First Commit

square/helper.php

@@ -0,0 +1,91 @@
+<?php
+$ValidAccess = 2010;
+
+require_once("../include/globals.php");
+if(session_status() !== PHP_SESSION_ACTIVE) session_start();
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   header("Location: {$FormTarget}");
+   exit();
+}
+
+
+$AllowedUserTypes = array('SuperUser','System Administrator');
+if (checkPermission($AllowedUserTypes) != 1) {
+   $error_message = getLanguageText('ERRORMSG-ACCESS-DENIED');
+   $naction = '';
+   header("Location: {$FormTarget}?action=$action&naction=$naction$headerArgs&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+   exit();
+}
+
+
+/**
+ * Helpers to look up a school's Square connection (merchant id + tokens).
+ *
+ * The PayPal helper only returned a merchant_id because PayPal acts via the
+ * partner credentials. Square requires the SELLER's access token to charge on
+ * their behalf, so getValidAccessToken() returns a decrypted, auto-refreshed
+ * bearer token. All persistence/encryption/refresh lives in MerchantStore so
+ * the web flow, the CLI cron, and the webhook share one implementation.
+ */
+
+require_once __DIR__ . '/lib/SquareClient.php';
+require_once __DIR__ . '/lib/MerchantStore.php';
+
+function squareConfig(): array {
+    return require __DIR__ . '/config.php';
+}
+
+function squareStore(): MerchantStore {
+    static $store = null;
+    if ($store === null) $store = new MerchantStore(squareConfig());
+    return $store;
+}
+
+function getMerchantId(string $schoolName): ?string
+{
+    $conn = squareStore()->get($schoolName);
+    return $conn['merchant_id'] ?? null;
+}
+
+/**
+ * Return a usable (decrypted, non-expired) access token for a school, refreshing
+ * it lazily via the refresh token if it is near expiry. Returns null if the
+ * school is not connected. This is what the Phase 4 payments code calls.
+ */
+function getValidAccessToken(string $schoolName): ?string
+{
+    $client = new SquareClient(squareConfig());
+    $result = squareStore()->ensureFreshToken($schoolName, $client);
+    return $result['access_token'] ?? null;
+}
+
+function getAllMerchants(): array
+{
+    $store = squareStore();
+    $merchants = [];
+    foreach ($store->connectedSchools() as $school) {
+        $rec = $store->get($school);
+        if (!$rec) continue;
+        $merchants[$school] = [
+            'merchant_id' => $rec['merchant_id'],
+            'expires_at'  => $rec['expires_at'],
+        ];
+    }
+    return $merchants;
+}
+
+// Return JSON when accessed directly (never expose tokens here).
+if (basename(__FILE__) === basename($_SERVER['SCRIPT_FILENAME'])) {
+    header('Content-Type: application/json');
+    $school = $_GET['school'] ?? '';
+    if ($school) {
+        echo json_encode([
+            'school'      => $school,
+            'merchant_id' => getMerchantId($school),
+            'connected'   => getMerchantId($school) !== null,
+        ]);
+    } else {
+        echo json_encode(['merchants' => getAllMerchants()]);
+    }
+}