(SP: 1) [Checkout] Harden contracts: PATCH price merge validation, cross-order PI guard, payable-state gating; cleanup dead code; add provider CHECK; inline ensureStripePI

Author: liudmylasovetovs

frontend/app/[locale]/shop/checkout/payment/[orderId]/page.tsx

@@ -163,54 +163,6 @@ export default async function PaymentPage(props: PaymentPageProps) {
   let clientSecret = resolveClientSecret(searchParams);
   const publishableKey = paymentsEnabled ? stripeEnv.publishableKey : null;
 
-  // Ensure we have a clientSecret even when URL doesn't include ?clientSecret=...
-  // Source of truth for payment finality is webhook; this only initializes Elements.
-  // if (
-  //   paymentsEnabled &&
-  //   publishableKey &&
-  //   (!clientSecret || !clientSecret.trim())
-  // ) {
-  //   const existingPi = order.paymentIntentId?.trim() ?? '';
-  //   let phase:
-  //     | 'retrievePaymentIntent'
-  //     | 'createPaymentIntent'
-  //     | 'setOrderPaymentIntent'
-  //     | 'unknown' = 'unknown';
-
-  //   try {
-  //     if (existingPi) {
-  //       phase = 'retrievePaymentIntent';
-  //       const retrieved = await retrievePaymentIntent(existingPi);
-  //       clientSecret = retrieved.clientSecret;
-  //     } else {
-  //       phase = 'createPaymentIntent';
-  //       const snapshot = await readStripePaymentIntentParams(order.id);
-  //       const created = await createPaymentIntent({
-  //         amount: snapshot.amountMinor,
-  //         currency: snapshot.currency,
-  //         orderId: order.id,
-  //         idempotencyKey: `pi:${order.id}`,
-  //       });
-
-  //       phase = 'setOrderPaymentIntent';
-  //       await setOrderPaymentIntent({
-  //         orderId: order.id,
-  //         paymentIntentId: created.paymentIntentId,
-  //       });
-
-  //       clientSecret = created.clientSecret;
-  //     }
-  //   } catch (error) {
-  //     logError('payment_page_failed', error, {
-  //       orderId: order.id,
-  //       existingPi,
-  //       phase,
-  //     });
-
-  //     // Leave clientSecret empty -> UI shows "Payment cannot be initialized"
-  //   }
-  // }
-
   if (
     paymentsEnabled &&
     publishableKey &&

frontend/app/api/shop/admin/products/[id]/route.ts

@@ -7,10 +7,14 @@ import {
   AdminUnauthorizedError,
   requireAdminApi,
 } from '@/lib/auth/admin';
+import {
+  InvalidPayloadError,
+  SlugConflictError,
+  PriceConfigError,
+} from '@/lib/services/errors';
 
 import { parseAdminProductForm } from '@/lib/admin/parseAdminProductForm';
 import { logError } from '@/lib/logging';
-import { InvalidPayloadError, SlugConflictError } from '@/lib/services/errors';
 import {
   deleteProduct,
   getAdminProductByIdWithPrices,
@@ -217,6 +221,19 @@ export async function PATCH(
     } catch (error) {
       logError('Failed to update product', error);
 
+      if (error instanceof PriceConfigError) {
+        return NextResponse.json(
+          {
+            error: error.message,
+            code: error.code, // PRICE_CONFIG_ERROR
+            productId: error.productId,
+            currency: error.currency,
+            field: 'prices',
+          },
+          { status: 400 }
+        );
+      }
+
       if (error instanceof InvalidPayloadError) {
         const anyErr = error as any;
         return NextResponse.json(

frontend/app/api/shop/checkout/route.ts

@@ -292,26 +292,16 @@ export async function POST(request: NextRequest) {
     const stripePaymentFlow =
       paymentsEnabled && order.paymentProvider === 'stripe';
 
-    async function ensureStripePI(
-      orderId: string,
-      existingPaymentIntentId: string | null
-    ) {
-      return await ensureStripePaymentIntentForOrder({
-        orderId,
-        existingPaymentIntentId,
-      });
-    }
-
     // =========================
     // Existing order path
     // =========================
     if (!result.isNew) {
       if (stripePaymentFlow) {
         try {
-          const ensured = await ensureStripePI(
-            order.id,
-            order.paymentIntentId ?? null
-          );
+          const ensured = await ensureStripePaymentIntentForOrder({
+            orderId: order.id,
+            existingPaymentIntentId: order.paymentIntentId ?? null,
+          });
 
           return buildCheckoutResponse({
             order: {
@@ -408,10 +398,10 @@ export async function POST(request: NextRequest) {
 
