Implement Cash on Delivery (COD) payment for Bangladesh market

prisma/migrations/20251211120000_add_cod_fields/migration.sql

@@ -0,0 +1,6 @@
+-- AlterTable
+ALTER TABLE "Order" ADD COLUMN "codFee" DOUBLE PRECISION,
+ADD COLUMN "phoneVerified" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN "deliveryAttempts" INTEGER NOT NULL DEFAULT 0,
+ADD COLUMN "codCollectionStatus" TEXT,
+ADD COLUMN "codCollectedAt" TIMESTAMP(3);

prisma/schema.prisma

@@ -774,6 +774,13 @@ model Order {
 
   ipAddress   String?
 
+  // COD-specific fields
+  codFee              Float? // Cash on Delivery fee
+  phoneVerified       Boolean @default(false) // Phone verification status
+  deliveryAttempts    Int @default(0) // Number of delivery attempts
+  codCollectionStatus String? // PENDING, COLLECTED, FAILED, PARTIAL
+  codCollectedAt      DateTime? // When cash was collected
+
   items    OrderItem[]
 
   createdAt DateTime @default(now())

src/app/api/orders/[id]/cod-status/route.ts

@@ -0,0 +1,127 @@
+/**
+ * COD Collection Status Update API
+ * PUT /api/orders/[id]/cod-status
+ * 
+ * Updates the collection status of a COD order (COLLECTED or FAILED)
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { authOptions } from '@/lib/auth';
+import { CODService } from '@/lib/services/cod.service';
+import { prisma } from '@/lib/prisma';
+import { z } from 'zod';
+
+// Request validation schema
+const updateCODStatusSchema = z.object({
+  status: z.enum(['COLLECTED', 'FAILED']),
+  collectedAmount: z.number().positive().optional(),
+  failureReason: z.string().optional(),
+  notes: z.string().optional(),
+});
+
+export async function PUT(
+  req: NextRequest,
+  context: { params: Promise<{ id: string }> }
+) {
+  try {
+    // Get session - must be authenticated
+    const session = await getServerSession(authOptions);
+    if (!session?.user?.id) {
+      return NextResponse.json(
+        { success: false, error: 'Unauthorized' },
+        { status: 401 }
+      );
+    }
+
+    const params = await context.params;
+    const orderId = params.id;
+
+    // Parse and validate request body
+    const body = await req.json();
+    const validatedData = updateCODStatusSchema.parse(body);
+
+    // Get order and verify access
+    const order = await prisma.order.findUnique({
+      where: { id: orderId },
+      include: {
+        store: {
+          include: {
+            organization: {
+              include: {
+                memberships: {
+                  where: { userId: session.user.id },
+                },
+              },
+            },
+            staff: {
+              where: { userId: session.user.id },
+            },
+          },
+        },
+      },
+    });
+
+    if (!order) {
+      return NextResponse.json(
+        { success: false, error: 'Order not found' },
+        { status: 404 }
+      );
+    }
+
+    // Check if user has access to this store
+    const hasOrgAccess = order.store.organization.memberships.length > 0;
+    const hasStaffAccess = order.store.staff.length > 0;
+
+    if (!hasOrgAccess && !hasStaffAccess) {
+      return NextResponse.json(
+        { success: false, error: 'Forbidden - No access to this store' },
+        { status: 403 }
+      );
+    }
+
+    // Update COD collection status
+    const updatedOrder = await CODService.updateCollectionStatus({
+      orderId,
+      status: validatedData.status,
+      collectedAmount: validatedData.collectedAmount,
+      failureReason: validatedData.failureReason,
+      notes: validatedData.notes,
+    });
+
+    return NextResponse.json({
+      success: true,
+      order: {
+        id: updatedOrder!.id,
+        orderNumber: updatedOrder!.orderNumber,
+        status: updatedOrder!.status,
+        paymentStatus: updatedOrder!.paymentStatus,
+        codCollectionStatus: updatedOrder!.codCollectionStatus,
+        codCollectedAt: updatedOrder!.codCollectedAt,
+      },
+    });
+  } catch (error) {
+    console.error('COD status update error:', error);
+
+    // Handle validation errors
+    if (error instanceof z.ZodError) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: 'Validation failed',
+          details: error.issues,
+        },
+        { status: 400 }
+      );
+    }
+
+    // Handle business logic errors
+    return NextResponse.json(
+      {
+        success: false,
+        error: error instanceof Error ? error.message : 'Failed to update COD status',
+      },
+      { status: 400 }
+    );
+  }
+}

src/app/api/orders/cod/route.ts

@@ -0,0 +1,98 @@
+/**
+ * COD Order Creation API
+ * POST /api/orders/cod
+ * 
+ * Creates a Cash on Delivery order with phone verification and fraud checks
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getServerSession } from 'next-auth';
+import { authOptions } from '@/lib/auth';
+import { CODService } from '@/lib/services/cod.service';
+import { z } from 'zod';
+
+// Request validation schema
+const createCODOrderSchema = z.object({
+  storeId: z.string().min(1, 'Store ID is required'),
+  customerEmail: z.string().email('Invalid email address'),
+  customerName: z.string().min(1, 'Customer name is required'),
+  customerPhone: z.string().min(10, 'Phone number is required'),
+  shippingAddress: z.object({
+    address: z.string().min(1, 'Address is required'),
+    city: z.string().min(1, 'City is required'),
+    state: z.string().optional(),
+    postalCode: z.string().min(1, 'Postal code is required'),
+    country: z.string().min(1, 'Country is required'),
+  }),
+  billingAddress: z.string().optional(),
+  items: z.array(
+    z.object({
+      productId: z.string(),
+      variantId: z.string().optional(),
+      quantity: z.number().int().positive(),
+    })
+  ).min(1, 'At least one item is required'),
+  subtotal: z.number().positive('Subtotal must be positive'),
+  taxAmount: z.number().nonnegative('Tax amount must be non-negative').default(0),
+  shippingAmount: z.number().nonnegative('Shipping amount must be non-negative').default(0),
+  discountAmount: z.number().nonnegative('Discount amount must be non-negative').default(0),
+  codFee: z.number().nonnegative('COD fee must be non-negative'),
+  notes: z.string().optional(),
+  locale: z.enum(['en', 'bn']).optional().default('en'),
+  idempotencyKey: z.string().optional(),
+});
+
+export async function POST(req: NextRequest) {
+  try {
+    // Get session (optional for guest checkout)
+    const session = await getServerSession(authOptions);
+
+    // Parse and validate request body
+    const body = await req.json();
+    const validatedData = createCODOrderSchema.parse(body);
+
+    // Create COD order
+    const order = await CODService.createCODOrder({
+      ...validatedData,
+      userId: session?.user?.id,
+    });
+
+    return NextResponse.json(
+      {
+        success: true,
+        order: {
+          id: order.id,
+          orderNumber: order.orderNumber,
+          status: order.status,
+          totalAmount: order.totalAmount,
+          codFee: order.codFee,
+          estimatedDelivery: order.estimatedDelivery,
+        },
+      },
+      { status: 201 }
+    );
+  } catch (error) {
+    console.error('COD order creation error:', error);
+
+    // Handle validation errors
+    if (error instanceof z.ZodError) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: 'Validation failed',
+          details: error.issues,
+        },
+        { status: 400 }
+      );
+    }
+
+    // Handle business logic errors
+    return NextResponse.json(
+      {
+        success: false,
+        error: error instanceof Error ? error.message : 'Failed to create COD order',
+      },
+      { status: 400 }
+    );
+  }
+}