(SP: 3)[Backend][Shop][Monobank] Webhook apply hardening + safer cleanup (archive test products)

frontend/lib/services/orders/monobank.ts

@@ -1,6 +1,6 @@
 import 'server-only';
 
-import { and, eq, sql } from 'drizzle-orm';
+import { and, eq, inArray, sql } from 'drizzle-orm';
 
 import { db } from '@/db';
 import { orderItems, orders, paymentAttempts } from '@/db/schema';
@@ -49,7 +49,7 @@ async function getActiveAttempt(
       and(
         eq(paymentAttempts.orderId, orderId),
         eq(paymentAttempts.provider, 'monobank'),
-        sql`${paymentAttempts.status} in ('creating','active')`
+        inArray(paymentAttempts.status, ['creating', 'active'])
       )
     )
     .limit(1);
@@ -230,7 +230,7 @@ async function cancelOrderAndRelease(orderId: string, reason: string) {
       and(
         eq(orders.id, orderId),
         eq(orders.paymentProvider, 'monobank'),
-        sql`${orders.paymentStatus} in ('pending','requires_payment')`
+        inArray(orders.paymentStatus, ['pending', 'requires_payment'])
       )
     )
     .returning({ id: orders.id });
@@ -458,6 +458,7 @@ async function createMonoAttemptAndInvoiceImpl(
   }
 ): Promise<{
   attemptId: string;
+  attemptNumber: number;
   invoiceId: string;
   pageUrl: string;
   currency: 'UAH';
@@ -473,6 +474,7 @@ async function createMonoAttemptAndInvoiceImpl(
         invoiceId: existing.providerPaymentIntentId,
         pageUrl,
         attemptId: existing.id,
+        attemptNumber: existing.attemptNumber,
         currency: MONO_CURRENCY,
         totalAmountMinor: snapshot.amountMinor,
       };
@@ -535,6 +537,7 @@ async function createMonoAttemptAndInvoiceImpl(
             invoiceId: reused.providerPaymentIntentId,
             pageUrl,
             attemptId: reused.id,
+            attemptNumber: reused.attemptNumber,
             currency: MONO_CURRENCY,
             totalAmountMinor: snapshot.amountMinor,
           };
@@ -579,10 +582,18 @@ async function createMonoAttemptAndInvoiceImpl(
       });
     }
 
-    await deps.cancelOrderAndRelease(
-      args.orderId,
-      'Monobank snapshot validation failed.'
-    );
+    try {
+      await deps.cancelOrderAndRelease(
+        args.orderId,
+        'Monobank snapshot validation failed.'
+      );
+    } catch (cancelErr) {
+      logError('monobank_cancel_order_failed', cancelErr, {
+        orderId: args.orderId,
+        attemptId: attempt.id,
+        requestId: args.requestId,
+      });
+    }
 
     throw error;
   }
@@ -673,6 +684,7 @@ async function createMonoAttemptAndInvoiceImpl(
     invoiceId: invoice.invoiceId,
     pageUrl: invoice.pageUrl,
     attemptId: attempt.id,
+    attemptNumber: attempt.attemptNumber,
     currency: MONO_CURRENCY,
     totalAmountMinor: snapshot.amountMinor,
   };
@@ -686,6 +698,7 @@ export async function createMonoAttemptAndInvoice(args: {
   maxAttempts?: number;
 }): Promise<{
   attemptId: string;
+  attemptNumber: number;
   invoiceId: string;
   pageUrl: string;
   currency: 'UAH';
@@ -738,14 +751,5 @@ export async function createMonobankAttemptAndInvoice(args: {
     maxAttempts: args.maxAttempts,
   });
 
-  const [row] = await db
-    .select({ attemptNumber: paymentAttempts.attemptNumber })
-    .from(paymentAttempts)
-    .where(eq(paymentAttempts.id, result.attemptId))
-    .limit(1);
-
-  return {
-    ...result,
-    attemptNumber: row?.attemptNumber ?? 1,
-  };
+  return result;
 }

frontend/lib/tests/shop/monobank-psp-unavailable.test.ts

@@ -8,6 +8,7 @@ import { orders, paymentAttempts, productPrices, products } from '@/db/schema';
 import { resetEnvCache } from '@/lib/env';
 import { toDbMoney } from '@/lib/shop/money';
 import { deriveTestIpFromIdemKey } from '@/lib/tests/helpers/ip';
+import { isUuidV1toV5 } from '@/lib/utils/uuid';
 
 vi.mock('@/lib/auth', () => ({
   getCurrentUser: vi.fn().mockResolvedValue(null),
@@ -120,20 +121,41 @@ async function createIsolatedProduct(stock: number) {
 }
 
 async function cleanupOrder(orderId: string) {
-  await db.execute(sql`delete from inventory_moves where order_id = ${orderId}::uuid`);
-  await db.execute(sql`delete from order_items where order_id = ${orderId}::uuid`);
-  await db.delete(paymentAttempts).where(eq(paymentAttempts.orderId, orderId));
-  await db.delete(orders).where(eq(orders.id, orderId));
+  if (!isUuidV1toV5(orderId))
+    throw new Error(`cleanupOrder: invalid uuid: ${orderId}`);
+
+  await db.execute(
+    sql`delete from inventory_moves where order_id = ${orderId}::uuid`
+  );
+  await db.execute(
+    sql`delete from order_items where order_id = ${orderId}::uuid`
+  );
+  await db.execute(
+    sql`delete from payment_attempts where order_id = ${orderId}::uuid`
+  );
+  await db.execute(sql`delete from orders where id = ${orderId}::uuid`);
 }
 
-async function cleanupProduct(productId: string) {
-  await db.execute(sql`delete from inventory_moves where product_id = ${productId}::uuid`);
-  await db.execute(sql`delete from order_items where product_id = ${productId}::uuid`);
-  await db.delete(productPrices).where(eq(productPrices.productId, productId));
-  await db.delete(products).where(eq(products.id, productId));
+async function archiveProduct(productId: string) {
+  if (!isUuidV1toV5(productId))
+    throw new Error(`archiveProduct: invalid uuid: ${productId}`);
+  const TEST_ARCHIVE_PREFIX = '[TEST-ARCHIVED] ';
+  await db
+    .update(products)
+    .set({
+      isActive: false,
+      stock: 0,
+      title: sql<string>`
+        case
+          when ${products.title} like ${TEST_ARCHIVE_PREFIX + '%'} then ${products.title}
+          else ${TEST_ARCHIVE_PREFIX} || ${products.title}
+        end
+      `,
+      updatedAt: new Date(),
+    } as any)
+    .where(eq(products.id, productId));
 }
 
-
 async function postCheckout(idemKey: string, productId: string) {
   const mod = (await import('@/app/api/shop/checkout/route')) as unknown as {
     POST: (req: NextRequest) => Promise<Response>;
@@ -237,12 +259,14 @@ describe.sequential('monobank PSP_UNAVAILABLE invariant', () => {
         if (orderId) {
           await cleanupOrder(orderId);
         }
-      } catch (e) { warnCleanup('cleanupOrder', e); }
+      } catch (e) {
+        warnCleanup('cleanupOrder', e);
+      }
 
       try {
-        await cleanupProduct(productId);
+        await archiveProduct(productId);
       } catch (e) {
-        warnCleanup('cleanupProduct', e);
+        warnCleanup('archiveProduct', e);
       }
     }
   }, 20_000);