Record Omada voucher sessions reliably

src/routes/portal.routes.js

@@ -14,6 +14,7 @@ const { snippeWebhookUrl } = require('../utils/webhookUrl');
 const { decryptSecret } = require('../utils/paymentSecrets');
 
 const normalizeMac = mac => String(mac || '').toUpperCase().replace(/[:\-]/g, '');
+const normalizePortalMac = mac => String(mac || '').trim().toUpperCase().replace(/:/g, '-');
 
 const omadaPortalErrorMap = {
   '-41501': 'Failed to authenticate.',
@@ -136,53 +137,71 @@ function numberOrUndefined(value) {
 }
 
 async function recordOmadaVoucherUse({ siteId, code, mac }) {
-  const token = await db.query(
-    `SELECT t.*, d.omada_site_id
-     FROM access_tokens t
-     JOIN devices d ON d.id = t.device_id
-     WHERE BINARY t.code = ? AND d.omada_site_id = ? LIMIT 1`,
-    [code, siteId]
-  ).then(r => r[0]);
-
-  if (!token) {
-    console.warn('[portal/omada-auth-record] Omada accepted voucher but code is not in WiFiBiz DB:', {
+  if (!mac) {
+    const err = new Error('clientMac is required to record Omada voucher usage');
+    err.status = 400;
+    err.code = 'CLIENT_MAC_REQUIRED';
+    console.warn('[portal/omada-auth-record] missing clientMac; cannot attach voucher to device:', {
       siteId,
-      mac,
       code,
     });
-    return { token: null, sessionRecorded: false };
+    throw err;
   }
 
-  const now = new Date();
-  let expiresAt = token.expires_at ? new Date(token.expires_at) : null;
+  const conn = await db.pool.getConnection();
 
-  if (token.status === 'revoked') {
-    console.warn('[portal/omada-auth-record] Omada accepted revoked WiFiBiz token; leaving DB status revoked:', {
-      siteId,
-      mac,
-      code,
-      tokenId: token.id,
-    });
-    return { token, expiresAt, sessionRecorded: false, statusMismatch: 'revoked_but_omada_accepted' };
-  }
+  try {
+    await conn.beginTransaction();
 
-  if (token.locked_mac && token.locked_mac.toUpperCase() !== mac) {
-    console.warn('[portal/omada-auth-record] Omada accepted token for a different MAC; syncing DB lock to Omada result:', {
-      siteId,
-      code,
-      tokenId: token.id,
-      previousMac: token.locked_mac,
-      acceptedMac: mac,
-    });
-  }
+    const [rows] = await conn.execute(
+      `SELECT t.*, d.omada_site_id
+       FROM access_tokens t
+       JOIN devices d ON d.id = t.device_id
+       WHERE BINARY t.code = ? AND d.omada_site_id = ? LIMIT 1
+       FOR UPDATE`,
+      [code, siteId]
+    );
+    const token = rows[0];
 
-  if (!expiresAt || expiresAt < now) {
-    expiresAt = new Date(now.getTime() + token.duration_seconds * 1000);
-  }
+    if (!token) {
+      await conn.rollback();
+      console.warn('[portal/omada-auth-record] Omada accepted voucher but code is not in WiFiBiz DB:', {
+        siteId,
+        mac,
+        code,
+      });
+      return { token: null, sessionRecorded: false };
+    }
 
