# ****************************************************************************** # PAYMENT BTCPAY FOR ODOO # # Copyright (C) 2020 Susanna Fort # # ****************************************************************************** # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License as # published by the Free Software Foundation; either version 2 of # the License, or any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # For a full copy of the GNU General Public License see the LICENSE.txt file. # # ****************************************************************************** import json import pprint from werkzeug import urls from odoo import _, http from odoo.exceptions import ValidationError from odoo.http import request from odoo.addons.payment.logging import get_payment_logger from ..models.libs.client import BTCPayClient _logger = get_payment_logger(__name__) class BTCPayController(http.Controller): _checkout_url = '/btcpay/checkout' _notify_url = '/payment/btcpay/ipn' _return_url = '/payment/btcpay/return' @staticmethod def _btcpay_client(provider): return BTCPayClient( host=provider.btcpay_location, pem=provider.btcpay_privateKey, tokens={provider.btcpay_facade: provider.btcpay_token}, ) @staticmethod def _find_transaction(reference): return request.env['payment.transaction'].sudo().search([ ('reference', '=', reference), ('provider_code', '=', 'btcpayserver'), ], limit=1) @http.route(_checkout_url, type='http', auth='public', methods=['POST'], csrf=False, website=True) def checkout(self, **data): """ Create the BTCPay invoice and redirect the buyer to it. The redirect form only carries the transaction reference. The invoice price, currency and buyer details are read from the transaction server-side and are never taken from the (client-controlled) request data, so a buyer cannot have an invoice created for a tampered amount. """ _logger.info("BTCPay: checkout request with data:\n%s", pprint.pformat(data)) reference = data.get('reference') tx_sudo = self._find_transaction(reference) if not tx_sudo: raise ValidationError( _("BTCPay: No transaction found matching reference %s.", reference)) if tx_sudo.state != 'draft': # Already processed (e.g. double submission): fall back to the # generic payment status page. return request.redirect('/payment/status') provider = tx_sudo.provider_id base_url = provider.get_base_url() client = self._btcpay_client(provider) invoice = client.create_invoice({ "price": tx_sudo.amount, "currency": tx_sudo.currency_id.name, "orderId": tx_sudo.reference, "token": provider.btcpay_token, "redirectURL": urls.url_join(base_url, self._return_url), "notificationURL": urls.url_join(base_url, self._notify_url), "extendedNotifications": True, "buyer": { "email": tx_sudo.partner_email or 'noemailavailable@example.com', "name": tx_sudo.partner_name, "address1": tx_sudo.partner_address, "locality": tx_sudo.partner_city, "postalCode": tx_sudo.partner_zip, "country": tx_sudo.partner_country_id.code, "notify": False, }, }) tx_sudo.btcpay_invoiceId = invoice.get('id') _logger.info("BTCPay: created invoice %s for transaction %s", invoice.get('id'), tx_sudo.reference) return request.redirect(invoice['url'], local=False) @http.route(_notify_url, type='jsonrpc', auth='public', csrf=False) def btcpay_ipn(self, **post): """ BTCPay IPN. """ _logger.info('BTCPay: IPN received') data = json.loads(request.httprequest.data) _logger.info("%s", pprint.pformat(data)) try: reference = data['data']['orderId'] invoice_id = data['data']['id'] tx_sudo = self._find_transaction(reference) if not tx_sudo: _logger.warning("No transaction found matching reference %s.", reference) return '' # The invoice is fetched back from BTCPay (signed request); the # posted payload is only used to locate the transaction. client = self._btcpay_client(tx_sudo.provider_id) fetched_invoice = client.get_invoice(invoice_id) _logger.info('BTCPay: fetched invoice = %s', pprint.pformat(fetched_invoice)) payment_data = { "reference": fetched_invoice.get('orderId'), "status": fetched_invoice.get('status'), "invoiceID": fetched_invoice.get('id'), "txid": fetched_invoice.get('url'), # Settled amount and currency, validated against the transaction # by the payment framework before it is set done. "amount": fetched_invoice.get('price'), "currency": fetched_invoice.get('currency'), } tx_sudo._process('btcpayserver', payment_data) except ValidationError: _logger.exception("Unable to handle the notification data; skipping to acknowledge") return '' @http.route(_return_url, type='http', auth="public", methods=['GET'], csrf=False, save_session=False) def btcpay_return_from_redirect(self, **data): """ BTCPay return """ _logger.info("BTCPay: user returned to shop after payment") return request.redirect('/payment/status')