3f15b0c8b6
Security: - orders/submit.cfm: parameterize IN clause (was string-interpolated) - auth/completeProfile.cfm: fix UserID → ID on Users table PK Environment-aware URLs: - Add application.baseUrl to config/environment.cfm - Replace all hardcoded https://biz.payfrit.com with application.baseUrl in: orders/getDetail, tasks/getDetails, auth/completeProfile, auth/avatar, stripe/onboard, users/search, workers/onboardingLink, workers/earlyUnlock Also fix submit.cfm qMeta.ItemID → qMeta.ID (column not in SELECT) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
116 lines
3.9 KiB
Text
116 lines
3.9 KiB
Text
<cfscript>
|
|
/**
|
|
* Stripe Connect Onboarding
|
|
* Creates a connected account and returns the onboarding URL
|
|
*
|
|
* POST: { BusinessID: int }
|
|
* Returns: { OK: true, ONBOARDING_URL: string } or { OK: false, ERROR: string }
|
|
*/
|
|
|
|
// Initialize response
|
|
response = { "OK": false };
|
|
|
|
try {
|
|
// Get request data
|
|
requestData = deserializeJSON(toString(getHttpRequestData().content));
|
|
businessID = val(requestData.BusinessID ?: 0);
|
|
|
|
if (businessID == 0) {
|
|
response["ERROR"] = "BusinessID is required";
|
|
writeOutput(serializeJSON(response));
|
|
abort;
|
|
}
|
|
|
|
// Get Stripe keys from application settings
|
|
stripeSecretKey = application.stripeSecretKey ?: "";
|
|
|
|
if (stripeSecretKey == "") {
|
|
response["ERROR"] = "Stripe is not configured";
|
|
writeOutput(serializeJSON(response));
|
|
abort;
|
|
}
|
|
|
|
// Check if business already has a Stripe account
|
|
qBusiness = queryExecute("
|
|
SELECT StripeAccountID AS BusinessStripeAccountID, Name AS BusinessName
|
|
FROM Businesses
|
|
WHERE ID = :businessID
|
|
", { businessID: businessID });
|
|
|
|
if (qBusiness.recordCount == 0) {
|
|
response["ERROR"] = "Business not found";
|
|
writeOutput(serializeJSON(response));
|
|
abort;
|
|
}
|
|
|
|
stripeAccountID = qBusiness.BusinessStripeAccountID;
|
|
|
|
// Create new connected account if none exists
|
|
if (stripeAccountID == "" || isNull(stripeAccountID)) {
|
|
// Create Stripe Connect Express account
|
|
httpService = new http();
|
|
httpService.setMethod("POST");
|
|
httpService.setUrl("https://api.stripe.com/v1/accounts");
|
|
httpService.setUsername(stripeSecretKey);
|
|
httpService.setPassword("");
|
|
httpService.addParam(type="formfield", name="type", value="express");
|
|
httpService.addParam(type="formfield", name="country", value="US");
|
|
httpService.addParam(type="formfield", name="capabilities[card_payments][requested]", value="true");
|
|
httpService.addParam(type="formfield", name="capabilities[transfers][requested]", value="true");
|
|
httpService.addParam(type="formfield", name="business_profile[name]", value=qBusiness.BusinessName);
|
|
|
|
result = httpService.send().getPrefix();
|
|
accountData = deserializeJSON(result.fileContent);
|
|
|
|
if (structKeyExists(accountData, "error")) {
|
|
response["ERROR"] = accountData.error.message;
|
|
writeOutput(serializeJSON(response));
|
|
abort;
|
|
}
|
|
|
|
stripeAccountID = accountData.id;
|
|
|
|
// Save to database
|
|
queryExecute("
|
|
UPDATE Businesses
|
|
SET StripeAccountID = :stripeAccountID,
|
|
StripeOnboardingStarted = NOW()
|
|
WHERE ID = :businessID
|
|
", {
|
|
stripeAccountID: stripeAccountID,
|
|
businessID: businessID
|
|
});
|
|
}
|
|
|
|
// Create account link for onboarding
|
|
baseURL = application.baseUrl;
|
|
|
|
httpService = new http();
|
|
httpService.setMethod("POST");
|
|
httpService.setUrl("https://api.stripe.com/v1/account_links");
|
|
httpService.setUsername(stripeSecretKey);
|
|
httpService.setPassword("");
|
|
httpService.addParam(type="formfield", name="account", value=stripeAccountID);
|
|
httpService.addParam(type="formfield", name="refresh_url", value=baseURL & "/portal/index.html?stripe=retry");
|
|
httpService.addParam(type="formfield", name="return_url", value=baseURL & "/portal/index.html?stripe=complete");
|
|
httpService.addParam(type="formfield", name="type", value="account_onboarding");
|
|
|
|
result = httpService.send().getPrefix();
|
|
linkData = deserializeJSON(result.fileContent);
|
|
|
|
if (structKeyExists(linkData, "error")) {
|
|
response["ERROR"] = linkData.error.message;
|
|
writeOutput(serializeJSON(response));
|
|
abort;
|
|
}
|
|
|
|
response["OK"] = true;
|
|
response["ONBOARDING_URL"] = linkData.url;
|
|
response["STRIPE_ACCOUNT_ID"] = stripeAccountID;
|
|
|
|
} catch (any e) {
|
|
response["ERROR"] = e.message;
|
|
}
|
|
|
|
writeOutput(serializeJSON(response));
|
|
</cfscript>
|