Square payment integration: real HTTP client, tip flow rewrite, card UI/validation overhaul

Backend: - Create square_http_client.go: real Square REST API client (Payments, Terminal Checkouts, Refunds, Cards, Locations) with proper JSON types, auth, error handling - Update ProdClient in square.go to delegate to shared HTTP functions - Wire devProdClient in square_dev.go to also make real HTTP calls for sandbox/prod env - Rewrite CreateTipPayment handler: accept card_id OR new_card_token (+save_card), advisory lock, idempotency check, max amount validation - Add ValidateCardInfo, bump ValidateAmount max to £10,000 - Fix mock CreateCardOnFile to detect brand/last4 from raw card numbers - Fix mock RefundPayment to index by SquarePayID and accept unknown payment IDs - Remove dead types (ProcessingFee, sqAddress), add Deadline parity - Fix AMEX brand inconsistency (AMEX -> AMERICAN_EXPRESS) - Pre-existing fix: remove unused context import in giftcards.go Frontend: - CardInput.svelte: add onfieldblur/onfieldinput callbacks for blur-based validation - CardBrandIcon.svelte: brand SVGs for VISA, MC, AMEX, Discover, Diners, JCB, Square Gift Card, UnionPay, Interac, EFTPOS - tip/+page, pay-tip/[id], UserBookingModal tip: saved card list + CardInput + Luhn/expiry/CVC validation + blur-based errors + no-saved-cards edge case - UserPaymentModal, BookingFlow: card validation parity (blur-based, all-valid check) - account page: replace text brand badges with CardBrandIcon - Fix handleCustomTip bug (state mutations outside if block) - Remove dead pageState variable - Add tip modal scroll (max-h-[90vh] overflow-y-auto) - Submit button disabled on !isCardValid Tests: - 30 square package tests (+new: CreateCardOnFile raw number path, detectCardInfo variants) - 5 tip handler tests (HappyPath, NoPriorPayment, WrongOwner, MultipleTips, TxFailure) - All +-race clean, refund tests fixed
2026-08-22 00:34:49 +01:00
parent f6caaab8a3
commit 4abcb324c9
17 changed files with 2171 additions and 358 deletions
@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"log"
 	"os"
+	"strings"
 	"sync"
 	"time"
 )
@@ -23,41 +24,41 @@ func mockSleep(d time.Duration) {
 }

 type MockClient struct {
-	mu              sync.RWMutex
-	cards           map[string]map[string]*CardOnFile
-	checkouts       map[string]*CheckoutResult
-	payments        map[string]*PaymentResult
-	refunds         map[string]*RefundResult
-	completed       map[string]*PaymentResult
-	HoldCheckouts   bool
-	ShouldFail      bool // if true, CreatePayment/RefundPayment return errors for testing error paths
+	mu            sync.RWMutex
+	cards         map[string]map[string]*CardOnFile
+	checkouts     map[string]*CheckoutResult
+	payments      map[string]*PaymentResult
+	refunds       map[string]*RefundResult
+	completed     map[string]*PaymentResult
+	HoldCheckouts bool
+	ShouldFail    bool // if true, CreatePayment/RefundPayment return errors for testing error paths
 }

