ashwin/nxtgauge-backend-rust
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Integrate Razorpay checkout payments

Browse source
This commit is contained in:
Tracewebstudio Dev 2026-06-26 20:47:31 +02:00
parent a38a2fd185
commit cd3fbfe7ca
3 changed files with 206 additions and 143 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Cargo.lock generated
View file

@ -2679,9 +2679,12 @@ dependencies = [
"axum", "axum",
"chrono", "chrono",
"contracts", "contracts",
"hex",
"hmac 0.12.1",
"reqwest", "reqwest",
"serde", "serde",
"serde_json", "serde_json",
"sha2 0.10.9",
"sqlx", "sqlx",
"tokio", "tokio",
"tracing", "tracing",

3
apps/payments/Cargo.toml
View file

@ -16,3 +16,6 @@ contracts = { path = "../../crates/contracts" }
sqlx.workspace = true sqlx.workspace = true
uuid.workspace = true uuid.workspace = true
chrono.workspace = true chrono.workspace = true
hmac = "0.12"
sha2 = "0.10"
hex = "0.4"

333
apps/payments/src/main.rs
View file

@ -1,33 +1,37 @@
use axum::{ use axum::{
extract::State, extract::{Path, State},
http::StatusCode, http::StatusCode,
routing::{get, post}, routing::{get, post},
Json, Router, Json, Router,
}; };
use contracts::auth_middleware::AuthUser; use contracts::auth_middleware::AuthUser;
use hmac::{Hmac, Mac};
use serde::{Deserialize, Serialize}; use serde::{Deserialize, Serialize};
use sha2::Sha256;
use sqlx::{postgres::PgPool, FromRow};
use std::net::SocketAddr; use std::net::SocketAddr;
use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt}; use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
use uuid::Uuid; use uuid::Uuid;
use sqlx::postgres::PgPool;
use sqlx::FromRow;
pub mod ai_credits; pub mod ai_credits;
pub mod packages; pub mod packages;
type HmacSha256 = Hmac<Sha256>;
#[derive(Clone)] #[derive(Clone)]
pub struct AppState { pub struct AppState {
beeceptor_url: String,
client: reqwest::Client, client: reqwest::Client,
pool: PgPool, pool: PgPool,
razorpay_key_id: String,
razorpay_key_secret: String,
} }
#[derive(Debug, Serialize, Deserialize)] #[derive(Debug, Deserialize)]
struct CreateOrderRequest { struct CreateOrderRequest {
amount: u64, amount: u64,
currency: Option<String>, currency: Option<String>,
receipt: Option<String>,
package_id: Option<String>, package_id: Option<String>,
user_id: Option<String>,
} }
#[derive(Debug, Serialize)] #[derive(Debug, Serialize)]
@ -38,10 +42,13 @@ struct CreateOrderResponse {
status: String, status: String,
} }
#[derive(Debug, Serialize, Deserialize)] #[derive(Debug, Deserialize)]
struct VerifyPaymentRequest { struct VerifyPaymentRequest {
order_id: String, #[serde(alias = "razorpay_order_id")]
payment_id: String, order_id: Option<String>,
#[serde(alias = "razorpay_payment_id")]
payment_id: Option<String>,
#[serde(alias = "razorpay_signature")]
signature: Option<String>, signature: Option<String>,
} }
@ -64,15 +71,42 @@ struct PaymentStatusResponse {
#[derive(Debug, FromRow)] #[derive(Debug, FromRow)]
struct PricingPackageRow { struct PricingPackageRow {
tracecoins_amount: i32, tracecoins_amount: i32,
price_inr: i32,
} }
#[derive(Debug, FromRow)] #[derive(Debug, FromRow)]
#[allow(dead_code)]
struct PaymentRow { struct PaymentRow {
id: Uuid, id: Uuid,
user_id: Uuid, user_id: Uuid,
package_id: Option<Uuid>,
tracecoins_credited: Option<i32>, tracecoins_credited: Option<i32>,
amount_inr: i32,
status: String,
razorpay_payment_id: Option<String>,
}
#[derive(Debug, Serialize)]
struct RazorpayOrderRequest {
amount: u64,
currency: String,
