activemerchant-est 1.4.2.5

data/lib/active_merchant/billing/integrations/paypal/notification.rb

@@ -0,0 +1,154 @@
+require 'net/http'
+
+module ActiveMerchant #:nodoc:
+  module Billing #:nodoc:
+    module Integrations #:nodoc:
+      module Paypal
+        # Parser and handler for incoming Instant payment notifications from paypal. 
+        # The Example shows a typical handler in a rails application. Note that this
+        # is an example, please read the Paypal API documentation for all the details
+        # on creating a safe payment controller.
+        #
+        # Example
+        #  
+        #   class BackendController < ApplicationController
+        #     include ActiveMerchant::Billing::Integrations
+        #
+        #     def paypal_ipn
+        #       notify = Paypal::Notification.new(request.raw_post)
+        #   
+        #       order = Order.find(notify.item_id)
+        #     
+        #       if notify.acknowledge 
+        #         begin
+        #           
+        #           if notify.complete? and order.total == notify.amount
+        #             order.status = 'success' 
+        #             
+        #             shop.ship(order)
+        #           else
+        #             logger.error("Failed to verify Paypal's notification, please investigate")
+        #           end
+        #   
+        #         rescue => e
+        #           order.status        = 'failed'      
+        #           raise
+        #         ensure
+        #           order.save
+        #         end
+        #       end
+        #   
+        #       render :nothing
+        #     end
+        #   end
+        class Notification < ActiveMerchant::Billing::Integrations::Notification
+          include PostsData
+          
+          # Was the transaction complete?
+          def complete?
+            status == "Completed"
+          end
+
+          # When was this payment received by the client. 
+          # sometimes it can happen that we get the notification much later. 
+          # One possible scenario is that our web application was down. In this case paypal tries several 
+          # times an hour to inform us about the notification
+          def received_at
+            Time.parse params['payment_date']
+          end
+
+          # Status of transaction. List of possible values:
+          # <tt>Canceled-Reversal</tt>::
+          # <tt>Completed</tt>::
+          # <tt>Denied</tt>::
+          # <tt>Expired</tt>::
+          # <tt>Failed</tt>::
+          # <tt>In-Progress</tt>::
+          # <tt>Partially-Refunded</tt>::
+          # <tt>Pending</tt>::
+          # <tt>Processed</tt>::
+          # <tt>Refunded</tt>::
+          # <tt>Reversed</tt>::
+          # <tt>Voided</tt>::
+          def status
+            params['payment_status']
+          end
+
+          # Id of this transaction (paypal number)
+          def transaction_id
+            params['txn_id']
+          end
+
+          # What type of transaction are we dealing with? 
+          #  "cart" "send_money" "web_accept" are possible here. 
+          def type
+            params['txn_type']
+          end
+
+          # the money amount we received in X.2 decimal.
+          def gross
+            params['mc_gross']
+          end
+
+          # the markup paypal charges for the transaction
+          def fee
+            params['mc_fee']
+          end
+
+          # What currency have we been dealing with
+          def currency
+            params['mc_currency']
+          end
+
+          # This is the item number which we submitted to paypal 
+          # The custom field is also mapped to item_id because PayPal
+          # doesn't return item_number in dispute notifications
+          def item_id
+            params['item_number'] || params['custom']
+          end
+
+          # This is the invoice which you passed to paypal 
+          def invoice
+            params['invoice']
+          end   
+
+          # Was this a test transaction?
+          def test?
+            params['test_ipn'] == '1'
+          end
+          
+          def account
+            params['business'] || params['receiver_email']
+          end
+
+          # Acknowledge the transaction to paypal. This method has to be called after a new 
+          # ipn arrives. Paypal will verify that all the information we received are correct and will return a 
+          # ok or a fail. 
+          # 
+          # Example:
+          # 
+          #   def paypal_ipn
+          #     notify = PaypalNotification.new(request.raw_post)
+          #
+          #     if notify.acknowledge 
+          #       ... process order ... if notify.complete?
+          #     else
+          #       ... log possible hacking attempt ...
+          #     end
+          def acknowledge
+            payload =  raw
+
+            response = ssl_post(Paypal.service_url + '?cmd=_notify-validate', payload, 
+              'Content-Length' => "#{payload.size}",
+              'User-Agent'     => "Active Merchant -- http://activemerchant.org"
+            )
+            
+            raise StandardError.new("Faulty paypal result: #{response}") unless ["VERIFIED", "INVALID"].include?(response)
+
+            response == "VERIFIED"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_merchant/billing/integrations/paypal/return.rb