 type devProdClient struct{}

 func (d *devProdClient) CreatePayment(ctx context.Context, req CreatePaymentReq) (*PaymentResult, error) {
-	return nil, fmt.Errorf("square payments not yet configured — set SQUARE_ACCESS_TOKEN and SQUARE_LOCATION_ID in .env")
+	return createPaymentHTTP(ctx, req)
 }
 func (d *devProdClient) CreateCheckout(ctx context.Context, req CreateCheckoutReq) (*CheckoutResult, error) {
-	return nil, fmt.Errorf("square payments not yet configured — set SQUARE_ACCESS_TOKEN and SQUARE_LOCATION_ID in .env")
+	return createCheckoutHTTP(ctx, req)
 }
 func (d *devProdClient) GetCheckout(ctx context.Context, checkoutID string) (*PaymentResult, error) {
-	return nil, fmt.Errorf("square payments not yet configured — set SQUARE_ACCESS_TOKEN and SQUARE_LOCATION_ID in .env")
+	return getCheckoutHTTP(ctx, checkoutID)
 }
 func (d *devProdClient) RefundPayment(ctx context.Context, req RefundPaymentReq) (*RefundResult, error) {
-	return nil, fmt.Errorf("square payments not yet configured — set SQUARE_ACCESS_TOKEN and SQUARE_LOCATION_ID in .env")
+	return refundPaymentHTTP(ctx, req)
 }
 func (d *devProdClient) CreateCardOnFile(ctx context.Context, userID, cardToken string) (*CardOnFile, error) {
-	return nil, fmt.Errorf("square payments not yet configured — set SQUARE_ACCESS_TOKEN and SQUARE_LOCATION_ID in .env")
+	return createCardOnFileHTTP(ctx, userID, cardToken)
 }
 func (d *devProdClient) CreateCardOnFileRaw(ctx context.Context, userID, cardNumber string, expMonth, expYear int, cvc string) (*CardOnFile, error) {
-	return nil, fmt.Errorf("square payments not yet configured — set SQUARE_ACCESS_TOKEN and SQUARE_LOCATION_ID in .env")
+	return nil, fmt.Errorf("square: raw card number input is not supported in production — use CreateCardOnFile with a card nonce")
 }
 func (d *devProdClient) GetCardsOnFile(ctx context.Context, userID string) ([]CardOnFile, error) {
-	return nil, fmt.Errorf("square payments not yet configured — set SQUARE_ACCESS_TOKEN and SQUARE_LOCATION_ID in .env")
+	return getCardsOnFileHTTP(ctx, userID)
 }
 func (d *devProdClient) DeleteCardOnFile(ctx context.Context, cardID string) error {
-	return fmt.Errorf("square payments not yet configured — set SQUARE_ACCESS_TOKEN and SQUARE_LOCATION_ID in .env")
+	return deleteCardOnFileHTTP(ctx, cardID)
 }

 func NewClient() SquareClient {
@@ -67,7 +68,7 @@ func NewClient() SquareClient {
 func NewDevClient() SquareClient {
 	env := os.Getenv("SQUARE_ENVIRONMENT")
 	if env == "sandbox" || env == "production" {
-		log.Printf("[SQUARE-MOCK] SQUARE_ENVIRONMENT=%s — real client TODO stub", env)
+		log.Printf("[SQUARE-PROD] SQUARE_ENVIRONMENT=%s — making real API calls to %s", env, realBaseURL(env))
 		return &devProdClient{}
 	}
 	log.Println("[SQUARE-MOCK] Using in-memory mock client")
@@ -80,48 +81,118 @@ func NewDevClient() SquareClient {
 	}
 }

+func detectCardInfo(sourceID string) (brand, last4 string) {
+	switch sourceID {
+	case "cnon:test-card":
+		return "VISA", "4242"
+	case "cnon:visa":
+		return "VISA", "1111"
+	case "cnon:mastercard":
+		return "MASTERCARD", "4444"
+	case "cnon:amex":
+		return "AMERICAN_EXPRESS", "0005"
+	default:
+		return "VISA", "4242"
+	}
+}
+
 func (m *MockClient) CreatePayment(ctx context.Context, req CreatePaymentReq) (*PaymentResult, error) {
 	if m.ShouldFail {
 		return nil, fmt.Errorf("mock: payment declined (simulated failure)")
 	}
-	log.Printf("[SQUARE-MOCK] CreatePayment: amount=%d, reference=%s", req.Amount, req.ReferenceID)
+	log.Printf("[SQUARE-MOCK] CreatePayment: amount=%d, reference=%s, source=%s", req.Amount, req.ReferenceID, req.SourceID)
 	mockSleep(1 * time.Second)

 	m.mu.Lock()
 	defer m.mu.Unlock()

