الـ Payments: idempotency و webhooks و refunds و reconciliation

// payments.js: checkout بالـ idempotency، و webhooks موقّعة ومن غير تكرار وبترتيب أي حاجة، و refunds ما تعدّيش المبلغ، و reconciliation
// lab.js و test.js بيعملوا import من هنا: PaymentError و migrate و createPayments
import { createHmac, timingSafeEqual } from "node:crypto";

export class PaymentError extends Error {
  constructor(code, extra = {}) { super(code); this.code = code; Object.assign(this, extra); }
}

export async function migrate(db) {
  await db.query(`
    create table if not exists payments (
      id serial primary key,
      order_id text not null unique,
      amount_cents int not null check (amount_cents > 0),
      currency text not null,
      status text not null,
      idempotency_key text not null unique,
      intent_id text unique,
      client_secret text,
      refunded_cents int not null default 0,
      updated_at timestamptz not null default now()
    );
    create table if not exists refunds (
      id serial primary key,
      payment_id int not null references payments(id),
      amount_cents int not null check (amount_cents > 0),
      idempotency_key text not null unique,
      status text not null,
      psp_refund_id text
    );
    create table if not exists webhook_events (
      event_id text primary key,
      type text not null,
      received_at timestamptz not null default now()
    );
  `);
}

const RANK = { creating: 0, pending: 1, failed: 2, succeeded: 3, partially_refunded: 4, refunded: 5 };

export function createPayments({ pool, psp, webhookSecret, toleranceMs = 300000, now = Date.now }) {
  async function call(path, body, key) {
    let res;
    try {
      res = await fetch(psp.baseUrl + path, {
        method: "POST",
        headers: { authorization: `Bearer ${psp.apiKey}`, "content-type": "application/json", "idempotency-key": key },
        body: JSON.stringify(body),
      });
    } catch {
      throw new PaymentError("PSP_UNAVAILABLE");
    }
    const out = await res.json();
    if (!res.ok) throw new PaymentError("PSP_REJECTED", { status: res.status, pspError: out.error });
    return out;
  }

  async function tx(fn) {
    const c = await pool.connect();
    try { await c.query("begin"); const r = await fn(c); await c.query("commit"); return r; }
    catch (e) { await c.query("rollback"); throw e; }
    finally { c.release(); }
  }

  async function startCheckout(orderId, amountCents, currency = "EGP") {
    if (!Number.isInteger(amountCents) || amountCents <= 0) throw new PaymentError("INVALID_AMOUNT");
    await pool.query(
      "insert into payments (order_id, amount_cents, currency, status, idempotency_key) values ($1, $2, $3, 'creating', $4) on conflict (order_id) do nothing",
      [orderId, amountCents, currency, `checkout:${orderId}`],
    );
    const { rows: [p] } = await pool.query("select * from payments where order_id = $1", [orderId]);
    if (p.amount_cents !== amountCents || p.currency !== currency) throw new PaymentError("AMOUNT_MISMATCH");
    if (!p.intent_id) 
…

$ node lab.js

--- 1) العميل داس Pay مرتين، والـ response الأولاني ضاع ---
  النتيجتين: ✘ PSP_UNAVAILABLE و pi_1
  الـ retry: pi_1. عدد الـ intents عند الـ provider: 1
  الـ requests للـ provider: checkout:ord-1 ، checkout:ord-1

--- 2) العميل دفع: الـ webhook وصل تلات مرات، وواحد قديم وصل بعدهم ---
  succeeded                ← {"status":"processed","paymentStatus":"succeeded"}
  succeeded (retry)        ← {"status":"duplicate"}
  succeeded (retry)        ← {"status":"duplicate"}
  payment_failed (اتأخر)   ← {"status":"ignored","reason":"STALE_TRANSITION","paymentStatus":"succeeded"}

--- 3) حد بيبعت webhooks من عنده ---
  من غير signature       ← ✘ BAD_SIGNATURE
  غيّر المبلغ في الـ body ← ✘ BAD_SIGNATURE
  event حقيقي من امبارح  ← ✘ STALE

--- 4) refunds ---
  تلاتين جنيه             ← {"refundId":1,"status":"succeeded","pspRefundId":"re_2","amountCents":3000}
  نفس الـ ticket تاني      ← {"refundId":1,"status":"succeeded","pspRefundId":"re_2","amountCents":3000}
  تلات admins في نفس الوقت، كل واحد أربعين ← ✔ 4000 ، ✔ 4000 ، ✘ AMOUNT_TOO_LARGE
  webhook الـ refund       ← {"status":"processed","paymentStatus":"partially_refunded"}
  عند الـ provider: اترجع 11000 من 11410

