NFC POS Payment Network

#include <Arduino.h>
#include <WiFi.h>
#include <WebServer.h>
#include <SPI.h>
#include <SD.h>
#include <Wire.h>
#include <MFRC522.h>
#include <LiquidCrystal_I2C.h>


// Forward declarations
void showScreen(const String &line1, const String &line2);
void beepSuccess();
void beepFailure();
String jsonValue(const String &json, const String &key);

const char *AP_SSID = "NFC-POS-Server";
const char *AP_PASSWORD = "posserver2026"; // Change before real financial use.
const char *API_KEY = "change-this-local-api-key"; // Every client must send this in X-API-Key.

// ESP32 DevKit v1 external SPI: SCK=18, MISO=19, MOSI=23.
constexpr uint8_t RC522_SS_PIN = 4;
constexpr uint8_t RC522_RST_PIN = 27;
constexpr uint8_t SD_CS_PIN = 13;
constexpr uint8_t LCD_SDA_PIN = 21;
constexpr uint8_t LCD_SCL_PIN = 22;
constexpr uint8_t BUZZER_PIN = 25;
constexpr uint8_t GREEN_LED_PIN = 26;
constexpr uint8_t RED_LED_PIN = 32;

const char *USERS_FILE = "/users.csv";
const char *USERS_TEMP_FILE = "/users.tmp";
const char *TRANSACTIONS_FILE = "/transactions.csv";

WebServer server(80);
MFRC522 rfid(RC522_SS_PIN, RC522_RST_PIN);
LiquidCrystal_I2C lcd(0x27, 16, 2);
bool sdReady = false;
String shownLine1;
String shownLine2;

void showScreen(const String &line1, const String &line2) {
  if (line1 == shownLine1 && line2 == shownLine2) return;
  shownLine1 = line1;
  shownLine2 = line2;
  lcd.clear();
  lcd.setCursor(0, 0);
  lcd.print(line1.substring(0, 16));
  lcd.setCursor(0, 1);
  lcd.print(line2.substring(0, 16));
}

void beepSuccess() {
  digitalWrite(RED_LED_PIN, LOW);
  digitalWrite(GREEN_LED_PIN, HIGH);
  digitalWrite(BUZZER_PIN, HIGH);
  delay(200);
  digitalWrite(BUZZER_PIN, LOW);
  digitalWrite(GREEN_LED_PIN, LOW);
}

void beepFailure() {
  digitalWrite(GREEN_LED_PIN, LOW);
  digitalWrite(RED_LED_PIN, HIGH);
  for (int i = 0; i < 3; ++i) {
    digitalWrite(BUZZER_PIN, HIGH);
    delay(90);
    digitalWrite(BUZZER_PIN, LOW);
    delay(90);
  }
  digitalWrite(RED_LED_PIN, LOW);
}

String jsonValue(const String &json, const String &key) {
  String marker = "\"" + key + "\"";
  int keyPos = json.indexOf(marker);
  if (keyPos < 0) return "";
  int colon = json.indexOf(':', keyPos + marker.length());
  if (colon < 0) return "";
  int start = colon + 1;
  while (start < json.length() && (json[start] == ' ' || json[start] == '\t' || json[start] == '\"')) start++;
  int end = start;
  while (end < json.length() && json[end] != '\"' && json[end] != ',' && json[end] != '}' && json[end] != '\r' && json[end] != '\n') end++;
  return json.substring(start, end);
}

bool validUid(const String &uid) {
  if (uid.length() < 8 || uid.length() > 20) return false;
  for (size_t i = 0; i < uid.length(); i++) {
    if (!isxdigit(uid[i])) return false;
  }
  return true;
}

bool findBalance(const String &uid, long &balance) {
  if (!sdReady || !SD.exists(USERS_FILE)) return false;
  File file = SD.open(USERS_FILE, FILE_READ);
  if (!file) return false;
  bool found = false;
  while (file.available()) {
    String line = file.readStringUntil('\n');
    line.trim();
    int comma = line.indexOf(',');
    if (comma > 0 && line.substring(0, comma) == uid) {
      balance = line.substring(comma + 1).toInt();
      found = true;
      break;
    }
  }
  file.close();
  return found;
}

