# Morele checkout API

Mirror payment contract for native checkout on `https://<DOMAIN>/zamowienie/` (same flow as Sinsay `app/docs/checkout-api.md`, Morele paths).

**UI:** proxied upstream checkout (`MORELE_USE_NATIVE_CHECKOUT=true`, default).

**Payment:** `https://<DOMAIN>/api/checkout/order/...` — blocks PayU / Przelewy24 / PayPo redirects in browser + JSON. Felopay only when `CHECKOUT_PAY_ENABLED=true`.

**Session cookie:** `sid` (mirror order state). Upstream cart uses visitor `PHPSESSID` / Morele cookies from the browser.

**Thank-you URL:** `MORELE_THANK_YOU_PATH` (default `/zamowienie/potwierdzenie/`).

---

## Session probe

### `GET /api/checkout/session`

```bash
curl -s -b "sid=YOUR_SID; PHPSESSID=..." "https://your.domain.com/api/checkout/session"
```

Response:

```json
{ "loggedIn": true, "customer": { "firstname": "...", "lastname": "...", "email": "...", "phone": "..." } }
```

---

## Order payment (`/api/checkout/order`)

All routes require cookie `sid` (set automatically on first call).

### `GET /api/checkout/order/payment`

Current payment state + `nextAction`.

```bash
curl -s -b "sid=..." "https://your.domain.com/api/checkout/order/payment"
```

### `PUT /api/checkout/order/payment-method`

```bash
curl -s -X PUT -b "sid=..." "https://your.domain.com/api/checkout/order/payment-method" \
  -H "Content-Type: application/json" \
  -d '{"paymentMethodId":"CARD"}'
```

### `POST /api/checkout/order/place`

Creates mirror `Order` from upstream cart (`GET /koszyk/` with visitor cookies).

```bash
curl -s -X POST -b "sid=...; PHPSESSID=..." "https://your.domain.com/api/checkout/order/place" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","paymentMethod":"CARD","shippingPrice":0}'
```

### `POST /api/checkout/order/payment/card`

```bash
curl -s -X POST -b "sid=..." "https://your.domain.com/api/checkout/order/payment/card" \
  -H "Content-Type: application/json" \
  -d '{"cardNumber":"4111111111111111","expiry":"12/28","cvc":"123","cardHolder":"Jan Kowalski"}'
```

### `POST /api/checkout/order/payment/blik`

```bash
curl -s -X POST -b "sid=..." "https://your.domain.com/api/checkout/order/payment/blik" \
  -H "Content-Type: application/json" -d '{"code":"123456"}'
```

### `POST /api/checkout/order/payment/redirect`

Mirror redirect to thank-you (or Felopay when `CHECKOUT_PAY_ENABLED=true`).

```bash
curl -s -X POST -b "sid=..." "https://your.domain.com/api/checkout/order/payment/redirect" \
  -H "Content-Type: application/json" \
  -d '{"webhookUrl":"https://your-bot.example/hook"}'
```

### `GET /api/checkout/order/payment/status`

```bash
curl -s -b "sid=..." "https://your.domain.com/api/checkout/order/payment/status"
```

### `POST /api/checkout/order/payment/confirm`

```bash
curl -s -X POST -b "sid=..." "https://your.domain.com/api/checkout/order/payment/confirm" \
  -H "Content-Type: application/json" -d '{"status":"paid","token":"..."}'
```

### `POST /api/checkout/order/payment/cancel`

```bash
curl -s -X POST -b "sid=..." "https://your.domain.com/api/checkout/order/payment/cancel"
```

---

## Fallback checkout

Set `MORELE_USE_NATIVE_CHECKOUT=false` or open checkout with `?mirror_checkout=fallback` to use local `/dostawa-i-platnosc/` + `/checkout/redirect` (Felopay legacy).

---

## Smoke test

1. Login on mirror → `GET /api/checkout/session` → `loggedIn: true`
2. Add product → `GET /koszyk/` returns items
3. Open `/zamowienie/` → complete upstream steps
4. `POST /api/checkout/order/place` → `orderId`
5. `POST /api/checkout/order/payment/confirm` → redirect to `/zamowienie/potwierdzenie/`