-	paymentID := fmt.Sprintf("pay_mock_%d", clock.Now().UnixNano())
-	fees := req.Amount*14/1000 + 25 // online rate: 1.4% + 25p
+	now := clock.Now().UTC()
+
+	status := "COMPLETED"
+	if req.Autocomplete != nil && !*req.Autocomplete {
+		status = "APPROVED"
+	}
+
+	amount := req.Amount
+	tipAmount := int64(0)
+	if req.TipMoney != nil {
+		tipAmount = *req.TipMoney
+		amount += tipAmount
+	}
+
+	cardBrand, cardLast4 := detectCardInfo(req.SourceID)
+
+	// Entry method: ON_FILE for card-on-file tokens, KEYED for nonces
+	entryMethod := "KEYED"
+	if len(req.SourceID) >= 5 && req.SourceID[:5] == "ccof:" {
+		entryMethod = "ON_FILE"
+	}
+
+	paymentID := fmt.Sprintf("pay_mock_%d", now.UnixNano())
+	fees := amount*14/1000 + 25 // online rate: 1.4% + 25p
+
+	locationID := req.LocationID
+	if locationID == "" {
+		locationID = "L_MOCK"
+	}

 	result := &PaymentResult{
-		ID:          paymentID,
-		Status:      "COMPLETED",
-		Amount:      req.Amount,
-		CardBrand:   "VISA",
-		CardLast4:   "4242",
-		TipAmount:   0,
-		ReceiptURL:  "https://squareup.com/receipt/" + paymentID,
-		SquarePayID: "sqp_" + paymentID,
-		Fees:        fees,
+		ID:              paymentID,
+		Status:          status,
+		Amount:          amount,
+		CardBrand:       cardBrand,
+		CardLast4:       cardLast4,
+		CardFingerprint: fmt.Sprintf("sqfp_mock_%d", now.UnixNano()),
+		ExpMonth:        12,
+		ExpYear:         2030,
+		EntryMethod:     entryMethod,
+		CVVStatus:       "CVV_ACCEPTED",
+		AVSStatus:       "AVS_ACCEPTED",
+		TipAmount:       tipAmount,
+		ReceiptURL:      "https://squareup.com/receipt/" + paymentID,
+		ReceiptNumber:   fmt.Sprintf("RCPT_mock_%d", now.UnixNano()),
+		SquarePayID:     "sqp_" + paymentID,
+		Fees:            fees,
+		BuyerEmail:      req.BuyerEmail,
+		CustomerID:      req.CustomerID,
+		LocationID:      locationID,
+		CreatedAt:       now.Format(time.RFC3339),
+		UpdatedAt:       now.Format(time.RFC3339),
+		ReferenceID:     req.ReferenceID,
 	}
 	m.payments[paymentID] = result
-	log.Printf("[SQUARE-MOCK] Payment completed: id=%s, fees=%d", paymentID, fees)
+	m.payments[result.SquarePayID] = result
+	log.Printf("[SQUARE-MOCK] Payment created: id=%s, status=%s, amount=%d, fees=%d", paymentID, status, amount, fees)
 	return result, nil
 }

 func (m *MockClient) CreateCheckout(ctx context.Context, req CreateCheckoutReq) (*CheckoutResult, error) {
 	log.Printf("[SQUARE-MOCK] CreateCheckout: amount=%d, tipEnabled=%v, reference=%s", req.Amount, req.TipEnabled, req.ReferenceID)

-	checkoutID := fmt.Sprintf("chk_mock_%d", clock.Now().UnixNano())
+	now := clock.Now().UTC()
+	checkoutID := fmt.Sprintf("chk_mock_%d", now.UnixNano())
+
 	result := &CheckoutResult{
-		ID:     checkoutID,
-		Status: "PENDING",
+		ID:          checkoutID,
+		Status:      "PENDING",
+		AmountMoney: req.Amount,
+		Currency:    req.Currency,
+		DeviceID:    req.DeviceID,
+		ReferenceID: req.ReferenceID,
+		Note:        req.Note,
+		CreatedAt:   now.Format(time.RFC3339),
+		UpdatedAt:   now.Format(time.RFC3339),
+		Deadline:    now.Add(5 * time.Minute).Format(time.RFC3339),
 	}

 	m.mu.Lock()
-	m.checkouts[checkoutID] = &CheckoutResult{ID: checkoutID, Status: "PENDING"}
+	m.checkouts[checkoutID] = result
 	m.mu.Unlock()

