=invoice.id)
        if co.completedat:
            # Session exists and is completed! Redirect to the invoice page that shows
            # the results.
            # This is a case that normally shouldn't happen, but can for example if a
            # user has multiple tabs open.
            return HttpResponseRedirect("/invoices/{0}/{1}/".format(invoice.invoiceid, invoice.recipient_secret))

        # Else session exists but is not completed, so send it through back to Stripe
        # again.
    except StripeCheckout.DoesNotExist:
        # Create a new checkout session
        co = StripeCheckout(createdat=datetime.now(),
                            paymentmethod=method,
                            invoiceid=invoice.id,
                            amount=invoice.total_amount)

        # Generate the session
        r = api.secret('checkout/sessions', {
            'cancel_url': '{0}/invoices/stripepay/{1}/{2}/{3}/cancel/'.format(settings.SITEBASE, paymentmethod, invoiceid, secret),
            'success_url': '{0}/invoices/stripepay/{1}/{2}/{3}/results/'.format(settings.SITEBASE, paymentmethod, invoiceid, secret),
            'payment_method_types': ['card', ],
            'client_reference_id': invoice.id,
            'line_items': [
                {
                    'amount': int(invoice.total_amount * 100),
                    'currency': settings.CURRENCY_ISO,
                    'name': '{0} invoice #{1}'.format(settings.ORG_NAME, invoice.id),
                    'quantity': 1,
                },
            ],
            'customer_email': invoice.recipient_email,
            'payment_intent_data': {
                'capture_method': 'automatic',
                'statement_descriptor': '{0} invoice {1}'.format(settings.ORG_SHORTNAME, invoice.id),
            },
        })
        if r.status_code != 200:
            return HttpResponse("Unable to create Stripe payment session: {}".format(r.status_code))
        j = r.json()
        co.sessionid = j['id']
        co.paymentintent = j['payment_intent']
        co.save()

    return render(request, 'stripepayment/payment.html', {
        'invoice': invoice,
        'stripekey': pm.config('published_key'),
        'sessionid': co.sessionid,
    })


def invoicepayment_results(request, paymentmethod, invoiceid, secret):
    # Get the invoice so we can be sure that we have the secret
    get_object_or_404(Invoice, id=invoiceid, recipient_secret=secret)
    co = get_object_or_404(StripeCheckout, invoiceid=invoiceid)

    if co.completedat:
        # Payment is completed!
        return HttpResponseRedirect("/invoices/{0}/{1}/".format(invoiceid, secret))

    # Else we need to loop on this page. To handle this we create
    # a temporary object so we can increase the waiting time
    status, created = ReturnAuthorizationStatus.objects.get_or_create(checkoutid=co.id)
    status.seencount += 1
    status.save()
    return render(request, 'stripepayment/pending.html', {
        'refresh': 3 * status.seencount,
        'url': '/invoices/stripepay/{0}/{1}/{2}/'.format(paymentmethod, invoiceid, secret),
        'createdat': co.createdat,
    })


def invoicepayment_cancel(request, paymentmethod, invoiceid, secret):
    # Get the invoice so we can be sure that we have the secret
    get_object_or_404(Invoice, id=invoiceid, recipient_secret=secret)
    co = get_object_or_404(StripeCheckout, invoiceid=invoiceid)
    method = InvoicePaymentMethod.objects.get(pk=paymentmethod, classname="postgresqleu.util.payment.stripe.Stripe")

    if not co.completedat:
        # Payment is not completed, so delete ours session.
        # Stripe API has no way to delete it on their end, but as soon as we have
        # removed our reference to it, it will never be used again.
        with transaction.atomic():
            StripeLog(message="Payment for Stripe checkout {0} (id {1}) canceled, removing.".format(co.id, co.sessionid),
                      paymentmethod=method).save()
            co.delete()

    # Send the user back to the invoice to pick another payment method (optionally)
    return HttpResponseRedirect("/invoices/{0}/{1}/".format(invoiceid, secret))


@csrf_exempt
def webhook(request, methodid):
    sig = request.META['HTTP_STRIPE_SIGNATURE']
    try:
        payload = json.loads(request.body.decode('utf8', errors='ignore'))
    except ValueError:
        return HttpResponse("Invalid JSON", status=400)

    method = InvoicePaymentMethod.objects.get(pk=methodid, classname="postgresqleu.util.payment.stripe.Stripe")
    pm = method.get_implementation()

    sigdata = dict([v.strip().split('=') for v in sig.split(',')])

    sigstr = sigdata['t'] + '.' + request.body.decode('utf8', errors='ignore')
    mac = hmac.new(pm.config('webhook_secret').encode('utf8'),
                   msg=sigstr.encode('utf8'),
                   digestmod=hashlib.sha256)
    if mac.hexdigest() != sigdata['v1']:
        return HttpResponse("Invalid signature", status=400)

