feat(loyalty): pay own orders with EnakPoint from the app

Adds POST /customer/orders/:id/pay-with-points (docs/prd-point-coin.md F9,
PC-306) for the customer app and self-order. It uses the same payment path
as the cashier, approved by the customer's PIN instead of a code: the
session alone is not enough (K8), and a wrong PIN takes nothing and counts
toward the lock.

A customer can pay only their own order; any other order, and one that
does not exist, answer 404 alike, so the endpoint does not reveal other
customers' orders. The method is the organization's EnakPoint method, no
cashier is recorded, and settling the order triggers earning through the
same onOrderPaid hook as every other payment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/processor/order_processor.go

@@ -21,6 +21,9 @@ type OrderProcessor interface {
 	CreateOrder(ctx context.Context, req *models.CreateOrderRequest, organizationID uuid.UUID) (*models.OrderResponse, error)
 	AddToOrder(ctx context.Context, orderID uuid.UUID, req *models.AddToOrderRequest) (*models.AddToOrderResponse, error)
 	UpdateOrder(ctx context.Context, id uuid.UUID, req *models.UpdateOrderRequest) (*models.OrderResponse, error)
+	// PayWithPointsInApp pays the customer's own order with EnakPoint from the app or a
+	// self-order, approved by their PIN (docs/prd-point-coin.md F9).
+	PayWithPointsInApp(ctx context.Context, customerID, orderID uuid.UUID, points int64, pin string, info models.CustomerPinRequestInfo) (*models.PaymentResponse, error)
 	GetOrderByID(ctx context.Context, id uuid.UUID) (*models.OrderResponse, error)
 	ListOrders(ctx context.Context, req *models.ListOrdersRequest) (*models.ListOrdersResponse, error)
 	VoidOrder(ctx context.Context, req *models.VoidOrderRequest, voidedBy uuid.UUID) error
@@ -114,6 +117,7 @@ type OrderProcessorImpl struct {
 	loyalty                  OrderLoyalty
 	pointPayments            *PointPaymentProcessor
 	paymentCodes             paymentCodeRedeemer
+	pins                     pinVerifier
 }
 
 // OrderLoyalty is what the order flow tells and asks the loyalty program
@@ -144,11 +148,13 @@ type paymentCodeRedeemer interface {
 	Redeem(ctx context.Context, code string, customerID uuid.UUID) error
 }
 
-// SetPointPayments enables paying with the EnakPoint method: CreatePayment hands such
-// payments to pointPayments, approved by the code the customer shows (F9).
-func (p *OrderProcessorImpl) SetPointPayments(pointPayments *PointPaymentProcessor, codes paymentCodeRedeemer) {
+// SetPointPayments enables paying with the EnakPoint method. CreatePayment hands such
+// payments to pointPayments approved by the code the customer shows at the cashier,
+// and PayWithPointsInApp approved by the customer's PIN (F9).
+func (p *OrderProcessorImpl) SetPointPayments(pointPayments *PointPaymentProcessor, codes paymentCodeRedeemer, pins pinVerifier) {
 	p.pointPayments = pointPayments
 	p.paymentCodes = codes
+	p.pins = pins
 }
 
 // createPointPayment is CreatePayment for the EnakPoint method. It never uses the
@@ -1787,3 +1793,43 @@ func (p *OrderProcessorImpl) prepareRefundedIngredientRecipeItem(ctx context.Con
 func stringPtr(s string) *string {
 	return &s
 }
+
+// PayWithPointsInApp pays an order with EnakPoint on the customer's own request, in the
+// app or a self-order. The session alone is not enough: the customer's PIN approves
+// it (K8). An order that is not the customer's own is reported as not found, so the
+// endpoint does not reveal other customers' orders.
+func (p *OrderProcessorImpl) PayWithPointsInApp(ctx context.Context, customerID, orderID uuid.UUID, points int64, pin string, info models.CustomerPinRequestInfo) (*models.PaymentResponse, error) {
+	if p.pointPayments == nil || p.pins == nil {
+		return nil, fmt.Errorf("%w: paying with EnakPoint is not available", ErrPointPaymentRejected)
+	}
+	organizationID, owner, err := p.pointPayments.OrderOwner(ctx, orderID)
+	if err != nil {
+		return nil, err
+	}
+	if owner == nil || *owner != customerID {
+		return nil, repository.ErrPointPaymentOrderNotFound
+	}
+	methodID, err := p.pointPayments.PointMethodID(ctx, organizationID)
+	if err != nil {
+		return nil, err
+	}
+	result, err := p.pointPayments.Pay(ctx, PointPaymentInput{
+		OrderID:         orderID,
+		PaymentMethodID: methodID,
+		Points:          points,
+		Authorize: func(ctx context.Context, customerID uuid.UUID) error {
+			return p.pins.VerifyPin(ctx, customerID, pin, PinActionPay, info)
+		},
+	})
+	if err != nil {
+		return nil, err
+	}
+	if result.Completed {
+		p.onOrderPaid(ctx, orderID)
+	}
+	payment, err := p.paymentRepo.GetByID(ctx, result.Payment.ID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to retrieve created payment: %w", err)
+	}
+	return mappers.PaymentEntityToResponse(payment), nil
+}

