Produits Entr'ouvert » Combo

{% extends "combo/page_template.html" %}

{% load staticfiles i18n %}

{% block combo-content %}

{% block wait-js %}

<script>

function display_error(message) {

    $('#transaction-error').text(message);

    $('#transaction-error').show();

    $("#wait-msg").hide();

}

$(function() {

    var next_url = '{{next_url}}';

    var transaction_id = '{{transaction_id}}';

    if (transaction_id === "") {

        display_error($('#transaction-error').data('error'));

    }

    else {

        $.ajax({

            url: `/api/lingo/transaction-status/${transaction_id}/`,

            success: function(data, status) {

                if (!data.wait) {

                    $('#wait-msg').text($('#wait-msg').data('continue'))

                    // wait a little to show messages

                    setTimeout(function(){location.href=next_url}, 3000);

                } else if (data.error) {

                    display_error(data.error_msg)

                } else {

                    setTimeout(wait_payment, 3000, next_url, transaction_id);

                }

            },

            error: function(error) {

                display_error($('#transaction-status').data('error'));

                window.console && console.log(':(', error);

            }

        });

    }

});

</script>

{% endblock %}

{% block wait-content%}

<div>

  {% block wait-message %}

  <h2 id="wait-msg" data-continue="{% trans "Wait a moment or click on 'Continue'." %}">{% trans "Please wait while your request is being processed..." %}</h2>

  {% endblock %}

   <div id="transaction-error" class="errornotice" data-error="{% trans 'An error occured' %}" style="display: none;"></div>

   <p><a id="next-url" href="{{next_url}}">{% trans "Continue" %}</a></p>

   </p>

</div>

{% endblock %}

{% endblock %}

                    CancelTransactionApiView, SelfInvoiceView, BasketItemPayView,

                    TransactionStatusApiView, PaymentStatusView)

    url(

        '^api/lingo/transaction-status/(?P<signature>\w+)/$', TransactionStatusApiView.as_view(),

        name='api-transaction-status'

    ),

    url(r'^lingo/item/(?P<signature>\w+)/pay$',

    url(r'^lingo/payment-status/(?P<signature>\w+)/$',

        PaymentStatusView.as_view(), name='payment-status'),

import uuid

from django.http import HttpResponse, HttpResponseNotFound, HttpResponseRedirect, HttpResponseBadRequest

from combo.utils import check_request_signature, aes_hex_decrypt, aes_hex_encrypt, DecryptionError

from combo.public.views import publish_page

                     LingoBasketCell, SelfDeclaredInvoicePayment, PaymentBackend, EXPIRED)

def get_eopayment_object(request, regie_or_payment_backend, payment_uuid=None):

    normal_return_url = reverse(

        'lingo-return-payment-backend',

        kwargs={'payment_backend_pk': payment_backend.id}

    )

    if payment_uuid:

        normal_return_url = "%s?publik-payment=%s" % (normal_return_url, payment_uuid)

        'normal_return_url': request.build_absolute_uri(normal_return_url)

                user = None

        if user:

            item.regie.compute_extra_fees(user=item.user)

        payment_url = reverse(

            'basket-item-pay-view',

            kwargs={

                'signature': aes_hex_encrypt(settings.SECRET_KEY, str(item.id))

            })

    def handle_payment(

            self, request, regie, items, remote_items, next_url='/', email='', firstname='',

            lastname=''):

        payment_uuid = str(uuid.uuid4())

        request.session.setdefault('payment', {}).setdefault(payment_uuid, {})['items'] = [

            item.pk for item in items

        ]

        request.session['payment'][payment_uuid]['next_url'] = next_url

        request.session.modified = True

            return HttpResponseRedirect(get_payment_status_view(payment_uuid))

        payment = get_eopayment_object(request, regie, payment_uuid)

def get_payment_status_view(transaction_uuid, transaction_id=None):

    url = reverse(

        'payment-status',

        kwargs={'signature': aes_hex_encrypt(settings.SECRET_KEY, str(transaction_uuid))}

    )

    if transaction_id:

        url = "%s?transaction-id=%s" % (

            url, aes_hex_encrypt(settings.SECRET_KEY, str(transaction_id))

        )

    return url

        next_url = request.GET.get('next_url') or None

        email = request.GET.get('email', '')

        firstname = request.GET.get('firstname', '')

        lastname = request.GET.get('lastname', '')

        signature = kwargs.get('signature')

        try:

            item_id = aes_hex_decrypt(settings.SECRET_KEY, signature)

        except DecryptionError:

            return HttpResponseForbidden(_('Invalid payment request.'))