-  if (token.status !== 'active' || token.locked_mac !== mac || !token.activated_at || !token.expires_at || new Date(token.expires_at) < now) {
-    expiresAt = new Date(now.getTime() + token.duration_seconds * 1000);
-    await db.query(
+    const now = new Date();
+    let expiresAt = token.expires_at ? new Date(token.expires_at) : null;
+
+    if (token.status === 'revoked') {
+      await conn.rollback();
+      console.warn('[portal/omada-auth-record] Omada accepted revoked WiFiBiz token; leaving DB status revoked:', {
+        siteId,
+        mac,
+        code,
+        tokenId: token.id,
+      });
+      return { token, expiresAt, sessionRecorded: false, statusMismatch: 'revoked_but_omada_accepted' };
+    }
+
+    if (token.locked_mac && token.locked_mac.toUpperCase() !== mac) {
+      console.warn('[portal/omada-auth-record] Omada accepted token for a different MAC; syncing DB lock to Omada result:', {
+        siteId,
+        code,
+        tokenId: token.id,
+        previousMac: token.locked_mac,
+        acceptedMac: mac,
+      });
+    }
+
+    if (!expiresAt || expiresAt < now) {
+      expiresAt = new Date(now.getTime() + token.duration_seconds * 1000);
+    }
+
+    await conn.execute(
       `UPDATE access_tokens SET
          status       = 'active',
          locked_mac   = ?,
@@ -191,29 +210,53 @@ async function recordOmadaVoucherUse({ siteId, code, mac }) {
        WHERE id = ?`,
       [mac, now, expiresAt, token.id]
     );
-  }
-
-  const activeSession = await db.query(
-    'SELECT id FROM sessions WHERE access_token_id = ? AND client_mac = ? AND is_active = 1 LIMIT 1',
-    [token.id, mac]
-  ).then(r => r[0]);
 
-  if (activeSession) {
-    await db.query(
-      `UPDATE sessions
-       SET last_seen_at = NOW(), ended_at = NULL, is_active = 1
-       WHERE id = ?`,
-      [activeSession.id]
+    const [activeSessionRows] = await conn.execute(
+      'SELECT id FROM sessions WHERE access_token_id = ? AND client_mac = ? AND is_active = 1 LIMIT 1',
+      [token.id, mac]
     );
-  } else {
-    await db.query(
-      `INSERT INTO sessions (access_token_id, client_id, device_id, client_mac, started_at, last_seen_at, is_active)
-       VALUES (?, ?, ?, ?, NOW(), NOW(), 1)`,
-      [token.id, token.client_id, token.device_id, mac]
+    const activeSession = activeSessionRows[0];
+
+    let sessionId = null;
+    if (activeSession) {
+      sessionId = activeSession.id;
+      await conn.execute(
+        `UPDATE sessions
+         SET last_seen_at = NOW(), ended_at = NULL, is_active = 1
+         WHERE id = ?`,
+        [activeSession.id]
+      );
+    } else {
+      const [insertResult] = await conn.execute(
+        `INSERT INTO sessions (access_token_id, client_id, device_id, client_mac, started_at, last_seen_at, is_active)
+         VALUES (?, ?, ?, ?, NOW(), NOW(), 1)`,
+        [token.id, token.client_id, token.device_id, mac]
+      );
+      sessionId = insertResult.insertId;
+    }
+
+    const [updatedRows] = await conn.execute(
+      `SELECT t.*, d.omada_site_id
+       FROM access_tokens t
+       JOIN devices d ON d.id = t.device_id
+       WHERE t.id = ? LIMIT 1`,
+      [token.id]
     );
-  }
 
-  return { token, expiresAt, sessionRecorded: true };
+    await conn.commit();
+
+    return {
+      token: updatedRows[0] || { ...token, status: 'active', locked_mac: mac, expires_at: expiresAt },
+      expiresAt,
+      sessionRecorded: true,
+      sessionId,
+    };
+  } catch (err) {
+    await conn.rollback();
+    throw err;
+  } finally {
+    conn.release();
+  }
 }
 
 function applyRateLimitLater(siteId, mac, token) {
@@ -589,22 +632,57 @@ router.get('/:siteId/check/:reference', async (req, res) => {
 // POST /portal/:siteId/omada-auth-record - record Omada-native voucher success in WiFiBiz
 router.post('/:siteId/omada-auth-record', portalAuthLimiter, async (req, res) => {
   const { siteId } = req.params;
-  const { code, clientMac } = req.body;
+  const {
+    code,
+    clientMac,
+    apMac,
+    gatewayMac,
+    ssidName,
+    radioId,
+    vid,
+    originUrl,
+  } = req.body;
 
