136 lines
7.3 KiB
PHP
136 lines
7.3 KiB
PHP
<?php
|
|
// Basic configuration for the Square integration.
|
|
// Fill in your Sandbox (or Production) credentials from developer.squareup.com
|
|
// (Developer Dashboard → your Application → OAuth).
|
|
|
|
// Compute a runtime base URL if no explicit override is provided (supports multi-tenant subdomains).
|
|
$envBaseUrl = getenv('SQUARE_BASE_URL');
|
|
if ($envBaseUrl && is_string($envBaseUrl)) {
|
|
$computedBaseUrl = rtrim($envBaseUrl, '/');
|
|
} else {
|
|
$scheme = 'http';
|
|
if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
|
|
$scheme = 'https';
|
|
} elseif (!empty($_SERVER['HTTP_X_FORWARDED_PROTO'])) {
|
|
$scheme = $_SERVER['HTTP_X_FORWARDED_PROTO'];
|
|
}
|
|
$host = $_SERVER['HTTP_HOST'] ?? 'localhost';
|
|
// e.g., /square from /square/index.php
|
|
$scriptDir = isset($_SERVER['SCRIPT_NAME']) ? str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'])) : '';
|
|
$scriptDir = rtrim($scriptDir, '/');
|
|
$computedBaseUrl = $scheme . '://' . $host . ($scriptDir ?: '');
|
|
}
|
|
|
|
return [
|
|
// 'sandbox' or 'production'
|
|
'env' => 'production',
|
|
|
|
// Square Application credentials for your platform app (Dashboard → your app
|
|
// → Credentials; flip the Sandbox/Production toggle to match 'env' above).
|
|
// - client_id IS the Application ID. Production: sq0idp-... Sandbox: the
|
|
// Sandbox Application ID (sandbox-sq0idb-...). This SAME value is used as
|
|
// the Web Payments SDK appId on the frontend (see web_payments_app_id).
|
|
// - client_secret is the OAuth Application Secret. Production: sq0csp-...
|
|
// Sandbox: sandbox-sq0csb-...
|
|
'client_id' => 'sq0idp-gx2ebQJw0LVnELCNf7jaPA',
|
|
// OAuth Application Secret (sandbox-sq0csb-...), from the dashboard's OAuth page.
|
|
// Only needed for OAuth onboarding (onboard.php) — NOT for the local charge test.
|
|
// NOTE: the EAAA... value you had here was your Sandbox ACCESS TOKEN, which is
|
|
// not the OAuth secret — use that access token as the seed helper's --token.
|
|
'client_secret' => 'sq0csp-U1L2aDIsPDf7ix7hYfN4v2zrklxn4-6Q2tlDHg916YY',
|
|
|
|
// Web Payments SDK application id used by the browser to tokenize cards. This
|
|
// is the public Application ID and is normally identical to client_id, so we
|
|
// default to it. Only set this if your frontend must use a different app id.
|
|
'web_payments_app_id' => '',
|
|
|
|
// OAuth permissions we request from each seller (space-joined in the URL).
|
|
// PAYMENTS_WRITE/READ -> charge cards + read payments on the seller's behalf
|
|
// MERCHANT_PROFILE_READ -> read merchant + locations (needed to verify readiness)
|
|
// PAYMENTS_WRITE_ADDITIONAL_RECIPIENTS -> REQUIRED to take app_fee_money (your
|
|
// platform cut). Only needed if platform_fee.enabled is true below; if you
|
|
// turn fees on you must add it here AND have sellers re-authorize.
|
|
// Changing scopes requires sellers to re-authorize.
|
|
'scopes' => [
|
|
'MERCHANT_PROFILE_READ',
|
|
'PAYMENTS_WRITE',
|
|
'PAYMENTS_READ',
|
|
'PAYMENTS_WRITE_ADDITIONAL_RECIPIENTS', // uncomment to take app fees
|
|
],
|
|
|
|
// The OAuth redirect URL. Leave BLANK (recommended): Square then returns every
|
|
// school to the "Redirect URL" registered in the Square Developer Dashboard,
|
|
// which must be https://<any host serving this app>/square/onboard.php (e.g.
|
|
// https://app.hotlunches.net/square/onboard.php). If you do set it, it must
|
|
// match the dashboard value byte for byte (scheme, host, and path).
