Rork × Stripe Connect でマーケットプレイスアプリの決済を構築する

-- 出品者情報（Stripe Connectアカウント紐付け）
create table sellers (
  id uuid primary key default gen_random_uuid(),
  user_id uuid references auth.users(id) not null,
  stripe_account_id text unique,           -- Stripe Connect アカウントID (acct_xxxx)
  onboarding_complete boolean default false,
  charges_enabled boolean default false,
  payouts_enabled boolean default false,
  created_at timestamptz default now()
);
 
-- 商品テーブル
create table products (
  id uuid primary key default gen_random_uuid(),
  seller_id uuid references sellers(id) not null,
  title text not null,
  description text,
  price integer not null,                  -- 価格（円）
  currency text default 'jpy',
  image_url text,
  status text default 'active',           -- active / sold / deleted
  created_at timestamptz default now()
);
 
-- 注文テーブル
create table orders (
  id uuid primary key default gen_random_uuid(),
  product_id uuid references products(id) not null,
  buyer_user_id uuid references auth.users(id) not null,
  seller_id uuid references sellers(id) not null,
  amount integer not null,                 -- 決済金額（円）
  platform_fee integer not null,           -- プラットフォーム手数料（円）
  stripe_payment_intent_id text unique,
  stripe_transfer_id text,
  status text default 'pending',          -- pending / paid / shipped / completed / refunded
  created_at timestamptz default now()
);

-- 出品者は自分のレコードのみ参照・更新可能
alter table sellers enable row level security;
create policy "sellers_own_record" on sellers
  for all using (auth.uid() = user_id);
 
-- 商品は誰でも閲覧可能、変更は出品者のみ
alter table products enable row level security;
create policy "products_read_all" on products
  for select using (status = 'active');
create policy "products_write_own" on products
  for all using (
    seller_id in (select id from sellers where user_id = auth.uid())
  );
 
-- 注文は売り手・買い手のみ参照可能
alter table orders enable row level security;
create policy "orders_participant_only" on orders
  for select using (
    buyer_user_id = auth.uid() or
    seller_id in (select id from sellers where user_id = auth.uid())
  );

// supabase/functions/stripe-connect-onboard/index.ts
import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
import Stripe from "https://esm.sh/stripe@14.0.0";
import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
 
const stripe = new Stripe(Deno.env.get("STRIPE_SECRET_KEY")!, {
  apiVersion: "2024-06-20",
});
 
serve(async (req) => {
  const supabase = createClient(
    Deno.env.get("SUPABASE_URL")!,
    Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!
  );
 
  // ユーザー認証確認
  const authHeader = req.headers.get("Authorization")!;
  const { data: { user } } = await supabase.auth.getUser(
    authHeader.replace("Bearer ", "")
  );
  if (!user) return new Response("Unauthorized", { status: 401 });
 
  // 既存のStripe Connectアカウントを確認
  const { data: existingSeller } = await supabase
    .from("sellers")
    .select("stripe_account_id")
    .eq("user_id", user.id)
    .single();
 
  let accountId = existingSeller?.stripe_account_id;
 
  // なければ新規作成
  if (!accountId) {
    const account = await stripe.accounts.create({
      type: "express",
      country: "JP",
      email: user.email,
      capabilities: {
        card_payments: { requested: true },
        transfers: { requested: true },
      },
      business_type: "individual",
    });
    accountId = account.id;
 
    // Supabaseに保存
    await supabase.from("sellers").upsert({
      user_id: user.id,
      stripe_account_id: accountId,
    });
  }
 
  // オンボーディングURL生成（Stripeのホストする本人確認画面）
  const accountLink = await stripe.accountLinks.create({
    account: accountId,
    refresh_url: `${Deno.env.get("APP_URL")}/seller/onboarding?reauth=true`,
    return_url: `${Deno.env.get("APP_URL")}/seller/onboarding?success=true`,
    type: "account_onboarding",
  });
 
  return new Response(
    JSON.stringify({ url: accountLink.url }),
    { headers: { "Content-Type": "application/json" } }
  );
});