     // Stripe new order: durable attempt layer (bounded + audited)
     try {
-      const ensured = await ensureStripePI(
-        order.id,
-        order.paymentIntentId ?? null
-      );
+      const ensured = await ensureStripePaymentIntentForOrder({
+        orderId: order.id,
+        existingPaymentIntentId: order.paymentIntentId ?? null,
+      });
 
       return buildCheckoutResponse({
         order: {

frontend/drizzle/0001_add_payment_attempts.sql

@@ -12,6 +12,7 @@ CREATE TABLE "payment_attempts" (
 	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
 	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
 	"finalized_at" timestamp with time zone,
+	CONSTRAINT "payment_attempts_provider_check" CHECK ("payment_attempts"."provider" in ('stripe')),
 	CONSTRAINT "payment_attempts_status_check" CHECK ("payment_attempts"."status" in ('active','succeeded','failed','canceled')),
 	CONSTRAINT "payment_attempts_attempt_number_check" CHECK ("payment_attempts"."attempt_number" >= 1)
 );

frontend/lib/psp/stripe.ts

@@ -20,11 +20,20 @@ type CreateRefundInput = {
 let _stripe: Stripe | null = null;
 let _stripeKey: string | null = null;
 
+class StripePspError extends Error {
+  readonly code: string;
+  readonly cause: unknown;
+
+  constructor(code: string, cause: unknown) {
+    super(code);
+    this.name = 'StripePspError';
+    this.code = code;
+    this.cause = cause;
+  }
+}
+
 function withCause(code: string, cause: unknown): Error {
-  const err = new Error(code);
-  // Preserve original error for logs/diagnostics without relying on ES2022 ErrorOptions.
-  (err as any).cause = cause;
-  return err;
+  return new StripePspError(code, cause);
 }
 
 export async function createRefund({

frontend/lib/services/errors.ts

@@ -35,10 +35,12 @@ export class OrderNotFoundError extends Error {
 //   code = "SLUG_CONFLICT" as const
 // }
 export class InvalidPayloadError extends Error {
-  code = 'INVALID_PAYLOAD' as const;
-  constructor(message = 'Invalid payload') {
+  code: string;
+
+  constructor(message = 'Invalid payload', opts?: { code?: string }) {
     super(message);
     this.name = 'InvalidPayloadError';
+    this.code = opts?.code ?? 'INVALID_PAYLOAD';
   }
 }
 
@@ -91,26 +93,27 @@ export class SlugConflictError extends Error {
 }
 
 export class OrderStateInvalidError extends Error {
-  code = 'ORDER_STATE_INVALID' as const;
-  orderId?: string;
-  field?: string;
-  rawValue?: unknown;
-  details?: Record<string, unknown>;
+  readonly code = 'ORDER_STATE_INVALID' as const;
+
+  readonly orderId?: string;
+  readonly field?: string;
+  readonly rawValue?: unknown;
+  readonly details?: unknown;
 
   constructor(
-    message = 'Order state is invalid.',
-    options?: {
+    message: string,
+    opts?: {
       orderId?: string;
       field?: string;
       rawValue?: unknown;
-      details?: Record<string, unknown>;
+      details?: unknown;
     }
   ) {
     super(message);
     this.name = 'OrderStateInvalidError';
-    this.orderId = options?.orderId;
-    this.field = options?.field;
-    this.rawValue = options?.rawValue;
-    this.details = options?.details;
+    this.orderId = opts?.orderId;
+    this.field = opts?.field;
+    this.rawValue = opts?.rawValue;
+    this.details = opts?.details;
   }
 }

frontend/lib/services/orders/payment-attempts.ts

@@ -8,6 +8,7 @@ import { readStripePaymentIntentParams } from '@/lib/services/orders/payment-int
 import { createPaymentIntent, retrievePaymentIntent } from '@/lib/psp/stripe';
 import { setOrderPaymentIntent } from '@/lib/services/orders';
 import { logError } from '@/lib/logging';
+import { OrderStateInvalidError } from '@/lib/services/errors';
 
 export type PaymentProvider = 'stripe';
 export type PaymentAttemptStatus =
@@ -125,7 +126,27 @@ async function upsertBackfillAttemptForExistingPI(args: {
     )
     .limit(1);
 
-  if (found[0]) return found[0];
+  const existingAttempt = found[0] ?? null;
+  if (existingAttempt) {
+    // Guard: never reuse attempt that belongs to a different order (cross-order PI reuse).
+    if (existingAttempt.orderId === orderId) return existingAttempt;
+
+    // Fail-closed: PI is already linked to another order. Do NOT create a new attempt
+    // that would bind this PI to a second order.
+    throw new OrderStateInvalidError(
+      'PaymentIntent is already associated with a different order.',
+      {
+        orderId,
+        field: 'providerPaymentIntentId',
+        rawValue: paymentIntentId,
+        details: {
+          provider,
+          paymentIntentId,
+          existingOrderId: existingAttempt.orderId,
+        },
+      }
+    );
+  }
 
   const max = await getMaxAttemptNumber(orderId, provider);
   const next = max + 1;

frontend/lib/services/orders/payment-intent.ts

@@ -110,23 +110,39 @@ export async function readStripePaymentIntentParams(orderId: string): Promise<{
     );
   }
 