+	// Copy the result before spawning the goroutine to avoid data races.
+	// The caller gets this copy; the goroutine modifies the map-stored original.
+	resultCopy := *result
+
 	if !m.HoldCheckouts {
 		go func() {
 			defer func() {
@@ -134,7 +205,8 @@ func (m *MockClient) CreateCheckout(ctx context.Context, req CreateCheckoutReq)
 			m.mu.Lock()
 			defer m.mu.Unlock()

-			paymentID := fmt.Sprintf("pay_%d", clock.Now().UnixNano())
+			payNow := clock.Now().UTC()
+			paymentID := fmt.Sprintf("pay_mock_%d", payNow.UnixNano())
 			amount := req.Amount
 			tipAmount := int64(0)
 			if req.TipEnabled {
@@ -144,23 +216,37 @@ func (m *MockClient) CreateCheckout(ctx context.Context, req CreateCheckoutReq)
 			fees := amount * 175 / 10000 // in-person rate: 1.75%

 			paymentResult := &PaymentResult{
-				ID:          paymentID,
-				Status:      "COMPLETED",
-				Amount:      amount,
-				CardBrand:   "VISA",
-				CardLast4:   "4242",
-				TipAmount:   tipAmount,
-				ReceiptURL:  "https://squareup.com/receipt/" + paymentID,
-				SquarePayID: "sqp_" + paymentID,
-				Fees:        fees,
+				ID:              paymentID,
+				Status:          "COMPLETED",
+				Amount:          amount,
+				CardBrand:       "VISA",
+				CardLast4:       "4242",
+				CardFingerprint: fmt.Sprintf("sqfp_mock_%d", payNow.UnixNano()),
+				ExpMonth:        12,
+				ExpYear:         2030,
+				EntryMethod:     "EMV",
+				CVVStatus:       "CVV_ACCEPTED",
+				AVSStatus:       "AVS_ACCEPTED",
+				TipAmount:       tipAmount,
+				ReceiptURL:      "https://squareup.com/receipt/" + paymentID,
+				ReceiptNumber:   fmt.Sprintf("RCPT_mock_%d", payNow.UnixNano()),
+				SquarePayID:     "sqp_" + paymentID,
+				Fees:            fees,
+				CustomerID:      req.CustomerID,
+				LocationID:      "L_MOCK",
+				CreatedAt:       payNow.Format(time.RFC3339),
+				UpdatedAt:       payNow.Format(time.RFC3339),
+				ReferenceID:     req.ReferenceID,
 			}
 			m.completed[checkoutID] = paymentResult
 			m.checkouts[checkoutID].Status = "COMPLETED"
+			m.checkouts[checkoutID].UpdatedAt = payNow.Format(time.RFC3339)
+			m.checkouts[checkoutID].PaymentIDs = []string{paymentID}
 			log.Printf("[SQUARE-MOCK] Checkout completed: id=%s, amount=%d, tip=%d", checkoutID, amount, tipAmount)
 		}()
 	}

-	return result, nil
+	return &resultCopy, nil
 }

 func (m *MockClient) GetCheckout(ctx context.Context, checkoutID string) (*PaymentResult, error) {
@@ -196,27 +282,72 @@ func (m *MockClient) RefundPayment(ctx context.Context, req RefundPaymentReq) (*
 	m.mu.Lock()
 	defer m.mu.Unlock()