// Rork で生成するオンボーディング画面のコア実装
import React, { useState } from "react";
import { View, Text, TouchableOpacity, Alert } from "react-native";
import { WebView } from "react-native-webview";
import { supabase } from "@/lib/supabase";
 
export default function SellerOnboardingScreen() {
  const [isLoading, setIsLoading] = useState(false);
  const [onboardingUrl, setOnboardingUrl] = useState<string | null>(null);
  const [isComplete, setIsComplete] = useState(false);
 
  const startOnboarding = async () => {
    setIsLoading(true);
    try {
      const { data: { session } } = await supabase.auth.getSession();
      const response = await fetch(
        `${process.env.EXPO_PUBLIC_SUPABASE_URL}/functions/v1/stripe-connect-onboard`,
        {
          method: "POST",
          headers: {
            Authorization: `Bearer ${session?.access_token}`,
            "Content-Type": "application/json",
          },
        }
      );
      const { url } = await response.json();
      setOnboardingUrl(url);
    } catch (error) {
      Alert.alert("エラー", "オンボーディングの開始に失敗しました");
    } finally {
      setIsLoading(false);
    }
  };
 
  if (isComplete) {
    return (
      <View style={{ flex: 1, justifyContent: "center", alignItems: "center" }}>
        <Text style={{ fontSize: 24 }}>✅</Text>
        <Text style={{ fontSize: 18, marginTop: 16 }}>
          出品者登録が完了しました！
        </Text>
        <Text style={{ color: "#666", marginTop: 8 }}>
          審査完了後に販売を開始できます
        </Text>
      </View>
    );
  }
 
  if (onboardingUrl) {
    return (
      <WebView
        source={{ uri: onboardingUrl }}
        onNavigationStateChange={(state) => {
          // return_url に遷移したら完了とみなす
          if (state.url.includes("success=true")) {
            setIsComplete(true);
            setOnboardingUrl(null);
          }
        }}
      />
    );
  }
 
  return (
    <View style={{ flex: 1, padding: 24, justifyContent: "center" }}>
      <Text style={{ fontSize: 22, fontWeight: "bold", marginBottom: 16 }}>
        出品者として登録する
      </Text>
      <Text style={{ color: "#555", marginBottom: 32, lineHeight: 24 }}>
        Stripe による本人確認（KYC）を完了すると、
        商品を出品して売上を受け取ることができます。
        確認作業は通常1〜2営業日で完了します。
      </Text>
      <TouchableOpacity
        onPress={startOnboarding}
        disabled={isLoading}
        style={{
          backgroundColor: "#5469D4",
          padding: 16,
          borderRadius: 8,
          alignItems: "center",
        }}
      >
        <Text style={{ color: "#fff", fontSize: 16, fontWeight: "600" }}>
          {isLoading ? "準備中..." : "本人確認を開始する"}
        </Text>
      </TouchableOpacity>
    </View>
  );
}

// supabase/functions/create-marketplace-payment/index.ts
import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
import Stripe from "https://esm.sh/stripe@14.0.0";
import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
 
const stripe = new Stripe(Deno.env.get("STRIPE_SECRET_KEY")!, {
  apiVersion: "2024-06-20",
});
 
// プラットフォーム手数料率（10%）
const PLATFORM_FEE_RATE = 0.10;
 
serve(async (req) => {
  const supabase = createClient(
    Deno.env.get("SUPABASE_URL")!,
    Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!
  );
 
  const { productId } = await req.json();
 
  // ユーザー認証
  const authHeader = req.headers.get("Authorization")!;
  const { data: { user } } = await supabase.auth.getUser(
    authHeader.replace("Bearer ", "")
  );
  if (!user) return new Response("Unauthorized", { status: 401 });
 
  // 商品・出品者情報を取得
  const { data: product } = await supabase
    .from("products")
    .select("*, sellers(stripe_account_id, charges_enabled)")
    .eq("id", productId)
    .eq("status", "active")
    .single();
 
  if (!product) {
    return new Response("Product not found", { status: 404 });
  }
 
  if (!product.sellers.charges_enabled) {
    return new Response("Seller not ready to accept payments", { status: 400 });
  }
 
  const amount = product.price;  // 円
  const platformFee = Math.floor(amount * PLATFORM_FEE_RATE);
 
