payfrit-works/api/orders/getOrCreateCart.cfm
John Mizerek d8d7efe056 Add user account APIs and fix Lucee header handling
- Add avatar.cfm: GET/POST for user profile photos with multi-extension support
- Add profile.cfm: GET/POST for user profile (name, email, phone)
- Add history.cfm: Order history endpoint with pagination
- Add addresses/list.cfm and add.cfm: Delivery address management
- Add setOrderType.cfm: Set delivery/takeaway type on orders
- Add checkToken.cfm: Debug endpoint for token validation
- Fix headerValue() in Application.cfm to use servlet request object
  (Lucee CGI scope doesn't expose custom HTTP headers like X-User-Token)
- Update public allowlist for new endpoints
- Add privacy.html page

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-08 20:01:07 -08:00

322 lines
10 KiB
Text

<cfsetting showdebugoutput="false">
<cfsetting enablecfoutputonly="true">
<cffunction name="readJsonBody" access="public" returntype="struct" output="false">
<cfset var raw = getHttpRequestData().content>
<cfif isNull(raw) OR len(trim(raw)) EQ 0>
<cfreturn {}>
</cfif>
<cftry>
<cfset var data = deserializeJSON(raw)>
<cfif isStruct(data)>
<cfreturn data>
<cfelse>
<cfreturn {}>
</cfif>
<cfcatch>
<cfreturn {}>
</cfcatch>
</cftry>
</cffunction>
<cffunction name="apiAbort" access="public" returntype="void" output="true">
<cfargument name="payload" type="struct" required="true">
<cfcontent type="application/json; charset=utf-8">
<cfoutput>#serializeJSON(arguments.payload)#</cfoutput>
<cfabort>
</cffunction>
<cffunction name="loadCartPayload" access="public" returntype="struct" output="false">
<cfargument name="OrderID" type="numeric" required="true">
<cfset var out = {}>
<cfset var qOrder = queryExecute(
"
SELECT
OrderID,
OrderUUID,
OrderUserID,
OrderBusinessID,
OrderBusinessDeliveryMultiplier,
OrderTypeID,
OrderDeliveryFee,
OrderStatusID,
OrderAddressID,
OrderPaymentID,
OrderRemarks,
OrderAddedOn,
OrderLastEditedOn,
OrderSubmittedOn,
OrderServicePointID
FROM Orders
WHERE OrderID = ?
LIMIT 1
",
[ { value = arguments.OrderID, cfsqltype = "cf_sql_integer" } ],
{ datasource = "payfrit" }
)>
<cfif qOrder.recordCount EQ 0>
<cfreturn { "OK": false, "ERROR": "not_found", "MESSAGE": "Order not found", "DETAIL": "" }>
</cfif>
<!--- Get business delivery fee for display in cart --->
<cfset var qBusiness = queryExecute(
"SELECT BusinessDeliveryFlatFee FROM Businesses WHERE BusinessID = ? LIMIT 1",
[ { value = qOrder.OrderBusinessID, cfsqltype = "cf_sql_integer" } ],
{ datasource = "payfrit" }
)>
<cfset var businessDeliveryFee = qBusiness.recordCount GT 0 ? qBusiness.BusinessDeliveryFlatFee : 0>
<cfset out.Order = {
"OrderID": qOrder.OrderID,
"OrderUUID": qOrder.OrderUUID,
"OrderUserID": qOrder.OrderUserID,
"OrderBusinessID": qOrder.OrderBusinessID,
"OrderBusinessDeliveryMultiplier": qOrder.OrderBusinessDeliveryMultiplier,
"OrderTypeID": qOrder.OrderTypeID,
"OrderDeliveryFee": qOrder.OrderDeliveryFee,
"BusinessDeliveryFee": businessDeliveryFee,
"OrderStatusID": qOrder.OrderStatusID,
"OrderAddressID": qOrder.OrderAddressID,
"OrderPaymentID": qOrder.OrderPaymentID,
"OrderRemarks": qOrder.OrderRemarks,
"OrderAddedOn": qOrder.OrderAddedOn,
"OrderLastEditedOn": qOrder.OrderLastEditedOn,
"OrderSubmittedOn": qOrder.OrderSubmittedOn,
"OrderServicePointID": qOrder.OrderServicePointID
}>
<cfset var qLI = queryExecute(
"
SELECT
OrderLineItemID,
OrderLineItemParentOrderLineItemID,
OrderLineItemOrderID,
OrderLineItemItemID,
OrderLineItemStatusID,
OrderLineItemPrice,
OrderLineItemQuantity,
OrderLineItemRemark,
OrderLineItemIsDeleted,
OrderLineItemAddedOn
FROM OrderLineItems
WHERE OrderLineItemOrderID = ?
