fix critical bug customer can recharge without balance when using balance. and move Balance to select Gateway

system/autoload/App.php

@@ -19,6 +19,9 @@ class App{
     }
 
     public static function getTokenValue($key){
+        if(empty($key)){
+            return "";
+        }
         if(isset($_SESSION[$key])){
             return $_SESSION[$key];
         }else{

system/autoload/Balance.php

@@ -30,13 +30,9 @@ class Balance
     public static function min($id_customer, $amount)
     {
         $c = ORM::for_table('tbl_customers')->where('id', $id_customer)->find_one();
-        if ($c && $c['balance'] >= $amount) {
-            $c->balance = $c['balance'] - $amount;
-            $c->save();
-            return true;
-        } else {
-            return false;
-        }
+        $c->balance = $c['balance'] - $amount;
+        $c->save();
+        return true;
     }
 
     public static function plusByPhone($phone_customer, $amount)

system/autoload/Message.php

@@ -188,6 +188,20 @@ class Message
         } else {
             $msg = str_replace('[[expired_date]]', "", $msg);
         }
+
+        if(strpos($msg, '[[payment_link]]')!== false){
+            // token only valid for 1 day, for security reason
+            $token = User::generateToken($customer['id'], 1);
+            $tur = ORM::for_table('tbl_user_recharges')
+                ->where('customer_id', $customer['id'])
+                ->where('namebp', $package)
+                ->find_one();
+            if($tur){
+                $url = APP_URL . '?_route=home&recharge='. $tur.'uid='. $token;
+                $msg = str_replace('[[payment_link]]', $url, $msg);
+            }
+        }
+
         if (
             !empty($customer['phonenumber']) && strlen($customer['phonenumber']) > 5
             && !empty($message) && in_array($via, ['sms', 'wa'])

system/autoload/User.php

@@ -163,7 +163,8 @@ class User
         if($validDays>=30){
             $time = time();
         }else{
-            $time = strtotime("+ $validDays days");
+            // for customer, deafult expired is 30 days
+            $time = strtotime('+ '.(30 - $validDays).' days');
         }
 
         return [