activemerchant 1.38.0 → 1.78.0

data/lib/active_merchant/billing/gateways/redsys.rb

@@ -9,30 +9,14 @@ module ActiveMerchant #:nodoc:
     # used by many banks in Spain and is particularly well supported by
     # Catalunya Caixa's ecommerce department.
     #
-    # Standard ActiveMerchant methods are supported, with one notable exception:
-    # :order_id must be provided and must conform to a very specific format.
+    # Redsys requires an order_id be provided with each transaction and it must
+    # follow a specific format. The rules are as follows:
     #
-    # == Example use:
-    #
-    #   gateway = ActiveMerchant::Billing::RedsysGateway.new(
-    #               :login      => "091358382",
-    #               :secret_key => "qwertyasdf0123456789"
-    #            )
-    #
-    #   # Run a purchase for 10 euros
-    #   response = gateway.purchase(1000, creditcard, :order_id => "123456")
-    #   puts reponse.success?       # => true
-    #
-    #   # Partially refund the purchase
-    #   response = gateway.refund(500, response.authorization)
-    #
-    # Redsys requires an order_id be provided with each transaction of a
-    # specific format. The rules are as follows:
-    #
-    #  * Minimum length: 4
-    #  * Maximum length: 12
     #  * First 4 digits must be numerical
     #  * Remaining 8 digits may be alphanumeric
+    #  * Max length: 12
+    #
+    #  If an invalid order_id is provided, we do our best to clean it up.
     #
     # Much of the code for this library is based on the active_merchant_sermepa
     # integration gateway which uses essentially the same API but with the
@@ -40,41 +24,64 @@ module ActiveMerchant #:nodoc:
     #
     # Written by Samuel Lown for Cabify. For implementation questions, or
     # test access details please get in touch: sam@cabify.com.
+    #
+    # *** SHA256 Authentication Update ***
+    #
+    # Redsys is dropping support for the SHA1 authentication method. This
+    # adapter has been updated to work with the new SHA256 authentication
+    # method, however in your initialization options hash you will need to
+    # specify the key/value :signature_algorithm => "sha256" to use the
+    # SHA256 method. Otherwise it will default to using the SHA1.
+    #
+    #
     class RedsysGateway < Gateway
       self.live_url = "https://sis.sermepa.es/sis/operaciones"
-      self.test_url = "https://sis-t.sermepa.es:25443/sis/operaciones"
+      self.test_url = "https://sis-t.redsys.es:25443/sis/operaciones"
 
-      # Sensible region specific defaults.
       self.supported_countries = ['ES']
       self.default_currency    = 'EUR'
       self.money_format        = :cents
 
-      # Not all card types may be actived by the bank!
+      # Not all card types may be activated by the bank!
       self.supported_cardtypes = [:visa, :master, :american_express, :jcb, :diners_club]
-
-      # Homepage URL of the gateway for reference
       self.homepage_url        = "http://www.redsys.es/"
-
-      # What to call this gateway
       self.display_name        = "Redsys"
 
       CURRENCY_CODES = {
-        "ARS" => '032',
-        "AUD" => '036',
+        "AED" => '784',
+        "ARS" => '32',
+        "AUD" => '36',
         "BRL" => '986',
-        "BOB" => '068',
+        "BOB" => '68',
         "CAD" => '124',
         "CHF" => '756',
         "CLP" => '152',
+        "CNY" => '156',
         "COP" => '170',
+        "CRC" => '188',
+        "CZK" => '203',
+        "DKK" => '208',
+        "DOP" => '214',
         "EUR" => '978',
         "GBP" => '826',
         "GTQ" => '320',
+        "HUF" => '348',
+        "IDR" => '360',
+        "INR" => '356',
         "JPY" => '392',
+        "KRW" => '410',
+        "MYR" => '458',
         "MXN" => '484',
+        "NOK" => '578',
         "NZD" => '554',
         "PEN" => '604',
+        "PLN" => '616',
         "RUB" => '643',
+        "SAR" => '682',
+        "SEK" => '752',
+        "SGD" => '702',
+        "THB" => '764',
+        "TWD" => '901',
         "USD" => '840',
         "UYU" => '858'
       }
@@ -94,14 +101,12 @@ module ActiveMerchant #:nodoc:
       # a card has been rejected. Syntax or general request errors
       # are not covered here.
       RESPONSE_TEXTS = {
-        # Accepted Codes
         0 => "Transaction Approved",
         400 => "Cancellation Accepted",
         481 => "Cancellation Accepted",
         500 => "Reconciliation Accepted",
         900 => "Refund / Confirmation approved",
 
-        # Declined error codes
         101 => "Card expired",
         102 => "Card blocked temporarily or under susciption of fraud",
         104 => "Transaction not permitted",
@@ -121,9 +126,8 @@ module ActiveMerchant #:nodoc:
         190 => "Refusal with no specific reason",
         191 => "Expiry date incorrect",
 