-	refundID := fmt.Sprintf("ref_mock_%d", clock.Now().UnixNano())
+	now := clock.Now().UTC()
+	refundID := fmt.Sprintf("ref_mock_%d", now.UnixNano())
+
+	payment, ok := m.payments[req.PaymentID]
+	if !ok {
+		// Payment not in mock map — this happens when integration tests
+		// create payments via DB fixture with a square_payment_id, bypassing
+		// the mock. Process the refund without full payment data.
+		log.Printf("[SQUARE-MOCK] RefundPayment: payment %s not in mock map — proceeding without full payment data", req.PaymentID)
+	}
+
 	amount := req.Amount
-	if amount == 0 {
-		if payment, ok := m.payments[req.PaymentID]; ok {
-			amount = payment.Amount
-		}
+	if amount == 0 && ok {
+		amount = payment.Amount
+	}
+
+	locationID := req.LocationID
+	if locationID == "" {
+		locationID = "L_MOCK"
 	}

 	result := &RefundResult{
-		ID:     refundID,
-		Status: "COMPLETED",
-		Amount: amount,
+		ID:         refundID,
+		Status:     "COMPLETED",
+		Amount:     amount,
+		PaymentID:  req.PaymentID,
+		LocationID: locationID,
+		Reason:     req.Reason,
+		CreatedAt:  now.Format(time.RFC3339),
 	}
 	m.refunds[refundID] = result
-	log.Printf("[SQUARE-MOCK] Refund completed: id=%s, amount=%d", refundID, amount)
+	log.Printf("[SQUARE-MOCK] Refund completed: id=%s, payment=%s, amount=%d", refundID, req.PaymentID, amount)
 	return result, nil
 }

 func (m *MockClient) CreateCardOnFile(ctx context.Context, userID, cardToken string) (*CardOnFile, error) {
 	log.Printf("[SQUARE-MOCK] CreateCardOnFile: user=%s", userID)

+	// Detect card info from the input token.
+	// Raw card numbers (digit-only, possibly with spaces) are parsed directly.
+	// Nonce-like tokens (cnon:xxx etc.) use detectCardInfo for mapped values.
+	cleanDigits := strings.ReplaceAll(cardToken, " ", "")
+	cardBrand := "VISA"
+	cardLast4 := "4242"
+	cardExpMonth := 12
+	cardExpYear := 2030
+
+	if isAllDigits(cleanDigits) && len(cleanDigits) >= 13 {
+		cardLast4 = cleanDigits[len(cleanDigits)-4:]
+		firstDigit := string(cleanDigits[0])
+		switch firstDigit {
+		case "4":
+			cardBrand = "VISA"
+		case "5":
+			cardBrand = "MASTERCARD"
+		case "3":
+			cardBrand = "AMERICAN_EXPRESS"
+		case "6":
+			cardBrand = "DISCOVER"
+		}
+	} else {
+		brand, last4 := detectCardInfo(cardToken)
+		cardBrand = brand
+		cardLast4 = last4
+	}
+
 	m.mu.Lock()
 	defer m.mu.Unlock()

@@ -224,16 +355,22 @@ func (m *MockClient) CreateCardOnFile(ctx context.Context, userID, cardToken str
 		m.cards[userID] = make(map[string]*CardOnFile)
 	}

-	cardID := fmt.Sprintf("mock_card_%d", clock.Now().UnixNano())
+	now := clock.Now().UTC()
+	cardID := fmt.Sprintf("mock_card_%d", now.UnixNano())
 	card := &CardOnFile{
-		ID:          cardID,
-		CardID:      "cfa_" + cardID,
-		Brand:       "VISA",
-		Last4:       "4242",
-		ExpMonth:    12,
-		ExpYear:     2030,
-		Fingerprint: fmt.Sprintf("fp_%d", clock.Now().UnixNano()),
-		IsDefault:   len(m.cards[userID]) == 0,
+		ID:             cardID,
+		CardID:         fmt.Sprintf("ccof_mock_%d", now.UnixNano()),
+		Brand:          cardBrand,
+		Last4:          cardLast4,
+		ExpMonth:       cardExpMonth,
+		ExpYear:        cardExpYear,
+		Fingerprint:    fmt.Sprintf("sqfp_mock_%d", now.UnixNano()),
+		CardholderName: "John Doe",
+		CustomerID:     userID,
+		Enabled:        true,
+		IsDefault:      len(m.cards[userID]) == 0,
+		Version:        1,
+		CreatedAt:      now.Format(time.RFC3339),
 	}
 	m.cards[userID][cardID] = card
 	log.Printf("[SQUARE-MOCK] Card created: id=%s, brand=%s, last4=%s", cardID, card.Brand, card.Last4)
@@ -243,6 +380,10 @@ func (m *MockClient) CreateCardOnFile(ctx context.Context, userID, cardToken str
 func (m *MockClient) CreateCardOnFileRaw(ctx context.Context, userID, cardNumber string, expMonth, expYear int, cvc string) (*CardOnFile, error) {
 	log.Printf("[SQUARE-MOCK] CreateCardOnFileRaw: user=%s", userID)