|
|
'redirect_uri' => 'https://dev.hotlunches.net/square/onboard.php',
|
|
|
|
// When true, the authorize URL sends session=false, forcing Square to show the
|
|
// seller LOGIN screen every time. Square REQUIRES this for production apps so a
|
|
// school admin who is already signed into a different Square account (e.g. a
|
|
// personal one) cannot connect the wrong account by accident.
|
|
// ⚠️ Set FALSE in Sandbox — the sandbox authorize page can't render a login and
|
|
// returns 400 when session=false is sent.
|
|
'oauth_force_login' => true,
|
|
|
|
// Base URL used by browser redirects (auto-detected; override via SQUARE_BASE_URL env if needed)
|
|
'base_url' => $computedBaseUrl,
|
|
|
|
// Master switch for moving money. When false, order-api.php validates the
|
|
// request but does NOT charge (returns stage:"validated") — useful to deploy
|
|
// the frontend before you're ready to take live payments.
|
|
'payments_enabled' => true,
|
|
|
|
// When true, order-api.php rejects a charge whose browser Origin is not in
|
|
// the school's registered embed allowlist (schools.square_allowed_origins).
|
|
// Leave false until every connected school has registered
|
|
// the domain(s) their "Pay" button lives on, or legitimate buttons may be
|
|
// blocked. A first-party call with no Origin header is always allowed.
|
|
'enforce_embed_origins' => false,
|
|
|
|
// Your platform's per-transaction cut, taken via Square's app_fee_money.
|
|
// fee = round(amount * percentage / 100) + fixed_cents
|
|
// DEFAULT OFF. To enable: set enabled=true, add the
|
|
// PAYMENTS_WRITE_ADDITIONAL_RECIPIENTS scope above, have sellers re-authorize,
|
|
// and ensure your app is approved by Square to take app fees. The fee is
|
|
// capped at 90% of the amount (Square's limit) and must use the same currency.
|
|
'platform_fee' => [
|
|
'enabled' => false,
|
|
'percentage' => 0.0, // e.g. 2.0 for 2%
|
|
'fixed_cents' => 0, // e.g. 30 for $0.30
|
|
],
|
|
|
|
// API version sent on every request (the date-based Square-Version header).
|
|
// Pin this so a future API change can't silently alter behavior; bump it
|
|
// deliberately after reviewing the changelog.
|
|
'square_version' => '2026-05-20',
|
|
|
|
// Storage path (must be writable by Apache/PHP)
|
|
'storage_path' => __DIR__ . DIRECTORY_SEPARATOR . 'data',
|
|
|
|
// Key used to encrypt seller access/refresh tokens at rest (AES-256-GCM).
|
|
// Generate one once with: php -r "echo bin2hex(random_bytes(32));"
|
|
// and paste the 64-hex-char string here (or set the SQUARE_TOKEN_KEY env var).
|
|
// If left empty, tokens are stored in PLAINTEXT and a warning is logged — do
|
|
// not ship to production without a key.
|
|
'token_encryption_key' => getenv('SQUARE_TOKEN_KEY') ?: '296dfee5fbf2f334b542c982eed54384d670fc9aef6c896ab8e18317caf029b2',
|
|
|
|
// CA bundle for cURL TLS verification. Some environments (notably Windows
|
|
// PHP builds) ship without a configured curl.cainfo, which makes every
|
|
// HTTPS call to Square fail with "unable to get local issuer certificate".
|
|
// We bundle a Mozilla CA file next to this config and use it when present;
|
|
// on servers with a system bundle already configured this is simply ignored.
|
|
'curl_ca_bundle' => is_file(__DIR__ . '/cacert.pem') ? __DIR__ . '/cacert.pem' : null,
|
|
|
|
// Webhook signature key from Square Dashboard → your App → Webhooks.
|
|
// Used to verify the x-square-hmacsha256-signature header on incoming events
|
|
// such as oauth.authorization.revoked.
|
|
'webhook_signature_key' => 'KszGraQZC-6Bkidoz1Fd_A',
|
|
|
|
// The EXACT Notification URL registered for the webhook subscription. Square's
|
|
// signature is computed over (this URL + raw body), so it must match byte for
|
|
// byte (e.g. https://app.hotlunches.net/square/webhook.php). If left blank,
|
|
// webhook.php reconstructs it from the request, which can break behind a proxy.
|
|
'webhook_url' => 'https://app.hotlunches.net/square/webhook.php',
|
|
];
|