Razorpay payments for GoCommerce

What it does

Configuration

Three settings are required: the API key pair and the webhook secret. Set them in Config from your own main(), or leave Config empty and type them under Settings › Payment methods in the admin.

The module reads its Config struct, not the environment. The variable names are the ones the package’s own example or the reference binary uses; in your own main() you choose where each value comes from. Where a setting has a panel label, the admin’s settings drawer can hold it too, and a value typed there wins over Config.

Setting it up

1. Register the webhookIn Razorpay, point a webhook at https://your-api-host/api/checkout/razorpay/webhook for the payment.captured and payment.failed events, and keep its secret.
2. Install the moduleImport it and pass razorpay.New to gocommerce.New, as below — or run the reference binary with -gateways, which installs every payment module idle.
3. Give it the keysKey ID, key secret and webhook secret, in Config or under Settings › Payment methods. A key typed into the panel counts on the next request, with no restart.
4. Take a paymentPOST /api/checkout/razorpay answers with the order and a client_action intent carrying razorpay_order_id and key_id for Razorpay’s checkout. The webhook marks it paid.

import (
	"os"

	"github.com/itswadesh/gocommerce/core"
	razorpay "github.com/itswadesh/gocommerce/ext/payments-razorpay"
)

app, err := gocommerce.New(cfg,
	razorpay.New(razorpay.Config{
		KeyID:         os.Getenv("RAZORPAY_KEY_ID"),
		KeySecret:     os.Getenv("RAZORPAY_KEY_SECRET"),
		WebhookSecret: os.Getenv("RAZORPAY_WEBHOOK_SECRET"),
	}),
)

How it works

• One route, owned by the engine

  Razorpay calls POST /api/checkout/razorpay/webhook. The engine hands the module the request body untouched, because the signature is over the exact bytes Razorpay sent.

• Signed, or refused

  The body’s HMAC-SHA256 is compared with X-Razorpay-Signature in constant time. A missing or wrong signature is refused with a 400; until the module is switched on and configured, every webhook is refused with a 503.

• Each fact once

  Razorpay sends no per-delivery event id, so the module keys each event on its name plus the payment id and claims it with INSERT … ON CONFLICT DO NOTHING in its own table. A repeated capture is answered 200 and changes nothing.

• A failed update is retried

  If marking the order paid fails, the module releases its claim on the event and answers 500, so Razorpay’s retry finds work to do rather than a record saying it was handled.

• Refunds keep Razorpay’s id

  A refund from the admin posts to Razorpay against the captured payment, for the amount asked, and the refund id Razorpay answers with is recorded on the refund row — the id somebody reconciles against a bank statement.

• Settings without a restart

  Before each use the panel’s values are laid over Config. A store with nothing in Config installs the module idle; one with all three keys in Config starts with it switched on.

What it does not do

Read these before an order depends on it. No store is known to run GoCommerce in production yet, so these come from the code, not from anyone’s experience.

• No testsThe package has no _test.go file. Every other payment module in the repository ships with one, so read razorpay.go before an order depends on it.
• Captured payments onlyOnly payment.captured marks an order paid. A payment that is authorised but never captured leaves the order unpaid; when Razorpay captures is a setting on Razorpay’s side.
• Refunds need the webhook firstA refund looks up the payment id the payment.captured webhook recorded. If that webhook never arrived, the refund is refused with “no captured payment recorded for this order”.
• Dashboard refunds are not readEvents other than payment.captured and payment.failed are acknowledged and ignored, so a refund made in Razorpay’s dashboard does not appear on the GoCommerce order.
• Hosted mode returns no URLWith Hosted on, the intent is a redirect carrying the Razorpay order id, the key id and your return URL as callback_url. There is no page URL in it; the storefront still sends the shopper to Razorpay itself.
• The store’s one currencyThe total goes to Razorpay in the store’s single settlement currency, unconverted. Which currencies Razorpay accepts is Razorpay’s decision, not the module’s.