veza/veza-backend-api/internal/services/stripe_connect_service.go

package services

import (
	"context"
	"errors"
	"fmt"
	"net/http"
	"strings"

	"github.com/google/uuid"
	"github.com/stripe/stripe-go/v82"
	"github.com/stripe/stripe-go/v82/account"
	"github.com/stripe/stripe-go/v82/accountlink"
	"github.com/stripe/stripe-go/v82/balance"
	"github.com/stripe/stripe-go/v82/transfer"
	"github.com/stripe/stripe-go/v82/transferreversal"
	"go.uber.org/zap"
	"gorm.io/gorm"

	"veza-backend-api/internal/core/connecterrors"
	"veza-backend-api/internal/models"
)

var (
	ErrStripeConnectDisabled = errors.New("Stripe Connect is not enabled")
	ErrNoStripeAccount       = errors.New("seller has no Stripe Connect account")
)

// BalanceResponse is the balance for a connected account
type BalanceResponse struct {
	Connected bool  `json:"connected"` // true if seller has completed Stripe Connect onboarding
	Available int64 `json:"available"` // in minor units (cents)
	Pending   int64 `json:"pending"`   // in minor units (cents)
}

// StripeConnectService handles Stripe Connect operations for seller payouts
type StripeConnectService struct {
	db        *gorm.DB
	secretKey string
	logger    *zap.Logger
}

// NewStripeConnectService creates a new Stripe Connect service
func NewStripeConnectService(db *gorm.DB, secretKey string, logger *zap.Logger) *StripeConnectService {
	return &StripeConnectService{
		db:        db,
		secretKey: secretKey,
		logger:    logger,
	}
}

// CreateOnboardingLink creates or retrieves a Stripe Express account and returns an onboarding URL
func (s *StripeConnectService) CreateOnboardingLink(ctx context.Context, userID uuid.UUID, returnURL, refreshURL string) (string, error) {
	if s.secretKey == "" {
		return "", ErrStripeConnectDisabled
	}
	stripe.Key = s.secretKey

	// Get user email
	var user models.User
	if err := s.db.WithContext(ctx).Where("id = ?", userID).First(&user).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return "", fmt.Errorf("user not found: %w", err)
		}
		return "", err
	}

	// Check if account already exists
	var existing models.SellerStripeAccount
	if err := s.db.WithContext(ctx).Where("user_id = ?", userID).First(&existing).Error; err == nil {
		// Account exists, create new account link for onboarding/update
		params := &stripe.AccountLinkParams{
			Account:    stripe.String(existing.StripeAccountID),
			ReturnURL:  stripe.String(returnURL),
			RefreshURL: stripe.String(refreshURL),
			Type:       stripe.String(string(stripe.AccountLinkTypeAccountOnboarding)),
		}
		link, err := accountlink.New(params)
		if err != nil {
			return "", fmt.Errorf("create account link: %w", err)
		}
		return link.URL, nil
	}

	// Create new Express account
	accountParams := &stripe.AccountParams{
		Type:  stripe.String(string(stripe.AccountTypeExpress)),
		Email: stripe.String(user.Email),
	}
	acct, err := account.New(accountParams)
	if err != nil {
		return "", fmt.Errorf("create stripe account: %w", err)
	}

	// Save to DB
	sa := models.SellerStripeAccount{
		UserID:              userID,
		StripeAccountID:     acct.ID,
		OnboardingCompleted: false,
	}
	if err := s.db.WithContext(ctx).Create(&sa).Error; err != nil {
		return "", fmt.Errorf("save seller stripe account: %w", err)
	}

	// Create account link
	linkParams := &stripe.AccountLinkParams{
		Account:    stripe.String(acct.ID),
		ReturnURL:  stripe.String(returnURL),
		RefreshURL: stripe.String(refreshURL),
		Type:       stripe.String(string(stripe.AccountLinkTypeAccountOnboarding)),
	}
	link, err := accountlink.New(linkParams)
	if err != nil {
		return "", fmt.Errorf("create account link: %w", err)
	}
	return link.URL, nil
}

