copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Validate Stripe payment intent amount before reuse

Browse Source
This commit is contained in:
Jeppe B
2026-06-01 23:54:04 +02:00
parent 4730eebdb4
commit 9ec8499d55
2 changed files with 43 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/ordersRoute.php
+35 -5
View File
@@ -629,6 +629,7 @@ class ordersRoute
$stripe = new stripe();
$stripePaymentIntents = new stripe_payment_intents_o();
$expectedPaymentIntentAmount = $this->getStripePaymentIntentAmountForOrder($order, $tax_percentage ?? 0);
if ($stripePaymentIntents->doesOrderHavePaymentIntent((int)$order->id)) {
$stripePaymentIntents->selectOrderPaymentIntent((int)$order->id);
@@ -641,7 +642,10 @@ class ordersRoute
$stripePaymentIntents->tax_percentage->set($tax_percentage);
}
if ($this->isStripePaymentIntentReusable($storedPaymentIntent)) {
if (
$this->isStripePaymentIntentReusable($storedPaymentIntent)
&& $this->doesStripePaymentIntentMatchOrder($storedPaymentIntent, $expectedPaymentIntentAmount, $tax_percentage ?? 0)
) {
(new logs_o())->add('orders', $order->department_id->value(), 1, $user->id, 'CHARGE_ORDER', 'Reused Stripe payment intent for order (ID: ' . $data['id'] . ')');
$response->success($this->buildStripePaymentIntentResponse($storedPaymentIntent, $stripePaymentIntents, [
'reused' => true,
@@ -655,10 +659,7 @@ class ordersRoute
}
$paymentIntent = $stripe->payment_intents->create(
(int)round($this->addTaxNetAmount(
(float)$order->getNetAmount() * 100,
$tax_percentage ?? 0
)),
$expectedPaymentIntentAmount,
[
'description' => 'Order ID: ' . $order->id,
'metadata' => [
@@ -952,6 +953,35 @@ class ordersRoute
return $net_amount + ($net_amount * ($tax_percentage / 100));
}
private function getStripePaymentIntentAmountForOrder(orders_o $order, ?int $tax_percentage): int
{
return (int)round($this->addTaxNetAmount(
(float)$order->getNetAmount() * 100,
$tax_percentage ?? 0
));
}
private function doesStripePaymentIntentMatchOrder(object $paymentIntent, int $expectedAmount, ?int $tax_percentage): bool
{
if (!isset($paymentIntent->amount) || (int)$paymentIntent->amount !== $expectedAmount) {
return false;
}
$metadata = $paymentIntent->metadata ?? null;
$storedTaxPercentage = null;
if (is_array($metadata)) {
$storedTaxPercentage = $metadata['tax_percentage'] ?? null;
} elseif (is_object($metadata)) {
$storedTaxPercentage = $metadata->tax_percentage ?? null;
}
if ($storedTaxPercentage === null || !is_numeric($storedTaxPercentage)) {
return ($tax_percentage ?? 0) === 0;
}
return (int)$storedTaxPercentage === ($tax_percentage ?? 0);
}
private function isStripePaymentIntentReusable(object $paymentIntent): bool
{
$status = strtolower((string)($paymentIntent->status ?? ''));