public-invoice-payment.js

Go to the documentation of this file.

/**
 * @file routes/public-invoice-payment.js
 * @module routes/public-invoice-payment
 * @description Public invoice payment endpoints that don't require authentication.
 * Allows customers to pay invoices via secure tokenized links sent by email.
 * 
 * **Security:**
 * - No authentication required (uses payment_token instead)
 * - Tokens are cryptographically secure (64-char hex, 256-bit entropy)
 * - One-time use recommended (can generate new token after payment)
 * - Rate limiting should be applied at reverse proxy level
 * 
 * **Payment Flow:**
 * 1. Customer receives email with payment link: /pay/{token}
 * 2. Frontend fetches invoice details via GET /api/public/pay/:token
 * 3. Customer enters payment details (Stripe Elements)
 * 4. Frontend creates payment intent via POST /api/public/pay/:token/create-payment
 * 5. Stripe confirms payment
 * 6. Frontend confirms payment via POST /api/public/pay/:token/confirm-payment
 * 
 * @requires express
 * @requires crypto
 * @requires stripe
 * @requires ../services/db
 * @requires ../services/stripeService
 */
 
const express = require('express');
const router = express.Router();
const crypto = require('crypto');
const pool = require('../services/db');
 
// Initialize Stripe with correct key based on mode
const stripeMode = process.env.STRIPE_MODE || 'test';
const stripeSecretKey = stripeMode === 'live' 
  ? process.env.STRIPE_LIVE_SECRET_KEY 
  : process.env.STRIPE_TEST_SECRET_KEY;
const stripe = require('stripe')(stripeSecretKey);
 
console.log(`[Stripe] Public Invoice Payment initialized in ${stripeMode.toUpperCase()} mode`);
 
/**
 * @api {get} /public/pay/:token Get Invoice by Payment Token
 * @apiName GetPublicInvoice
 * @apiGroup PublicPayment
 * @apiDescription Fetches invoice details using a secure payment token.
 * No authentication required. Returns invoice data needed for payment page.
 * 
 * @apiParam {string} token 64-character hex payment token from email link
 * 
 * @apiSuccess {Object} invoice Invoice object
 * @apiSuccess {number} invoice.invoice_id Invoice ID
 * @apiSuccess {string} invoice.currency Currency code (AUD, USD, etc.)
 * @apiSuccess {number} invoice.subtotal Subtotal amount (ex tax)
 * @apiSuccess {number} invoice.tax_rate Tax rate percentage
 * @apiSuccess {number} invoice.tax_amount Tax amount
 * @apiSuccess {number} invoice.total Total amount (inc tax)
 * @apiSuccess {string} invoice.payment_status Payment status (unpaid, paid, etc.)
 * @apiSuccess {string} invoice.status Invoice status (draft, sent, paid, void)
 * @apiSuccess {string} invoice.customer_name Customer name
 * @apiSuccess {Object[]} invoice.items Line items array
 * @apiSuccess {boolean} canPay Whether invoice can be paid (not void/paid)
 * 
 * @apiError {Number} 404 Invoice not found or token invalid
 * @apiError {Number} 400 Invoice already paid or voided
 */
router.get('/pay/:token', async (req, res) => {
  const { token } = req.params;
 
  try {
    // Validate token format (64 hex chars)
    if (!/^[0-9a-f]{64}$/i.test(token)) {
      return res.status(400).json({ error: 'Invalid payment token format' });
    }
 
    // Fetch invoice by payment token
    const result = await pool.query(`
      SELECT 
        i.invoice_id,
        i.customer_id,
        i.currency,
        i.subtotal,
        i.tax_rate,
        i.tax_amount,
        i.total,
        i.amount,
        i.status,
        i.payment_status,
        i.issued_date,
        i.due_date,
        i.description,
        i.created_at,
        i.tenant_id,
        c.name as customer_name,
        c.email as customer_email,
        c.phone as customer_phone,
        c.billing_address as customer_address
      FROM invoices i
      LEFT JOIN customers c ON i.customer_id = c.customer_id
      WHERE i.payment_token = $1
    `, [token]);
 
