created two endpoints for the staff

app/app.py

@@ -9,7 +9,8 @@
   UpdateStaffEmailSchema,
   UpdateMenuItemSchema,
   MenuScanResponse,
-  CreateOrderSchema
+  CreateOrderSchema,
+  UpdateOrderStatusSchema
 )
 from .auth import (
   authenticate_student,
@@ -22,6 +23,8 @@
   update_menu_item,
   delete_menu_item,
   add_staff_member,
+  get_stall_orders,
+  update_order_status_staff
 )
 from .manager import (
   get_my_staff,
@@ -96,7 +99,7 @@
 async def remove_staff_endpoint(
     staff_uid: str,
     credentials: HTTPAuthorizationCredentials = Security(security)
 ):
     return await remove_staff_member(staff_uid, credentials.credentials)
 
 @app.put('/staff/{staff_uid}/email', tags=["manager"])
@@ -151,3 +154,18 @@
         item_id,
         credentials.credentials
     )
+
+@app.get("/staff/orders", tags=["staff", "manager"])
+async def get_staff_orders_endpoint(
+    status: str = "PAID",
+    credentials: HTTPAuthorizationCredentials = Security(security)
+):
+    return await get_stall_orders(credentials.credentials, status_filter=status)
+
+@app.patch("/staff/orders/{order_id}/status", tags=["staff", "manager"])
+async def update_order_status_endpoint(
+    order_id: str,
+    status_data: UpdateOrderStatusSchema,
+    credentials: HTTPAuthorizationCredentials = Security(security)
+):
+    return await update_order_status_staff(order_id, status_data, credentials.credentials)

app/schema.py

@@ -50,3 +50,19 @@
 class CreateOrderSchema(BaseModel):
   stall_id: str
   items: List[CartItemSchema]
+
+class OrderItemSchema(BaseModel):
+  name: str
+  quantity: int
+  price: float
+
+class OrderResponseSchema(BaseModel):
+  order_id: str
+  user_id: str
+  amount: float
+  status: str
+  items: List[OrderItemSchema]
+  created_at: str
+
+class UpdateOrderStatusSchema(BaseModel):
+  status: str

app/staff.py

@@ -5,7 +5,7 @@
 import json
 import google.generativeai as genai
 from fastapi import UploadFile
-from .schema import MenuSchema, UpdateMenuItemSchema, AddStaffSchema
+from .schema import MenuSchema, UpdateMenuItemSchema, AddStaffSchema, UpdateOrderStatusSchema
 from fastapi.responses import JSONResponse
 from starlette import status
 from .firebase_init import db
@@ -18,7 +18,7 @@
   genai.configure(api_key=os.environ.get("GEMINI_API_KEY"))
 
 async def get_staff_details(id_token: str):
   try:
     decoded_token = auth.verify_id_token(id_token)
     uid = decoded_token["uid"]
 
@@ -34,7 +34,7 @@
   except auth.InvalidIdTokenError:
     print("Invalid token")
     return None, None
   except Exception as e:
     print(f"Auth Error: {e}")
     return None, None
 
@@ -105,7 +105,7 @@
 
     db.collection("staffs").document(new_uid).set({
       "email": new_email,
       "stall_id": stall_id,
       "college_id": college_id,
       "role": "staff",
       "added_by": requester_data.get("email"),
@@ -117,21 +117,21 @@
       content={"message": f"Staff {new_email} added successfully."}
     )
 
   except Exception as e:
     return JSONResponse(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, content={"message": str(e)})
 
 async def upload_menu(menu_data: MenuSchema, id_token: str):
   try:
     staff_data, staff_uid = await get_staff_details(id_token)
 
     if not staff_data:
       return JSONResponse(
         status_code=status.HTTP_401_UNAUTHORIZED,
         content={"message": "Invalid or expired token."}
       )
 
     if not menu_data.items:
       return JSONResponse(
         status_code=status.HTTP_400_BAD_REQUEST,
         content={"message": "Menu items cannot be empty."}
       )
@@ -140,8 +140,8 @@
     staff_stall_id = staff_data.get("stall_id")
 
     if staff_stall_id != menu_data.stall_id:
       return JSONResponse(
         status_code=status.HTTP_403_FORBIDDEN,
         content={
           "message": f"Unauthorized. You can only manage stall: {staff_stall_id}"
         }
@@ -192,18 +192,18 @@
       }
     )
 
   except Exception as e:
     return JSONResponse(
       status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
       content={"message": str(e)}
     )
 
 async def get_menu(id_token: str):
   try:
     staff_data, staff_uid = await get_staff_details(id_token)
 
     if not staff_data:
       return JSONResponse(
         status_code=status.HTTP_401_UNAUTHORIZED,
         content={"message": "Invalid or expired token."}
       )
@@ -239,15 +239,15 @@
       item = serialize_firestore_data(item)
       menu_items.append(item)
 