--- 5) 
…

// checkout.naive.js: الدفع زي ما كان مكتوب
app.post("/checkout", async (req, res) => {
  const order = await db.orders.find(req.body.orderId);
  const pi = await fetch(`${PSP}/v1/payment_intents`, {
    method: "POST",
    headers: { authorization: `Bearer ${KEY}` },
    body: JSON.stringify({ amount: order.total * 100, currency: "EGP" }), // total = 114.1
  }).then((r) => r.json());
  await db.payments.insert({ orderId: order.id, intentId: pi.id });
  res.json({ clientSecret: pi.client_secret });
});

// الـ provider بيرجّع العميل هنا بعد الدفع
app.get("/checkout/return", async (req, res) => {
  if (req.query.status === "success") await db.orders.update(req.query.orderId, { status: "paid" });
  res.redirect("/thanks");
});

app.post("/webhooks/psp", express.json(), async (req, res) => {
  const event = req.body;
  if (event.type === "payment_intent.succeeded") await db.payments.update(event.data.object.id, { status: "succeeded" });
  if (event.type === "payment_intent.payment_failed") await db.payments.update(event.data.object.id, { status: "failed" });
  await shipOrder(event.data.object.metadata.orderId);
  res.sendStatus(200);
});

app.post("/admin/refund", async (req, res) => {
  await fetch(`${PSP}/v1/refunds`, { method: "POST", headers: { authorization: `Bearer ${KEY}` }, body: JSON.stringify({ payment_intent: req.body.intentId, amount: req.body.amount }) });
  res.sendStatus(200);
});

// psp.js: payment provider مزيّف شبه Stripe على HTTP (ما تغيّروش). idempotency keys، و webhooks موقّعة، و responses بتضيع
import http from "node:http";
import { createHmac } from "node:crypto";

export async function startPsp({ apiKey, webhookSecret }) {
  const state = { intents: new Map(), refunds: new Map(), keys: new Map(), requests: [], dropNextResponse: false };
  let n = 0, ev = 0;

  function sign(type, object, { created = Math.floor(Date.now() / 1000), id = `evt_${++ev}` } = {}) {
    const raw = JSON.stringify({ id, type, created, data: { object } });
    const t = created;
    const v1 = createHmac("sha256", webhookSecret).update(`${t}.${raw}`).digest("hex");
    return { raw, header: `t=${t},v1=${v1}`, id };
  }

  function createIntent(body) {
    const id = `pi_${++n}`;
    const pi = { id, amount: body.amount, currency: body.currency, metadata: body.metadata ?? {}, status: "requires_payment_method", amount_refunded: 0, client_secret: `${id}_secret_${n}` };
    state.intents.set(id, pi);
    return [200, pi];
  }

  function createRefund(body) {
    const pi = state.intents.get(body.payment_intent);
    if (!pi) return [404, { error: "no_such_payment_intent" }];
    if (pi.status !== "succeeded") return [400, { error: "charge_not_captured" }];
    if (!Number.isInteger(body.amount) || body.amount <= 0 || body.amount > pi.amount - pi.amount_refunded) return [400, { error: "amount_too_large" }];
    pi.amount_refunded += body.amount;
    const re = { id: `re_${++n}`, payment_intent: pi.id, amount: body.amount, status: "succeeded" };
    state.refunds.set(re.id, re);
    return [200, re];
  }

  const server = http.createServer(async (req, res) => {
    let raw = "";
    for await (const c of req) raw += c;
    const body = raw ? JSON.parse(raw) : {};
    const key = req.headers["idempotency-key"] ?? null;
    state.requests.push({ method: req.method, path: req.url, key, body });
    const send = (status, obj, replayed = false) => {
      if (state.dropNextResponse && req.method === "POST") { state.dropNextResponse = false; return req.socket.destroy(); }
      res.writeHead(status, { "content-type": "application/json", ...(replayed ? { "idempotent-replayed": "true" } : {}) });
      res.end(JSON.stringify(obj));
    };
    if (req.headers.authorization !== `Bearer ${apiKey}`) return send(401, { error: "unauthorized" });
    if (req.method === "GET" && req.url.startsWith("/v1/payment_intents")) return send(200, { data: [...state.intents.values()] });
    if (req.method !== "POST") return send(404, { error: "not_found" });
    if (!key) return send(400, { error: "idempotency_key_required" });
    const scoped = `${req.url}:${key}`;
    const prev = state.keys.get(scoped);
    if (prev) return prev.raw === raw ? send(prev.status, prev.body, true) : send(400, { error: "idempotency_key_reused" });
    let out;
    if (req.url === "/v1/payment_intents") out = createIntent(body);
    else if (req.url === "/v1/refunds") out = createRefund(bod
…