payment on hold

app/api/payments/cleanup-expired/route.ts

@@ -0,0 +1,115 @@
+import { NextRequest, NextResponse } from 'next/server'
+import pool from '@/lib/db'
+import { getNowPaymentsConfig } from '@/lib/nowpayments'
+
+// POST /api/payments/cleanup-expired - Clean up expired pending orders
+// This endpoint should be called periodically (e.g., via cron job every minute)
+export async function POST(request: NextRequest) {
+  try {
+    // Optional: Add authentication/authorization check here
+    // For security, you might want to require an API key or admin authentication
+    const authHeader = request.headers.get('authorization')
+    const expectedToken = process.env.CLEANUP_API_TOKEN
+    if (expectedToken && authHeader !== `Bearer ${expectedToken}`) {
+      return NextResponse.json(
+        { error: 'Unauthorized' },
+        { status: 401 }
+      )
+    }
+
+    // Find all expired pending orders
+    const [expiredRows] = await pool.execute(
+      'SELECT * FROM pending_orders WHERE expires_at < NOW()',
+    )
+    const expiredOrders = expiredRows as any[]
+
+    if (expiredOrders.length === 0) {
+      return NextResponse.json({
+        message: 'No expired orders to clean up',
+        cleaned: 0,
+      })
+    }
+
+    const nowPaymentsConfig = getNowPaymentsConfig()
+    let cleanedCount = 0
+    const errors: string[] = []
+
+    // Process each expired order
+    for (const order of expiredOrders) {
+      try {
+        // Try to cancel the NOWPayments invoice if it still exists
+        // Note: NOWPayments may not have a direct cancel endpoint, but we can try
+        // to check the status and handle accordingly
+        try {
+          const statusResponse = await fetch(
+            `${nowPaymentsConfig.baseUrl}/v1/payment/${order.payment_id}`,
+            {
+              method: 'GET',
+              headers: {
+                'x-api-key': nowPaymentsConfig.apiKey,
+                'Content-Type': 'application/json',
+              },
+            }
+          )
+
+          if (statusResponse.ok) {
+            const paymentStatus = await statusResponse.json()
+            // If payment is still pending/waiting, we can consider it expired
+            // NOWPayments will handle the expiration on their end based on invoice_timeout
+            console.log(`Payment ${order.payment_id} status:`, paymentStatus.payment_status)
+          }
+        } catch (apiError) {
+          // Invoice might already be expired/cancelled on NOWPayments side
+          console.log(`Could not check status for payment ${order.payment_id}:`, apiError)
+        }
+
+        // Delete the expired pending order
+        await pool.execute('DELETE FROM pending_orders WHERE id = ?', [order.id])
+        cleanedCount++
+        console.log(`Cleaned up expired pending order ${order.id} (payment_id: ${order.payment_id})`)
+      } catch (error) {
+        const errorMsg = `Error cleaning up order ${order.id}: ${error}`
+        console.error(errorMsg)
+        errors.push(errorMsg)
+      }
+    }
+
+    return NextResponse.json({
+      message: `Cleaned up ${cleanedCount} expired pending orders`,
+      cleaned: cleanedCount,
+      total: expiredOrders.length,
+      errors: errors.length > 0 ? errors : undefined,
+    })
+  } catch (error) {
+    console.error('Error in cleanup endpoint:', error)
+    return NextResponse.json(
+      { error: 'Failed to clean up expired orders' },
+      { status: 500 }
+    )
+  }
+}
+
+// GET /api/payments/cleanup-expired - Get status of expired orders (for monitoring)
+export async function GET() {
+  try {
+    const [expiredRows] = await pool.execute(
+      'SELECT COUNT(*) as count FROM pending_orders WHERE expires_at < NOW()',
+    )
+    const result = expiredRows as any[]
+    const expiredCount = result[0]?.count || 0
+
+    return NextResponse.json({
+      expired_orders_count: expiredCount,
+      message: expiredCount > 0 
+        ? `There are ${expiredCount} expired pending orders that need cleanup`
+        : 'No expired orders',
+    })
+  } catch (error) {
+    console.error('Error checking expired orders:', error)
+    return NextResponse.json(
+      { error: 'Failed to check expired orders' },
+      { status: 500 }
+    )
+  }
+}
+

app/api/payments/create-invoice/route.ts

@@ -45,31 +45,65 @@ export async function POST(request: NextRequest) {
 
     const drop = drops[0]
 
