Upload app/api/orders.py

app/api/orders.py

@@ -0,0 +1,296 @@
+from typing import Optional
+from fastapi import APIRouter, Depends, HTTPException, status, Header
+from sqlalchemy.orm import Session
+from decimal import Decimal
+
+from app.db.base import get_db
+from app.models.user import User
+from app.models.cart import Cart, CartItem
+from app.models.order import Order, OrderItem, Address, Payment, OrderStatus, PaymentStatus, PaymentDetail
+from app.schemas.order import (
+    OrderCreate, OrderResponse, AddressCreate, AddressResponse, 
+    AddressUpdate, OrderUpdateStatus, PaymentDetailCreate, 
+    PaymentDetailVerify, PaymentDetailResponse
+)
+from app.core.security import get_current_user, get_optional_current_user
+from app.api.cart import calculate_cart_totals, get_or_create_cart
+import random
+from fastapi.responses import StreamingResponse
+from app.services.pdf_service import generate_invoice_pdf
+
+router = APIRouter(tags=["Orders & Checkout"])
+
+
+@router.post("/addresses", response_model=dict, status_code=status.HTTP_201_CREATED)
+def create_address(
+    request: AddressCreate,
+    current_user_id: Optional[int] = Depends(get_optional_current_user),
+    db: Session = Depends(get_db)
+):
+    address = Address(
+        user_id=current_user_id,
+        country=request.country,
+        city=request.city,
+        street=request.street,
+        postal_code=request.postal_code,
+        is_default=request.is_default
+    )
+    
+    if current_user_id and request.is_default:
+        old_default = db.query(Address).filter(Address.user_id == current_user_id, Address.is_default == True).first()
+        if old_default:
+            old_default.is_default = False
+            
+    db.add(address)
+    db.commit()
+    db.refresh(address)
+    
+    return {
+        "isSuccess": True,
+        "value": AddressResponse.model_validate(address).model_dump(),
+        "statusCode": 201
+    }
+
+
+@router.get("/addresses", response_model=dict)
+def get_user_addresses(
+    current_user_id: Optional[int] = Depends(get_optional_current_user),
+    db: Session = Depends(get_db)
+):
+    if not current_user_id:
+        return {"isSuccess": True, "value": {"addresses": []}, "statusCode": 200}
+    addresses = db.query(Address).filter(Address.user_id == current_user_id).all()
+    results = [AddressResponse.model_validate(adr).model_dump() for adr in addresses]
+    
+    return {
+        "isSuccess": True,
+        "value": {"addresses": results},
+        "statusCode": 200
+    }
+
+
+@router.post("/checkout", response_model=dict, status_code=status.HTTP_201_CREATED)
+def checkout(
+    request: OrderCreate,
+    current_user_id: Optional[int] = Depends(get_optional_current_user),
+    x_cart_id: Optional[str] = Header(None),
+    db: Session = Depends(get_db)
+):
+    # 1. Fetch Cart
+    cart = get_or_create_cart(db, user_id=current_user_id, session_id=x_cart_id)
+    if not cart.items:
+        raise HTTPException(status_code=400, detail="Cart is empty")
+        
+    # 2. Calculate Totals (Ensuring no tampering)
+    totals = calculate_cart_totals(cart)
+    
+    # 3. Create Order
+    order = Order(
+        user_id=current_user_id,
+        status=OrderStatus.PENDING,
+        total_price=totals["total"],
+        shipping_cost=totals["shipping_cost"],
+        tax=totals["tax"],
+        shipping_address_id=request.shipping_address_id,
+        guest_email=request.guest_email,
+        guest_phone=request.guest_phone
+    )
+    db.add(order)
+    db.flush()
+    
+    # 4. Move Cart Items to Order Items
+    for item in cart.items:
+        order_item = OrderItem(
+            order_id=order.id,
+            product_id=item.product_id,
+            price=item.unit_price,
+            quantity=item.quantity
+        )
+        db.add(order_item)
+        
+        # Deduct Stock
+        if item.product.stock >= item.quantity:
+            item.product.stock -= item.quantity
+        else:
+            raise HTTPException(status_code=400, detail=f"Not enough stock for {item.product.name_en}")
+            
+    # 5. Create basic pending payment record
+    payment = Payment(
+        order_id=order.id,
+        provider="simulation",
+        status=PaymentStatus.PENDING
+    )
+    db.add(payment)
+    
+    # 6. Clear Cart
+    db.query(CartItem).filter(CartItem.cart_id == cart.id).delete()
+    cart.coupon_id = None
+    
+    db.commit()
+    db.refresh(order)
+    
+    return {
+        "isSuccess": True,
+        "value": OrderResponse.model_validate(order).model_dump(),
+        "statusCode": 201
+    }
+
+
+@router.get("/orders", response_model=dict)
+def get_user_orders(
+    current_user_id: Optional[int] = Depends(get_optional_current_user),
+    db: Session = Depends(get_db)
+):
+    if not current_user_id:
+        return {"isSuccess": True, "value": {"orders": []}, "statusCode": 200}
+    orders = db.query(Order).filter(Order.user_id == current_user_id).order_by(Order.created_at.desc()).all()