// HandleOnboardingCallback updates the account status after Stripe redirect
func (s *StripeConnectService) HandleOnboardingCallback(ctx context.Context, userID uuid.UUID) error {
	var sa models.SellerStripeAccount
	if err := s.db.WithContext(ctx).Where("user_id = ?", userID).First(&sa).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return ErrNoStripeAccount
		}
		return err
	}

	if s.secretKey == "" {
		return ErrStripeConnectDisabled
	}
	stripe.Key = s.secretKey

	// Retrieve account from Stripe to get charges_enabled, payouts_enabled
	params := &stripe.AccountParams{}
	acct, err := account.GetByID(sa.StripeAccountID, params)
	if err != nil {
		return fmt.Errorf("get stripe account: %w", err)
	}

	sa.ChargesEnabled = acct.ChargesEnabled
	sa.PayoutsEnabled = acct.PayoutsEnabled
	sa.OnboardingCompleted = acct.DetailsSubmitted
	if err := s.db.WithContext(ctx).Save(&sa).Error; err != nil {
		return fmt.Errorf("update seller stripe account: %w", err)
	}
	return nil
}

// GetBalance returns the balance for a seller's connected account
func (s *StripeConnectService) GetBalance(ctx context.Context, userID uuid.UUID) (*BalanceResponse, error) {
	var sa models.SellerStripeAccount
	if err := s.db.WithContext(ctx).Where("user_id = ?", userID).First(&sa).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return &BalanceResponse{Connected: false, Available: 0, Pending: 0}, nil
		}
		return nil, err
	}

	if s.secretKey == "" {
		return nil, ErrStripeConnectDisabled
	}
	stripe.Key = s.secretKey

	params := &stripe.BalanceParams{}
	params.SetStripeAccount(sa.StripeAccountID)
	bal, err := balance.Get(params)
	if err != nil {
		return nil, fmt.Errorf("get stripe balance: %w", err)
	}

	var available, pending int64
	for _, a := range bal.Available {
		available += a.Amount
	}
	for _, p := range bal.Pending {
		pending += p.Amount
	}
	return &BalanceResponse{Connected: true, Available: available, Pending: pending}, nil
}

// CreateTransfer transfers funds to a connected account (for payout on sale).
// Returns the Stripe transfer identifier (tr_*) on success so the caller can
// persist it on the SellerTransfer row — required by item B (reversal worker)
// and by reconciliation against the Stripe dashboard.
func (s *StripeConnectService) CreateTransfer(ctx context.Context, sellerUserID uuid.UUID, amount int64, currency, orderID string) (string, error) {
	var sa models.SellerStripeAccount
	if err := s.db.WithContext(ctx).Where("user_id = ?", sellerUserID).First(&sa).Error; err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return "", ErrNoStripeAccount
		}
		return "", err
	}
	if !sa.PayoutsEnabled {
		return "", fmt.Errorf("seller account does not have payouts enabled")
	}

	if s.secretKey == "" {
		return "", ErrStripeConnectDisabled
	}
	stripe.Key = s.secretKey

	params := &stripe.TransferParams{
		Amount:      stripe.Int64(amount),
		Currency:    stripe.String(currency),
		Destination: stripe.String(sa.StripeAccountID),
	}
	if orderID != "" {
		params.AddMetadata("order_id", orderID)
	}
	tr, err := transfer.New(params)
	if err != nil {
		return "", fmt.Errorf("create stripe transfer: %w", err)
	}
	// Defensive: Stripe's Go SDK should never return (tr, nil) with an empty
	// tr.ID, but the invariant is load-bearing for item B (reversal needs a
	// real id to target). If it's ever violated we'd rather fail the transfer
	// than persist an empty string and leave the row permanently un-reversible.
	if tr.ID == "" {
		return "", fmt.Errorf("create stripe transfer: provider returned empty transfer id")
	}
	return tr.ID, nil
}