receipt: String,
notes: serde_json::Value,
}
#[derive(Debug, Deserialize)]
struct RazorpayOrderResponse {
id: String,
amount: u64,
currency: String,
status: String,
}
fn error_response(status: StatusCode, message: impl Into<String>) -> (StatusCode, String) {
(status, message.into())
}
fn build_receipt(receipt: Option<String>) -> String {
let candidate = receipt.unwrap_or_else(|| format!("tc_{}", Uuid::new_v4().simple()));
candidate.chars().take(40).collect()
} }
async fn create_order( async fn create_order(
@ -80,57 +114,82 @@ async fn create_order(
State(state): State<AppState>, State(state): State<AppState>,
Json(payload): Json<CreateOrderRequest>, Json(payload): Json<CreateOrderRequest>,
) -> Result<Json<CreateOrderResponse>, (StatusCode, String)> { ) -> Result<Json<CreateOrderResponse>, (StatusCode, String)> {
tracing::info!("Creating payment order: amount={}", payload.amount); let package_id_str = payload
.package_id
.as_ref()
.ok_or_else(|| error_response(StatusCode::BAD_REQUEST, "package_id is required"))?;
let package_id = Uuid::parse_str(package_id_str)
.map_err(|_| error_response(StatusCode::BAD_REQUEST, "Invalid package id"))?;
let package_id_str = payload.package_id.as_ref().ok_or((StatusCode::BAD_REQUEST, "package_id is required".to_string()))?; if payload.amount < 100 {
let package_id = Uuid::parse_str(package_id_str).map_err(|_| (StatusCode::BAD_REQUEST, "Invalid package id".to_string()))?; return Err(error_response(
StatusCode::BAD_REQUEST,
"Amount must be at least 100 paise",
));
}
let currency = payload.currency.unwrap_or_else(|| "INR".to_string());
let package = sqlx::query_as::<_, PricingPackageRow>( let package = sqlx::query_as::<_, PricingPackageRow>(
"SELECT tracecoins_amount FROM pricing_packages WHERE id = $1 AND is_active = true", "SELECT tracecoins_amount, price_inr FROM pricing_packages WHERE id = $1 AND is_active = true",
) )
.bind(package_id) .bind(package_id)
.fetch_optional(&state.pool) .fetch_optional(&state.pool)
.await .await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?; .map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
let package = package.ok_or((StatusCode::BAD_REQUEST, "Invalid or inactive package".to_string()))?; let package = package.ok_or_else(|| {
let tracecoins_credited = package.tracecoins_amount; error_response(StatusCode::BAD_REQUEST, "Invalid or inactive package")
})?;
let resp = state if payload.amount != package.price_inr as u64 {
.client return Err(error_response(
.post(&state.beeceptor_url)
.header("Content-Type", "application/json")
.json(&serde_json::json!({
"amount": payload.amount,
"currency": payload.currency.as_deref().unwrap_or("INR"),
"package_id": package_id_str,
"user_id": auth.user_id.to_string(),
}))
.send()
.await
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Beeceptor error: {}", e)))?;
let status = resp.status();
let body: serde_json::Value = resp
.json()
.await
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Parse error: {}", e)))?;
if !status.is_success() {
return Err((
StatusCode::BAD_REQUEST, StatusCode::BAD_REQUEST,
body.get("message") "Requested amount does not match package price",
.and_then(|m| m.as_str())
.unwrap_or("Order creation failed")
.to_string(),
)); ));
} }
let order_id = body let razorpay_request = RazorpayOrderRequest {
.get("order_id") amount: payload.amount,
.and_then(|v| v.as_str()) currency: currency.clone(),
.unwrap_or("mock_order_123") receipt: build_receipt(payload.receipt),
.to_string(); notes: serde_json::json!({