+  // Payable-state gate: fail-closed for paid/failed/refunded/canceled/etc.
+  const allowed: PaymentStatus[] = ['pending', 'requires_payment'];
+  if (!allowed.includes(existing.paymentStatus as PaymentStatus)) {
+    throw new OrderStateInvalidError(
+      'Order is not payable; Stripe PaymentIntent initialization is not allowed in the current state.',
+      {
+        orderId,
+        field: 'paymentStatus',
+        rawValue: existing.paymentStatus,
+        details: {
+          allowed,
+          provider,
+          paymentIntentId: existing.paymentIntentId ?? null,
+        },
+      }
+    );
+  }
+
   const amountMinor = existing.totalAmountMinor;
 
   // Canonical money source = DB minor units. Fail-closed on invalid totals.
   if (!Number.isSafeInteger(amountMinor) || amountMinor <= 0) {
-    const err = new OrderStateInvalidError(
-      'Invalid order total for Stripe payment intent creation.'
+    throw new OrderStateInvalidError(
+      'Invalid order total for Stripe payment intent creation.',
+      {
+        orderId,
+        field: 'totalAmountMinor',
+        rawValue: amountMinor,
+        details: {
+          reason: 'Invalid order total for Stripe payment intent creation.',
+        },
+      }
     );
-
-    // attach diagnostics for API handler (keeps existing errorResponse shape)
-    (err as any).orderId = orderId;
-    (err as any).field = 'totalAmountMinor';
-    (err as any).rawValue = amountMinor;
-    (err as any).details = {
-      reason: 'Invalid order total for Stripe payment intent creation.',
-    };
-
-    throw err;
   }
 
   return { amountMinor, currency: existing.currency };

frontend/lib/services/orders/refund.ts

@@ -11,9 +11,7 @@ import {
 } from './psp-metadata/refunds';
 
 function invalid(code: string, message: string): InvalidPayloadError {
-  const err = new InvalidPayloadError(message);
-  (err as any).code = code;
-  return err;
+  return new InvalidPayloadError(message, { code });
 }
 
 function makeRefundIdempotencyKey(

frontend/lib/services/products/mutations/update.ts

@@ -1,6 +1,4 @@
-// frontend/lib/services/products/mutations/update.ts
 import { eq, sql } from 'drizzle-orm';
-
 import {
   destroyProductImage,
   uploadProductImageFromFile,
@@ -17,6 +15,7 @@ import { mapRowToProduct } from '../mapping';
 import { normalizeSlug } from '../slug';
 import {
   assertMoneyMinorInt,
+  assertMergedPricesPolicy,
   enforceSaleBadgeRequiresOriginal,
   normalizePricesFromInput,
   validatePriceRows,
@@ -56,10 +55,14 @@ export async function updateProduct(
 
   const prices = normalizePricesFromInput(input);
   if (prices.length) validatePriceRows(prices);
-  // Enforce SALE invariant against FINAL state (DB rows + incoming upserts)
+
   const finalBadge = (input as any).badge ?? existing.badge;
 
-  if (finalBadge === 'SALE') {
+  // Enforce merged-state invariants (DB rows + incoming upserts)
+  // - If prices are patched, validate merged currency policy (e.g. USD must exist)
+  // - If final badge is SALE, enforce originalPrice for ALL currencies in merged state
+
+  if (prices.length || finalBadge === 'SALE') {
     const existingPriceRows = await db
       .select({
         currency: productPrices.currency,
@@ -92,7 +95,18 @@ export async function updateProduct(
       merged.set(p.currency, p);
     }
 
-    enforceSaleBadgeRequiresOriginal('SALE', Array.from(merged.values()));
+    const mergedRows = Array.from(merged.values());
+
+    // Currency-set policy should be enforced on merged state ONLY when prices are patched.
+    // This keeps PATCH semantics: partial prices payload is allowed, and policy is checked post-merge.
+    if (prices.length) {
+      assertMergedPricesPolicy(mergedRows, { productId: id, requireUsd: true });
+    }
+
+    // SALE invariant must be enforced on merged state when badge is SALE (even if prices are not patched).
+    if (finalBadge === 'SALE') {
+      enforceSaleBadgeRequiresOriginal('SALE', mergedRows);
+    }
   }
 
   // Base fields update
@@ -138,7 +152,7 @@ export async function updateProduct(
   }
 
   try {
-    // 1) upsert prices 
+    // 1) upsert prices
     if (prices.length) {
       const upsertRows = prices.map(p => {
         const priceMinor = p.priceMinor;