// ReverseTransfer issues a reversal against a previously-created Stripe
// transfer (v1.0.7 item B). amount=nil reverses the full transfer;
// amount>0 reverses that portion (partial reversal, used for partial
// refunds in a future item — v1.0.7 always passes nil). Returns the
// Stripe reversal id on success.
//
// Error handling in this function is intentionally opaque in v1.0.7:
// every non-nil return is a raw wrapped Stripe error. Day 3 of item B
// will parse stripe.Error.Code to return the marketplace-package
// sentinels ErrTransferAlreadyReversed ("transfer was already reversed
// out-of-band") and ErrTransferNotFound ("stripe_transfer_id doesn't
// exist at Stripe — data-integrity incident"). The worker routes by
// sentinel, so this function is the single place disambiguation needs
// to happen; until day 3 lands the worker treats every error as a
// transient retry candidate.
func (s *StripeConnectService) ReverseTransfer(ctx context.Context, stripeTransferID string, amount *int64, reason string) (string, error) {
	if s.secretKey == "" {
		return "", ErrStripeConnectDisabled
	}
	if stripeTransferID == "" {
		return "", fmt.Errorf("reverse stripe transfer: empty stripe_transfer_id")
	}
	stripe.Key = s.secretKey

	params := &stripe.TransferReversalParams{
		ID:     stripe.String(stripeTransferID),
		Amount: amount,
	}
	if reason != "" {
		params.Description = stripe.String(reason)
		params.AddMetadata("reason", reason)
	}
	rev, err := transferreversal.New(params)
	if err != nil {
		// Disambiguate the two alarming-looking cases from the generic
		// transient error. Stripe's SDK surfaces these as *stripe.Error
		// with a Code + HTTPStatusCode; we map to marketplace sentinels
		// so the worker can route correctly (see reversal_worker.go).
		//
		//   404 + code=resource_missing → the transfer id doesn't exist
		//   at Stripe. This is a data-integrity incident on our side
		//   (our DB has an id Stripe can't find): never retry, surface.
		//
		//   400 + message containing "already" + "revers" → Stripe
		//   reports the transfer is already fully reversed. Benign,
		//   idempotent — someone else (admin, Dashboard, another
		//   instance) did the reversal out-of-band. Treat as success.
		//
		// Any other error (including 5xx, network timeout, rate-limit)
		// is a transient retry candidate and bubbles unchanged.
		//
		// "already reversed" isn't codified in stripe-go as an enum —
		// the SDK only lists codes like ChargeAlreadyRefunded for
		// charges, not transfers. Message-parse is fragile but Stripe's
		// wording on this has been stable for years. Document here
		// rather than hiding in a helper so a future reader sees the
		// reasoning and the fragility together.
		var stripeErr *stripe.Error
		if errors.As(err, &stripeErr) {
			switch {
			case stripeErr.HTTPStatusCode == http.StatusNotFound && stripeErr.Code == stripe.ErrorCodeResourceMissing:
				return "", fmt.Errorf("%w: %s", connecterrors.ErrTransferNotFound, stripeErr.Msg)
			case stripeErr.HTTPStatusCode == http.StatusBadRequest && isAlreadyReversedMessage(stripeErr.Msg):
				return "", fmt.Errorf("%w: %s", connecterrors.ErrTransferAlreadyReversed, stripeErr.Msg)
			}
		}
		return "", fmt.Errorf("create stripe reversal: %w", err)
	}
	if rev.ID == "" {
		return "", fmt.Errorf("create stripe reversal: provider returned empty reversal id")
	}
	return rev.ID, nil
}

// isAlreadyReversedMessage detects Stripe's "transfer already fully
// reversed" wording. Parsing a free-text message is fragile, but
// Stripe doesn't publish a machine-readable code for this case on the
// transferreversal endpoint. The strings we look for have been stable
// across Stripe API versions. If Stripe changes the wording, the
// worker will treat the response as a transient error and retry — the
// row stays in reversal_pending and eventually hits max_retries, at
// which point permanently_failed surfaces it for ops to inspect.
// Worst-case regression is "benign case gets noisier", not data loss.
func isAlreadyReversedMessage(msg string) bool {
	lower := strings.ToLower(msg)
	return strings.Contains(lower, "already") &&
		(strings.Contains(lower, "reversed") || strings.Contains(lower, "reversal"))
}