"package_id": package_id_str,
"user_id": auth.user_id.to_string(),
}),
};
let resp = state
.client
.post("https://api.razorpay.com/v1/orders")
.basic_auth(&state.razorpay_key_id, Some(&state.razorpay_key_secret))
.json(&razorpay_request)
.send()
.await
.map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("Razorpay request failed: {e}")))?;
let status = resp.status();
if status == StatusCode::UNAUTHORIZED {
return Err(error_response(
StatusCode::UNAUTHORIZED,
"Razorpay authentication failed",
));
}
if !status.is_success() {
let body = resp
.text()
.await
.unwrap_or_else(|_| "Unable to read Razorpay error response".to_string());
return Err(error_response(
StatusCode::INTERNAL_SERVER_ERROR,
format!("Razorpay order creation failed: {body}"),
));
}
let razorpay_order = resp
.json::<RazorpayOrderResponse>()
.await
.map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("Invalid Razorpay response: {e}")))?;
sqlx::query( sqlx::query(
r#" r#"
@ -140,18 +199,18 @@ async fn create_order(
) )
.bind(auth.user_id) .bind(auth.user_id)
.bind(package_id) .bind(package_id)
.bind(&order_id) .bind(&razorpay_order.id)
.bind(payload.amount as i64) .bind(razorpay_order.amount as i64)
.bind(tracecoins_credited) .bind(package.tracecoins_amount)
.execute(&state.pool) .execute(&state.pool)
.await .await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?; .map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
Ok(Json(CreateOrderResponse { Ok(Json(CreateOrderResponse {
order_id, order_id: razorpay_order.id,
amount: payload.amount, amount: razorpay_order.amount,
currency: payload.currency.unwrap_or("INR".to_string()), currency: razorpay_order.currency,
status: "created".to_string(), status: razorpay_order.status,
})) }))
} }
@ -160,53 +219,52 @@ async fn verify_payment(
State(state): State<AppState>, State(state): State<AppState>,
Json(payload): Json<VerifyPaymentRequest>, Json(payload): Json<VerifyPaymentRequest>,
) -> Result<Json<VerifyPaymentResponse>, (StatusCode, String)> { ) -> Result<Json<VerifyPaymentResponse>, (StatusCode, String)> {
tracing::info!("Verifying payment: order_id={}", payload.order_id); let order_id = payload
.order_id
.ok_or_else(|| error_response(StatusCode::BAD_REQUEST, "order_id is required"))?;
let payment_id = payload
.payment_id
.ok_or_else(|| error_response(StatusCode::BAD_REQUEST, "payment_id is required"))?;
let signature = payload
.signature
.ok_or_else(|| error_response(StatusCode::BAD_REQUEST, "razorpay_signature is required"))?;
let verify_url = format!("{}/verify", state.beeceptor_url.trim_end_matches('/')); let provided_signature = hex::decode(signature)
let resp = state .map_err(|_| error_response(StatusCode::BAD_REQUEST, "Invalid signature format"))?;
.client
.post(&verify_url)
.header("Content-Type", "application/json")
.json(&payload)
.send()
.await
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Beeceptor error: {}", e)))?;
let status = resp.status(); let mut mac = HmacSha256::new_from_slice(state.razorpay_key_secret.as_bytes())
let body: serde_json::Value = resp .map_err(|_| error_response(StatusCode::INTERNAL_SERVER_ERROR, "Unable to initialize signature verifier"))?;
.json() mac.update(format!("{order_id}|{payment_id}").as_bytes());
.await mac.verify_slice(&provided_signature)
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Parse error: {}", e)))?; .map_err(|_| error_response(StatusCode::BAD_REQUEST, "Signature mismatch"))?;
if !status.is_success() {
return Err((