ORDER BY OrderLineItemID
",
[ { value = arguments.OrderID, cfsqltype = "cf_sql_integer" } ],
{ datasource = "payfrit" }
)>
<cfset var rows = []>
<cfloop query="qLI">
<cfset arrayAppend(rows, {
"OrderLineItemID": qLI.OrderLineItemID,
"OrderLineItemParentOrderLineItemID": qLI.OrderLineItemParentOrderLineItemID,
"OrderLineItemOrderID": qLI.OrderLineItemOrderID,
"OrderLineItemItemID": qLI.OrderLineItemItemID,
"OrderLineItemStatusID": qLI.OrderLineItemStatusID,
"OrderLineItemPrice": qLI.OrderLineItemPrice,
"OrderLineItemQuantity": qLI.OrderLineItemQuantity,
"OrderLineItemRemark": qLI.OrderLineItemRemark,
"OrderLineItemIsDeleted": qLI.OrderLineItemIsDeleted,
"OrderLineItemAddedOn": qLI.OrderLineItemAddedOn
})>
</cfloop>
<cfset out.OrderLineItems = rows>
<cfset out.OK = true>
<cfset out.ERROR = "">
<cfreturn out>
</cffunction>
<cfset data = readJsonBody()>
<cfset BusinessID = val( structKeyExists(data,"BusinessID") ? data.BusinessID : 0 )>
<cfset OrderServicePointID = val( structKeyExists(data,"OrderServicePointID") ? data.OrderServicePointID : 0 )>
<cfset OrderTypeID = val( structKeyExists(data,"OrderTypeID") ? data.OrderTypeID : 0 )>
<cfset OrderUserID = val( structKeyExists(data,"OrderUserID") ? data.OrderUserID : 0 )>
<!--- OrderTypeID: 0=undecided, 1=dine-in, 2=takeaway, 3=delivery --->
<cfif BusinessID LTE 0 OR OrderUserID LTE 0>
<cfset apiAbort({
"OK": false,
"ERROR": "missing_params",
"MESSAGE": "BusinessID and OrderUserID are required.",
"DETAIL": ""
})>
</cfif>
<!--- OrderTypeID can be 0 (undecided) for delivery/takeaway flow, or 1 for dine-in --->
<cfif OrderTypeID LT 0 OR OrderTypeID GT 3>
<cfset apiAbort({
"OK": false,
"ERROR": "invalid_order_type",
"MESSAGE": "OrderTypeID must be 0-3 (0=undecided, 1=dine-in, 2=takeaway, 3=delivery).",
"DETAIL": ""
})>
</cfif>
<cftry>
<!--- Find existing cart (OrderStatusID=0 assumed cart) --->
<!--- Look for any active cart for this user/business - order type can be changed later --->
<cfset qFind = queryExecute(
"
SELECT OrderID, OrderTypeID
FROM Orders
WHERE OrderUserID = ?
AND OrderBusinessID = ?