@@ -0,0 +1,10 @@
+module ActiveMerchant #:nodoc:
+  module Billing #:nodoc:
+    module Integrations #:nodoc:
+      module Paypal
+        class Return < ActiveMerchant::Billing::Integrations::Return
+	      end
+      end
+    end
+  end
+end

data/lib/active_merchant/billing/integrations/pizza.rb

@@ -0,0 +1,116 @@
+require 'active_merchant/billing/integrations/pizza/helper.rb'
+require 'active_merchant/billing/integrations/pizza/notification.rb'
+module ActiveMerchant #:nodoc:
+  module Billing #:nodoc:
+    module Integrations #:nodoc:
+      module Pizza
+
+        # Define sender id (VK_SND_ID) to bank module mappings.
+        def self.get_class(vk_snd_id)
+          case vk_snd_id
+            when 'EYP' then SebEst
+            when 'SAMPOPANK' then SampoEst
+            when 'HP' then SwedbankEst
+            else raise(ArgumentError, "unknown sender id: #{vk_snd_id}")
+          end
+        end
+
+        # Define required fields for each service message.
+        # We need to know this in order to calculate VK_MAC
+        # from a given hash of parameters.
+        # Order of the parameters is important.
+        mattr_accessor :required_service_params
+        self.required_service_params = {
+          1001 => [
+            'VK_SERVICE',
+            'VK_VERSION',
+            'VK_SND_ID',
+            'VK_STAMP',
+            'VK_AMOUNT',
+            'VK_CURR',
+            'VK_ACC',
+            'VK_NAME',
+            'VK_REF',
+            'VK_MSG'],
+          1002 => [
+            'VK_SERVICE',
+            'VK_VERSION',
+            'VK_SND_ID',
+            'VK_STAMP',
+            'VK_AMOUNT',
+            'VK_CURR',
+            'VK_REF',
+            'VK_MSG' ],
+          1101 => [
+            'VK_SERVICE',
+            'VK_VERSION',
+            'VK_SND_ID',
+            'VK_REC_ID',
+            'VK_STAMP',
+            'VK_T_NO',
+            'VK_AMOUNT',
+            'VK_CURR',
+            'VK_REC_ACC',
+            'VK_REC_NAME',
+            'VK_SND_ACC',
+            'VK_SND_NAME',
+            'VK_REF',
+            'VK_MSG',
+            'VK_T_DATE'],
+          1901 => [
+            'VK_SERVICE',
+            'VK_VERSION',
+            'VK_SND_ID',
+            'VK_REC_ID',
+            'VK_STAMP',
+            'VK_REF',
+            'VK_MSG']
+        }
+
+        # Calculation using method VK_VERSION=008:
+        # VK_MAC is RSA signature of the request fields coded into BASE64.
+        # VK_MAC will be calculated using secret key of the sender using RSA. Signature will
+        # be calculated for string that consists of all field lengths and contents in the query. Also
+        # empty fields are used in calculation – lenght “000”. Unnumbered (optional) fields are
+        # not used in calculation.
+        # MAC(x1,x2,...,xn) := RSA( SHA-1(p(x1 )|| x1|| p(x2 )|| x2 || ... ||p( xn )||xn),d,n)
+        # where:
+        # || is string concatenation mark
+        # x1, x2, ..., xn are parameters of the query
+        # p(x) is length of the field x represented by three digits
+        # d is RSA secret exponent
+        # n is RSA modulus
+        module Common
+          # p(x) is length of the field x represented by three digits
+          def func_p(val)
+            sprintf("%03i", val.size)
+          end
+
+          # Generate a string to be signed out of service message parameters.
+          # p(x1 )|| x1|| p(x2 )|| x2 || ... ||p( xn )||xn
+          # || is string concatenation mark
+          # p(x) is length of the field x represented by three digits
+          # Parameters val1, val2, value3 would be turned into:
+          # '003val1003val2006value3'
+          def generate_data_string(service_msg_number, sigparams)
+            str = ''
+            Pizza.required_service_params[Integer(service_msg_number)].each do |param|
+              val = sigparams[param].to_s # nil goes to ''
+              str << func_p(val) << val
+            end
+            str
+          end
+
+          def generate_signature(service_msg_number, sigparams)
+            privkey = self.class.parent.get_private_key
+            privkey.sign(OpenSSL::Digest::SHA1.new, generate_data_string(service_msg_number, sigparams))
+          end
+
+          def generate_mac(service_msg_number, sigparams)
+            Base64.encode64(generate_signature(service_msg_number, sigparams)).gsub(/\n/,'')
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_merchant/billing/integrations/pizza/helper.rb

