cashout request email flow and views

1 files changed, 68 insertions, 0 deletions

diff --git a/jb/views/wallet.py b/jb/views/wallet.py
new file mode 100644
index 0000000..90e8de8
--- /dev/null
+++ b/jb/views/wallet.py
@@ -0,0 +1,68 @@
+from typing import Annotated
+from urllib.parse import urlencode
+
+from fastapi import APIRouter, Depends
+from fastapi.responses import HTMLResponse
+from generalresearch.models.thl.wallet.cashout_method import CashoutRequestInfo
+
+from jb.api.auth import get_authenticated_user
+from jb.api.cashout_token import consume_cashout_token, create_cashout_token
+from jb.config import settings
+from jb.managers.email_manager import send_cashout_confirmation_email
+from jb.managers.thl import user_cashout_request
+from jb.models.auth import User
+from jb.models.wallet import CashoutConfirmation, CashoutRequest, PendingCashout
+from jb.settings import render_base_html
+
+wallet_router = APIRouter(prefix="/wallet", tags=["Wallet"])
+
+
+@wallet_router.post("/cashout/request/")
+def request_cashout(
+    body: CashoutRequest,
+    user: Annotated[User, Depends(get_authenticated_user)],
+) -> dict[str, str]:
+    """Email the authenticated user a link confirming the requested amount."""
+    token = create_cashout_token(
+        PendingCashout(
+            product_user_id=user.product_user_id,
+            amount=body.amount,
+            cashout_method_id=body.cashout_method_id,
+        )
+    )
+    query = urlencode({"token": token})
+    confirmation_link = f"{settings.base_url}wallet/cashout/confirm/?{query}"
+
+    if settings.debug:
+        return {"confirmation_link": confirmation_link}
+
+    send_cashout_confirmation_email(email=str(user.email), token=token)
+    return {"detail": "Confirmation sent. Check your inbox to finish the cashout."}
+
+
+@wallet_router.get(
+    "/cashout/confirm/", response_class=HTMLResponse, include_in_schema=False
+)
+def cashout_confirmation_page() -> HTMLResponse:
+    """Serve the SPA without consuming the token; email prefetches are harmless."""
+    return HTMLResponse(
+        render_base_html(),
+        headers={
+            "Cache-Control": "no-store",
+            "Referrer-Policy": "no-referrer",
+            "X-Robots-Tag": "noindex, nofollow",
+        },
+    )
+
+
+@wallet_router.post("/cashout/confirm/", response_model=CashoutRequestInfo)
+def confirm_cashout(
+    body: CashoutConfirmation,
+) -> CashoutRequestInfo:
+    cashout = consume_cashout_token(body.token)
+
+    return user_cashout_request(
+        product_user_id=cashout.product_user_id,
+        amount=cashout.amount,
+        cashout_method_id=cashout.cashout_method_id,
+    )