-    // Check inventory availability (but don't reserve yet - will reserve when payment confirmed)
-    const [salesRows] = await pool.execute(
-      'SELECT COALESCE(SUM(size), 0) as total_fill FROM sales WHERE drop_id = ?',
-      [drop_id]
-    )
-    const salesData = salesRows as any[]
-    const currentFill = salesData[0]?.total_fill || 0
-
-    // Convert fill to the drop's unit for comparison
-    let currentFillInDropUnit = currentFill
-    let sizeInDropUnit = size
-    if (drop.unit === 'kg') {
-      currentFillInDropUnit = currentFill / 1000
-      sizeInDropUnit = size / 1000
-    }
-
-    // Check if there's enough remaining inventory
-    const remaining = drop.size - currentFillInDropUnit
-    if (sizeInDropUnit > remaining) {
+    // Get IPN callback URL from environment variable (IPN is handled by external service)
+    // This URL is still required for NOWPayments to know where to send payment notifications
+    const ipnCallbackUrl = process.env.IPN_CALLBACK_URL
+    if (!ipnCallbackUrl) {
       return NextResponse.json(
-        { error: 'Not enough inventory remaining' },
-        { status: 400 }
+        { error: 'IPN_CALLBACK_URL environment variable is required. This should point to your external IPN handler service.' },
+        { status: 500 }
       )
     }
 
+    // Use transaction to atomically check and reserve inventory
+    const connection = await pool.getConnection()
+    await connection.beginTransaction()
+
+    try {
+      // Check inventory availability including non-expired pending orders
+      // First, clean up expired pending orders
+      await connection.execute(
+        'DELETE FROM pending_orders WHERE expires_at < NOW()',
+      )
+
+      // Calculate current fill from sales
+      const [salesRows] = await connection.execute(
+        'SELECT COALESCE(SUM(size), 0) as total_fill FROM sales WHERE drop_id = ?',
+        [drop_id]
+      )
+      const salesData = salesRows as any[]
+      const currentFill = salesData[0]?.total_fill || 0
+
+      // Calculate pending orders (non-expired) that are holding inventory
+      const [pendingRows] = await connection.execute(
+        'SELECT COALESCE(SUM(size), 0) as total_pending FROM pending_orders WHERE drop_id = ? AND expires_at > NOW()',
+        [drop_id]
+      )
+      const pendingData = pendingRows as any[]
+      const pendingFill = pendingData[0]?.total_pending || 0
+      console.log(`total fill : ${currentFill} + ${pendingFill} = ${Number(currentFill) + Number(pendingFill)}`)
+      // Total reserved = sales + pending orders, ensure both are numbers
+      const totalReserved = Number(currentFill) + Number(pendingFill)
+
+      // Convert fill to the drop's unit for comparison
+      let totalReservedInDropUnit = totalReserved
+      let sizeInDropUnit = size
+      if (drop.unit === 'kg') {
+        totalReservedInDropUnit = totalReserved / 1000
+        sizeInDropUnit = size / 1000
+      }
+
+      // Check if there's enough remaining inventory
+      const remaining = drop.size - totalReservedInDropUnit
+      if (sizeInDropUnit > remaining) {
+        await connection.rollback()
+        connection.release()
+        return NextResponse.json(
+          { error: 'Not enough inventory remaining. Item may be on hold by another buyer.' },
+          { status: 400 }
+        )
+      }
+
     // Calculate price
     // ppu is stored as integer where 1000 = $1.00, so divide by 1000 to get actual price
     const pricePerUnit = drop.ppu / 1000
@@ -86,64 +120,72 @@ export async function POST(request: NextRequest) {
     // Generate order ID
     const orderId = `SALE-${Date.now()}-${drop_id}-${buyer_id}`
 
-    // Get base URL for success/cancel redirects
-    const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || 
-                   request.headers.get('origin') || 
-                   'http://localhost:3420'
+      // Get base URL for success/cancel redirects
+      const baseUrl = process.env.NEXT_PUBLIC_BASE_URL || 
+                     request.headers.get('origin') || 
+                     'http://localhost:3420'
 