        item = BasketItem.objects.get(pk=item_id)

        if item.user and item.user != request.user:

        return self.handle_payment(

            request=request, regie=regie, items=[item], remote_items=[], next_url=next_url, email=email,

            firstname=firstname, lastname=lastname

        )

        payment_uuid = request.GET.get('publik-payment')

            if payment_uuid:

                return HttpResponseRedirect(get_payment_status_view(payment_uuid, e.transaction.pk))

            if payment_uuid:

                return HttpResponseRedirect(get_payment_status_view(payment_uuid))

        if transaction and payment_uuid:

            return HttpResponseRedirect(get_payment_status_view(payment_uuid, transaction.pk))

class PaymentStatusView(View):

    http_method_names = ['get']

    def get(self, request, *args, **kwargs):

        page = Page()

        page.template_name = 'standard'

        template_name = 'lingo/combo/payment-status.html'

        signature = kwargs.get('signature')

        try:

            payment_uuid = aes_hex_decrypt(settings.SECRET_KEY, signature)

        except DecryptionError:

            return HttpResponseForbidden(_('Invalid payment signature.'))

        next_url = request.session.get('payment', {}).get(payment_uuid, {}).get('next_url')

        if not next_url:

            items = BasketItem.objects.filter(

                pk__in=request.session.get('payment', {}).get(payment_uuid, {}).get('items', [])

            )

            next_url = get_basket_url()

            if len(set([item.source_url for item in items])) == 1:

                next_url = items[0].source_url

        next_url = request.build_absolute_uri(next_url)

        transaction = None

        if 'transaction-id' in request.GET:

            try:

                transaction_id = aes_hex_decrypt(

                    settings.SECRET_KEY, request.GET.get('transaction-id')

                )

            except DecryptionError:

                return HttpResponseForbidden(_('Invalid transaction signature.'))

            try:

                transaction = Transaction.objects.get(pk=transaction_id)

            except Transaction.DoesNotExist:

                return HttpResponseForbidden(_('Invalid transaction.'))

        extra_context_data = getattr(request, 'extra_context_data', {})

        extra_context_data['transaction_id'] = ''

        if transaction:

            extra_context_data['transaction_id'] = \

                aes_hex_encrypt(settings.SECRET_KEY, str(transaction.pk))

        extra_context_data['next_url'] = next_url

        request.extra_context_data = extra_context_data

        return publish_page(request, page, template_name=template_name)

class TransactionStatusApiView(View):

    http_method_names = ['get']

    def get(self, request, *args, **kwargs):

        signature = kwargs.get('signature')

        try:

            transaction_id = aes_hex_decrypt(settings.SECRET_KEY, signature)

        except DecryptionError:

            return HttpResponseBadRequest(_('Invalid transaction.'))

        try:

            transaction = Transaction.objects.get(pk=transaction_id)

        except Transaction.DoesNotExist:

            return HttpResponseNotFound(_('Unknown transaction.'))

        user = request.user if request.user.is_authenticated() else None

        error_msg = _('Transaction does not belong to the requesting user')

        if user and transaction.user and user != transaction.user:

            return HttpResponseForbidden(error_msg)

        if not user and transaction.user:

            return HttpResponseForbidden(error_msg)

        if transaction.is_paid():

            data = {

                'wait': False,

                'error': False,

                'error_msg': ''

            }

            return JsonResponse(data=data)

        if transaction.status in (

                eopayment.CANCELLED, eopayment.ERROR, eopayment.DENIED, EXPIRED

        ):

            data = {

                'wait': True,

                'error': True,

                'error_msg': _('Payment error, you can continue and make another payment')

            }

            return JsonResponse(data=data)

        data = {

            'wait': True,

            'error': False,

            'error_msg': ''

        }

        return JsonResponse(data=data)

import os.path

from combo.utils import aes_hex_decrypt, aes_hex_encrypt, sign_url

def assert_payment_status(url, transaction_id=None):

    if hasattr(url, 'path'):

        url = url.path

    if transaction_id:

        url, part = url.split('?')

        assert 'transaction-id' in part

        signature = part.replace('transaction-id=', '')

        assert aes_hex_decrypt(settings.SECRET_KEY, signature) == str(transaction_id)

    assert url.startswith('/lingo/payment-status/')

    # redirect to payment status

    assert urlparse.urlparse(resp.url).path.startswith('/lingo/payment-status/')

    assert urlparse.urlparse(resp.html.find('a', {'id': 'next-url'})['href']).path == \

