payouts

backend/routes/stripe.js

@@ -1,12 +1,10 @@
 const express = require("express");
 const { authenticateToken } = require("../middleware/auth");
-const { User } = require("../models");
-const { Rental, Item } = require("../models");
+const { User, Item } = require("../models");
 const StripeService = require("../services/stripeService");
 const router = express.Router();
-const platformFee = 0.1;
 
-router.post("/create-checkout-session", async (req, res) => {
+router.post("/create-checkout-session", authenticateToken, async (req, res) => {
   try {
     const { itemName, total, return_url, rentalData } = req.body;
 
@@ -20,18 +18,37 @@ router.post("/create-checkout-session", async (req, res) => {
       return res.status(400).json({ error: "No return_url found" });
     }
 
+    // Validate rental data and user authorization
+    if (rentalData && rentalData.itemId) {
+      const item = await Item.findByPk(rentalData.itemId);
+
+      if (!item) {
+        return res.status(404).json({ error: "Item not found" });
+      }
+
+      if (!item.availability) {
+        return res
+          .status(400)
+          .json({ error: "Item is not available for rent" });
+      }
+
+      // Check if user is trying to rent their own item
+      if (item.ownerId === req.user.id) {
+        return res.status(400).json({ error: "You cannot rent your own item" });
+      }
+    }
+
     // Prepare metadata - Stripe metadata keys must be strings
     const metadata = rentalData
       ? {
           itemId: rentalData.itemId,
-          startDate: rentalData.startDate,
-          endDate: rentalData.endDate,
-          startTime: rentalData.startTime,
-          endTime: rentalData.endTime,
+          renterId: req.user.id.toString(), // Add authenticated user ID
+          startDateTime: rentalData.startDateTime,
+          endDateTime: rentalData.endDateTime,
           totalAmount: rentalData.totalAmount.toString(),
           deliveryMethod: rentalData.deliveryMethod,
         }
-      : {};
+      : { renterId: req.user.id.toString() };
 
     const session = await StripeService.createCheckoutSession({
       item_name: itemName,