+	if len(cardNumber) < 4 {
+		return nil, fmt.Errorf("invalid card number: too short")
+	}
+
 	m.mu.Lock()
 	defer m.mu.Unlock()

@@ -250,23 +391,29 @@ func (m *MockClient) CreateCardOnFileRaw(ctx context.Context, userID, cardNumber
 		m.cards[userID] = make(map[string]*CardOnFile)
 	}

-	cardID := fmt.Sprintf("mock_card_%d", clock.Now().UnixNano())
+	now := clock.Now().UTC()
+	cardID := fmt.Sprintf("mock_card_%d", now.UnixNano())
 	last4 := cardNumber[len(cardNumber)-4:]
-	brands := map[string]string{"4": "VISA", "5": "MASTERCARD", "3": "AMEX", "6": "DISCOVER"}
+	brands := map[string]string{"4": "VISA", "5": "MASTERCARD", "3": "AMERICAN_EXPRESS", "6": "DISCOVER"}
 	brand := brands[string(cardNumber[0])]
 	if brand == "" {
 		brand = "UNKNOWN"
 	}

 	card := &CardOnFile{
-		ID:          cardID,
-		CardID:      "cfa_" + cardID,
-		Brand:       brand,
-		Last4:       last4,
-		ExpMonth:    expMonth,
-		ExpYear:     expYear,
-		Fingerprint: fmt.Sprintf("fp_%d", clock.Now().UnixNano()),
-		IsDefault:   len(m.cards[userID]) == 0,
+		ID:             cardID,
+		CardID:         fmt.Sprintf("ccof_mock_%d", now.UnixNano()),
+		Brand:          brand,
+		Last4:          last4,
+		ExpMonth:       expMonth,
+		ExpYear:        expYear,
+		Fingerprint:    fmt.Sprintf("sqfp_mock_%d", now.UnixNano()),
+		CardholderName: "John Doe",
+		CustomerID:     userID,
+		Enabled:        true,
+		IsDefault:      len(m.cards[userID]) == 0,
+		Version:        1,
+		CreatedAt:      now.Format(time.RFC3339),
 	}
 	m.cards[userID][cardID] = card
 	log.Printf("[SQUARE-MOCK] Card created: id=%s, brand=%s, last4=%s", cardID, card.Brand, card.Last4)
@@ -298,11 +445,21 @@ func (m *MockClient) DeleteCardOnFile(ctx context.Context, cardID string) error
 	defer m.mu.Unlock()

 	for userID, cards := range m.cards {
-		if _, ok := cards[cardID]; ok {
-			delete(m.cards[userID], cardID)
-			log.Printf("[SQUARE-MOCK] Card deleted: id=%s (user=%s)", cardID, userID)
+		if card, ok := cards[cardID]; ok {
+			card.Enabled = false
+			log.Printf("[SQUARE-MOCK] Card disabled: id=%s (user=%s)", cardID, userID)
 			return nil
 		}
 	}
 	return fmt.Errorf("card not found: %s", cardID)
 }
+
+// isAllDigits returns true if every rune in s is an ASCII digit.
+func isAllDigits(s string) bool {
+	for _, r := range s {
+		if r < '0' || r > '9' {
+			return false
+		}
+	}
+	return len(s) > 0
+}