        '/test_basket_cell/'

    payment_url = urlparse.urlparse(response['payment_url'])

    assert payment_url.path.startswith('/lingo/item/')

    assert payment_url.path.endswith('/pay')

    assert 'Wrong item: payment not allowed.' in resp.text

    item  = BasketItem.objects.filter(regie=regie, amount=amount, payment_date__isnull=False).first()

    # check that user is redirected to the item payment status view

    assert_payment_status(resp.location, transaction_id=item.transaction_set.last().pk)

    return_qs = urlparse.parse_qs(urlparse.urlparse(qs['return_url'][0]).query)

    publik_payment = return_qs['publik-payment'][0]

    return_url = get_url(with_payment_backend, 'lingo-return', regie) + '?publik-payment=%s' % publik_payment

    # redirect to payment status

    assert urlparse.urlparse(get_resp.url).path.startswith('/lingo/payment-status/')

    resp = get_resp.follow()

    assert urlparse.urlparse(resp.html.find('a', {'id': 'next-url'})['href']).path == \

        '/test_basket_cell/'

@pytest.mark.parametrize("authenticated", [True, False])

def test_payment_no_basket(app, user, regie, authenticated):

    url = reverse('api-add-basket-item')

    source_url = 'http://example.org/item/1'

    data = {'amount': 10, 'display_name': 'test item', 'url': source_url}

    if authenticated:

        data['email'] = user.email

    url = sign_url(url, settings.LINGO_API_SIGN_KEY)

    resp = app.post_json(url, params=data)

    assert resp.status_code == 200

    payment_url = resp.json['payment_url']

    item = BasketItem.objects.first()

    assert item.user is None

    assert item.amount == Decimal('10.00')

    path = urlparse.urlparse(payment_url).path

    start = '/lingo/item/'

    end = '/pay'

    assert path.startswith(start)

    assert path.endswith(end)

    signature = path.replace(start, '').replace(end, '')

    assert aes_hex_decrypt(settings.SECRET_KEY, signature) == str(item.id)

    if authenticated:

        app = login(app)

    # payment error due to too small amount

    item.amount = Decimal('1.00')

    item.save()

    resp = app.get(payment_url)

    assert_payment_status(resp.location)

    resp = resp.follow()

    assert 'Minimal payment amount is 4.50' in resp.text

    # we can go back to form

    assert source_url in resp.text

    # amount ok, redirection to payment backend

    item.amount = Decimal('10.00')

    item.save()

    resp = app.get(payment_url)

    assert resp.location.startswith('http://dummy-payment.demo.entrouvert.com/')

    qs = urlparse.parse_qs(urlparse.urlparse(resp.location).query)

    assert qs['amount'] == ['10.00']

    if authenticated:

        assert qs['email'] == ['foo@example.com']

    else:

        assert 'email' not in qs

    # mail get be specified here for anonymous user

    resp = app.get(

        payment_url,

        params={

            'email': 'foo@localhost',

        }

    )

    assert resp.location.startswith('http://dummy-payment.demo.entrouvert.com/')

    qs = urlparse.parse_qs(urlparse.urlparse(resp.location).query)

    assert qs['amount'] == ['10.00']

    if authenticated:

        assert qs['email'] == ['foo@example.com']

    else:

        assert qs['email'] == ['foo@localhost']

    # simulate bad responseform payment backend, no transaction id

    data = {'amount': qs['amount'][0], 'signed': True}

    return_url = qs['return_url'][0]

    assert 'publik-payment' in return_url

    resp = app.get(return_url, params=data)

    assert_payment_status(resp.location)

    resp = resp.follow()

    assert 'We are sorry but the payment service failed to provide a correct answer.' in resp.text

    assert 'http://example.org/item/1' in resp.text

    # check that item is not paid

    item = BasketItem.objects.get(pk=item.pk)

    assert not item.payment_date

    # simulate successful payment response from dummy backend

    data = {

        'transaction_id': qs['transaction_id'][0], 'ok': True,

        'amount': qs['amount'][0], 'signed': True

    }

    return_url = qs['return_url'][0]

    assert 'publik-payment' in return_url

    resp = app.get(return_url, params=data)

    assert_payment_status(resp.location, transaction_id=item.transaction_set.last().pk)

    # check that item is paid

    item = BasketItem.objects.get(pk=item.pk)

    assert item.payment_date

    # accept redirection to item payment status view

    resp = resp.follow()

    # which should it self redirect to item.source_url as it is paid

    assert 'Please wait while your request is being processed' in resp.text

    assert source_url in resp.text

def test_transaction_status_api(app, regie, user):

