Money and payments

0.1 + 0.2                                // 0.300000000000000040.1m + 0.2m                              // 0.3let price = 19.99mlet total = price * 3 + 4.50m            // 64.47let vat = round(total * 0.21m, 2)        // 13.54, half to evendec("12.50")                             // from a form or JSON: 12.50

money.of(19.99m, "USD")                          // { amount: 19.99m, currency: "USD" }money.of("12.345", "USD")                        // an error value: USD has two decimalsmoney.of("12.345", "USD", "half_up")             // 12.35money.mul(money.of(19.99m, "USD"), 0.075m, "half_up")   // 1.50, rounded to centsmoney.of(10, "USD") + money.of(2.50m, "USD")     // 12.50: two amounts of one currencymoney.allocate(money.of(100, "USD"), [1, 1, 1])  // 33.34, 33.33 and 33.33money.parse("1.234,50 €", "EUR", "de-DE")        // 1234.50, as a German visitor writes itmoney.format(money.of("1234.5", "EUR"), "de-DE") // "1.234,50 €"money.to_minor(money.of(19.99m, "USD"))          // 1999money.from_minor(1250, "USD")                    // 12.50

-- migrations/001_ledger.sqlcreate table accounts (    id integer primary key,    owner text not null,    currency text not null,    balance_minor integer not null default 0    -- cents, for USD);create table transfers (    id integer primary key,    from_id integer, to_id integer not null,    amount_minor integer not null,    currency text not null,    at text not null default (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')),    stripe_event text unique                    -- a webhook's event, once);create table history (    id integer primary key,    at text not null default (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')),    actor text, action text not null, details text not null);

db.open(env("DATABASE_URL") ?? "ledger.db") | unwrapdb.migrate()fn me() = session().user ?? reply 401 "Sign in first"fn balance(a) -> map = money.from_minor(a.balance_minor, a.currency)// Who did what: a row of `history`, in the transaction of the change it records.fn record(action: str, details) -> map with db =    db.exec("insert into history (actor, action, details) values (?, ?, ?)",        session().user, action, json.stringify(details))

route POST /transfers { json: { from: int, to: int, amount: dec } } with db {    let user = me()    idempotent({ isolation: "serializable", retries: 5 }, () => {        let src = db.one("select * from accounts where id = ? and owner = ?", from, user)            ?? reply 404 "No such account"        let dst = db.one("select * from accounts where id = ?", to) ?? reply 404 "No such account"        if dst.currency != src.currency { reply 422 "The accounts hold different currencies" }        let amt = money.of(amount, src.currency) ?? reply 422 `Not an amount of ${src.currency}`        let cents = money.to_minor(amt)        if cents <= 0 { reply 422 "The amount must be more than zero" }        if cents > src.balance_minor {            return respond(422, { error: "Not enough money", balance: balance(src) })        }        db.exec("update accounts set balance_minor = balance_minor - ? where id = ?", cents, from)?        db.exec("update accounts set balance_minor = balance_minor + ? where id = ?", cents, to)?        db.exec("insert into transfers (from_id, to_id, amount_minor, currency) values (?, ?, ?, ?)",            from, to, cents, src.currency)?        let id = db.one("select last_insert_rowid() as id").id        record("transfer", { id, from, to, amount: amt })?        respond(201, { id, balance: money.sub(balance(src), amt) })    })}

curl localhost:8080/transfers -b cookies.txt -H "Idempotency-Key: $(uuidgen)" \    --json '{"from": 1, "to": 2, "amount": "12.50"}'# 201 {"id":1,"balance":{"amount":"87.50","currency":"USD"}}# the same again: 201, the same body, and Idempotent-Replayed: true

fn withdraw(account: int, cents: int) -> map with db =    db.transaction({ isolation: "serializable", retries: 5 }, () => {        let balance = db.one("select balance_minor from accounts where id = ?", account).balance_minor        if balance < cents { return err("not enough money") }        db.exec("update accounts set balance_minor = balance_minor - ? where id = ?", cents, account)    })

fn stripe_signed(body: str, header: str?, secret: str) -> bool {    let fields = split(header ?? "", ",") | map((f) => split(f, "="))    let t = int(find(fields, (f) => f[0] == "t")?[1] ?? "")    if is_err(t) || abs(now() / 1000 - t) > 300 { return false }   // five minutes    let want = crypto.hmac(secret, `${t}.${body}`)    any(fields, (f) => f[0] == "v1" && crypto.equal(f[1] ?? "", want))}route POST /hooks/stripe with db, env, time {    if !stripe_signed(request.body, request.headers["stripe-signature"], env("STRIPE_WEBHOOK_SECRET")) {        reply 400 "Bad signature"    }    let event = request.json    if event.type == "payment_intent.succeeded" {        let pi = event.data.object        let to = int(pi.metadata.account)?        let amt = money.from_minor(pi.amount, upper(pi.currency))        db.transaction(() => {            // Stripe may send an event more than once: keep it once.            if db.one("select id from transfers where stripe_event = ?", event.id) == null {                db.exec("insert into transfers (to_id, amount_minor, currency, stripe_event) values (?, ?, ?, ?)",                    to, money.to_minor(amt), amt.currency, event.id)?                db.exec("update accounts set balance_minor = balance_minor + ? where id = ? and currency = ?",                    money.to_minor(amt), to, amt.currency)?                record("deposit", { to, amount: amt, stripe_event: event.id })?            }        })    }    { received: true }}

body='{"id":"evt_1","type":"payment_intent.succeeded","data":{"object":{"amount":2500,"currency":"usd","metadata":{"account":"2"}}}}'t=$(date +%s)sig=$(printf '%s.%s' "$t" "$body" | openssl dgst -sha256 -hmac "$STRIPE_WEBHOOK_SECRET" -hex | awk '{print $NF}')curl localhost:8080/hooks/stripe -H "Stripe-Signature: t=$t,v1=$sig" --json "$body"# {"received":true}, and account 2 has 25.00 more; sent again, the same answer and nothing addedcurl localhost:8080/hooks/stripe -H "Stripe-Signature: t=$t,v1=00" --json "$body"# 400 Bad signature

view Statement(a, rows: list, locale: str) =    <section>        <h1>{money.format(balance(a), locale)}</h1>        <table>{for t in rows =>            <tr>                <td>{slice(t.at, 0, 10)}</td>                <td>{t.to_id == a.id ? "In" : "Out"}</td>                <td>{money.format(money.from_minor(t.amount_minor, t.currency), locale)}</td>            </tr>}</table>    </section>route GET /accounts/:id(int) { query: { locale: str = "en-US" } } with db {    let a = db.one("select * from accounts where id = ? and owner = ?", id, me()) ?? reply 404 "No such account"    let rows = db.query("select * from transfers where from_id = ? or to_id = ? order by id desc limit 50", id, id)    <html><body><Statement a={a} rows={rows} locale={locale}/></body></html>}

fn payment(principal: dec, yearly: dec, months: int) -> dec {    let r = yearly / 12    let f = pow(1m + r, months)    principal * r * f / (f - 1)}money.of(payment(200000m, 0.05m, 360), "USD", "half_up")   // 1073.64 a month