-    // Get IPN callback URL from environment variable
-    const ipnCallbackUrl = process.env.IPN_CALLBACK_URL
-    if (!ipnCallbackUrl) {
-      return NextResponse.json(
-        { error: 'IPN_CALLBACK_URL environment variable is required' },
-        { status: 500 }
+      // Get NOWPayments config (testnet or production)
+      const nowPaymentsConfig = getNowPaymentsConfig()
+
+      // Calculate expiration time (10 minutes from now)
+      const expiresAt = new Date()
+      expiresAt.setMinutes(expiresAt.getMinutes() + 10)
+
+      // Create NOWPayments invoice
+      // Note: NOWPayments doesn't support invoice_timeout parameter
+      // Expiration is handled by our pending_orders table (10 minutes)
+      const nowPaymentsResponse = await fetch(`${nowPaymentsConfig.baseUrl}/v1/invoice`, {
+        method: 'POST',
+        headers: {
+          'x-api-key': nowPaymentsConfig.apiKey,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          price_amount: priceAmount,
+          price_currency: nowPaymentsConfig.currency,
+          order_id: orderId,
+          order_description: `${drop.item} - ${size}g`,
+          ipn_callback_url: ipnCallbackUrl,
+          success_url: `${baseUrl}/?payment=success&order_id=${orderId}`,
+          cancel_url: `${baseUrl}/?payment=cancelled&order_id=${orderId}`,
+        }),
+      })
+
+      if (!nowPaymentsResponse.ok) {
+        const error = await nowPaymentsResponse.json()
+        console.error('NOWPayments error:', error)
+        await connection.rollback()
+        connection.release()
+        return NextResponse.json(
+          { error: 'Failed to create payment invoice', details: error },
+          { status: 500 }
+        )
+      }
+
+      const invoice = await nowPaymentsResponse.json()
+
+      // Store pending order with expiration time (atomically reserves inventory)
+      await connection.execute(
+        'INSERT INTO pending_orders (payment_id, order_id, drop_id, buyer_id, size, price_amount, price_currency, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
+        [invoice.id, orderId, drop_id, buyer_id, size, priceAmount, nowPaymentsConfig.currency, expiresAt]
       )
-    }
 
-    // Get NOWPayments config (testnet or production)
-    const nowPaymentsConfig = getNowPaymentsConfig()
+      // Commit transaction - inventory is now reserved
+      await connection.commit()
+      connection.release()
 
-    // Create NOWPayments invoice
-    const nowPaymentsResponse = await fetch(`${nowPaymentsConfig.baseUrl}/v1/invoice`, {
-      method: 'POST',
-      headers: {
-        'x-api-key': nowPaymentsConfig.apiKey,
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({
-        price_amount: priceAmount,
-        price_currency: nowPaymentsConfig.currency,
+      // Return invoice URL - sale will be created by external IPN handler when payment is confirmed
+      return NextResponse.json({
+        invoice_url: invoice.invoice_url,
+        payment_id: invoice.id,
         order_id: orderId,
-        order_description: `${drop.item} - ${size}g`,
-        ipn_callback_url: ipnCallbackUrl,
-        success_url: `${baseUrl}/?payment=success&order_id=${orderId}`,
-        cancel_url: `${baseUrl}/?payment=cancelled&order_id=${orderId}`,
-      }),
-    })
-
-    if (!nowPaymentsResponse.ok) {
-      const error = await nowPaymentsResponse.json()
-      console.error('NOWPayments error:', error)
-      return NextResponse.json(
-        { error: 'Failed to create payment invoice', details: error },
-        { status: 500 }
-      )
+      }, { status: 201 })
+    } catch (error) {
+      await connection.rollback()
+      connection.release()
+      throw error
     }
-
-    const invoice = await nowPaymentsResponse.json()
-
-    // Store pending order (will create sale when payment is confirmed)
-    const [result] = await pool.execute(
-      'INSERT INTO pending_orders (payment_id, order_id, drop_id, buyer_id, size, price_amount, price_currency) VALUES (?, ?, ?, ?, ?, ?, ?)',
-      [invoice.id, orderId, drop_id, buyer_id, size, priceAmount, nowPaymentsConfig.currency]
-    )
-
-    // Return invoice URL - sale will be created when payment is confirmed via IPN
-    return NextResponse.json({
-      invoice_url: invoice.invoice_url,
-      payment_id: invoice.id,
-      order_id: orderId,
-    }, { status: 201 })
   } catch (error) {
     console.error('Error creating invoice:', error)
     return NextResponse.json(