AND OrderStatusID = 0
ORDER BY OrderID DESC
LIMIT 1
",
[
{ value = OrderUserID, cfsqltype = "cf_sql_integer" },
{ value = BusinessID, cfsqltype = "cf_sql_integer" }
],
{ datasource = "payfrit" }
)>
<cfif qFind.recordCount GT 0>
<!--- Always update the service point to match the current table/beacon --->
<cfif OrderServicePointID GT 0>
<cfset queryExecute(
"UPDATE Orders SET OrderServicePointID = ?, OrderLastEditedOn = ? WHERE OrderID = ?",
[
{ value = OrderServicePointID, cfsqltype = "cf_sql_integer" },
{ value = now(), cfsqltype = "cf_sql_timestamp" },
{ value = qFind.OrderID, cfsqltype = "cf_sql_integer" }
],
{ datasource = "payfrit" }
)>
</cfif>
<!--- Check if cart order type differs from requested and cart is empty --->
<!--- If so, update the cart's order type to match the new flow --->
<cfif qFind.OrderTypeID NEQ OrderTypeID>
<cfset qLineItems = queryExecute(
"SELECT COUNT(*) AS ItemCount FROM OrderLineItems WHERE OrderLineItemOrderID = ? AND OrderLineItemIsDeleted = 0",
[ { value = qFind.OrderID, cfsqltype = "cf_sql_integer" } ],
{ datasource = "payfrit" }
)>
<!--- Only update order type if cart is empty (allows switching flows) --->
<cfif qLineItems.ItemCount EQ 0>
<cfset queryExecute(
"UPDATE Orders SET OrderTypeID = ?, OrderLastEditedOn = ? WHERE OrderID = ?",
[
{ value = OrderTypeID, cfsqltype = "cf_sql_integer" },
{ value = now(), cfsqltype = "cf_sql_timestamp" },
{ value = qFind.OrderID, cfsqltype = "cf_sql_integer" }
],
{ datasource = "payfrit" }
)>
</cfif>
</cfif>
<cfset payload = loadCartPayload(qFind.OrderID)>
<cfset apiAbort(payload)>
</cfif>
<!--- Create new cart order --->
<cfset qBiz = queryExecute(
"
SELECT BusinessDeliveryMultiplier, BusinessDeliveryFlatFee
FROM Businesses
WHERE BusinessID = ?
LIMIT 1
",
[ { value = BusinessID, cfsqltype = "cf_sql_integer" } ],
{ datasource = "payfrit" }
)>
<cfif qBiz.recordCount EQ 0>
<cfset apiAbort({ "OK": false, "ERROR": "bad_business", "MESSAGE": "Business not found", "DETAIL": "" })>
</cfif>
<cfset nowDt = now()>
<cfset newUUID = createUUID()>
<!--- Calculate delivery fee: only for delivery orders (OrderTypeID = 3)
OrderTypeID: 0=undecided, 1=dine-in, 2=takeaway, 3=delivery
Only delivery (3) should have delivery fee.
Note: For undecided orders (0), fee is set later via setOrderType.cfm --->
<cfset deliveryFee = (OrderTypeID EQ 3) ? qBiz.BusinessDeliveryFlatFee : 0>
<!--- Generate new OrderID (table is not auto-inc in SSOT) --->
<cfset qNext = queryExecute(
"SELECT IFNULL(MAX(OrderID),0) + 1 AS NextID FROM Orders",
[],
{ datasource = "payfrit" }
)>
<cfset NewOrderID = qNext.NextID>
<cfset queryExecute(
"
INSERT INTO Orders (
OrderID,
OrderUUID,
OrderUserID,
OrderBusinessID,
OrderBusinessDeliveryMultiplier,
OrderTypeID,
OrderDeliveryFee,
OrderStatusID,
OrderAddressID,
OrderPaymentID,
OrderRemarks,
OrderAddedOn,
OrderLastEditedOn,
OrderSubmittedOn,
OrderServicePointID
) VALUES (
?,
?,
?,
?,
?,
?,
?,
0,
NULL,
NULL,
NULL,
?,
?,
NULL,
?
)
",
[
{ value = NewOrderID, cfsqltype = "cf_sql_integer" },
{ value = newUUID, cfsqltype = "cf_sql_varchar" },
{ value = OrderUserID, cfsqltype = "cf_sql_integer" },
{ value = BusinessID, cfsqltype = "cf_sql_integer" },
{ value = qBiz.BusinessDeliveryMultiplier, cfsqltype = "cf_sql_decimal" },
{ value = OrderTypeID, cfsqltype = "cf_sql_integer" },
{ value = deliveryFee, cfsqltype = "cf_sql_decimal" },
{ value = nowDt, cfsqltype = "cf_sql_timestamp" },
{ value = nowDt, cfsqltype = "cf_sql_timestamp" },
{ value = OrderServicePointID, cfsqltype = "cf_sql_integer" }
],
{ datasource = "payfrit" }
)>
<!--- Per your rule: OrderID is determined by selecting highest after creation --->
<cfset qLatest = queryExecute(
"SELECT MAX(OrderID) AS OrderID FROM Orders",
[],
{ datasource = "payfrit" }
)>
<cfset FinalOrderID = qLatest.OrderID>
<cfset payload = loadCartPayload(FinalOrderID)>
<cfset apiAbort(payload)>
<cfcatch>
<cfset apiAbort({
"OK": false,
"ERROR": "server_error",
"MESSAGE": "DB error creating cart",
"DETAIL": cfcatch.message
})>
</cfcatch>
</cftry>