Business Logic

// Node.js/Express - Secure business logic

const rateLimit = require('express-rate-limit');

// SECURE: Server-side price catalog
const PRODUCT_CATALOG = {
  'prod-1': { name: 'Premium Plan', price: 99.99, maxQuantity: 1 },
  'prod-2': { name: 'Basic Plan', price: 19.99, maxQuantity: 1 },
  'prod-3': { name: 'Widget', price: 15.00, maxQuantity: 100 }
};

// SECURE: Server calculates total
function computeTotal(items) {
  let total = 0;
  
  for (const item of items) {
    // SECURE: Look up price from server catalog
    const product = PRODUCT_CATALOG[item.productId];
    
    if (!product) {
      throw new Error(`Invalid product: ${item.productId}`);
    }
    
    // SECURE: Validate quantity
    if (!Number.isInteger(item.quantity) || 
        item.quantity < 1 || 
        item.quantity > product.maxQuantity) {
      throw new Error(`Invalid quantity for ${product.name}`);
    }
    
    // SECURE: Server computes line total
    total += product.price * item.quantity;
  }
  
  return total;
}

// SECURE: Checkout with server-side validation
app.post('/checkout', async (req, res) => {
  try {
    const { items, couponCode } = req.body;
    
    // SECURE: Compute total server-side
    let total = computeTotal(items);
    
    // SECURE: Validate and apply coupon
    if (couponCode) {
      const discount = await applyCoupon(couponCode, req.user.id, total);
      total -= discount;
    }
    
    // SECURE: Charge with server-computed amount
    const charge = await stripe.charges.create({
      amount: Math.round(total * 100),  // Server's calculation!
      currency: 'usd',
      customer: req.user.stripeId
    });
    
    // Create order after successful payment
    const order = await db.orders.create({
      userId: req.user.id,
      items,
      total,
      chargeId: charge.id,
      status: 'paid'
    });
    
    res.json({ success: true, orderId: order.id, charged: total });
    
  } catch (err) {
    logger.error('Checkout error', { err, userId: req.user.id });
    res.status(400).json({ error: 'Checkout failed' });
  }
});

// SECURE: Add to cart with validation
app.post('/add-to-cart', async (req, res) => {
  const { productId, quantity } = req.body;
  
  const product = PRODUCT_CATALOG[productId];
  
  if (!product) {
    return res.status(404).json({ error: 'Product not found' });
  }
  
  // SECURE: Validate quantity is positive integer within limits
  if (!Number.isInteger(quantity) || 
      quantity < 1 || 
      quantity > product.maxQuantity) {
    return res.status(400).json({ 
      error: `Quantity must be between 1 and ${product.maxQuantity}` 
    });
  }
  
  await db.cart.insert({
    userId: req.user.id,
    productId,
    quantity,
    priceSnapshot: product.price  // Store price at add time
  });
  
  res.json({ success: true });
});

// SECURE: Coupon application with tracking
async function applyCoupon(code, userId, orderTotal) {
  const coupon = await db.coupons.findOne({ code });
  
  if (!coupon || !coupon.active) {
    throw new Error('Invalid coupon');
  }
  
  // SECURE: Check expiration
  if (coupon.expiresAt && new Date() > coupon.expiresAt) {
    throw new Error('Coupon expired');
  }
  
  // SECURE: Check minimum order amount
  if (coupon.minimumAmount && orderTotal < coupon.minimumAmount) {
    throw new Error(`Minimum order amount: $${coupon.minimumAmount}`);
  }
  
  // SECURE: Check if already used by this user
  const previousUse = await db.couponUsage.findOne({
    couponId: coupon._id,
    userId
  });
  
  if (previousUse) {
    throw new Error('Coupon already used');
  }
  
  // SECURE: Check total usage limit
  const totalUses = await db.couponUsage.countDocuments({
    couponId: coupon._id
  });
  
  if (coupon.maxUses && totalUses >= coupon.maxUses) {
    throw new Error('Coupon no longer available');
  }
  
  // Record usage
  await db.couponUsage.create({
    couponId: coupon._id,
    userId,
    usedAt: new Date()
  });
  
  // Calculate discount
  const discount = (orderTotal * coupon.percentage) / 100;
  return Math.min(discount, coupon.maxDiscount || Infinity);
}

// SECURE: Rate-limited report generation
const reportLimiter = rateLimit({
  windowMs: 60 * 1000,  // 1 minute
  max: 3,  // 3 reports per minute
  message: 'Too many report requests'
});

app.post('/generate-report', reportLimiter, async (req, res) => {
  const { startDate, endDate } = req.body;
  
  const start = new Date(startDate);
  const end = new Date(endDate);
  
  // SECURE: Limit date range to prevent resource exhaustion
  const daysDiff = (end - start) / (1000 * 60 * 60 * 24);
  if (daysDiff > 90) {
    return res.status(400).json({ error: 'Date range cannot exceed 90 days' });
  }
  