  // PaymentIntent を作成（Destination Charges方式）
  const paymentIntent = await stripe.paymentIntents.create({
    amount,
    currency: "jpy",
    // 出品者のStripe Connectアカウントに送金
    transfer_data: {
      destination: product.sellers.stripe_account_id,
    },
    // プラットフォーム手数料（自動的にプラットフォームアカウントに残る）
    application_fee_amount: platformFee,
    metadata: {
      product_id: productId,
      buyer_user_id: user.id,
      seller_id: product.seller_id,
    },
  });
 
  // 注文レコード作成
  await supabase.from("orders").insert({
    product_id: productId,
    buyer_user_id: user.id,
    seller_id: product.seller_id,
    amount,
    platform_fee: platformFee,
    stripe_payment_intent_id: paymentIntent.id,
    status: "pending",
  });
 
  return new Response(
    JSON.stringify({
      clientSecret: paymentIntent.client_secret,
      amount,
      platformFee,
      sellerReceives: amount - platformFee,
    }),
    { headers: { "Content-Type": "application/json" } }
  );
});

// Rork の購入画面（Payment Sheet 使用）
import React, { useState } from "react";
import { View, Text, TouchableOpacity, Alert } from "react-native";
import { useStripe } from "@stripe/stripe-react-native";
import { supabase } from "@/lib/supabase";
 
interface ProductPurchaseProps {
  productId: string;
  productTitle: string;
  price: number;
}
 
export default function ProductPurchaseScreen({
  productId,
  productTitle,
  price,
}: ProductPurchaseProps) {
  const { initPaymentSheet, presentPaymentSheet } = useStripe();
  const [isLoading, setIsLoading] = useState(false);
 
  const handlePurchase = async () => {
    setIsLoading(true);
    try {
      const { data: { session } } = await supabase.auth.getSession();
 
      // バックエンドからclientSecretを取得
      const response = await fetch(
        `${process.env.EXPO_PUBLIC_SUPABASE_URL}/functions/v1/create-marketplace-payment`,
        {
          method: "POST",
          headers: {
            Authorization: `Bearer ${session?.access_token}`,
            "Content-Type": "application/json",
          },
          body: JSON.stringify({ productId }),
        }
      );
      const { clientSecret, amount, sellerReceives } = await response.json();
 
      // Payment Sheet の初期化
      const { error: initError } = await initPaymentSheet({
        paymentIntentClientSecret: clientSecret,
        merchantDisplayName: "Your Marketplace",
        primaryButtonLabel: `¥${amount.toLocaleString()} で購入する`,
      });
 
      if (initError) throw new Error(initError.message);
 
      // Payment Sheet を表示
      const { error: presentError } = await presentPaymentSheet();
 
      if (presentError) {
        if (presentError.code !== "Canceled") {
          Alert.alert("決済エラー", presentError.message);
        }
        return;
      }
 
      // 決済成功
      Alert.alert(
        "購入完了",
        `「${productTitle}」の購入が完了しました。\n出品者への連絡をお待ちください。`
      );
    } catch (error) {
      Alert.alert("エラー", "購入処理中にエラーが発生しました");
    } finally {
      setIsLoading(false);
    }
  };
 
  const platformFee = Math.floor(price * 0.10);
 
  return (
    <View style={{ padding: 24 }}>
      <Text style={{ fontSize: 20, fontWeight: "bold", marginBottom: 8 }}>
        {productTitle}
      </Text>
 
      <View style={{ backgroundColor: "#f8f9fa", padding: 16, borderRadius: 8, marginBottom: 24 }}>
        <Text style={{ fontSize: 16, marginBottom: 4 }}>
          価格: ¥{price.toLocaleString()}
        </Text>
        <Text style={{ fontSize: 13, color: "#666" }}>
          ※ サービス手数料 ¥{platformFee.toLocaleString()} を含む
        </Text>
      </View>
 
      <TouchableOpacity
        onPress={handlePurchase}
        disabled={isLoading}
        style={{
          backgroundColor: "#00a651",
          padding: 16,
          borderRadius: 8,
          alignItems: "center",
        }}
      >
        <Text style={{ color: "#fff", fontSize: 16, fontWeight: "600" }}>
          {isLoading ? "処理中..." : `¥${price.toLocaleString()} で購入する`}
        </Text>
      </TouchableOpacity>
    </View>
  );
}

