QR Order Pay (User Scans Merchant QR)

// Backend: Generate QR
app.post('/api/orders/:orderId/qr', async (req, res) => {
  const order = await getOrder(req.params.orderId);

  const response = await rebellAPI.createQrOrder({
    productCode: process.env.REBELL_PRODUCT_CODE,
    paymentRequestId: `order-${order.id}`,
    paymentAmount: {
      currency: 'EUR',
      value: order.totalCents
    },
    order: {
      orderDescription: order.description,
      merchant: {
        store: {
          externalStoreId: process.env.STORE_ID
        }
      }
    }
  });

  // Store QR code reference
  await updateOrder(order.id, {
    qrCode: response.qrCode,
    paymentRequestId: `order-${order.id}`,
    status: 'pending_payment'
  });

  res.json({ qrCode: response.qrCode });
});

// Frontend: Render QR
async function displayCheckout(orderId) {
  const { qrCode } = await fetch(`/api/orders/${orderId}/qr`).then(r => r.json());

  // Render QR code
  const canvas = document.getElementById('qr-canvas');
  await QRCode.toCanvas(canvas, qrCode, { width: 300 });

  // Poll for payment status (optional)
  const interval = setInterval(async () => {
    const order = await fetch(`/api/orders/${orderId}`).then(r => r.json());

    if (order.status === 'paid') {
      clearInterval(interval);
      showSuccess();
    } else if (order.status === 'failed') {
      clearInterval(interval);
      showError();
    }
  }, 3000);
}

// Webhook handler
app.post('/webhooks/rebell', async (req, res) => {
  // Verify signature
  if (!verifySignature(req)) {
    return res.status(401).send('Invalid signature');
  }

  const { paymentRequestId, result } = req.body;
  const orderId = paymentRequestId.replace('order-', '');

  if (result.resultStatus === 'S') {
    await updateOrder(orderId, { status: 'paid' });
    await fulfillOrder(orderId);
  } else {
    await updateOrder(orderId, { status: 'failed' });
  }

  res.status(200).send('OK');
});