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Invoice not found' });
    }
 
    const invoice = result.rows[0];
 
    // Check if invoice can be paid
    if (invoice.status === 'void') {
      return res.status(400).json({ error: 'This invoice has been voided and cannot be paid' });
    }
 
    if (invoice.payment_status === 'paid') {
      return res.status(400).json({ 
        error: 'This invoice has already been paid',
        alreadyPaid: true 
      });
    }
 
    // Fetch line items
    const itemsResult = await pool.query(
      'SELECT * FROM invoice_items WHERE invoice_id = $1 ORDER BY item_id',
      [invoice.invoice_id]
    );
 
    invoice.items = itemsResult.rows;
    invoice.canPay = invoice.status !== 'void' && invoice.payment_status !== 'paid';
 
    // Don't expose sensitive customer data beyond what's needed
    const publicInvoice = {
      invoice_id: invoice.invoice_id,
      currency: invoice.currency,
      subtotal: invoice.subtotal,
      tax_rate: invoice.tax_rate,
      tax_amount: invoice.tax_amount,
      total: invoice.total,
      amount: invoice.amount,
      status: invoice.status,
      payment_status: invoice.payment_status,
      issued_date: invoice.issued_date,
      due_date: invoice.due_date,
      description: invoice.description,
      customer_name: invoice.customer_name,
      items: invoice.items,
      canPay: invoice.canPay
    };
 
    res.json(publicInvoice);
 
  } catch (error) {
    console.error('Error fetching public invoice:', error);
    res.status(500).json({ error: 'Server error', details: error.message });
  }
});
 
/**
 * @api {post} /public/pay/:token/create-payment Create Payment Intent (Public)
 * @apiName CreatePublicPaymentIntent
 * @apiGroup PublicPayment
 * @apiDescription Creates a Stripe payment intent for public invoice payment.
 * No authentication required - uses payment token for security.
 */
router.post('/pay/:token/create-payment', async (req, res) => {
  const { token } = req.params;
 
  try {
    // Validate token format
    if (!/^[0-9a-f]{64}$/i.test(token)) {
      return res.status(400).json({ error: 'Invalid payment token format' });
    }
 
    // Fetch invoice
    const result = await pool.query(`
      SELECT 
        i.invoice_id,
        i.customer_id,
        i.tenant_id,
        i.currency,
        i.total,
        i.amount,
        i.status,
        i.payment_status,
        i.description,
        c.name as customer_name,
        sc.stripe_account_id
      FROM invoices i
      LEFT JOIN customers c ON i.customer_id = c.customer_id
      LEFT JOIN stripe_config sc ON i.tenant_id = sc.tenant_id
      WHERE i.payment_token = $1
    `, [token]);
 
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Invoice not found' });
    }
 
    const invoice = result.rows[0];
 
    // Validate invoice can be paid
    if (invoice.status === 'void') {
      return res.status(400).json({ error: 'Invoice has been voided' });
    }
 
    if (invoice.payment_status === 'paid') {
      return res.status(400).json({ error: 'Invoice already paid' });
    }
 
    // Get Stripe connected account
    const stripeAccountId = invoice.stripe_account_id;
    if (!stripeAccountId) {
      return res.status(400).json({ error: 'Payment processing not configured for this invoice' });
    }
 
    // Calculate amount in cents
    const amountInCents = Math.round(parseFloat(invoice.total || invoice.amount || 0) * 100);
 
    if (amountInCents <= 0) {
      return res.status(400).json({ error: 'Invalid invoice amount' });
    }
 
    // Create payment intent on connected account
    const paymentIntent = await stripe.paymentIntents.create({
      amount: amountInCents,
      currency: (invoice.currency || 'AUD').toLowerCase(),
      description: `Invoice #${invoice.invoice_id}${invoice.description ? ' - ' + invoice.description : ''}`,
      metadata: {
        invoice_id: invoice.invoice_id.toString(),
        customer_id: invoice.customer_id?.toString() || '',
        tenant_id: invoice.tenant_id,
        customer_name: invoice.customer_name || '',
        payment_type: 'public_invoice_payment'
      },
      application_fee_amount: Math.round(amountInCents * 0.03), // 3% platform fee
    }, {
      stripeAccount: stripeAccountId,
    });
 
    res.json({
      clientSecret: paymentIntent.client_secret,
      publishableKey: process.env.STRIPE_TEST_PUBLISHABLE_KEY,
      stripeAccount: stripeAccountId,
      amount: amountInCents,
      currency: (invoice.currency || 'AUD').toLowerCase(),
    });
 
