This payment session has expired
Please return to merchant and try again

Invalid or expired payment session
Please contact merchant support

This payment has already been completed
Redirecting to confirmation page...

Too many payment attempts
Please create a new payment session

// ❌ BAD: Trust the redirect
app.get('/success', (req, res) => {
  res.render('order-success');
});

// ✅ GOOD: Verify payment status
app.get('/success', async (req, res) => {
  const intent = await verifyPaymentIntent(req.query.session_id);
  if (intent.status === 'authorized') {
    await fulfillOrder(intent.payment_id);
    res.render('order-success');
  } else {
    res.redirect('/order/cancel');
  }
});

// Success handler
app.get('/order/success', handleSuccess);

// Cancel handler (payment failed, expired, or user canceled)
app.get('/order/cancel', handleCancellation);

app.post('/webhooks/payment', (req, res) => {
  const event = req.body;
  
  if (event.event === 'payment.authorized') {
    // Fulfill order (primary path)
    await fulfillOrder(event.data.payment_id);
  }
  
  res.status(200).send('OK');
});

// ❌ BAD: Reuse intent for multiple orders
const intent = await createPaymentIntent({ amount: 9999 });
// Store intent.id for later...

// ✅ GOOD: New intent per order
app.post('/checkout', async (req, res) => {
  const intent = await createPaymentIntent({
    amount: order.total,
    metadata: { order_id: order.id }
  });
  res.redirect(intent.checkout_url);
});

// ❌ BAD: Generic description
description: "Payment"

// ✅ GOOD: Descriptive
description: "Order #12345 - Premium Plan (Annual)"

{
  "metadata": {
    "billing_address": "123 Main St, City, State 12345",
    "billing_country": "US"
  }
}