102 lines
2.8 KiB
TypeScript
102 lines
2.8 KiB
TypeScript
// routes/api/delete/payment_method.ts
|
|
import { define } from "../../../utils.ts";
|
|
import {
|
|
deletePaymentMethod,
|
|
getPaymentMethodsByUser,
|
|
} from "../../../services/paymentService.ts";
|
|
import { SessionCookie } from "../../auth/callback.ts";
|
|
|
|
export const handler = define.handlers({
|
|
async POST(ctx) {
|
|
try {
|
|
const stateData: SessionCookie = ctx.state.data;
|
|
const { user_id } = stateData;
|
|
|
|
const contentType = ctx.req.headers.get("content-type") || "";
|
|
let data: Record<string, string> = {};
|
|
let sender: string | null = null;
|
|
let isJsonRequest = false;
|
|
|
|
// Handle both JSON and form data
|
|
if (contentType.includes("application/json")) {
|
|
isJsonRequest = true;
|
|
const jsonData = await ctx.req.json();
|
|
data = jsonData;
|
|
} else {
|
|
const formData = await ctx.req.formData();
|
|
sender = formData.get("sender")?.toString() || null;
|
|
|
|
data = {
|
|
id: formData.get("id")?.toString() || "",
|
|
};
|
|
}
|
|
|
|
const id = data.id;
|
|
|
|
if (!id) {
|
|
return new Response(
|
|
JSON.stringify({
|
|
error: "Payment method ID is required",
|
|
}),
|
|
{
|
|
status: 400,
|
|
headers: { "Content-Type": "application/json" },
|
|
},
|
|
);
|
|
}
|
|
|
|
// DATA ISOLATION: Verify user owns this payment method
|
|
const userPaymentMethods = await getPaymentMethodsByUser(user_id);
|
|
const ownsPaymentMethod = userPaymentMethods.some(
|
|
(method) => method.id === id,
|
|
);
|
|
|
|
if (!ownsPaymentMethod) {
|
|
return new Response(
|
|
JSON.stringify({
|
|
error: "Payment method not found or unauthorized",
|
|
}),
|
|
{
|
|
status: 403,
|
|
headers: { "Content-Type": "application/json" },
|
|
},
|
|
);
|
|
}
|
|
|
|
const result = await deletePaymentMethod(id);
|
|
|
|
// Return appropriate response based on request type
|
|
if (isJsonRequest) {
|
|
return new Response(
|
|
JSON.stringify({
|
|
success: true,
|
|
deleted: result[0],
|
|
}),
|
|
{
|
|
status: 200,
|
|
headers: { "Content-Type": "application/json" },
|
|
},
|
|
);
|
|
} else {
|
|
// Redirect back to the sender URL
|
|
const senderPath = sender?.toString() || "/";
|
|
let redirectUrl = senderPath;
|
|
try {
|
|
if (senderPath.startsWith("/")) {
|
|
const url = new URL(ctx.req.url);
|
|
redirectUrl = url.origin + senderPath;
|
|
}
|
|
} catch (_) {
|
|
// fallback: just use senderPath
|
|
}
|
|
return Response.redirect(redirectUrl, 303);
|
|
}
|
|
} catch (e) {
|
|
return new Response(JSON.stringify({ error: e }), {
|
|
status: 500,
|
|
headers: { "Content-Type": "application/json" },
|
|
});
|
|
}
|
|
},
|
|
});
|