bool saveBalance(const String &uid, long balance) {
  if (!sdReady || balance < 0) return false;
  File source = SD.open(USERS_FILE, FILE_READ);
  File temp = SD.open(USERS_TEMP_FILE, FILE_WRITE);
  if (!temp) {
    if (source) source.close();
    return false;
  }
  bool replaced = false;
  if (source) {
    while (source.available()) {
      String line = source.readStringUntil('\n');
      line.trim();
      int comma = line.indexOf(',');
      if (comma > 0 && line.substring(0, comma) == uid) {
        temp.printf("%s,%ld\n", uid.c_str(), balance);
        replaced = true;
      } else if (line.length() > 0) {
        temp.println(line);
      }
    }
    source.close();
  }
  if (!replaced) temp.printf("%s,%ld\n", uid.c_str(), balance);
  temp.close();
  SD.remove(USERS_FILE);
#if defined(ESP32)
  // ESP32 SD supports an atomic-style replacement on the real server.
  return SD.rename(USERS_TEMP_FILE, USERS_FILE);
#else
  // The browser's SD compatibility layer has no rename(). Copy the completed
  // temporary file instead; this branch is never used by the ESP32 firmware.
  File completed = SD.open(USERS_TEMP_FILE, FILE_READ);
  File destination = SD.open(USERS_FILE, FILE_WRITE);
  if (!completed || !destination) {
    if (completed) completed.close();
    if (destination) destination.close();
    return false;
  }
  while (completed.available()) destination.write(completed.read());
  completed.close();
  destination.close();
  SD.remove(USERS_TEMP_FILE);
  return true;
#endif
}

void logTransaction(const String &type, const String &uid, long amount, long newBalance, const String &terminal) {
  if (!sdReady) return;
  // FILE_WRITE appends on the ESP32 SD library and is also available in the browser simulator.
  File logFile = SD.open(TRANSACTIONS_FILE, FILE_WRITE);
  if (!logFile) return;
  logFile.printf("%lu,%s,%s,%ld,%ld,%s\n", static_cast<unsigned long>(millis()), type.c_str(), uid.c_str(), amount, newBalance, terminal.c_str());
  logFile.close();
}

void sendJson(int code, const String &body) {
  server.sendHeader("Content-Type", "application/json");
  server.send(code, "application/json", body);
}

bool apiAuthorized() {
  if (!server.hasHeader("X-API-Key") || server.header("X-API-Key") != API_KEY) {
    sendJson(401, "{\"status\":\"error\",\"reason\":\"unauthorized\"}");
    return false;
  }
  return true;
}

void handleBalance() {
  if (!apiAuthorized()) return;
  String uid = server.arg("uid");
  uid.toUpperCase();
  long balance = 0;
  if (!validUid(uid)) {
    sendJson(400, "{\"status\":\"error\",\"reason\":\"invalid_uid\"}");
  } else if (!findBalance(uid, balance)) {
    sendJson(404, "{\"status\":\"error\",\"reason\":\"unknown_card\"}");
  } else {
    sendJson(200, "{\"status\":\"success\",\"uid\":\"" + uid + "\",\"balance\":" + String(balance) + "}");
  }
}

void handleTopup() {
  if (!apiAuthorized()) return;
  String body = server.arg("plain");
  String uid = jsonValue(body, "uid");
  uid.toUpperCase();
  long amount = jsonValue(body, "amount").toInt();
  String terminal = jsonValue(body, "terminal");
  if (!validUid(uid) || amount <= 0 || amount > 100000) {
    beepFailure();
    sendJson(400, "{\"status\":\"error\",\"reason\":\"invalid_request\"}");
    return;
  }
  long balance = 0;
  findBalance(uid, balance);
  long newBalance = balance + amount;
  if (!saveBalance(uid, newBalance)) {
    beepFailure();
    sendJson(500, "{\"status\":\"error\",\"reason\":\"storage_failure\"}");
    return;
  }
  logTransaction("topup", uid, amount, newBalance, terminal);
  beepSuccess();
  showScreen("Topup OK", "Bal " + String(newBalance) + " THB");
  sendJson(200, "{\"status\":\"success\",\"new_balance\":" + String(newBalance) + "}");
}

