92 lines
2.8 KiB
PHP
92 lines
2.8 KiB
PHP
<?php
|
|
$ValidAccess = 2010;
|
|
|
|
require_once("../include/globals.php");
|
|
if(session_status() !== PHP_SESSION_ACTIVE) session_start();
|
|
|
|
if (SessionActive() != 1 || ! UserLoggedIn()) {
|
|
header("Location: {$FormTarget}");
|
|
exit();
|
|
}
|
|
|
|
|
|
$AllowedUserTypes = array('SuperUser','System Administrator');
|
|
if (checkPermission($AllowedUserTypes) != 1) {
|
|
$error_message = getLanguageText('ERRORMSG-ACCESS-DENIED');
|
|
$naction = '';
|
|
header("Location: {$FormTarget}?action=$action&naction=$naction$headerArgs&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
|
|
exit();
|
|
}
|
|
|
|
|
|
/**
|
|
* Helpers to look up a school's Square connection (merchant id + tokens).
|
|
*
|
|
* The PayPal helper only returned a merchant_id because PayPal acts via the
|
|
* partner credentials. Square requires the SELLER's access token to charge on
|
|
* their behalf, so getValidAccessToken() returns a decrypted, auto-refreshed
|
|
* bearer token. All persistence/encryption/refresh lives in MerchantStore so
|
|
* the web flow, the CLI cron, and the webhook share one implementation.
|
|
*/
|
|
|
|
require_once __DIR__ . '/lib/SquareClient.php';
|
|
require_once __DIR__ . '/lib/MerchantStore.php';
|
|
|
|
function squareConfig(): array {
|
|
return require __DIR__ . '/config.php';
|
|
}
|
|
|
|
function squareStore(): MerchantStore {
|
|
static $store = null;
|
|
if ($store === null) $store = new MerchantStore(squareConfig());
|
|
return $store;
|
|
}
|
|
|
|
function getMerchantId(string $schoolName): ?string
|
|
{
|
|
$conn = squareStore()->get($schoolName);
|
|
return $conn['merchant_id'] ?? null;
|
|
}
|
|
|
|
/**
|
|
* Return a usable (decrypted, non-expired) access token for a school, refreshing
|
|
* it lazily via the refresh token if it is near expiry. Returns null if the
|
|
* school is not connected. This is what the Phase 4 payments code calls.
|
|
*/
|
|
function getValidAccessToken(string $schoolName): ?string
|
|
{
|
|
$client = new SquareClient(squareConfig());
|
|
$result = squareStore()->ensureFreshToken($schoolName, $client);
|
|
return $result['access_token'] ?? null;
|
|
}
|
|
|
|
function getAllMerchants(): array
|
|
{
|
|
$store = squareStore();
|
|
$merchants = [];
|
|
foreach ($store->connectedSchools() as $school) {
|
|
$rec = $store->get($school);
|
|
if (!$rec) continue;
|
|
$merchants[$school] = [
|
|
'merchant_id' => $rec['merchant_id'],
|
|
'expires_at' => $rec['expires_at'],
|
|
];
|
|
}
|
|
return $merchants;
|
|
}
|
|
|
|
// Return JSON when accessed directly (never expose tokens here).
|
|
if (basename(__FILE__) === basename($_SERVER['SCRIPT_FILENAME'])) {
|
|
header('Content-Type: application/json');
|
|
$school = $_GET['school'] ?? '';
|
|
if ($school) {
|
|
echo json_encode([
|
|
'school' => $school,
|
|
'merchant_id' => getMerchantId($school),
|
|
'connected' => getMerchantId($school) !== null,
|
|
]);
|
|
} else {
|
|
echo json_encode(['merchants' => getAllMerchants()]);
|
|
}
|
|
}
|