     return JSONResponse(
       status_code=status.HTTP_200_OK,
       content={
         "stall_id": staff_stall_id,
         "menu_items": menu_items
       }
     )
 
   except Exception as e:
     return JSONResponse(
       status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
       content={"message": str(e)}
@@ -258,10 +258,10 @@
     update_data: UpdateMenuItemSchema,
     id_token: str
 ):
   try:
     staff_data, staff_uid = await get_staff_details(id_token)
 
     if not staff_data:
       return JSONResponse(
         status_code=status.HTTP_401_UNAUTHORIZED,
         content={"message": "Invalid or expired token."}
@@ -281,7 +281,7 @@
 
     item_doc = item_ref.get()
     if not item_doc.exists:
       return JSONResponse(
         status_code=status.HTTP_404_NOT_FOUND,
         content={"message": "Menu item not found."}
       )
@@ -310,14 +310,14 @@
       }
     )
 
   except Exception as e:
     return JSONResponse(
       status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
       content={"message": str(e)}
     )
 
 async def delete_menu_item(item_id: str, id_token: str):
   try:
     staff_data, staff_uid = await get_staff_details(id_token)
 
     if not staff_data:
@@ -346,18 +346,18 @@
 
     item_ref.delete()
 
     return JSONResponse(
       status_code=status.HTTP_200_OK,
       content={
         "message": "Menu item deleted successfully",
         "item_id": item_id
       }
     )
 
   except Exception as e:
     return JSONResponse(
       status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
       content={"message": str(e)}
     )
 
 def _extract_menu_from_image(image_bytes: bytes, mime_type: str) -> list:
@@ -413,21 +413,21 @@
   try:
     staff_data, staff_uid = await get_staff_details(id_token)
 
     if not staff_data:
       return JSONResponse(
         status_code=status.HTTP_401_UNAUTHORIZED,
         content={"message": "Invalid or expired token."}
       )
 
     if file.content_type not in ["image/jpeg", "image/png"]:
       return JSONResponse(
         status_code=status.HTTP_400_BAD_REQUEST,
         content={"message": "Invalid file type. Only JPEG and PNG allowed."}
       )
 
     contents = await file.read()
     if len(contents) > 5 * 1024 * 1024:
       return JSONResponse(
         status_code=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE,
         content={"message": "File too large. Max 5MB."}
       )
@@ -449,8 +449,86 @@
       }
     )
 
   except Exception as e:
     return JSONResponse(
       status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
       content={"message": f"Internal Server Error: {str(e)}"}
     )
+
+async def get_stall_orders(id_token: str, status_filter: str = "PAID"):
+  try:
+    staff_data, _ = await get_staff_details(id_token)
+
+    if not staff_data:
+      return JSONResponse(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        content={"message": "Invalid or expired token."}
+      )
+
+    stall_id = staff_data.get("stall_id")
+
+    orders_ref = (
+      db.collection("orders")
+      .where("stall_id", "==", stall_id)
+      .where("status", "==", status_filter)
+      .order_by("created_at", direction=firestore.Query.DESCENDING)
+    )
+
+    docs = orders_ref.stream()
+
+    orders_list = []
+    for doc in docs:
+      data = doc.to_dict()
+      data['order_id'] = doc.id
+
+      data = serialize_firestore_data(data)
+
+      orders_list.append(data)
+
+    return JSONResponse(
+      status_code=status.HTTP_200_OK,
+      content={
+        "stall_id": stall_id,
+        "count": len(orders_list),
+        "orders": orders_list
+      }
+    )
+
+  except Exception as e:
+    return JSONResponse(
+      status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+      content={"message": str(e)}
+    )
+
+async def update_order_status_staff(order_id: str, status_data: UpdateOrderStatusSchema, id_token: str):
+  try:
+    staff_data, _ = await get_staff_details(id_token)
+    if not staff_data:
+      return JSONResponse(status_code=status.HTTP_401_UNAUTHORIZED, content={"message": "Unauthorized"})
+
+    stall_id = staff_data.get("stall_id")
+
+    order_ref = db.collection("orders").document(order_id)
+    order_doc = order_ref.get()
+
+    if not order_doc.exists:
+      return JSONResponse(status_code=status.HTTP_404_NOT_FOUND, content={"message": "Order not found"})
+
+    order_data = order_doc.to_dict()
+
+    if order_data.get("stall_id") != stall_id:
+      return JSONResponse(
+        status_code=status.HTTP_403_FORBIDDEN,
+        content={"message": "You cannot update orders from other stalls."}
+      )
+
+    order_ref.update({
+      "status": status_data.status,
+      "updated_at": firestore.SERVER_TIMESTAMP,
+      "updated_by": staff_data.get("email")
+    })
+
+    return JSONResponse(status_code=status.HTTP_200_OK, content={"message": f"Order status updated to {status_data.status}"})
+
+  except Exception as e:
+    return JSONResponse(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, content={"message": str(e)})

app/user.py

@@ -5,7 +5,7 @@
 from fastapi.responses import JSONResponse
 from starlette import status
 from firebase_admin import auth
-from .firebase_init import db
+from .firebase_init import db, firestore
 from datetime import datetime
 from .schema import CreateOrderSchema
 