StatusCode::BAD_REQUEST,
body.get("message")
.and_then(|m| m.as_str())
.unwrap_or("Verification failed")
.to_string(),
));
}
let payment = sqlx::query_as::<_, PaymentRow>( let payment = sqlx::query_as::<_, PaymentRow>(
r#" r#"
SELECT id, user_id, package_id, tracecoins_credited SELECT id, user_id, tracecoins_credited, amount_inr, status, razorpay_payment_id
FROM payments FROM payments
WHERE razorpay_order_id = $1 AND status = 'PENDING' WHERE razorpay_order_id = $1 AND status = 'PENDING'
"#, "#,
) )
.bind(&payload.order_id) .bind(&order_id)
.fetch_optional(&state.pool) .fetch_optional(&state.pool)
.await .await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?; .map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
let payment = match payment { let payment = match payment {
Some(p) => p, Some(payment) => payment,
None => return Err((StatusCode::NOT_FOUND, "Payment not found or already processed".to_string())), None => {
return Err(error_response(
StatusCode::NOT_FOUND,
"Payment not found or already processed",
))
}
}; };
if payment.user_id != auth.user_id { if payment.user_id != auth.user_id {
return Err((StatusCode::FORBIDDEN, "Payment does not belong to user".to_string())); return Err(error_response(
StatusCode::FORBIDDEN,
"Payment does not belong to user",
));
} }
let tracecoins = payment.tracecoins_credited.unwrap_or(0); let tracecoins = payment.tracecoins_credited.unwrap_or(0);
@ -220,11 +278,11 @@ async fn verify_payment(
WHERE id = $2 WHERE id = $2
"#, "#,
) )
.bind(&payload.payment_id) .bind(&payment_id)
.bind(payment.id) .bind(payment.id)
.execute(&state.pool) .execute(&state.pool)
.await .await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?; .map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
sqlx::query( sqlx::query(
r#" r#"
@ -238,16 +296,16 @@ async fn verify_payment(
.bind(tracecoins as i64) .bind(tracecoins as i64)
.execute(&state.pool) .execute(&state.pool)
.await .await
.map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?; .map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
if let Ok(Some(wallet_id)) = sqlx::query_scalar::<_, Uuid>( if let Ok(Some(wallet_id)) = sqlx::query_scalar::<_, Uuid>(
"SELECT id FROM tracecoin_wallets WHERE user_id = $1" "SELECT id FROM tracecoin_wallets WHERE user_id = $1",
) )
.bind(payment.user_id) .bind(payment.user_id)
.fetch_optional(&state.pool) .fetch_optional(&state.pool)
.await .await
{ {
sqlx::query( let _ = sqlx::query(
r#" r#"
INSERT INTO tracecoin_ledger (wallet_id, transaction_type, amount, reference_type, reference_id) INSERT INTO tracecoin_ledger (wallet_id, transaction_type, amount, reference_type, reference_id)
VALUES ($1, 'CREDIT', $2, 'PAYMENT', $3) VALUES ($1, 'CREDIT', $2, 'PAYMENT', $3)
@ -257,8 +315,7 @@ async fn verify_payment(
.bind(tracecoins as i64) .bind(tracecoins as i64)
.bind(payment.id) .bind(payment.id)
.execute(&state.pool) .execute(&state.pool)
.await .await;
.ok();
} }
let _ = sqlx::query( let _ = sqlx::query(
@ -269,67 +326,68 @@ async fn verify_payment(
) )
.bind(payment.user_id) .bind(payment.user_id)
.bind("Tracecoins Purchased Successfully") .bind("Tracecoins Purchased Successfully")
.bind(format!("Your {} Tracecoin package has been credited to your wallet.", tracecoins)) .bind(format!(
"Your {} Tracecoin package has been credited to your wallet.",
tracecoins
))
.bind("PAYMENT") .bind("PAYMENT")
.bind(payment.id) .bind(payment.id)
.execute(&state.pool) .execute(&state.pool)
.await .await;
.ok();
