Seller Payouts

module MyApp
  class PayoutProvider < Spree::PayoutProvider::Base
    def self.display_name
      'Acme Bank Rails'
    end

    def self.reference_system
      'acme'
    end

    def self.requires_payout_account?
      true
    end

    def self.available_for_store?(store)
      store.integrations.active.exists?(type: 'MyApp::AcmeIntegration')
    end

    def onboarding_url(seller, refresh_url:, return_url:)
      account_id = seller.payout_account_reference(self.class) ||
                   client(seller.store).accounts.create(email: seller.contact_email).id.tap do |id|
                     seller.set_payout_account_reference(self.class, id)
                   end

      client(seller.store).onboarding_links.create(account: account_id, refresh_url:, return_url:).url
    rescue Acme::Error => e
      raise Spree::Core::GatewayError, e.message
    end

    def onboarded?(seller)
      account = client(seller.store).accounts.retrieve(seller.payout_account_reference(self.class))
      account.verified?
    end

    def transfer!(seller_transfer)
      seller_transfer.update!(status: 'completed')
      seller_transfer
    end

    def pay!(seller_payout)
      seller = seller_payout.seller
      transfer = client(seller.store).transfers.create(
        amount: seller_payout.amount,
        currency: seller_payout.currency,
        destination: seller.payout_account_reference(self.class),
        idempotency_key: idempotency_key(seller_payout)
      )

      seller_payout.update!(reference: transfer.id)
      seller_payout
    rescue Acme::TimeoutError, Acme::ServerError => e
      raise Spree::Core::AmbiguousGatewayError, e.message
    rescue Acme::Error => e
      raise Spree::Core::GatewayError, e.message
    end

    def reverse!(seller_transfer)
      seller_transfer.update!(status: 'completed')
      seller_transfer
    end

    private

    def client(store)
      Acme::Client.new(api_key: store.integrations.active.find_by!(type: 'MyApp::AcmeIntegration').preferred_api_key)
    end
  end
end

module MyApp
  class AcmeIntegration < Spree::Integration
    preference :api_key, :password
    preference :webhook_secret, :password

    def self.integration_group = 'payments'

    def can_connect?
      Acme::Client.new(api_key: preferred_api_key).ping
      true
    rescue Acme::Error => e
      self.connection_error_message = e.message
      false
    end
  end
end

Spree.integrations << 'MyApp::AcmeIntegration'
Spree.payout_providers << MyApp::PayoutProvider

Rails.application.routes.draw do
  post 'webhooks/acme/:integration_id', to: 'acme_webhooks#create'

  mount Spree::Core::Engine, at: '/'
end

# Events from the payout provider: POST /webhooks/acme/:integration_id
#
# Handled inline rather than in a job — marking a seller payable or a payout
# settled is a couple of database writes — and answered with a 5xx when they
# fail, so the provider redelivers. A 200 for work that did not happen is a
# settlement nobody will ever record.
class AcmeWebhooksController < ActionController::API
  include ActionController::RateLimiting

  rate_limit to: 120, within: 1.minute, store: Rails.cache, by: -> { request.remote_ip }

  def create
    integration = Spree::Integration.active.find_by_prefix_id!(params[:integration_id])
    event = verified_event(integration)

    case event['type']
    when 'account.updated' then account_updated(integration.store, event['data'])
    when 'transfer.paid' then payout_settled(integration.store, event['data'], paid: true)
    when 'transfer.failed' then payout_settled(integration.store, event['data'], paid: false)
    end

    head :ok
  rescue Spree::Integration::WebhookSignatureError
    head :unauthorized
  rescue ActiveRecord::RecordNotFound
    head :not_found
  rescue StandardError => e
    Rails.error.report(e, source: 'my_app.webhooks.acme')
    head :internal_server_error
  end

  private

  # Constant-time comparison against the secret this integration was given.
  # Anything unsigned or signed for another store is a 401, so a
  # misconfigured sender notices rather than being silently ignored.
  def verified_event(integration)
    expected = OpenSSL::HMAC.hexdigest('SHA256', integration.preferred_webhook_secret.to_s, request.raw_post)
    given = request.headers['X-Acme-Signature'].to_s
    raise Spree::Integration::WebhookSignatureError unless ActiveSupport::SecurityUtils.secure_compare(expected, given)

    JSON.parse(request.raw_post)
  rescue JSON::ParserError
    raise Spree::Integration::WebhookSignatureError, 'Malformed webhook payload'
  end

  # The provider knows the account, not the seller. The reverse lookup is a
  # uniquely indexed read scoped to this store, so an account id from another
  # tenant finds nothing.
  def seller_for(store, account_id)
    Spree::Seller.with_payout_account(store, MyApp::PayoutProvider, account_id).first
  end

  # Whether the provider will now accept money for this seller. It can go
  # back to false — expired documents, a closed account — and clearing the
  # stamp makes Spree hold new earnings instead of promising money nothing
  # can send. Becoming payable sends whatever they earned while unverified.
  def account_updated(store, data)
    seller = seller_for(store, data['account_id'])
    return if seller.nil?

    verified = data['verified'] == true
    became_payable = verified && seller.payouts_enabled_at.nil?

    seller.update!(payouts_enabled_at: verified ? (seller.payouts_enabled_at || Time.current) : nil)
    Spree::SellerTransfers::ExecutePendingJob.perform_later(seller.id) if became_payable
  end

  # Matched on the reference stored in `pay!`, never on amount or recency: a
  # redelivered event would otherwise skip the settlement it already completed
  # and land on the next one owed. The workflow is idempotent against a second
  # delivery and races safely with an operator marking the same payout paid.
  def payout_settled(store, data, paid:)
    seller = seller_for(store, data['account_id'])
    return if seller.nil?

    payout = seller.seller_payouts.find_by(provider: MyApp::PayoutProvider.provider_key, reference: data['transfer_id'])
    return if payout.nil? || payout.completed?

    if paid
      Spree.seller_payout_complete_workflow.call(seller_payout: payout, reference: data['transfer_id'])
    else
      payout.fail!
    end
  end
end