From 7660901eb0a2bdca9af6cfaf38b22208138fe8c4 Mon Sep 17 00:00:00 2001
From: egecankomur <egecankomur@hotmail.com>
Date: Thu, 14 May 2026 23:12:36 +0300
Subject: [PATCH] fix(paytr): encode hyphens in tenantId as Z in merchantOid

PayTR rejects merchant_oid with non-alphanumeric chars. Real Appwrite
tenant IDs are hex (a-z0-9) and safe, but demo-tenant-001 contains
hyphens. Encode - as Z (never appears in Appwrite hex IDs) in the
merchantOid; decode back in the callback.
---
 src/app/api/payments/paytr/callback/route.ts | 5 +++--
 src/lib/appwrite/subscription-actions.ts     | 7 ++++---
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/app/api/payments/paytr/callback/route.ts b/src/app/api/payments/paytr/callback/route.ts
index a7264fe..11a4235 100644
--- a/src/app/api/payments/paytr/callback/route.ts
+++ b/src/app/api/payments/paytr/callback/route.ts
@@ -16,8 +16,9 @@ export async function POST(req: Request): Promise<Response> {
   }
 
   if (status === "success") {
-    // merchant_oid: {tenantId}T{timestamp}{random}P{plan}X{period}
-    const tenantId = merchantOid.split("T")[0];
+    // merchant_oid: {encodedTenantId}T{timestamp}{random}P{plan}X{period}
+    // Hyphens were encoded as Z — decode back
+    const tenantId = (merchantOid.split("T")[0] ?? "").replace(/Z/g, "-");
     const planPart = merchantOid.split("P")[1]; // "{plan}X{period}"
     const plan = (planPart?.split("X")[0] ?? "pro") as TenantPlan;
     const period = (planPart?.split("X")[1] ?? "monthly") as PlanPeriod;
diff --git a/src/lib/appwrite/subscription-actions.ts b/src/lib/appwrite/subscription-actions.ts
index caa067f..de6ed13 100644
--- a/src/lib/appwrite/subscription-actions.ts
+++ b/src/lib/appwrite/subscription-actions.ts
@@ -213,9 +213,10 @@ export async function getPayTRTokenAction(formData: FormData): Promise<string> {
 
   const timestamp = Date.now().toString();
   const random = Math.random().toString(36).slice(2, 8);
-  // Uppercase harfler separator — tenantId (lowercase a-z0-9) hiçbir zaman içermez
-  // Format: {tenantId}T{timestamp}{random}P{plan}X{period}
-  const merchantOid = `${ctx.tenantId}T${timestamp}${random}P${planId}X${period}`;
+  // Hyphens encoded as Z (Appwrite hex IDs never contain uppercase letters)
+  // Format: {encodedTenantId}T{timestamp}{random}P{plan}X{period}
+  const encodedTenantId = ctx.tenantId.replace(/-/g, "Z");
+  const merchantOid = `${encodedTenantId}T${timestamp}${random}P${planId}X${period}`;
 
   const discountLabel = discountCodeRaw ? ` + ${discountCodeRaw.toUpperCase()} İndirimi` : "";
   const userBasket: Array<[string, string, number]> = [