# -*- coding:utf-8 -* # # Copyright 2023 © AE UTBM # ae@utbm.fr / ae.info@utbm.fr # # This file is part of the website of the UTBM Student Association (AE UTBM), # https://ae.utbm.fr. # # You can find the source code of the website at https://github.com/ae-utbm/sith3 # # LICENSED UNDER THE GNU GENERAL PUBLIC LICENSE VERSION 3 (GPLv3) # SEE : https://raw.githubusercontent.com/ae-utbm/sith3/master/LICENSE # OR WITHIN THE LOCAL FILE "LICENSE" # # import base64 import json from datetime import datetime from urllib.parse import unquote import sentry_sdk from django.conf import settings from django.contrib.auth.decorators import login_required from django.core.exceptions import SuspiciousOperation from django.db import DatabaseError, transaction from django.http import HttpRequest, HttpResponse from django.shortcuts import redirect, render from django.utils.decorators import method_decorator from django.views.decorators.http import require_GET, require_POST from django.views.generic import TemplateView, View from OpenSSL import crypto from counter.forms import BillingInfoForm from counter.models import Counter, Customer, Product from eboutic.forms import BasketForm from eboutic.models import Basket, Invoice, InvoiceItem, get_eboutic_products @login_required @require_GET def eboutic_main(request: HttpRequest) -> HttpResponse: """ Main view of the eboutic application. Return an Http response whose content is of type text/html. The latter represents the page from which a user can see the catalogue of products that he can buy and fill his shopping cart. The purchasable products are those of the eboutic which belong to a category of products of a product category (orphan products are inaccessible). If the session contains a key-value pair that associates "errors" with a list of strings, this pair is removed from the session and its value displayed to the user when the page is rendered. """ errors = request.session.pop("errors", None) products = get_eboutic_products(request.user) context = { "errors": errors, "products": products, "customer_amount": request.user.account_balance, } return render(request, "eboutic/eboutic_main.jinja", context) @require_GET @login_required def payment_result(request, result: str) -> HttpResponse: context = {"success": result == "success"} return render(request, "eboutic/eboutic_payment_result.jinja", context) class EbouticCommand(TemplateView): template_name = "eboutic/eboutic_makecommand.jinja" @method_decorator(login_required) def post(self, request, *args, **kwargs): return redirect("eboutic:main") @method_decorator(login_required) def get(self, request: HttpRequest, *args, **kwargs): form = BasketForm(request) if not form.is_valid(): request.session["errors"] = form.get_error_messages() request.session.modified = True res = redirect("eboutic:main") res.set_cookie("basket_items", form.get_cleaned_cookie(), path="/eboutic") return res basket = Basket.from_session(request.session) if basket is not None: basket.clear() else: basket = Basket.objects.create(user=request.user) request.session["basket_id"] = basket.id request.session.modified = True items = json.loads(unquote(request.COOKIES["basket_items"])) items.sort(key=lambda item: item["id"]) ids = [item["id"] for item in items] quantities = [item["quantity"] for item in items] products = Product.objects.filter(id__in=ids) for product, qty in zip(products, quantities): basket.add_product(product, qty) kwargs["basket"] = basket return self.render_to_response(self.get_context_data(**kwargs)) def get_context_data(self, **kwargs): # basket is already in kwargs when the method is called default_billing_info = None if hasattr(self.request.user, "customer"): customer = self.request.user.customer kwargs["customer_amount"] = customer.amount if hasattr(customer, "billing_infos"): default_billing_info = customer.billing_infos else: kwargs["customer_amount"] = None kwargs["must_fill_billing_infos"] = default_billing_info is None if not kwargs["must_fill_billing_infos"]: # the user has already filled its billing_infos, thus we can # get it without expecting an error data = kwargs["basket"].get_e_transaction_data() data = {"data": [{"key": key, "value": val} for key, val in data]} kwargs["billing_infos"] = json.dumps(data) kwargs["billing_form"] = BillingInfoForm(instance=default_billing_info) return kwargs @login_required @require_GET def e_transaction_data(request): basket = Basket.from_session(request.session) if basket is None: return HttpResponse(status=404, content=json.dumps({"data": []})) data = basket.get_e_transaction_data() data = {"data": [{"key": key, "value": val} for key, val in data]} return HttpResponse(status=200, content=json.dumps(data)) @login_required @require_POST def pay_with_sith(request): basket = Basket.from_session(request.session) refilling = settings.SITH_COUNTER_PRODUCTTYPE_REFILLING if basket is None or basket.items.filter(type_id=refilling).exists(): return redirect("eboutic:main") c = Customer.objects.filter(user__id=basket.user.id).first() if c is None: return redirect("eboutic:main") if c.amount < basket.get_total(): res = redirect("eboutic:payment_result", "failure") else: eboutic = Counter.objects.filter(type="EBOUTIC").first() sales = basket.generate_sales(eboutic, c.user, "SITH_ACCOUNT") try: with transaction.atomic(): for sale in sales: sale.save() basket.delete() request.session.pop("basket_id", None) res = redirect("eboutic:payment_result", "success") except DatabaseError as e: with sentry_sdk.push_scope() as scope: scope.user = {"username": request.user.username} scope.set_extra("someVariable", e.__repr__()) sentry_sdk.capture_message( f"Erreur le {datetime.now()} dans eboutic.pay_with_sith" ) res = redirect("eboutic:payment_result", "failure") res.delete_cookie("basket_items", "/eboutic") return res class EtransactionAutoAnswer(View): # Response documentation # https://www1.paybox.com/espace-integrateur-documentation/la-solution-paybox-system/gestion-de-la-reponse/ def get(self, request, *args, **kwargs): required = {"Amount", "BasketID", "Error", "Sig"} if not required.issubset(set(request.GET.keys())): return HttpResponse("Bad arguments", status=400) key = crypto.load_publickey(crypto.FILETYPE_PEM, settings.SITH_EBOUTIC_PUB_KEY) cert = crypto.X509() cert.set_pubkey(key) sig = base64.b64decode(request.GET["Sig"]) try: crypto.verify( cert, sig, "&".join(request.META["QUERY_STRING"].split("&")[:-1]).encode("utf-8"), "sha1", ) except: return HttpResponse("Bad signature", status=400) # Payment authorized: # * 'Error' is '00000' # * 'Auto' is in the request if request.GET["Error"] == "00000" and "Auto" in request.GET.keys(): try: with transaction.atomic(): b = ( Basket.objects.select_for_update() .filter(id=request.GET["BasketID"]) .first() ) if b is None: raise SuspiciousOperation("Basket does not exists") if int(b.get_total() * 100) != int(request.GET["Amount"]): raise SuspiciousOperation( "Basket total and amount do not match" ) i = Invoice() i.user = b.user i.payment_method = "CARD" i.save() for it in b.items.all(): InvoiceItem( invoice=i, product_id=it.product_id, product_name=it.product_name, type_id=it.type_id, product_unit_price=it.product_unit_price, quantity=it.quantity, ).save() i.validate() b.delete() except Exception as e: return HttpResponse( "Basket processing failed with error: " + repr(e), status=500 ) return HttpResponse("Payment successful", status=200) else: return HttpResponse( "Payment failed with error: " + request.GET["Error"], status=202 )