-        # Declined, and suspected of fraud
         201 => "Card expired",
-        202 => "Card blocked temporarily or under suscipition of fraud",
+        202 => "Card blocked temporarily or under suspicion of fraud",
         204 => "Transaction not permitted",
         207 => "Contact the card issuer",
         208 => "Lost or stolen card",
@@ -131,13 +135,11 @@ module ActiveMerchant #:nodoc:
         280 => "CVV2/CVC2 Error",
         290 => "Declined with no specific reason",
 
-        # More general codes for specific types of transaction
         480 => "Original transaction not located, or time-out exceeded",
         501 => "Original transaction not located, or time-out exceeded",
         502 => "Original transaction not located, or time-out exceeded",
         503 => "Original transaction not located, or time-out exceeded",
 
-        # Declined transactions by the bank
         904 => "Merchant not registered at FUC",
         909 => "System error",
         912 => "Issuer not available",
@@ -178,32 +180,38 @@ module ActiveMerchant #:nodoc:
       # * <tt>:secret_key</tt> -- The Redsys Secret Key. (REQUIRED)
       # * <tt>:terminal</tt> -- The Redsys Terminal. Defaults to 1. (OPTIONAL)
       # * <tt>:test</tt> -- +true+ or +false+. Defaults to +false+. (OPTIONAL)
+      # * <tt>:signature_algorithm</tt> -- +"sha256"+ Defaults to +"sha1"+. (OPTIONAL)
       def initialize(options = {})
         requires!(options, :login, :secret_key)
         options[:terminal] ||= 1
+        options[:signature_algorithm] ||= "sha1"
         super
       end
 
-      def purchase(money, creditcard, options = {})
+      def purchase(money, payment, options = {})
         requires!(options, :order_id)
 
         data = {}
         add_action(data, :purchase)
         add_amount(data, money, options)
         add_order(data, options[:order_id])
-        add_creditcard(data, creditcard)
+        add_payment(data, payment)
+        data[:description] = options[:description]
+        data[:store_in_vault] = options[:store]
 
         commit data
       end
 
-      def authorize(money, creditcard, options = {})
+      def authorize(money, payment, options = {})
         requires!(options, :order_id)
 
         data = {}
         add_action(data, :authorize)
         add_amount(data, money, options)
         add_order(data, options[:order_id])
-        add_creditcard(data, creditcard)
+        add_payment(data, payment)
+        data[:description] = options[:description]
+        data[:store_in_vault] = options[:store]
 
         commit data
       end
@@ -214,6 +222,7 @@ module ActiveMerchant #:nodoc:
         add_amount(data, money, options)
         order_id, _, _ = split_authorization(authorization)
         add_order(data, order_id)
+        data[:description] = options[:description]
 
         commit data
       end
@@ -224,6 +233,7 @@ module ActiveMerchant #:nodoc:
         order_id, amount, currency = split_authorization(authorization)
         add_amount(data, amount, :currency => currency)
         add_order(data, order_id)
+        data[:description] = options[:description]
 
         commit data
       end
@@ -234,10 +244,37 @@ module ActiveMerchant #:nodoc:
         add_amount(data, money, options)
         order_id, _, _ = split_authorization(authorization)
         add_order(data, order_id)
+        data[:description] = options[:description]
 
         commit data
       end
 
+      def verify(creditcard, options = {})
+        MultiResponse.run(:use_first_response) do |r|
+          r.process { authorize(100, creditcard, options) }
+          r.process(:ignore_result) { void(r.authorization, options) }
+        end
+      end
+
+      def supports_scrubbing
+        true
+      end
+
+      def scrub(transcript)
+        transcript.
+          gsub(%r((Authorization: Basic )\w+), '\1[FILTERED]').
+          gsub(%r((%3CDS_MERCHANT_PAN%3E)\d+(%3C%2FDS_MERCHANT_PAN%3E))i, '\1[FILTERED]\2').
+          gsub(%r((%3CDS_MERCHANT_CVV2%3E)\d+(%3C%2FDS_MERCHANT_CVV2%3E))i, '\1[FILTERED]\2').
+          gsub(%r((<DS_MERCHANT_PAN>)\d+(</DS_MERCHANT_PAN>))i, '\1[FILTERED]\2').
+          gsub(%r((<DS_MERCHANT_CVV2>)\d+(</DS_MERCHANT_CVV2>))i, '\1[FILTERED]\2').
+          gsub(%r((DS_MERCHANT_CVV2)%2F%3E%0A%3C%2F)i, '\1[BLANK]').
+          gsub(%r((DS_MERCHANT_CVV2)%2F%3E%3C)i, '\1[BLANK]').
+          gsub(%r((DS_MERCHANT_CVV2%3E)(%3C%2FDS_MERCHANT_CVV2))i, '\1[BLANK]\2').
+          gsub(%r((<DS_MERCHANT_CVV2>)(</DS_MERCHANT_CVV2>))i, '\1[BLANK]\2').
+          gsub(%r((DS_MERCHANT_CVV2%3E)\++(%3C%2FDS_MERCHANT_CVV2))i, '\1[BLANK]\2').
+          gsub(%r((<DS_MERCHANT_CVV2>)\s+(</DS_MERCHANT_CVV2>))i, '\1[BLANK]\2')
+      end
+
       private
 