-  if (!code || !clientMac) {
-    return res.status(400).json({ error: 'code and clientMac required' });
+  if (!code) {
+    return res.status(400).json({ error: 'code required', code: 'CODE_REQUIRED' });
   }
 
   const normalizedCode = String(code).trim();
-  const mac = clientMac.toUpperCase().replace(/:/g, '-');
+  const mac = normalizePortalMac(clientMac);
+  const identifiers = {
+    siteId,
+    mac: mac || null,
+    apMac: apMac || null,
+    gatewayMac: gatewayMac || null,
+    ssidName: ssidName || null,
+    radioId: numberOrUndefined(radioId) ?? null,
+    vid: numberOrUndefined(vid) ?? null,
+    originUrl: originUrl || null,
+  };
 
   try {
     const tokenMeta = await recordOmadaVoucherUse({ siteId, code: normalizedCode, mac });
+
+    if (!tokenMeta.token) {
+      console.warn('[portal/omada-auth-record] Omada accepted voucher but WiFiBiz has no matching token row:', {
+        ...identifiers,
+        code: normalizedCode,
+      });
+      return res.status(404).json({
+        success: false,
+        error: 'Voucher was accepted by Omada but was not found in WiFiBiz',
+        code: 'TOKEN_NOT_FOUND',
+        sessionRecorded: false,
+      });
+    }
+
     console.log('[portal/omada-auth-record] recorded Omada voucher success:', {
-      siteId,
-      mac,
+      ...identifiers,
       code: normalizedCode,
       tokenId: tokenMeta.token?.id || null,
+      lockedMac: tokenMeta.token?.locked_mac || null,
+      status: tokenMeta.token?.status || null,
+      sessionId: tokenMeta.sessionId || null,
       sessionRecorded: tokenMeta.sessionRecorded,
       expiresAt: tokenMeta.expiresAt || null,
       statusMismatch: tokenMeta.statusMismatch || null,
@@ -612,18 +690,25 @@ router.post('/:siteId/omada-auth-record', portalAuthLimiter, async (req, res) =>
     return res.json({
       success: true,
       tokenId: tokenMeta.token?.id || null,
+      lockedMac: tokenMeta.token?.locked_mac || null,
+      status: tokenMeta.token?.status || null,
+      sessionId: tokenMeta.sessionId || null,
       sessionRecorded: tokenMeta.sessionRecorded,
       expiresAt: tokenMeta.expiresAt || null,
       statusMismatch: tokenMeta.statusMismatch || null,
     });
   } catch (err) {
     console.error('[portal/omada-auth-record] failed:', {
-      siteId,
-      mac,
+      ...identifiers,
       code: normalizedCode,
+      errorCode: err.code || null,
       message: err.message,
     });
-    return res.status(500).json({ error: 'Failed to record Omada voucher usage' });
+    const status = err.status || 500;
+    return res.status(status).json({
+      error: status === 500 ? 'Failed to record Omada voucher usage' : err.message,
+      code: err.code || 'OMADA_RECORD_FAILED',
+    });
   }
 });
 
@@ -645,7 +730,7 @@ router.post('/:siteId/omada-auth', portalAuthLimiter, async (req, res) => {
   }
 
   const normalizedCode = String(code).trim();
-  const mac = clientMac.toUpperCase().replace(/:/g, '-');
+  const mac = normalizePortalMac(clientMac);
   const payload = {
     authType: 3,
     voucherCode: normalizedCode,

v2 Test/portal-redirect.html

@@ -27,6 +27,36 @@
       text-align: center;
     }
 
+    .status-mark {
+      display: none;
+      width: 56px;
+      height: 56px;
+      margin: 0 auto 16px;
+      border-radius: 50%;
+      background: #16a34a;
+      color: #fff;
+      font-size: 17px;
+      font-weight: 800;
+      line-height: 56px;
+      letter-spacing: 0;
+    }
+
+    .success-title {
+      display: none;
+      margin: 0 0 8px;
+      font-size: 24px;
+      line-height: 1.2;
+    }
+
+    .is-success .status-mark,
+    .is-success .success-title {
+      display: block;
+    }
+
+    .is-success #auth-form {
+      display: none !important;
+    }
+
     a {
       color: #0369a1;
     }
@@ -60,6 +90,8 @@
 </head>
 <body>
   <main>
+    <div id="status-mark" class="status-mark">OK</div>
+    <h1 id="success-title" class="success-title">You are connected</h1>
     <p id="status-text">Redirecting to the portal...</p>
     <p><a id="fallback-link" href="#">Continue to portal</a></p>
     <form id="auth-form" class="auth-form">
@@ -154,6 +186,7 @@
       function postJson(url, data, callback) {
         var xhr = new XMLHttpRequest();
         xhr.open("POST", url, true);
+        xhr.timeout = 8000;
         xhr.setRequestHeader("Content-Type", "application/json");
         xhr.onreadystatechange = function () {
           if (xhr.readyState !== 4) return;
@@ -165,25 +198,56 @@
           }
           callback(xhr.status, parsed);
         };
+        xhr.onerror = function () {
+          callback(0, { msg: "Network request failed" });
+        };
+        xhr.ontimeout = function () {
+          callback(0, { msg: "Network request timed out" });
+        };
         xhr.send(JSON.stringify(data));
       }
 
