120 lines
3.8 KiB
TypeScript
120 lines
3.8 KiB
TypeScript
// routes/api/update/payment_method.ts
|
|
import { define } from "../../../utils.ts";
|
|
import {
|
|
getPaymentMethodsByUser,
|
|
updatePaymentMethod,
|
|
} from "../../../services/paymentService.ts";
|
|
import { SessionCookie } from "../../auth/callback.ts";
|
|
|
|
export const handler = define.handlers({
|
|
async POST(ctx) {
|
|
try {
|
|
const stateData: SessionCookie = ctx.state.data;
|
|
const { user_id } = stateData;
|
|
|
|
const contentType = ctx.req.headers.get("content-type") || "";
|
|
let data: Record<string, string | boolean> = {};
|
|
let sender: string | null = null;
|
|
let isJsonRequest = false;
|
|
|
|
// Handle both JSON and form data
|
|
if (contentType.includes("application/json")) {
|
|
isJsonRequest = true;
|
|
const jsonData = await ctx.req.json();
|
|
data = jsonData;
|
|
} else {
|
|
const formData = await ctx.req.formData();
|
|
sender = formData.get("sender")?.toString() || null;
|
|
|
|
data = {
|
|
id: formData.get("id")?.toString() || "",
|
|
bank_name: formData.get("bank_name")?.toString() || "",
|
|
account_type: formData.get("account_type")?.toString() || "",
|
|
routing_number_encrypted:
|
|
formData.get("routing_number_encrypted")?.toString() || "",
|
|
account_number_encrypted:
|
|
formData.get("account_number_encrypted")?.toString() || "",
|
|
is_default: formData.get("is_default") === "true",
|
|
};
|
|
}
|
|
|
|
const id = data.id as string;
|
|
if (!id) {
|
|
return new Response(
|
|
JSON.stringify({
|
|
error: "Payment method ID is required",
|
|
}),
|
|
{
|
|
status: 400,
|
|
headers: { "Content-Type": "application/json" },
|
|
},
|
|
);
|
|
}
|
|
|
|
// DATA ISOLATION: Verify user owns this payment method
|
|
const userPaymentMethods = await getPaymentMethodsByUser(user_id);
|
|
const ownsPaymentMethod = userPaymentMethods.some(
|
|
(method) => method.id === id,
|
|
);
|
|
|
|
if (!ownsPaymentMethod) {
|
|
return new Response(
|
|
JSON.stringify({
|
|
error: "Payment method not found or unauthorized",
|
|
}),
|
|
{
|
|
status: 403,
|
|
headers: { "Content-Type": "application/json" },
|
|
},
|
|
);
|
|
}
|
|
|
|
// Build update object with only provided fields
|
|
const updates: Record<string, string | boolean> = {};
|
|
if (data.bank_name) updates.bank_name = data.bank_name;
|
|
if (data.account_type) updates.account_type = data.account_type;
|
|
if (data.routing_number_encrypted) {
|
|
updates.routing_number_encrypted = data.routing_number_encrypted;
|
|
}
|
|
if (data.account_number_encrypted) {
|
|
updates.account_number_encrypted = data.account_number_encrypted;
|
|
}
|
|
if (data.is_default !== undefined) updates.is_default = data.is_default;
|
|
|
|
const result = await updatePaymentMethod(id, updates);
|
|
|
|
// Return appropriate response based on request type
|
|
if (isJsonRequest) {
|
|
return new Response(
|
|
JSON.stringify({
|
|
success: true,
|
|
payment_method: result[0],
|
|
}),
|
|
{
|
|
status: 200,
|
|
headers: { "Content-Type": "application/json" },
|
|
},
|
|
);
|
|
} else {
|
|
// Redirect back to the sender URL
|
|
const senderPath = sender?.toString() || "/";
|
|
let redirectUrl = senderPath;
|
|
try {
|
|
if (senderPath.startsWith("/")) {
|
|
const url = new URL(ctx.req.url);
|
|
redirectUrl = url.origin + senderPath;
|
|
}
|
|
} catch (_) {
|
|
// fallback: just use senderPath
|
|
}
|
|
return Response.redirect(redirectUrl, 303);
|
|
}
|
|
} catch (e) {
|
|
return new Response(JSON.stringify({ error: e }), {
|
|
status: 500,
|
|
headers: { "Content-Type": "application/json" },
|
|
});
|
|
}
|
|
},
|
|
});
|