app/api/payments/ipn-callback/route.ts

@@ -1,132 +0,0 @@
-import { NextRequest, NextResponse } from 'next/server'
-import pool from '@/lib/db'
-
-// POST /api/payments/ipn-callback - Handle NOWPayments IPN callbacks
-export async function POST(request: NextRequest) {
-  try {
-    const body = await request.json()
-
-    // NOWPayments IPN callback structure
-    // You may need to adjust based on actual NOWPayments IPN format
-    const {
-      payment_id,
-      invoice_id,
-      order_id,
-      payment_status,
-      pay_amount,
-      pay_currency,
-      price_amount,
-      price_currency,
-    } = body
-
-    console.log('IPN Callback received:', {
-      payment_id,
-      invoice_id,
-      order_id,
-      payment_status,
-    })
-
-    // Find pending order by payment_id or invoice_id
-    const paymentIdToFind = invoice_id || payment_id
-    const [pendingRows] = await pool.execute(
-      'SELECT * FROM pending_orders WHERE payment_id = ?',
-      [paymentIdToFind]
-    )
-
-    const pendingOrders = pendingRows as any[]
-    if (pendingOrders.length === 0) {
-      // Check if sale already exists (idempotency)
-      const [existingSales] = await pool.execute(
-        'SELECT * FROM sales WHERE payment_id = ?',
-        [paymentIdToFind]
-      )
-      const existing = existingSales as any[]
-      if (existing.length > 0) {
-        // Sale already created, just return success
-        console.log('Sale already exists for payment_id:', paymentIdToFind)
-        return NextResponse.json({ status: 'ok' }, { status: 200 })
-      }
-      
-      console.error('Pending order not found for payment_id:', paymentIdToFind)
-      return NextResponse.json(
-        { error: 'Pending order not found' },
-        { status: 404 }
-      )
-    }
-
-    const pendingOrder = pendingOrders[0]
-
-    // Update payment status based on payment_status
-    // NOWPayments statuses: waiting, confirming, confirmed, sending, partially_paid, finished, failed, refunded, expired
-    if (payment_status === 'finished' || payment_status === 'confirmed') {
-      // Payment successful - create sale record
-      try {
-        // Check inventory again before creating sale
-        const [dropRows] = await pool.execute(
-          'SELECT * FROM drops WHERE id = ?',
-          [pendingOrder.drop_id]
-        )
-        const drops = dropRows as any[]
-        if (drops.length === 0) {
-          console.error('Drop not found for pending order:', pendingOrder.id)
-          return NextResponse.json({ status: 'error', message: 'Drop not found' }, { status: 200 })
-        }
-
-        const drop = drops[0]
-
-        // Calculate current fill from sales
-        const [salesRows] = await pool.execute(
-          'SELECT COALESCE(SUM(size), 0) as total_fill FROM sales WHERE drop_id = ?',
-          [pendingOrder.drop_id]
-        )
-        const salesData = salesRows as any[]
-        const currentFill = salesData[0]?.total_fill || 0
-
-        // Convert fill to the drop's unit for comparison
-        let currentFillInDropUnit = currentFill
-        let sizeInDropUnit = pendingOrder.size
-        if (drop.unit === 'kg') {
-          currentFillInDropUnit = currentFill / 1000
-          sizeInDropUnit = pendingOrder.size / 1000
-        }
-
-        // Check if there's still enough inventory
-        const remaining = drop.size - currentFillInDropUnit
-        if (sizeInDropUnit > remaining) {
-          console.error('Not enough inventory for pending order:', pendingOrder.id)
-          // Delete pending order since inventory is no longer available
-          await pool.execute('DELETE FROM pending_orders WHERE id = ?', [pendingOrder.id])
-          return NextResponse.json({ status: 'error', message: 'Inventory no longer available' }, { status: 200 })
-        }
-
-        // Create sale record
-        const [result] = await pool.execute(
-          'INSERT INTO sales (drop_id, buyer_id, size, payment_id) VALUES (?, ?, ?, ?)',
-          [pendingOrder.drop_id, pendingOrder.buyer_id, pendingOrder.size, pendingOrder.payment_id]
-        )
-
-        const saleId = (result as any).insertId
-
-        // Delete pending order since sale is created
-        await pool.execute('DELETE FROM pending_orders WHERE id = ?', [pendingOrder.id])
-
-        console.log(`Payment confirmed - Sale ${saleId} created from pending order ${pendingOrder.id}`)
-      } catch (error) {
-        console.error('Error creating sale from pending order:', error)
-        return NextResponse.json({ status: 'error' }, { status: 200 })
-      }
-    } else if (payment_status === 'failed' || payment_status === 'expired') {
-      // Payment failed - delete pending order
-      await pool.execute('DELETE FROM pending_orders WHERE id = ?', [pendingOrder.id])
-      console.log(`Payment failed - Pending order ${pendingOrder.id} deleted`)
-    }
-
-    // Return success to NOWPayments
-    return NextResponse.json({ status: 'ok' }, { status: 200 })
-  } catch (error) {
-    console.error('Error processing IPN callback:', error)
-    // Still return 200 to prevent NOWPayments from retrying
-    return NextResponse.json({ status: 'error' }, { status: 200 })
-  }
-}
-