internal/processor/point_payment_db_test.go

@@ -91,7 +91,7 @@ func newPointPaymentEnv(t *testing.T) *pointPaymentEnv {
 		txManager:          txm,
 	}
 	e.orders.SetLoyalty(NewEarningProcessor(repository.NewEarningRepository(db), settings, wallet, txm))
-	e.orders.SetPointPayments(e.payments, e.codes)
+	e.orders.SetPointPayments(e.payments, e.codes, pinVerifierFake{good: "482913"})
 
 	// The outlet earns 1 EnakPoint per Rp 100 and accepts EnakPoint.
 	s, err := settings.Outlet(context.Background(), e.outlet)
@@ -332,3 +332,45 @@ func TestPointPayment_ConcurrentForOneCustomer(t *testing.T) {
 		assert.NotEqual(t, customer, d.CustomerID, d.Check)
 	}
 }
+
+func TestPointPayment_InApp(t *testing.T) {
+	e := newPointPaymentEnv(t)
+	owner := e.customerWith(100000)
+	stranger := e.customerWith(100000)
+	order := e.order(owner, 60000)
+	info := models.CustomerPinRequestInfo{}
+
+	// Another customer cannot pay it, and is not told it exists.
+	_, err := e.orders.PayWithPointsInApp(e.ctx, stranger, order, 1000, "482913", info)
+	assert.ErrorIs(t, err, repository.ErrPointPaymentOrderNotFound)
+	_, err = e.orders.PayWithPointsInApp(e.ctx, owner, uuid.New(), 1000, "482913", info)
+	assert.ErrorIs(t, err, repository.ErrPointPaymentOrderNotFound)
+
+	// The session alone is not enough: a wrong PIN takes nothing.
+	_, err = e.orders.PayWithPointsInApp(e.ctx, owner, order, 1000, "000000", info)
+	var pe *PinError
+	require.ErrorAs(t, err, &pe)
+	assert.Equal(t, PinErrInvalid, pe.Code)
+	assert.Equal(t, int64(100000), e.balance(owner))
+
+	// The owner pays part, then the rest, with the same rules as at the cashier.
+	payment, err := e.orders.PayWithPointsInApp(e.ctx, owner, order, 10000, "482913", info)
+	require.NoError(t, err)
+	assert.Equal(t, int64(10000), *payment.PointsUsed)
+	status, remaining := e.orderState(order)
+	assert.Equal(t, "partial", status)
+	assert.Equal(t, 50000.0, remaining)
+
+	_, err = e.orders.PayWithPointsInApp(e.ctx, owner, order, 50001, "482913", info)
+	assert.ErrorIs(t, err, ErrPointPaymentRejected, "not more than what is left")
+	_, err = e.orders.PayWithPointsInApp(e.ctx, owner, order, 50000, "482913", info)
+	require.NoError(t, err)
+	status, _ = e.orderState(order)
+	assert.Equal(t, "completed", status)
+	assert.Equal(t, int64(40000), e.balance(owner))
+	assert.Equal(t, int64(100000), e.balance(stranger))
+
+	var createdBy *string
+	require.NoError(t, e.db.Raw(`SELECT created_by_user::text FROM wallet_transactions WHERE customer_id = ? AND type = 'PAYMENT' LIMIT 1`, owner).Scan(&createdBy).Error)
+	assert.Nil(t, createdBy, "no cashier took an in-app payment")
+}

internal/processor/point_payment_processor.go

@@ -319,3 +319,18 @@ func formatRupiah(n int64) string {
 	}
 	return string(out)
 }
+
+// PointMethodID returns the organization's EnakPoint payment method.
+func (p *PointPaymentProcessor) PointMethodID(ctx context.Context, organizationID uuid.UUID) (uuid.UUID, error) {
+	return p.repo.PointMethodID(ctx, organizationID)
+}
+
+// OrderOwner returns the organization and customer of an order, for checking that a
+// customer pays only their own order.
+func (p *PointPaymentProcessor) OrderOwner(ctx context.Context, orderID uuid.UUID) (organizationID uuid.UUID, customerID *uuid.UUID, err error) {
+	order, err := p.repo.GetOrder(ctx, orderID, false)
+	if err != nil {
+		return uuid.Nil, nil, err
+	}
+	return order.OrganizationID, order.CustomerID, nil
+}