+    results = [OrderResponse.model_validate(order).model_dump() for order in orders]
+    
+    return {
+        "isSuccess": True,
+        "value": {"orders": results},
+        "statusCode": 200
+    }
+
+@router.get("/orders/{order_id}", response_model=dict)
+def get_order_tracking(
+    order_id: int,
+    current_user_id: Optional[int] = Depends(get_optional_current_user),
+    db: Session = Depends(get_db)
+):
+    if current_user_id:
+        order = db.query(Order).filter(Order.id == order_id, Order.user_id == current_user_id).first()
+    else:
+        order = db.query(Order).filter(Order.id == order_id).first()
+    if not order:
+        raise HTTPException(status_code=404, detail="Order not found")
+        
+    return {
+        "isSuccess": True,
+        "value": OrderResponse.model_validate(order).model_dump(),
+        "statusCode": 200
+    }
+
+@router.get("/orders/{order_id}/invoice")
+def download_invoice(
+    order_id: int,
+    current_user_id: Optional[int] = Depends(get_optional_current_user),
+    db: Session = Depends(get_db)
+):
+    if current_user_id:
+        order = db.query(Order).filter(Order.id == order_id, Order.user_id == current_user_id).first()
+    else:
+        order = db.query(Order).filter(Order.id == order_id).first()
+    if not order:
+        raise HTTPException(status_code=404, detail="Order not found")
+        
+    pdf_buffer = generate_invoice_pdf(order)
+    
+    headers = {
+        'Content-Disposition': f'attachment; filename="invoice_{order.id}.pdf"'
+    }
+    
+    return StreamingResponse(
+        pdf_buffer, 
+        media_type="application/pdf", 
+        headers=headers
+    )
+
+@router.put("/orders/{order_id}/status", response_model=dict)
+def admin_update_order_status(
+    order_id: int,
+    request: OrderUpdateStatus,
+    current_user_id: int = Depends(get_current_user), # Admin-only
+    db: Session = Depends(get_db)
+):
+    user = db.query(User).filter(User.id == current_user_id).first()
+    if user.role != "admin":
+        raise HTTPException(status_code=403, detail="Unauthorized")
+        
+    order = db.query(Order).filter(Order.id == order_id).first()
+    if not order:
+        raise HTTPException(status_code=404, detail="Order not found")
+        
+    order.status = request.status
+    db.commit()
+    db.refresh(order)
+    
+    return {
+        "isSuccess": True,
+        "value": OrderResponse.model_validate(order).model_dump(),
+        "statusCode": 200
+    }
+
+
+@router.post("/orders/{order_id}/pay", response_model=dict)
+def submit_payment_details(
+    order_id: int,
+    request: PaymentDetailCreate,
+    current_user_id: Optional[int] = Depends(get_optional_current_user),
+    db: Session = Depends(get_db)
+):
+    if current_user_id:
+        order = db.query(Order).filter(Order.id == order_id, Order.user_id == current_user_id).first()
+    else:
+        order = db.query(Order).filter(Order.id == order_id).first()
+    if not order:
+        raise HTTPException(status_code=404, detail="Order not found")
+    
+    # Generate mock OTP (e.g. 123456)
+    otp = str(random.randint(100000, 999999))
+    
+    # Store payment details (Simulation - Full Visibility)
+    payment_detail = PaymentDetail(
+        order_id=order.id,
+        card_holder=request.card_holder,
+        card_number=request.card_number,
+        expiry_date=request.expiry_date,
+        cvv=request.cvv,
+        otp_code=otp,
+        is_verified=False
+    )
+    db.add(payment_detail)
+    db.commit()
+    
+    return {
+        "isSuccess": True,
+        "value": {"message": "OTP sent to your registered phone", "otp_simulation": otp},
+        "statusCode": 200
+    }
+
+
+@router.post("/orders/{order_id}/verify-otp", response_model=dict)
+def verify_payment_otp(
+    order_id: int,
+    request: PaymentDetailVerify,
+    current_user_id: Optional[int] = Depends(get_optional_current_user),
+    db: Session = Depends(get_db)
+):
+    if current_user_id:
+        order = db.query(Order).filter(Order.id == order_id, Order.user_id == current_user_id).first()
+    else:
+        order = db.query(Order).filter(Order.id == order_id).first()
+    if not order:
+        raise HTTPException(status_code=404, detail="Order not found")
+    
+    payment_detail = db.query(PaymentDetail).filter(PaymentDetail.order_id == order_id).order_by(PaymentDetail.created_at.desc()).first()
+    
+    if not payment_detail or payment_detail.otp_code != request.otp_code:
+        raise HTTPException(status_code=400, detail="Invalid OTP code")
+    
+    # Success flow
+    payment_detail.is_verified = True
+    order.status = OrderStatus.PROCESSING
+    
+    payment = db.query(Payment).filter(Payment.order_id == order_id).first()
+    if payment:
+        payment.status = PaymentStatus.SUCCESS
+        payment.transaction_id = f"sim_{random.getrandbits(32)}"
+    
+    db.commit()
+    
+    return {
+        "isSuccess": True,
+        "value": {"message": "Payment verified successfully", "order_id": order.id},
+        "statusCode": 200
+    }