    # Signature is OK, figure out what to do
    if payload['type'] == 'checkout.session.completed':
        sessionid = payload['data']['object']['id']
        try:
            co = StripeCheckout.objects.get(sessionid=sessionid)
        except StripeCheckout.DoesNotExist:
            StripeLog(message="Received completed session event for non-existing sessions {}".format(sessionid),
                      error=True,
                      paymentmethod=method).save()
            return HttpResponse("OK")

        # We don't get enough data in the session, unfortunately, so we have to
        # make some incoming API calls.
        StripeLog(message="Received Stripe webhook for checkout {}. Processing.".format(co.id), paymentmethod=method).save()
        process_stripe_checkout(co)
        StripeLog(message="Completed processing webhook for checkout {}.".format(co.id), paymentmethod=method).save()
        return HttpResponse("OK")
    elif payload['type'] == 'charge.refunded':
        chargeid = payload['data']['object']['id']

        # There can be multiple refunds on each charge, so we have to look through all the
        # possible ones, and compare. Unfortunately, there is no notification available which
        # tells us *which one* was completed. Luckily there will never be *many* refunds on a
        # single charge.
        with transaction.atomic():
            for r in payload['data']['object']['refunds']['data']:
                try:
                    refund = StripeRefund.objects.get(paymentmethod=method,
                                                      chargeid=chargeid,
                                                      refundid=r['id'])
                except StripeRefund.DoesNotExist:
                    StripeLog(message="Received completed refund event for non-existant refund {}".format(r['id']),
                              error=True,
                              paymentmethod=method).save()
                    return HttpResponse("OK")
                if refund.completedat:
                    # It wasn't this one, as it's already been completed.
                    continue

                if r['amount'] != refund.amount * 100:
                    StripeLog(message="Received completed refund with amount {0} instead of expected {1} for refund {2}".format(r['amount'] / 100, refund.amount, refund.id),
                              error=True,
                              paymentmethod=method).save()
                    return HttpResponse("OK")

                # OK, refund looks fine
                StripeLog(message="Received Stripe webhook for refund {}. Processing.".format(refund.id), paymentmethod=method).save()

                refund.completedat = datetime.now()
                refund.save()

                manager = InvoiceManager()
                manager.complete_refund(
                    refund.invoicerefundid_id,
                    refund.amount,
                    0,  # Unknown fee
                    pm.config('accounting_income'),
                    pm.config('accounting_fee'),
                    [],
                    method)
        return HttpResponse("OK")
    elif payload['type'] == 'payout.paid':
        # Payout has left Stripe. Should include both automatic and manual ones
        payoutid = payload['data']['object']['id']

        obj = payload['data']['object']
        if obj['currency'].lower() != settings.CURRENCY_ISO.lower():
            StripeLog(message="Received payout in incorrect currency {}, ignoring".format(obj['currency']),
                      error=True,
                      paymentmethod=method).save()
            return HttpResponse("OK")

        with transaction.atomic():
            if StripePayout.objects.filter(payoutid=payoutid).exists():
                StripeLog(message="Received duplicate notification for payout {}, ignoring".format(payoutid),
                          error=True,
                          paymentmethod=method).save()
                return HttpResponse("OK")

            payout = StripePayout(paymentmethod=method,
                                  payoutid=payoutid,
                                  amount=Decimal(obj['amount']) / 100,
                                  sentat=datetime.now(),
                                  description=obj['description'])
            payout.save()

            acctrows = [
                (pm.config('accounting_income'), 'Stripe payout {}'.format(payout.payoutid), -payout.amount, None),
                (pm.config('accounting_payout'), 'Stripe payout {}'.format(payout.payoutid), payout.amount, None),
            ]

            if is_managed_bank_account(pm.config('accounting_payout')):
                entry = create_accounting_entry(date.today(), acctrows, True)

                # XXX: we don't know what this looks like at the other end yet, so put a random string in there
                register_pending_bank_matcher(pm.config('accounting_payout'),
                                              '.*STRIPE_PAYOUT_WHAT_GOES_HERE?.*',
                                              payout.amount,
                                              entry)
                msg = "A Stripe payout with description {} completed for {}.\n\nAccounting entry {} was created and will automatically be closed once the payout has arrived.".format(
                    payout.description,
                    method.internaldescription,
                    entry,
                )
            else:
                msg = "A Stripe payout with description {} completed for {}.\n".format(payout.description, method.internaldescription)

            StripeLog(message=msg, paymentmethod=method).save()
            send_simple_mail(settings.INVOICE_SENDER_EMAIL,
                             pm.config('notification_receiver'),
                             'Stripe payout completed',
                             msg,
            )
            return HttpResponse("OK")
    else:
        StripeLog(message="Received unknown Stripe event type '{}'".format(payload['type']),
                  error=True,
                  paymentmethod=method).save()
        # We still flag it as OK to stripe
        return HttpResponse("OK")