@@ -49,7 +49,7 @@
 
         stalls_ref = (
             db.collection("colleges")
             .document(college_id)
             .collection("stalls")
             .where("status", "==", "active")
             .where("isVerified", "==", True)
@@ -117,6 +117,7 @@
     stall_id = order_data.stall_id
 
     total_amount = 0
+    order_items = []
 
     menu_ref = (
       db.collection("colleges")
@@ -139,7 +140,16 @@
           )
 
         price = item_data.get('price', 0)
-        total_amount += price * cart_item.quantity
+        quantity = cart_item.quantity
+        total_amount += price * quantity
+
+        order_items.append({
+          "item_id": cart_item.item_id,
+          "name": item_data.get('name'),
+          "price": price,
+          "quantity": quantity
+        })
+
       else:
         return JSONResponse(
           status_code=status.HTTP_400_BAD_REQUEST,
@@ -149,29 +159,49 @@
     if total_amount <= 0:
       return JSONResponse(
         status_code=status.HTTP_400_BAD_REQUEST,
-        content={"message": "Invalid order total (0). Check item availability."}
+        content={"message": "Invalid order total."}
       )
 
+    new_order_ref = db.collection('orders').document()
+    internal_order_id = new_order_ref.id
+
+    firestore_order_data = {
+      "user_id": user_uid,
+      "stall_id": stall_id,
+      "college_id": college_id,
+      "items": order_items,
+      "amount": total_amount,
+      "status": "PENDING",
+      "created_at": firestore.SERVER_TIMESTAMP,
+      "updated_at": firestore.SERVER_TIMESTAMP
+    }
+
+    new_order_ref.set(firestore_order_data)
+
     data = {
       "amount": int(total_amount * 100),
       "currency": "INR",
-      "receipt": f"order_{user_uid[:5]}_{int(datetime.now().timestamp())}",
+      "receipt": f"rcpt_{internal_order_id[:8]}",
       "notes": {
         "stall_id": stall_id,
         "user_uid": user_uid,
-        "college_id": college_id
+        "college_id": college_id,
+        "internal_order_id": internal_order_id
       }
     }
 
     order = razorpay_client.order.create(data=data)
 
+    new_order_ref.update({"razorpay_order_id": order['id']})
+
     return JSONResponse(
       status_code=status.HTTP_200_OK,
       content={
         "id": order['id'],
         "amount": order['amount'],
         "currency": order['currency'],
         "key_id": os.environ.get("RAZORPAY_KEY_ID"),
+        "internal_order_id": internal_order_id,
         "message": "Order created successfully"
       }
     )

app/webhook.py

@@ -36,32 +36,19 @@
     payment = payload['payload']['payment']['entity']
     notes = payment.get('notes', {})
 
-    if isinstance(notes, list):
-      notes = {}
-
-    stall_id = notes.get('stall_id')
-    user_id = notes.get('user_uid')
-
-    if not stall_id:
-      stall_id = "manual_test_stall"
-
-    order_data = {
-      "order_id": payment['order_id'],
-      "payment_id": payment['id'],
-      "amount": payment['amount'] / 100,
-      "status": "PAID",
-      "stall_id": stall_id,
-      "user_id": user_id,
-      "created_at": firestore.SERVER_TIMESTAMP
-    }
-
-    try:
-      db.collection('orders').add(order_data)
-    except Exception as e:
-      print(f"Error saving order to Firestore: {e}")
-      raise HTTPException(status_code=500, detail="Failed to save order")
-
-  else:
-    print(f"⏭️  Skipping event: {event_type}")
+    internal_order_id = notes.get('internal_order_id')
+    payment_id = payment.get('id')
+
+    if internal_order_id:
+      order_ref = db.collection('orders').document(internal_order_id)
+      order_ref.update({
+        "status": "PAID",
+        "payment_id": payment_id,
+        "razorpay_payment_data": payment,
+        "updated_at": firestore.SERVER_TIMESTAMP
+      })
+      print(f"✅ Order {internal_order_id} marked as PAID")
+    else:
+      print(f"⚠️ Payment received without internal_order_id: {payment['id']}")
 
   return {"status": "ok"}