// supabase/functions/stripe-webhook/index.ts
import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
import Stripe from "https://esm.sh/stripe@14.0.0";
import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
 
const stripe = new Stripe(Deno.env.get("STRIPE_SECRET_KEY")!, {
  apiVersion: "2024-06-20",
  httpClient: Stripe.createFetchHttpClient(),
});
 
const webhookSecret = Deno.env.get("STRIPE_WEBHOOK_SECRET")!;
 
serve(async (req) => {
  const body = await req.text();
  const signature = req.headers.get("stripe-signature")!;
 
  let event: Stripe.Event;
  try {
    // Deno/Cloudflare Workers 環境では非同期バージョンが必須
    event = await stripe.webhooks.constructEventAsync(
      body,
      signature,
      webhookSecret,
      undefined,
      Stripe.createSubtleCryptoProvider()
    );
  } catch (err) {
    console.error("Webhook signature verification failed:", err);
    return new Response("Invalid signature", { status: 400 });
  }
 
  const supabase = createClient(
    Deno.env.get("SUPABASE_URL")!,
    Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!
  );
 
  switch (event.type) {
    case "payment_intent.succeeded": {
      const paymentIntent = event.data.object as Stripe.PaymentIntent;
 
      // 注文ステータスを paid に更新
      await supabase
        .from("orders")
        .update({ status: "paid" })
        .eq("stripe_payment_intent_id", paymentIntent.id);
 
      // 商品ステータスを sold に更新（1点物の場合）
      const { data: order } = await supabase
        .from("orders")
        .select("product_id")
        .eq("stripe_payment_intent_id", paymentIntent.id)
        .single();
 
      if (order) {
        await supabase
          .from("products")
          .update({ status: "sold" })
          .eq("id", order.product_id);
      }
      break;
    }
 
    case "payment_intent.payment_failed": {
      const paymentIntent = event.data.object as Stripe.PaymentIntent;
      await supabase
        .from("orders")
        .update({ status: "failed" })
        .eq("stripe_payment_intent_id", paymentIntent.id);
      break;
    }
 
    case "account.updated": {
      // 出品者アカウントの審査状況を更新
      const account = event.data.object as Stripe.Account;
      await supabase
        .from("sellers")
        .update({
          charges_enabled: account.charges_enabled,
          payouts_enabled: account.payouts_enabled,
          onboarding_complete: account.details_submitted,
        })
        .eq("stripe_account_id", account.id);
      break;
    }
 
    default:
      console.log(`Unhandled event type: ${event.type}`);
  }
 
  return new Response(JSON.stringify({ received: true }), {
    headers: { "Content-Type": "application/json" },
  });
});

// supabase/functions/seller-dashboard/index.ts
import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
import Stripe from "https://esm.sh/stripe@14.0.0";
import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
 
const stripe = new Stripe(Deno.env.get("STRIPE_SECRET_KEY")!, {
  apiVersion: "2024-06-20",
});
 
serve(async (req) => {
  const supabase = createClient(
    Deno.env.get("SUPABASE_URL")!,
    Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!
  );
 
  const authHeader = req.headers.get("Authorization")!;
  const { data: { user } } = await supabase.auth.getUser(
    authHeader.replace("Bearer ", "")
  );
  if (!user) return new Response("Unauthorized", { status: 401 });
 
  const { data: seller } = await supabase
    .from("sellers")
    .select("stripe_account_id")
    .eq("user_id", user.id)
    .single();
 
  if (!seller?.stripe_account_id) {
    return new Response("Seller not found", { status: 404 });
  }
 
  // Stripe Connect アカウントの残高を取得
  const balance = await stripe.balance.retrieve({
    stripeAccount: seller.stripe_account_id,
  });
 
  // 最近の送金履歴
  const payouts = await stripe.payouts.list(
    { limit: 5 },
    { stripeAccount: seller.stripe_account_id }
  );
 
  return new Response(
    JSON.stringify({
      balance: {
        available: balance.available[0]?.amount ?? 0,
        pending: balance.pending[0]?.amount ?? 0,
        currency: "jpy",
      },
      recentPayouts: payouts.data.map((p) => ({
        amount: p.amount,
        status: p.status,
        arrivalDate: p.arrival_date,
      })),
    }),
    { headers: { "Content-Type": "application/json" } }
  );
});

