Tích Hợp Thanh Toán Online Vào Phần Mềm Bán Hàng 2026: Hướng Dẫn Toàn Diện

// vnpay-service.ts
import crypto from 'crypto'
import querystring from 'qs'

const VNPAY_CONFIG = {
  vnp_TmnCode: process.env.VNPAY_TMN_CODE,
  vnp_HashSecret: process.env.VNPAY_HASH_SECRET,
  vnp_Url: 'https://sandbox.vnpayment.vn/paymentv2/vpcpay.html',
  vnp_ReturnUrl: process.env.APP_URL + '/payment/vnpay/return',
  vnp_IpnUrl: process.env.APP_URL + '/api/payment/vnpay/ipn',
}

export function createVNPayUrl(params: {
  orderId: string
  amount: number // đơn vị: VND
  orderInfo: string
  ipAddr: string
}) {
  const date = new Date()
  const createDate = formatDate(date) // yyyyMMddHHmmss

  let vnpParams: Record<string, string> = {
    vnp_Version: '2.1.0',
    vnp_Command: 'pay',
    vnp_TmnCode: VNPAY_CONFIG.vnp_TmnCode!,
    vnp_Amount: String(params.amount * 100), // VNPay nhân 100
    vnp_CreateDate: createDate,
    vnp_CurrCode: 'VND',
    vnp_IpAddr: params.ipAddr,
    vnp_Locale: 'vn',
    vnp_OrderInfo: params.orderInfo,
    vnp_OrderType: 'other',
    vnp_ReturnUrl: VNPAY_CONFIG.vnp_ReturnUrl!,
    vnp_TxnRef: params.orderId,
  }

  // Sắp xếp params theo thứ tự alphabet
  vnpParams = sortObject(vnpParams)

  const signData = querystring.stringify(vnpParams, { encode: false })
  const hmac = crypto.createHmac('sha512', VNPAY_CONFIG.vnp_HashSecret!)
  const signed = hmac.update(Buffer.from(signData, 'utf-8')).digest('hex')

  vnpParams['vnp_SecureHash'] = signed

  return VNPAY_CONFIG.vnp_Url + '?' + querystring.stringify(vnpParams, { encode: false })
}

// Xác thực IPN từ VNPay
export function verifyVNPayIPN(body: Record<string, string>) {
  const secureHash = body['vnp_SecureHash']
  delete body['vnp_SecureHash']
  delete body['vnp_SecureHashType']

  const sortedBody = sortObject(body)
  const signData = querystring.stringify(sortedBody, { encode: false })
  const hmac = crypto.createHmac('sha512', VNPAY_CONFIG.vnp_HashSecret!)
  const signed = hmac.update(Buffer.from(signData, 'utf-8')).digest('hex')

  return secureHash === signed
}

// momo-service.ts
import crypto from 'crypto'
import axios from 'axios'

const MOMO_CONFIG = {
  partnerCode: process.env.MOMO_PARTNER_CODE!,
  accessKey: process.env.MOMO_ACCESS_KEY!,
  secretKey: process.env.MOMO_SECRET_KEY!,
  endpoint: 'https://test-payment.momo.vn/v2/gateway/api/create',
  redirectUrl: process.env.APP_URL + '/payment/momo/return',
  ipnUrl: process.env.APP_URL + '/api/payment/momo/ipn',
}

export async function createMoMoPayment(params: {
  orderId: string
  amount: number
  orderInfo: string
}) {
  const requestId = MOMO_CONFIG.partnerCode + Date.now()
  const requestType = 'payWithMethod'

  const rawSignature = [
    'accessKey=' + MOMO_CONFIG.accessKey,
    'amount=' + params.amount,
    'extraData=',
    'ipnUrl=' + MOMO_CONFIG.ipnUrl,
    'orderId=' + params.orderId,
    'orderInfo=' + params.orderInfo,
    'partnerCode=' + MOMO_CONFIG.partnerCode,
    'redirectUrl=' + MOMO_CONFIG.redirectUrl,
    'requestId=' + requestId,
    'requestType=' + requestType,
  ].join('&')

  const signature = crypto
    .createHmac('sha256', MOMO_CONFIG.secretKey)
    .update(rawSignature)
    .digest('hex')

  const response = await axios.post(MOMO_CONFIG.endpoint, {
    partnerCode: MOMO_CONFIG.partnerCode,
    accessKey: MOMO_CONFIG.accessKey,
    requestId,
    amount: params.amount,
    orderId: params.orderId,
    orderInfo: params.orderInfo,
    redirectUrl: MOMO_CONFIG.redirectUrl,
    ipnUrl: MOMO_CONFIG.ipnUrl,
    extraData: '',
    requestType,
    signature,
    lang: 'vi',
  })

  return response.data // { payUrl, deeplink, qrCodeUrl }
}

// Xử lý webhook từ SePay
// app/api/payment/sepay/webhook/route.ts

import { NextRequest, NextResponse } from 'next/server'

export async function POST(req: NextRequest) {
  const body = await req.json()