       function recordVoucherUse(code, callback) {
-        var called = false;
-        function done() {
-          if (called) return;
-          called = true;
-          callback();
+        var recordUrl = portalBase() + "/portal/" + encodeURIComponent(findSiteId()) + "/omada-auth-record";
+        var payload = {
+          code: code,
+          clientMac: sourceParams.get("clientMac") || undefined,
+          apMac: sourceParams.get("apMac") || undefined,
+          gatewayMac: sourceParams.get("gatewayMac") || undefined,
+          ssidName: sourceParams.get("ssidName") || undefined,
+          radioId: numberOrUndefined(sourceParams.get("radioId")),
+          vid: numberOrUndefined(sourceParams.get("vid")),
+          originUrl: sourceParams.get("originUrl") || undefined
+        };
+        var attempts = 0;
+        var delays = [0, 700, 1600];
+
+        function attemptRecord() {
+          attempts += 1;
+          statusText.textContent = attempts === 1
+            ? "Connected. Saving session..."
+            : "Connected. Saving session again...";
+
+          postJson(recordUrl, payload, function (status, data) {
+            if (status >= 200 && status < 300 && data && data.success && data.sessionRecorded) {
+              callback(null, data);
+              return;
+            }
+
+            if (attempts < delays.length) {
+              window.setTimeout(attemptRecord, delays[attempts]);
+              return;
+            }
+
+            callback(data || { msg: "Session save failed" });
+          });
         }
 
-        setTimeout(done, 1200);
-        postJson(portalBase() + "/portal/" + encodeURIComponent(findSiteId()) + "/omada-auth-record", {
-          code: code,
-          clientMac: sourceParams.get("clientMac") || undefined
-        }, done);
+        window.setTimeout(attemptRecord, delays[0]);
       }
 
       function showRetry(message, code) {
+        document.body.className = "";
         statusText.textContent = message || "Voucher validation failed.";
         fallbackLink.href = cleanReturnUrl();
         fallbackLink.textContent = "Back to plans";
@@ -195,6 +259,16 @@
         authCodeButton.textContent = "Try code";
       }
 
+      function showSuccess(nextUrl) {
+        document.body.className = "is-success";
+        statusText.textContent = "Voucher accepted. Your WiFi session has been saved.";
+        fallbackLink.href = nextUrl;
+        fallbackLink.textContent = "Continue";
+        fallbackLink.style.display = "";
+        authCodeButton.disabled = true;
+        authCodeButton.textContent = "Connected";
+      }
+
       function authenticateWithOmada(code) {
         statusText.textContent = "Validating voucher with Omada...";
         fallbackLink.style.display = "none";
@@ -217,10 +291,22 @@
 
         postJson("/portal/auth", payload, function (_status, data) {
           if (data && data.errorCode === 0) {
-            statusText.textContent = "Connected. Saving session...";
-            recordVoucherUse(code, function () {
-              statusText.textContent = "Connected. Opening landing page...";
-              window.location.href = landingUrl(data.result || payload.originUrl);
+            recordVoucherUse(code, function (recordError) {
+              if (recordError) {
+                statusText.textContent = (recordError && (recordError.msg || recordError.error)) || "Connected, but WiFiBiz could not save this session.";
+                fallbackLink.href = landingUrl(data.result || payload.originUrl);
+                fallbackLink.textContent = "Continue";
+                fallbackLink.style.display = "";
+                authCodeButton.disabled = false;
+                authCodeButton.textContent = "Try code";
+                return;
+              }
+
+              var nextUrl = landingUrl(data.result || payload.originUrl);
+              showSuccess(nextUrl);
+              window.setTimeout(function () {
+                window.location.href = nextUrl;
+              }, 1800);
             });
             return;
           }