// supabase/functions/process-refund/index.ts（管理者用）
import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
import Stripe from "https://esm.sh/stripe@14.0.0";
import { createClient } from "https://esm.sh/@supabase/supabase-js@2";
 
const stripe = new Stripe(Deno.env.get("STRIPE_SECRET_KEY")!, {
  apiVersion: "2024-06-20",
});
 
serve(async (req) => {
  const { orderId, reason } = await req.json();
 
  const supabase = createClient(
    Deno.env.get("SUPABASE_URL")!,
    Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!
  );
 
  const { data: order } = await supabase
    .from("orders")
    .select("*")
    .eq("id", orderId)
    .single();
 
  if (!order || order.status !== "paid") {
    return new Response("Order not eligible for refund", { status: 400 });
  }
 
  // Destination Charges の返金
  const refund = await stripe.refunds.create({
    payment_intent: order.stripe_payment_intent_id,
    reason: reason || "requested_by_customer",
    reverse_transfer: true,          // 出品者への送金を取り消す
    refund_application_fee: true,    // プラットフォーム手数料も返金
  });
 
  await supabase
    .from("orders")
    .update({ status: "refunded" })
    .eq("id", orderId);
 
  // 商品を再出品可能に戻す
  await supabase
    .from("products")
    .update({ status: "active" })
    .eq("id", order.product_id);
 
  return new Response(
    JSON.stringify({ refundId: refund.id, status: refund.status }),
    { headers: { "Content-Type": "application/json" } }
  );
});

create table processed_webhook_events (
  event_id text primary key,
  event_type text not null,
  processed_at timestamptz not null default now()
);

// stripe-webhook/index.ts の署名検証直後に挿入する
const { error: dupError } = await supabase
  .from("processed_webhook_events")
  .insert({ event_id: event.id, event_type: event.type });
 
if (dupError) {
  // 主キー衝突 = 処理済み。200 を返して再送を止める
  if (dupError.code === "23505") {
    return new Response(JSON.stringify({ received: true, duplicate: true }), {
      headers: { "Content-Type": "application/json" },
    });
  }
  // それ以外のDBエラーは 500 を返し、Stripe に再送させる
  return new Response("DB error", { status: 500 });
}

// supabase/functions/sync-seller-status/index.ts
// オンボーディング画面から戻ったとき、および出品者ダッシュボード表示時に呼ぶ
const { data: seller } = await supabase
  .from("sellers")
  .select("stripe_account_id")
  .eq("user_id", user.id)
  .single();
 
const account = await stripe.accounts.retrieve(seller.stripe_account_id);
 
await supabase
  .from("sellers")
  .update({
    charges_enabled: account.charges_enabled,
    payouts_enabled: account.payouts_enabled,
    onboarding_complete: account.details_submitted,
  })
  .eq("stripe_account_id", account.id);
 
return new Response(
  JSON.stringify({
    chargesEnabled: account.charges_enabled,
    // 何が足りないのかを出品者本人に見せる
    currentlyDue: account.requirements?.currently_due ?? [],
    pastDue: account.requirements?.past_due ?? [],
    disabledReason: account.requirements?.disabled_reason ?? null,
  }),
  { headers: { "Content-Type": "application/json" } }
);

// 部分返金：返金比率に応じて手数料も按分する
const refundAmount = 1000;                 // 返金する金額（円）
const orderAmount = order.amount;          // 3000
const orderFee = order.platform_fee;       // 300
 
// 端数はプラットフォーム側が飲む（出品者の受取を削らない）方向に丸める
const feeRefund = Math.floor((orderFee * refundAmount) / orderAmount);
 
const refund = await stripe.refunds.create({
  payment_intent: order.stripe_payment_intent_id,
  amount: refundAmount,
  reason: "requested_by_customer",
  reverse_transfer: true,
  refund_application_fee: false,   // 全額返金を止める
});
 
// 手数料の按分返金は別 API で行う
if (feeRefund > 0) {
  const charge = await stripe.charges.retrieve(refund.charge as string);
  await stripe.applicationFees.createRefund(
    charge.application_fee as string,
    { amount: feeRefund }
  );
}