@@ -0,0 +1,117 @@
+module ActiveMerchant #:nodoc:
+  module Billing #:nodoc:
+    module Integrations #:nodoc:
+      module Pizza #:nodoc:
+        module Helper #:nodoc:
+
+          def self.included(base)
+            base.class_eval do
+              mapping :account, 'VK_SND_ID'
+              # Amount paid, for example, "33.00"
+              mapping :amount, 'VK_AMOUNT'
+              # Unique order id
+              mapping :order, 'VK_STAMP'
+              # Currency used, 3-letter ISO 4217 code
+              mapping :currency, 'VK_CURR'
+              mapping :notify_url, 'VK_RETURN'
+              mapping :return_url, 'VK_RETURN'
+              mapping :cancel_return_url, 'VK_CANCEL'
+              
+              mapping :reference, 'VK_REF'
+              mapping :description, 'VK_MSG'
+            end
+          end
+
+          def initialize(order, account, options = {})
+            old_valid_keys = [:amount, :currency, :test]
+            new_valid_keys = [:description, :reference]
+            valid_keys = (old_valid_keys + new_valid_keys + Pizza.required_service_params.values << :service_msg_number).uniq
+            options.assert_valid_keys(valid_keys)
+
+            @options = options
+            @fields = {}
+            self.order = order
+            self.account = account
+            self.amount = options[:amount]
+            self.currency = options[:currency]
+            self.description = options[:description]
+            self.reference = options[:reference]
+
+            if options[:service_msg_number]
+              @service_msg_number = options.delete(:service_msg_number)
+            else
+              @service_msg_number = default_service_msg_number
+            end
+
+            add_required_params
+            add_charset_field
+            add_vk_mac
+          end
+
+          # Amount can be supplied with a optional dot separator for cents.
+          def amount=(amount)
+            # TODO check this, sooner or later someone will get a wrong amount.
+
+            # If a string is passed to us, don't do anything.
+            # If a Money object is passed to us, don't do anything.
+            # Otherwise delegate the handling to the money object
+            # and free ourself from the responsibility, yay.
+            if amount.is_a?(String) || amount.is_a?(Money)
+              add_field('VK_AMOUNT', amount)
+            else
+              add_field('VK_AMOUNT', Money.new(amount).to_s)
+            end
+          end
+
+          def add_vk_mac
+            # Signature used to validate previous parameters
+            add_field('VK_MAC', generate_mac(@service_msg_number, form_fields))
+          end
+
+          def add_charset_field
+            add_field vk_charset_param, vk_charset
+          end
+
+          def add_required_params
+            required_params = Pizza.required_service_params[@service_msg_number]
+            required_params.each do |param|
+              param_value = (@options.delete(param) || send(param.to_s.downcase)).to_s
+              add_field param, iconv.iconv(param_value)
+            end
+          end
+
+          # Default parameters
+          def vk_charset
+            'ISO-8859-1'
+          end
+
+          def vk_charset_param
+            'VK_CHARSET'
+          end
+
+          def vk_service
+            @service_msg_number
+          end
+
+          def vk_version
+            '008'
+          end
+
+          # Default service message number.
+          # Use '1002' because it requires the least amount of parameters.
+          def default_service_msg_number
+            1002
+          end
+
+          private
+          # Iconv converter to convert from utf8 to
+          # the charset the bank api expects.
+          def iconv
+            @iconv ||= Iconv.new(vk_charset, 'UTF-8')
+          end
+
+        end
+      end
+    end
+  end
+end

