ashwin/nxtgauge-backend-rust
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Integrate Razorpay checkout payments

Browse source
This commit is contained in:
Tracewebstudio Dev 2026-06-26 20:47:31 +02:00
parent a38a2fd185
commit cd3fbfe7ca
3 changed files with 206 additions and 143 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Cargo.lock generated
View file

@ -2679,9 +2679,12 @@ dependencies = [
"axum",
"chrono",
"contracts",
"hex",
"hmac 0.12.1",
"reqwest",
"serde",
"serde_json",
"sha2 0.10.9",
"sqlx",
"tokio",
"tracing",

3
apps/payments/Cargo.toml
View file

@ -16,3 +16,6 @@ contracts = { path = "../../crates/contracts" }
sqlx.workspace = true
uuid.workspace = true
chrono.workspace = true
hmac = "0.12"
sha2 = "0.10"
hex = "0.4"

343
apps/payments/src/main.rs
View file

@ -1,33 +1,37 @@
use axum::{
extract::State,
extract::{Path, State},
http::StatusCode,
routing::{get, post},
Json, Router,
};
use contracts::auth_middleware::AuthUser;
use hmac::{Hmac, Mac};
use serde::{Deserialize, Serialize};
use sha2::Sha256;
use sqlx::{postgres::PgPool, FromRow};
use std::net::SocketAddr;
use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
use uuid::Uuid;
use sqlx::postgres::PgPool;
use sqlx::FromRow;
pub mod ai_credits;
pub mod packages;
type HmacSha256 = Hmac<Sha256>;
#[derive(Clone)]
pub struct AppState {
beeceptor_url: String,
client: reqwest::Client,
pool: PgPool,
razorpay_key_id: String,
razorpay_key_secret: String,
}
#[derive(Debug, Serialize, Deserialize)]
#[derive(Debug, Deserialize)]
struct CreateOrderRequest {
amount: u64,
currency: Option<String>,
receipt: Option<String>,
package_id: Option<String>,
user_id: Option<String>,
}
#[derive(Debug, Serialize)]
@ -38,10 +42,13 @@ struct CreateOrderResponse {
status: String,
}
#[derive(Debug, Serialize, Deserialize)]
#[derive(Debug, Deserialize)]
struct VerifyPaymentRequest {
order_id: String,
payment_id: String,
#[serde(alias = "razorpay_order_id")]
order_id: Option<String>,
#[serde(alias = "razorpay_payment_id")]
payment_id: Option<String>,
#[serde(alias = "razorpay_signature")]
signature: Option<String>,
}
@ -64,15 +71,42 @@ struct PaymentStatusResponse {
#[derive(Debug, FromRow)]
struct PricingPackageRow {
tracecoins_amount: i32,
price_inr: i32,
}
#[derive(Debug, FromRow)]
#[allow(dead_code)]
struct PaymentRow {
id: Uuid,
user_id: Uuid,
package_id: Option<Uuid>,
tracecoins_credited: Option<i32>,
amount_inr: i32,
status: String,
razorpay_payment_id: Option<String>,
}
#[derive(Debug, Serialize)]
struct RazorpayOrderRequest {
amount: u64,
currency: String,
receipt: String,
notes: serde_json::Value,
}
#[derive(Debug, Deserialize)]
struct RazorpayOrderResponse {
id: String,
amount: u64,
currency: String,
status: String,
}
fn error_response(status: StatusCode, message: impl Into<String>) -> (StatusCode, String) {
(status, message.into())
}
fn build_receipt(receipt: Option<String>) -> String {
let candidate = receipt.unwrap_or_else(|| format!("tc_{}", Uuid::new_v4().simple()));
candidate.chars().take(40).collect()
}
async fn create_order(
@ -80,57 +114,82 @@ async fn create_order(
State(state): State<AppState>,
Json(payload): Json<CreateOrderRequest>,
) -> Result<Json<CreateOrderResponse>, (StatusCode, String)> {
tracing::info!("Creating payment order: amount={}", payload.amount);
let package_id_str = payload
.package_id
.as_ref()
.ok_or_else(|| error_response(StatusCode::BAD_REQUEST, "package_id is required"))?;
let package_id = Uuid::parse_str(package_id_str)
.map_err(|_| error_response(StatusCode::BAD_REQUEST, "Invalid package id"))?;