    # invalid transaction signature

    url = reverse('api-transaction-status', kwargs={'signature': 'xxxx'})

    resp = app.get(url, status=400)

    assert 'Invalid transaction.' in resp.text

    # unkown transaction identifier

    transaction_id = 1000

    url = reverse(

        'api-transaction-status',

        kwargs={'signature': aes_hex_encrypt(settings.SECRET_KEY, str(transaction_id))}

    )

    resp = app.get(url, status=404)

    assert 'Unknown transaction.' in resp.text

    wait_response = {

        'wait': True,

        'error': False,

        'error_msg': ''

    }

    # anonymous user on anonymous transaction: OK

    transaction = Transaction.objects.create(amount=Decimal('10.0'), regie=regie, status=0)

    url = reverse(

        'api-transaction-status',

        kwargs={'signature': aes_hex_encrypt(settings.SECRET_KEY, str(transaction.pk))}

    )

    resp = app.get(url)

    assert resp.json == wait_response

    # authenticated user on anonymous transaction: OK

    transaction = Transaction.objects.create(amount=Decimal('10.0'), regie=regie, status=0)

    url = reverse(

        'api-transaction-status',

        kwargs={'signature': aes_hex_encrypt(settings.SECRET_KEY, str(transaction.pk))}

    )

    resp = login(app).get(url)

    assert resp.json == wait_response

    app.reset()

    # authenticated user on his transaction: OK

    transaction = Transaction.objects.create(

        amount=Decimal('10.0'), regie=regie, status=0, user=user)

    url = reverse(

        'api-transaction-status',

        kwargs={'signature': aes_hex_encrypt(settings.SECRET_KEY, str(transaction.pk))}

    )

    resp = login(app).get(url)

    assert resp.json == wait_response

    app.reset()

    error_msg = 'Transaction does not belong to the requesting user'

    # anonymous user on other user transaction transaction: NOTOK

    transaction = Transaction.objects.create(

        amount=Decimal('10.0'), regie=regie, status=0, user=user)

    url = reverse(

        'api-transaction-status',

        kwargs={'signature': aes_hex_encrypt(settings.SECRET_KEY, str(transaction.pk))}

    )

    resp = app.get(url, status=403)

    assert error_msg in resp.text

    # authenticated user on other user transaction transaction: NOTOK

    user2 = User.objects.create_user(

        'user2', password='user2', email='user2@example.com'

    )

    transaction = Transaction.objects.create(

        amount=Decimal('10.0'), regie=regie, status=0, user=user2)

    url = reverse(

        'api-transaction-status',

        kwargs={'signature': aes_hex_encrypt(settings.SECRET_KEY, str(transaction.pk))}

    )

    resp = login(app).get(url, status=403)

    assert error_msg in resp.text

    app.reset()

    # transaction error

    transaction = Transaction.objects.create(

        amount=Decimal('10.0'), regie=regie, status=eopayment.ERROR

    )

    url = reverse(

        'api-transaction-status',

        kwargs={'signature': aes_hex_encrypt(settings.SECRET_KEY, str(transaction.pk))}

    )

    resp = app.get(url)

    assert resp.json == {

        'wait': True,

        'error': True,

        'error_msg': 'Payment error, you can continue and make another payment'

    }

    # transaction paid

    transaction = Transaction.objects.create(

        amount=Decimal('10.0'), regie=regie, status=eopayment.PAID

    )

    url = reverse(

        'api-transaction-status',

        kwargs={'signature': aes_hex_encrypt(settings.SECRET_KEY, str(transaction.pk))}

    )

    resp = app.get(url)

    assert resp.json == {

        'wait': False,

        'error': False,

        'error_msg': ''

    }

    # redirect to payment status

    assert urlparse.urlparse(resp.url).path.startswith('/lingo/payment-status/')

    resp = resp.follow()

    assert urlparse.urlparse(resp.html.find('a', {'id': 'next-url'})['href']).path == '/'

    # redirect to payment status

    assert urlparse.urlparse(resp.url).path.startswith('/lingo/payment-status/')

    resp = resp.follow()

    assert urlparse.urlparse(resp.html.find('a', {'id': 'next-url'})['href']).path == \

        '/active-remote-invoices-page/'

    # redirect to payment status

    assert urlparse.urlparse(resp.url).path.startswith('/lingo/payment-status/')

    resp = resp.follow()

    assert urlparse.urlparse(resp.html.find('a', {'id': 'next-url'})['href']).path == \

        '/active-remote-invoices-page/'