data/lib/active_merchant/billing/integrations/pizza/notification.rb

@@ -0,0 +1,101 @@
+module ActiveMerchant #:nodoc:
+  module Billing #:nodoc:
+    module Integrations #:nodoc:
+      module Pizza
+        module Notification
+
+          # A helper method to parse the raw post of the request & return
+          # the right Notification subclass based on the sender id.
+          def self.get_notification(http_raw_data)
+            params = ActiveMerchant::Billing::Integrations::Notification.new(http_raw_data).params
+            Pizza.get_class(params['VK_SND_ID'])::Notification.new(params)
+          end
+
+          def bank_signature_valid?(bank_signature, service_msg_number, sigparams)
+            self.class.parent.get_bank_public_key.verify(OpenSSL::Digest::SHA1.new, bank_signature, generate_data_string(service_msg_number, sigparams))
+          end
+
+          def complete?
+            params['VK_SERVICE'] == '1101'
+          end
+
+          def currency
+            params['VK_CURR']
+          end
+
+          # The order id we passed to the form helper.
+          def item_id
+            params['VK_STAMP']
+          end
+
+          def transaction_id
+            params['VK_T_NO']
+          end
+
+          # When was this payment received by the client.
+          # We're expecting a dd.mm.yyyy format.
+          def received_at
+            date = params['VK_T_DATE']
+            return nil unless date
+            day, month, year = *date.split('.').map(&:to_i)
+            Date.civil(year, month, day)
+          end
+
+          def signature
+            Base64.decode64(params['VK_MAC'])
+          end
+
+          # The money amount we received, string.
+          def gross
+            params['VK_AMOUNT']
+          end
+
+          # Was this a test transaction?
+          def test?
+            params['VK_REC_ID'] == 'testvpos'
+          end
+
+          # TODO what should be here?
+          def status
+            complete? ? 'Completed' : 'Failed'
+          end
+
+          # If our request was sent automatically by the bank (true) or manually
+          # by the user triggering the callback by pressing a "return" button (false).
+          def automatic?
+            params['VK_AUTO'].upcase == 'Y'
+          end
+
+          def success?
+            acknowledge && complete?
+          end
+
+          # We don't actually acknowledge the notification by making another request ourself,
+          # instead, we check the notification by checking the signature that came with the notification.
+          # This method has to be called when handling the notification & deciding whether to process the order.
+          # Example:
+          #
+          #   def notify
+          #     notify = Notification.new(params)
+          #
+          #     if notify.acknowledge
+          #       ... process order ... if notify.complete?
+          #     else
+          #       ... log possible hacking attempt ...
+          #     end
+          def acknowledge
+            bank_signature_valid?(signature, params['VK_SERVICE'], params)
+          end
+
+          private
+          # Take the posted data and move the relevant data into a hash
+          # No parsing since we're already expecting a hash.
+          def parse(params)
+            raise(ArgumentError, 'Need a hash') unless params.is_a?(Hash)
+            @params = params
+          end
+        end
+      end
+    end
+  end
+end