Ok(Json(VerifyPaymentResponse { Ok(Json(VerifyPaymentResponse {
verified: true, verified: true,
payment_id: payload.payment_id, payment_id,
status: "success".to_string(), status: "success".to_string(),
message: "Payment verified successfully".to_string(), message: "Payment verified successfully".to_string(),
})) }))
} }
async fn get_payment_status( async fn get_payment_status(
auth: AuthUser,
State(state): State<AppState>, State(state): State<AppState>,
axum::extract::Path(payment_id): axum::extract::Path<String>, Path(payment_id): Path<String>,
) -> Result<Json<PaymentStatusResponse>, (StatusCode, String)> { ) -> Result<Json<PaymentStatusResponse>, (StatusCode, String)> {
tracing::info!("Getting payment status: payment_id={}", payment_id); let payment = sqlx::query_as::<_, PaymentRow>(
r#"
let status_url = format!("{}/{}", state.beeceptor_url.trim_end_matches('/'), payment_id); SELECT id, user_id, tracecoins_credited, amount_inr, status, razorpay_payment_id
let resp = state FROM payments
.client WHERE razorpay_payment_id = $1 OR razorpay_order_id = $1
.get(&status_url) ORDER BY created_at DESC
.send() LIMIT 1
"#,
)
.bind(&payment_id)
.fetch_optional(&state.pool)
.await .await
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Beeceptor error: {}", e)))?; .map_err(|e| error_response(StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?;
let status = resp.status(); let payment = match payment {
let body: serde_json::Value = resp Some(payment) => payment,
.json() None => {
.await
.map_err(|e| (StatusCode::BAD_GATEWAY, format!("Parse error: {}", e)))?;
if !status.is_success() {
return Ok(Json(PaymentStatusResponse { return Ok(Json(PaymentStatusResponse {
payment_id, payment_id,
status: "not_found".to_string(), status: "not_found".to_string(),
amount: 0, amount: 0,
currency: "INR".to_string(), currency: "INR".to_string(),
})); }))
}
};
if payment.user_id != auth.user_id {
return Err(error_response(
StatusCode::FORBIDDEN,
"Payment does not belong to user",
));
} }
let amount = body.get("amount").and_then(|v| v.as_u64()).unwrap_or(0);
let currency = body
.get("currency")
.and_then(|v| v.as_str())
.unwrap_or("INR")
.to_string();
let status_str = body
.get("status")
.and_then(|v| v.as_str())
.unwrap_or("unknown")
.to_string();
Ok(Json(PaymentStatusResponse { Ok(Json(PaymentStatusResponse {
payment_id, payment_id: payment
status: status_str, .razorpay_payment_id
amount, .unwrap_or(payment_id),
currency, status: payment.status.to_lowercase(),
amount: payment.amount_inr as u64,
currency: "INR".to_string(),
})) }))
} }
@ -342,19 +400,18 @@ async fn main() {
.with(tracing_subscriber::fmt::layer()) .with(tracing_subscriber::fmt::layer())
.init(); .init();
let beeceptor_url = std::env::var("BEECEPTOR_URL") let db_url = std::env::var("DATABASE_URL").expect("DATABASE_URL must be set");
.expect("BEECEPTOR_URL must be set");
let db_url = std::env::var("DATABASE_URL")
.expect("DATABASE_URL must be set");
let pool = PgPool::connect(&db_url) let pool = PgPool::connect(&db_url)
.await .await
.expect("Failed to connect to database"); .expect("Failed to connect to database");
let state = AppState { let state = AppState {
beeceptor_url,
client: reqwest::Client::new(), client: reqwest::Client::new(),
pool, pool,
razorpay_key_id: std::env::var("RAZORPAY_KEY_ID")
.expect("RAZORPAY_KEY_ID must be set"),
razorpay_key_secret: std::env::var("RAZORPAY_KEY_SECRET")
.expect("RAZORPAY_KEY_SECRET must be set"),
}; };
let app = Router::new() let app = Router::new()