void handlePay() {
  if (!apiAuthorized()) return;
  String body = server.arg("plain");
  String uid = jsonValue(body, "uid");
  uid.toUpperCase();
  long amount = jsonValue(body, "amount").toInt();
  String terminal = jsonValue(body, "terminal");
  long balance = 0;
  if (!validUid(uid) || amount <= 0 || amount > 100000) {
    beepFailure();
    sendJson(400, "{\"status\":\"error\",\"reason\":\"invalid_request\"}");
  } else if (!findBalance(uid, balance)) {
    beepFailure();
    sendJson(404, "{\"status\":\"declined\",\"reason\":\"unknown_card\"}");
  } else if (balance < amount) {
    beepFailure();
    sendJson(200, "{\"status\":\"declined\",\"reason\":\"insufficient_funds\",\"balance\":" + String(balance) + "}");
  } else {
    long newBalance = balance - amount;
    if (!saveBalance(uid, newBalance)) {
      beepFailure();
      sendJson(500, "{\"status\":\"error\",\"reason\":\"storage_failure\"}");
      return;
    }
    logTransaction("pay", uid, amount, newBalance, terminal);
    beepSuccess();
    showScreen("Payment OK", "Bal " + String(newBalance) + " THB");
    sendJson(200, "{\"status\":\"approved\",\"new_balance\":" + String(newBalance) + "}");
  }
}

void handleStatus() {
  String json = "{\"status\":\"online\",\"ip\":\"" + WiFi.softAPIP().toString() + "\",\"storage\":";
  json += sdReady ? "\"ready\"}" : "\"unavailable\"}";
  sendJson(200, json);
}

void readPresentedCard() {
  if (!rfid.PICC_IsNewCardPresent() || !rfid.PICC_ReadCardSerial()) return;
  String uid;
  for (byte i = 0; i < rfid.uid.size; i++) {
    if (rfid.uid.uidByte[i] < 0x10) uid += "0";
    uid += String(rfid.uid.uidByte[i], HEX);
  }
  uid.toUpperCase();
  long balance = 0;
  if (findBalance(uid, balance)) {
    beepSuccess();
    showScreen("Card " + uid.substring(0, 6), "Bal " + String(balance) + " THB");
  } else {
    beepFailure();
    showScreen("New/unknown card", uid.substring(0, 16));
  }
  rfid.PICC_HaltA();
  rfid.PCD_StopCrypto1();
}

void setup() {
  Serial.begin(115200);
  pinMode(BUZZER_PIN, OUTPUT);
  pinMode(GREEN_LED_PIN, OUTPUT);
  pinMode(RED_LED_PIN, OUTPUT);
  digitalWrite(BUZZER_PIN, LOW);
  digitalWrite(GREEN_LED_PIN, LOW);
  digitalWrite(RED_LED_PIN, LOW);

  Wire.begin(LCD_SDA_PIN, LCD_SCL_PIN);
  lcd.init();
  lcd.backlight();
  showScreen("NFC POS Server", "Starting...");

  SPI.begin(18, 19, 23, -1);
  rfid.PCD_Init();
  sdReady = SD.begin(SD_CS_PIN);
  if (sdReady && !SD.exists(USERS_FILE)) {
    File users = SD.open(USERS_FILE, FILE_WRITE);
    if (users) users.close();
  }
  if (sdReady && !SD.exists(TRANSACTIONS_FILE)) {
    File transactions = SD.open(TRANSACTIONS_FILE, FILE_WRITE);
    if (transactions) {
      transactions.println("uptime_ms,type,uid,amount,new_balance,terminal");
      transactions.close();
    }
  }

  WiFi.mode(WIFI_AP);
  WiFi.softAP(AP_SSID, AP_PASSWORD);
  const char *headerKeys[] = {"X-API-Key"};
  server.collectHeaders(headerKeys, 1);
  server.on("/api/status", HTTP_GET, handleStatus);
  server.on("/api/balance", HTTP_GET, handleBalance);
  server.on("/api/topup", HTTP_POST, handleTopup);
  server.on("/api/pay", HTTP_POST, handlePay);
  server.onNotFound([]() { sendJson(404, "{\"status\":\"error\",\"reason\":\"not_found\"}"); });
  server.begin();

  showScreen(sdReady ? "Server ready" : "SD card error", WiFi.softAPIP().toString());
  Serial.println("NFC POS Server ready at " + WiFi.softAPIP().toString());
}

void loop() {
  server.handleClient();
  readPresentedCard();
}