let package_id_str = payload.package_id.as_ref().ok_or((StatusCode::BAD_REQUEST, "package_id is required".to_string()))?;
let package_id = Uuid::parse_str(package_id_str).map_err(|_| (StatusCode::BAD_REQUEST, "Invalid package id".to_string()))?;
if payload.amount < 100 {
return Err(error_response(
StatusCode::BAD_REQUEST,
"Amount must be at least 100 paise",
));
}
let currency = payload.currency.unwrap_or_else(|| "INR".to_string());
let package = sqlx::query_as::<_, PricingPackageRow>(
"SELECT tracecoins_amount FROM pricing_packages WHERE id = $1 AND is_active = true",
"SELECT tracecoins_amount, price_inr FROM pricing_packages WHERE id = $1 AND is_active = true",
)
.bind(package_id)
.fetch_optional(&state.pool)
.await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
.map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
let package = package.ok_or((StatusCode::BAD_REQUEST, "Invalid or inactive package".to_string()))?;
let tracecoins_credited = package.tracecoins_amount;
let package = package.ok_or_else(|| {
error_response(StatusCode::BAD_REQUEST, "Invalid or inactive package")
})?;
let resp = state
.client
.post(&state.beeceptor_url)
.header("Content-Type", "application/json")
.json(&serde_json::json!({
"amount": payload.amount,
"currency": payload.currency.as_deref().unwrap_or("INR"),
"package_id": package_id_str,
"user_id": auth.user_id.to_string(),
}))
.send()
.await
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Beeceptor error: {}", e)))?;
let status = resp.status();
let body: serde_json::Value = resp
.json()
.await
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Parse error: {}", e)))?;
if !status.is_success() {
return Err((
if payload.amount != package.price_inr as u64 {
return Err(error_response(
StatusCode::BAD_REQUEST,
body.get("message")
.and_then(|m| m.as_str())
.unwrap_or("Order creation failed")
.to_string(),
"Requested amount does not match package price",
));
}
let order_id = body
.get("order_id")
.and_then(|v| v.as_str())
.unwrap_or("mock_order_123")
.to_string();
let razorpay_request = RazorpayOrderRequest {
amount: payload.amount,
currency: currency.clone(),
receipt: build_receipt(payload.receipt),
notes: serde_json::json!({
"package_id": package_id_str,
"user_id": auth.user_id.to_string(),
}),
};
let resp = state
.client
.post("https://api.razorpay.com/v1/orders")
.basic_auth(&state.razorpay_key_id, Some(&state.razorpay_key_secret))
.json(&razorpay_request)
.send()
.await
.map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("Razorpay request failed: {e}")))?;
let status = resp.status();
if status == StatusCode::UNAUTHORIZED {
return Err(error_response(
StatusCode::UNAUTHORIZED,
"Razorpay authentication failed",
));
}
if !status.is_success() {
let body = resp
.text()
.await
.unwrap_or_else(|_| "Unable to read Razorpay error response".to_string());
return Err(error_response(
StatusCode::INTERNAL_SERVER_ERROR,
format!("Razorpay order creation failed: {body}"),
));
}
let razorpay_order = resp
.json::<RazorpayOrderResponse>()
.await
.map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("Invalid Razorpay response: {e}")))?;
sqlx::query(
r#"
@ -140,18 +199,18 @@ async fn create_order(
)
.bind(auth.user_id)
.bind(package_id)
.bind(&order_id)
.bind(payload.amount as i64)
.bind(tracecoins_credited)
.bind(&razorpay_order.id)
.bind(razorpay_order.amount as i64)
.bind(package.tracecoins_amount)
.execute(&state.pool)
.await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
.map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
Ok(Json(CreateOrderResponse {
order_id,
amount: payload.amount,
currency: payload.currency.unwrap_or("INR".to_string()),
status: "created".to_string(),
