Crussell/backend/handlers/payments/twofa.go

package payments

import (
	"context"
	"errors"
	"log"
	"net/http"
	"os"
	"strings"

	"crussell/db"
	"crussell/mw"

	"github.com/jackc/pgx/v5"
)

// require2FADisabled reports whether REQUIRE_2FA explicitly disables 2FA
// enforcement. The parse is case-insensitive and alias-tolerant (false/0/off/no),
// so a value like "False", "OFF" or "off" never silently leaves the gate ON.
// Any other value — including empty or unknown — keeps enforcement ON
// (fail-closed).
func require2FADisabled() bool {
	switch strings.ToLower(strings.TrimSpace(os.Getenv("REQUIRE_2FA"))) {
	case "false", "0", "off", "no":
		return true
	default:
		return false
	}
}

// twoFactorEnforced reports whether 2FA is required for online card payments.
// It is fail-closed: enforcement is ON unless 2FA has been explicitly disabled
// (REQUIRE_2FA=false/0/off/no, case-insensitive — see require2FADisabled) or
// SQUARE_ENVIRONMENT explicitly selects the dev/mock stack
// (mock/dev/development/test). Empty or unknown SQUARE_ENVIRONMENT values are
// treated as production-enforced, so a mistyped env var can never silently
// disarm the gate — main.go logs a startup warning for that misconfiguration.
func twoFactorEnforced() bool {
	return !require2FADisabled() && !IsExplicitDevOrMockEnv()
}

// IsExplicitDevOrMockEnv reports whether SQUARE_ENVIRONMENT explicitly selects
// the dev/mock Square stack. Only these exact values are treated as dev; an
// empty or unknown value is NOT dev (fail-closed), because in production an
// unset/mistyped env var must never bypass the 2FA gate.
func IsExplicitDevOrMockEnv() bool {
	switch os.Getenv("SQUARE_ENVIRONMENT") {
	case "mock", "dev", "development", "test":
		return true
	default:
		return false
	}
}

// TwoFactorEnforced is the exported form of twoFactorEnforced, so the user
// package (settings endpoints) and the profile handler can report whether 2FA
// is currently required without re-implementing the env logic.
func (s *PaymentService) TwoFactorEnforced() bool {
	return twoFactorEnforced()
}

// UserTwoFactorEnabled reports whether the user has completed 2FA setup
// (users.two_factor_enabled). It is the source of truth for the card-access
// gate: an enforced environment blocks online card access for users who have
// not enabled 2FA.
func (s *PaymentService) UserTwoFactorEnabled(ctx context.Context, userID string) (bool, error) {
	var enabled bool
	err := db.Conn.QueryRow(ctx, `SELECT two_factor_enabled FROM users WHERE id = $1`, userID).Scan(&enabled)
	if err != nil {
		return false, err
	}
	return enabled, nil
}

// requireTwoFactorForCardAccess gates the saved-card online payment paths
// (PSD2 SCA stand-in until real SCA infra lands). It returns true when the
// request may proceed:
//
//   - 2FA is not enforced (dev/mock), OR
//   - the user has completed 2FA setup (two_factor_enabled).
//
// When 2FA is enforced and the user has not enabled it, a 403 JSON error is
// written (parseable by the frontend via extractErrorMessage) and false is
// returned — the caller must abort the charge.
func requireTwoFactorForCardAccess(w http.ResponseWriter, r *http.Request, service *PaymentService, userID string) bool {
	if !twoFactorEnforced() {
		return true
	}
	if service == nil {
		service = &PaymentService{}
	}
	enabled, err := service.UserTwoFactorEnabled(r.Context(), userID)
	if err != nil {
		if errors.Is(err, pgx.ErrNoRows) {
			mw.RespondError(w, http.StatusForbidden, "Two-factor authentication is required to use online card payments. Enable it in your account settings.")
			return false
		}
		log.Printf("failed to check two-factor status for user %s: %v", userID, err)
		mw.RespondError(w, http.StatusInternalServerError, "failed to check two-factor status")
		return false
	}
	if enabled {
		return true
	}
	mw.RespondError(w, http.StatusForbidden, "Two-factor authentication is required to use online card payments. Enable it in your account settings.")
	return false
}