  } catch (error) {
    console.error('Error creating public payment intent:', error);
    res.status(500).json({ error: error.message || 'Failed to create payment intent' });
  }
});
 
/**
 * @api {post} /public/pay/:token/confirm-payment Confirm Payment (Public)
 * @apiName ConfirmPublicPayment
 * @apiGroup PublicPayment
 * @apiDescription Confirms successful payment and updates invoice status.
 * Called after Stripe payment succeeds on the frontend.
 */
router.post('/pay/:token/confirm-payment', async (req, res) => {
  const { token } = req.params;
  const { paymentIntentId } = req.body;
 
  const client = await pool.connect();
 
  try {
    // Validate token
    if (!/^[0-9a-f]{64}$/i.test(token)) {
      return res.status(400).json({ error: 'Invalid payment token format' });
    }
 
    if (!paymentIntentId) {
      return res.status(400).json({ error: 'Payment intent ID required' });
    }
 
    await client.query('BEGIN');
 
    // Fetch invoice
    const invoiceResult = await client.query(`
      SELECT 
        i.invoice_id,
        i.customer_id,
        i.tenant_id,
        i.total,
        i.amount,
        i.currency,
        i.status,
        i.payment_status,
        sc.stripe_account_id
      FROM invoices i
      LEFT JOIN stripe_config sc ON i.tenant_id = sc.tenant_id
      WHERE i.payment_token = $1
      FOR UPDATE
    `, [token]);
 
    if (invoiceResult.rows.length === 0) {
      await client.query('ROLLBACK');
      return res.status(404).json({ error: 'Invoice not found' });
    }
 
    const invoice = invoiceResult.rows[0];
 
    // Retrieve payment intent from Stripe
    const paymentIntent = await stripe.paymentIntents.retrieve(
      paymentIntentId,
      { stripeAccount: invoice.stripe_account_id }
    );
 
    if (paymentIntent.status !== 'succeeded') {
      await client.query('ROLLBACK');
      return res.status(400).json({ error: 'Payment not completed' });
    }
 
    // Update invoice status
    await client.query(`
      UPDATE invoices 
      SET 
        status = 'paid',
        payment_status = 'paid',
        payment_date = CURRENT_TIMESTAMP,
        updated_at = CURRENT_TIMESTAMP
      WHERE invoice_id = $1
    `, [invoice.invoice_id]);
 
    // Record payment
    await client.query(`
      INSERT INTO payments (
        invoice_id, customer_id, tenant_id,
        amount, currency, status,
        stripe_payment_intent_id, stripe_account_id,
        payment_method_type, card_brand, card_last4,
        application_fee_amount, net_amount,
        created_at, updated_at
      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
    `, [
      invoice.invoice_id,
      invoice.customer_id,
      invoice.tenant_id,
      paymentIntent.amount,
      paymentIntent.currency,
      paymentIntent.status,
      paymentIntent.id,
      invoice.stripe_account_id,
      paymentIntent.payment_method_types?.[0] || 'card',
      paymentIntent.charges?.data?.[0]?.payment_method_details?.card?.brand || null,
      paymentIntent.charges?.data?.[0]?.payment_method_details?.card?.last4 || null,
      paymentIntent.application_fee_amount,
      paymentIntent.amount - (paymentIntent.application_fee_amount || 0)
    ]);
 
    await client.query('COMMIT');
 
    res.json({ 
      success: true, 
      message: 'Payment confirmed',
      invoice_id: invoice.invoice_id
    });
 
  } catch (error) {
    await client.query('ROLLBACK');
    console.error('Error confirming public payment:', error);
    res.status(500).json({ error: error.message || 'Failed to confirm payment' });
  } finally {
    client.release();
  }
});
 
module.exports = router;