order_id: razorpay_order.id,
amount: razorpay_order.amount,
currency: razorpay_order.currency,
status: razorpay_order.status,
}))
}
@ -160,53 +219,52 @@ async fn verify_payment(
State(state): State<AppState>,
Json(payload): Json<VerifyPaymentRequest>,
) -> Result<Json<VerifyPaymentResponse>, (StatusCode, String)> {
tracing::info!("Verifying payment: order_id={}", payload.order_id);
let order_id = payload
.order_id
.ok_or_else(|| error_response(StatusCode::BAD_REQUEST, "order_id is required"))?;
let payment_id = payload
.payment_id
.ok_or_else(|| error_response(StatusCode::BAD_REQUEST, "payment_id is required"))?;
let signature = payload
.signature
.ok_or_else(|| error_response(StatusCode::BAD_REQUEST, "razorpay_signature is required"))?;
let verify_url = format!("{}/verify", state.beeceptor_url.trim_end_matches('/'));
let resp = state
.client
.post(&verify_url)
.header("Content-Type", "application/json")
.json(&payload)
.send()
.await
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Beeceptor error: {}", e)))?;
let provided_signature = hex::decode(signature)
.map_err(|_| error_response(StatusCode::BAD_REQUEST, "Invalid signature format"))?;
let status = resp.status();
let body: serde_json::Value = resp
.json()
.await
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Parse error: {}", e)))?;
if !status.is_success() {
return Err((
StatusCode::BAD_REQUEST,
body.get("message")
.and_then(|m| m.as_str())
.unwrap_or("Verification failed")
.to_string(),
));
}
let mut mac = HmacSha256::new_from_slice(state.razorpay_key_secret.as_bytes())
.map_err(|_| error_response(StatusCode::INTERNAL_SERVER_ERROR, "Unable to initialize signature verifier"))?;
mac.update(format!("{order_id}|{payment_id}").as_bytes());
mac.verify_slice(&provided_signature)
.map_err(|_| error_response(StatusCode::BAD_REQUEST, "Signature mismatch"))?;
let payment = sqlx::query_as::<_, PaymentRow>(
r#"
SELECT id, user_id, package_id, tracecoins_credited
SELECT id, user_id, tracecoins_credited, amount_inr, status, razorpay_payment_id
FROM payments
WHERE razorpay_order_id = $1 AND status = 'PENDING'
"#,
)
.bind(&payload.order_id)
.bind(&order_id)
.fetch_optional(&state.pool)
.await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
.map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
let payment = match payment {
Some(p) => p,
None => return Err((StatusCode::NOT_FOUND, "Payment not found or already processed".to_string())),
Some(payment) => payment,
None => {
return Err(error_response(
StatusCode::NOT_FOUND,
"Payment not found or already processed",
))
}
};
if payment.user_id != auth.user_id {
return Err((StatusCode::FORBIDDEN, "Payment does not belong to user".to_string()));
return Err(error_response(
StatusCode::FORBIDDEN,
"Payment does not belong to user",
));
}
let tracecoins = payment.tracecoins_credited.unwrap_or(0);
@ -220,11 +278,11 @@ async fn verify_payment(
WHERE id = $2
"#,
)
.bind(&payload.payment_id)
.bind(&payment_id)
.bind(payment.id)
.execute(&state.pool)
.await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
.map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
sqlx::query(
r#"
@ -238,16 +296,16 @@ async fn verify_payment(
.bind(tracecoins as i64)
.execute(&state.pool)
.await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
.map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
if let Ok(Some(wallet_id)) = sqlx::query_scalar::<_, Uuid>(
"SELECT id FROM tracecoin_wallets WHERE user_id = $1"
"SELECT id FROM tracecoin_wallets WHERE user_id = $1",
)
.bind(payment.user_id)
.fetch_optional(&state.pool)
.await
{
sqlx::query(
let _ = sqlx::query(