  // Generate report with pagination/limits
  const data = await db.transactions.find({
    userId: req.user.id,
    date: { $gte: start, $lte: end }
  }).limit(10000);  // Hard limit
  
  const report = generateReport(data);
  
  res.json({ report });
});

// SECURE: Purchase with stock checking and atomic operations
app.post('/purchase', async (req, res) => {
  const { productId, quantity } = req.body;
  
  // Start transaction
  const session = await db.startSession();
  session.startTransaction();
  
  try {
    // SECURE: Lock product row and check stock atomically
    const product = await db.products.findOneAndUpdate(
      { 
        _id: productId,
        stock: { $gte: quantity }  // Only if enough stock!
      },
      { 
        $inc: { stock: -quantity }  // Decrement atomically
      },
      { 
        session,
        new: true
      }
    );
    
    if (!product) {
      await session.abortTransaction();
      return res.status(400).json({ error: 'Insufficient stock' });
    }
    
    // Create order
    await db.orders.create([{
      userId: req.user.id,
      productId,
      quantity,
      price: product.price * quantity,
      status: 'pending'
    }], { session });
    
    await session.commitTransaction();
    
    res.json({ success: true });
    
  } catch (err) {
    await session.abortTransaction();
    throw err;
  } finally {
    session.endSession();
  }
});

// SECURE: State machine for order refunds
const ALLOWED_REFUND_STATES = ['delivered', 'shipped'];
const REFUND_WINDOW_DAYS = 30;

app.post('/orders/:id/refund', async (req, res) => {
  const order = await db.orders.findById(req.params.id);
  
  // SECURE: Verify ownership
  if (order.userId !== req.user.id) {
    return res.status(403).json({ error: 'Not your order' });
  }
  
  // SECURE: Check current state
  if (!ALLOWED_REFUND_STATES.includes(order.status)) {
    return res.status(400).json({ 
      error: `Cannot refund order with status: ${order.status}` 
    });
  }
  
  // SECURE: Check if already refunded
  if (order.refundedAt) {
    return res.status(400).json({ error: 'Order already refunded' });
  }
  
  // SECURE: Check refund window
  const daysSinceOrder = (Date.now() - order.createdAt) / (1000 * 60 * 60 * 24);
  if (daysSinceOrder > REFUND_WINDOW_DAYS) {
    return res.status(400).json({ 
      error: `Refund window of ${REFUND_WINDOW_DAYS} days has passed` 
    });
  }
  
  // Process refund
  await stripe.refunds.create({ charge: order.chargeId });
  
  // Update order state
  await db.orders.update(
    { _id: order._id },
    { 
      status: 'refunded',
      refundedAt: new Date()
    }
  );
  
  res.json({ success: true });
});

// SECURE: Referral with anti-abuse
app.post('/apply-referral', async (req, res) => {
  const { referralCode } = req.body;
  
  const referrer = await db.users.findOne({ referralCode });
  
  if (!referrer) {
    return res.status(404).json({ error: 'Invalid referral code' });
  }
  
  // SECURE: Prevent self-referral
  if (referrer._id.equals(req.user._id)) {
    return res.status(400).json({ error: 'Cannot refer yourself' });
  }
  
  // SECURE: Check if already used a referral
  if (req.user.referredBy) {
    return res.status(400).json({ error: 'Referral already applied' });
  }
  
  // SECURE: Detect abuse patterns (same IP, same device, etc.)
  const suspiciousActivity = await detectReferralAbuse(req.user, referrer);
  if (suspiciousActivity) {
    logger.warn('Suspicious referral', { userId: req.user.id, referrerId: referrer._id });
    return res.status(400).json({ error: 'Referral could not be applied' });
  }
  
  // Apply bonus
  await db.users.update(
    { _id: referrer._id },
    { $inc: { credits: 25 } }  // Reduced from vulnerable 50
  );
  
  await db.users.update(
    { _id: req.user._id },
    { 
      $inc: { credits: 25 },
      referredBy: referrer._id
    }
  );
  
  res.json({ bonus: 25 });
});

// SECURE: Workflow with state validation
const ORDER_STATE_MACHINE = {
  'pending': ['paid', 'cancelled'],
  'paid': ['processing', 'cancelled'],
  'processing': ['shipped', 'cancelled'],
  'shipped': ['delivered', 'returned'],
  'delivered': ['refunded'],
  'cancelled': [],
  'refunded': [],
  'returned': ['refunded']
};

app.post('/orders/:id/mark-shipped', requireAdmin, async (req, res) => {
  const order = await db.orders.findById(req.params.id);
  
  // SECURE: Verify current state allows this transition
  const allowedNext = ORDER_STATE_MACHINE[order.status];
  if (!allowedNext.includes('shipped')) {
    return res.status(400).json({ 
      error: `Cannot ship order with status: ${order.status}` 
    });
  }
  
  // SECURE: Verify payment completed
  if (order.status !== 'processing') {
    return res.status(400).json({ error: 'Order not ready to ship' });
  }
  
  await db.orders.update(
    { _id: order._id },
    { 
      status: 'shipped',
      shippedAt: new Date()
    }
  );
  
  res.json({ success: true });
});