  // Xác thực API key từ header
  const apiKey = req.headers.get('Authorization')?.replace('Bearer ', '')
  if (apiKey !== process.env.SEPAY_WEBHOOK_SECRET) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  // Payload từ SePay
  const {
    id,           // ID giao dịch SePay
    gateway,      // Ngân hàng (vietcombank, techcombank...)
    transactionDate,
    accountNumber,
    code,         // Nội dung chuyển khoản — dùng để map với đơn hàng
    content,
    transferType, // in / out
    transferAmount,
    accumulated,
    referenceCode,
    description,
  } = body

  if (transferType !== 'in') {
    return NextResponse.json({ success: true }) // Bỏ qua giao dịch gửi đi
  }

  // Tìm đơn hàng từ nội dung chuyển khoản
  // Ví dụ nội dung: "DH001234 Thanh toan don hang"
  const orderCode = code || content?.match(/DHd+/)?.[0]

  if (!orderCode) {
    console.log('Không tìm được mã đơn hàng từ:', content)
    return NextResponse.json({ success: true })
  }

  // Cập nhật trạng thái đơn hàng
  await updateOrderPaymentStatus({
    orderCode,
    amount: transferAmount,
    transactionId: String(id),
    gateway,
  })

  return NextResponse.json({ success: true })
}

// Tạo VietQR link cho đơn hàng
function generateVietQRUrl(params: {
  bankId: string    // Mã ngân hàng: MB, VCB, TCB...
  accountNumber: string
  amount: number
  description: string // Nội dung chuyển khoản
  accountName?: string
}) {
  const baseUrl = 'https://img.vietqr.io/image'
  const { bankId, accountNumber, amount, description, accountName } = params

  const queryParams = new URLSearchParams({
    amount: String(amount),
    addInfo: description,
    accountName: accountName || '',
  })

  // Format: /BANK_ID-ACCOUNT_NUMBER-compact2.png?params
  return `${baseUrl}/${bankId}-${accountNumber}-compact2.png?${queryParams}`
}

// Sử dụng trong đơn hàng
const qrUrl = generateVietQRUrl({
  bankId: 'MB',
  accountNumber: '0123456789',
  amount: 500000,
  description: 'DH001234',
  accountName: 'CONG TY ABC',
})
// → https://img.vietqr.io/image/MB-0123456789-compact2.png?amount=500000&addInfo=DH001234

// stripe-service.ts
import Stripe from 'stripe'

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
  apiVersion: '2024-11-20',
})

// Tạo Payment Intent
export async function createStripePaymentIntent(params: {
  amount: number // đơn vị: smallest currency unit (VND: đồng, USD: cent)
  currency: string // 'vnd' hoặc 'usd'
  orderId: string
  customerEmail?: string
}) {
  const paymentIntent = await stripe.paymentIntents.create({
    amount: params.amount,
    currency: params.currency,
    metadata: {
      orderId: params.orderId,
    },
    receipt_email: params.customerEmail,
    automatic_payment_methods: { enabled: true },
  })

  return {
    clientSecret: paymentIntent.client_secret,
    paymentIntentId: paymentIntent.id,
  }
}

// Xử lý Stripe Webhook
export async function handleStripeWebhook(
  payload: string,
  sig: string
) {
  const event = stripe.webhooks.constructEvent(
    payload,
    sig,
    process.env.STRIPE_WEBHOOK_SECRET!
  )

  switch (event.type) {
    case 'payment_intent.succeeded':
      const pi = event.data.object as Stripe.PaymentIntent
      await updateOrderStatus(pi.metadata.orderId, 'PAID')
      break
    case 'payment_intent.payment_failed':
      const failedPi = event.data.object as Stripe.PaymentIntent
      await updateOrderStatus(failedPi.metadata.orderId, 'PAYMENT_FAILED')
      break
  }
}

// Cron job đối soát cuối ngày — 23:55 mỗi ngày
async function dailyReconciliation(date: Date) {
  // 1. Lấy tất cả giao dịch trong ngày từ DB
  const dbTransactions = await getTransactionsByDate(date)

  // 2. Lấy sao kê từ cổng thanh toán
  const vnpayStatement = await fetchVNPayStatement(date)
  const momoStatement = await fetchMoMoStatement(date)
  const sePayStatement = await fetchSePayWebhooks(date)

  const allStatements = [...vnpayStatement, ...momoStatement, ...sePayStatement]

  // 3. Đối chiếu
  const mismatches: Mismatch[] = []

  for (const stmt of allStatements) {
    const dbTx = dbTransactions.find(t => t.transactionId === stmt.transactionId)

    if (!dbTx) {
      mismatches.push({ type: 'MISSING_IN_DB', data: stmt })
    } else if (dbTx.amount !== stmt.amount) {
      mismatches.push({ type: 'AMOUNT_MISMATCH', dbData: dbTx, stmtData: stmt })
    }
  }

  // 4. Báo cáo
  await generateReconciliationReport(date, dbTransactions, allStatements, mismatches)

  if (mismatches.length > 0) {
    await alertAdmins('Đối soát tìm thấy ' + mismatches.length + ' sai lệch')
  }
}