r#"
INSERT INTO tracecoin_ledger (wallet_id, transaction_type, amount, reference_type, reference_id)
VALUES ($1, 'CREDIT', $2, 'PAYMENT', $3)
@ -257,8 +315,7 @@ async fn verify_payment(
.bind(tracecoins as i64)
.bind(payment.id)
.execute(&state.pool)
.await
.ok();
.await;
}
let _ = sqlx::query(
@ -269,67 +326,68 @@ async fn verify_payment(
)
.bind(payment.user_id)
.bind("Tracecoins Purchased Successfully")
.bind(format!("Your {} Tracecoin package has been credited to your wallet.", tracecoins))
.bind(format!(
"Your {} Tracecoin package has been credited to your wallet.",
tracecoins
))
.bind("PAYMENT")
.bind(payment.id)
.execute(&state.pool)
.await
.ok();
.await;
Ok(Json(VerifyPaymentResponse {
verified: true,
payment_id: payload.payment_id,
payment_id,
status: "success".to_string(),
message: "Payment verified successfully".to_string(),
}))
}
async fn get_payment_status(
auth: AuthUser,
State(state): State<AppState>,
axum::extract::Path(payment_id): axum::extract::Path<String>,
Path(payment_id): Path<String>,
) -> Result<Json<PaymentStatusResponse>, (StatusCode, String)> {
tracing::info!("Getting payment status: payment_id={}", payment_id);
let payment = sqlx::query_as::<_, PaymentRow>(
r#"
SELECT id, user_id, tracecoins_credited, amount_inr, status, razorpay_payment_id
FROM payments
WHERE razorpay_payment_id = $1 OR razorpay_order_id = $1
ORDER BY created_at DESC
LIMIT 1
"#,
)
.bind(&payment_id)
.fetch_optional(&state.pool)
.await
.map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
let status_url = format!("{}/{}", state.beeceptor_url.trim_end_matches('/'), payment_id);
let resp = state
.client
.get(&status_url)
.send()
.await
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Beeceptor error: {}", e)))?;
let payment = match payment {
Some(payment) => payment,
None => {
return Ok(Json(PaymentStatusResponse {
payment_id,
status: "not_found".to_string(),
amount: 0,
currency: "INR".to_string(),
}))
}
};
let status = resp.status();
let body: serde_json::Value = resp
.json()
.await
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Parse error: {}", e)))?;
if !status.is_success() {
return Ok(Json(PaymentStatusResponse {
payment_id,
status: "not_found".to_string(),
amount: 0,
currency: "INR".to_string(),
}));
if payment.user_id != auth.user_id {
return Err(error_response(
StatusCode::FORBIDDEN,
"Payment does not belong to user",
));
}
let amount = body.get("amount").and_then(|v| v.as_u64()).unwrap_or(0);
let currency = body
.get("currency")
.and_then(|v| v.as_str())
.unwrap_or("INR")
.to_string();
let status_str = body
.get("status")
.and_then(|v| v.as_str())
.unwrap_or("unknown")
.to_string();
Ok(Json(PaymentStatusResponse {
payment_id,
status: status_str,
amount,
currency,
payment_id: payment
.razorpay_payment_id
.unwrap_or(payment_id),
status: payment.status.to_lowercase(),
amount: payment.amount_inr as u64,
currency: "INR".to_string(),
}))
}
@ -342,19 +400,18 @@ async fn main() {
.with(tracing_subscriber::fmt::layer())
.init();
let beeceptor_url = std::env::var("BEECEPTOR_URL")
.expect("BEECEPTOR_URL must be set");
let db_url = std::env::var("DATABASE_URL")
.expect("DATABASE_URL must be set");
let db_url = std::env::var("DATABASE_URL").expect("DATABASE_URL must be set");
let pool = PgPool::connect(&db_url)
.await
.expect("Failed to connect to database");
let state = AppState {
beeceptor_url,
client: reqwest::Client::new(),
pool,
razorpay_key_id: std::env::var("RAZORPAY_KEY_ID")
.expect("RAZORPAY_KEY_ID must be set"),
razorpay_key_secret: std::env::var("RAZORPAY_KEY_SECRET")
.expect("RAZORPAY_KEY_SECRET must be set"),
};
let app = Router::new()