       def add_action(data, action)
@@ -250,39 +287,52 @@ module ActiveMerchant #:nodoc:
       end
 
       def add_order(data, order_id)
-        raise ArgumentError.new("Invalid order_id format") unless(/^\d{4}[\da-zA-Z]{0,8}$/ =~ order_id)
-        data[:order_id] = order_id
+        data[:order_id] = clean_order_id(order_id)
       end
 
       def url
         test? ? test_url : live_url
       end
 
-      def add_creditcard(data, card)
-        name  = [card.first_name, card.last_name].join(' ').slice(0, 60)
-        year  = sprintf("%.4i", card.year)
-        month = sprintf("%.2i", card.month)
-        data[:card] = {
-          :name => name,
-          :pan  => card.number,
-          :date => "#{year[2..3]}#{month}",
-          :cvv  => card.verification_value
-        }
+      def add_payment(data, card)
+        if card.is_a?(String)
+          data[:credit_card_token] = card
+        else
+          name  = [card.first_name, card.last_name].join(' ').slice(0, 60)
+          year  = sprintf("%.4i", card.year)
+          month = sprintf("%.2i", card.month)
+          data[:card] = {
+            :name => name,
+            :pan  => card.number,
+            :date => "#{year[2..3]}#{month}",
+            :cvv  => card.verification_value
+          }
+        end
       end
 
       def commit(data)
-        headers = {
+        parse(ssl_post(url, "entrada=#{CGI.escape(xml_request_from(data))}", headers))
+      end
+
+      def headers
+        {
           'Content-Type' => 'application/x-www-form-urlencoded'
         }
-        xml = build_xml_request(data)
-        parse(ssl_post(url, "entrada=#{CGI.escape(xml)}", headers))
+      end
+
+      def xml_request_from(data)
+        if sha256_authentication?
+          build_sha256_xml_request(data)
+        else
+          build_sha1_xml_request(data)
+        end
       end
 
       def build_signature(data)
         str = data[:amount] +
-              data[:order_id].to_s +
-              @options[:login].to_s +
-              data[:currency]
+          data[:order_id].to_s +
+          @options[:login].to_s +
+          data[:currency]
 
         if card = data[:card]
           str << card[:pan]
@@ -290,23 +340,51 @@ module ActiveMerchant #:nodoc:
         end
 
         str << data[:action]
+        if data[:store_in_vault]
+          str << 'REQUIRED'
+        elsif data[:credit_card_token]
+          str << data[:credit_card_token]
+        end
         str << @options[:secret_key]
 
         Digest::SHA1.hexdigest(str)
       end
 
-      def build_xml_request(data)
+      def build_sha256_xml_request(data)
+        xml = Builder::XmlMarkup.new
+        xml.instruct!
+        xml.REQUEST do
+          build_merchant_data(xml, data)
+          xml.DS_SIGNATUREVERSION 'HMAC_SHA256_V1'
+          xml.DS_SIGNATURE sign_request(merchant_data_xml(data), data[:order_id])
+        end
+        xml.target!
+      end
+
+      def build_sha1_xml_request(data)
         xml = Builder::XmlMarkup.new :indent => 2
+        build_merchant_data(xml, data)
+        xml.target!
+      end
+
+      def merchant_data_xml(data)
+        xml = Builder::XmlMarkup.new
+        build_merchant_data(xml, data)
+        xml.target!
+      end
+
+      def build_merchant_data(xml, data)
         xml.DATOSENTRADA do
           # Basic elements
           xml.DS_Version 0.1
-          xml.DS_MERCHANT_CURRENCY          data[:currency]
-          xml.DS_MERCHANT_AMOUNT            data[:amount]
-          xml.DS_MERCHANT_ORDER             data[:order_id]
-          xml.DS_MERCHANT_TRANSACTIONTYPE   data[:action]
-          xml.DS_MERCHANT_TERMINAL          @options[:terminal]
-          xml.DS_MERCHANT_MERCHANTCODE      @options[:login]
-          xml.DS_MERCHANT_MERCHANTSIGNATURE build_signature(data)
+          xml.DS_MERCHANT_CURRENCY           data[:currency]
+          xml.DS_MERCHANT_AMOUNT             data[:amount]
+          xml.DS_MERCHANT_ORDER              data[:order_id]
+          xml.DS_MERCHANT_TRANSACTIONTYPE    data[:action]
+          xml.DS_MERCHANT_PRODUCTDESCRIPTION data[:description]
+          xml.DS_MERCHANT_TERMINAL           @options[:terminal]
+          xml.DS_MERCHANT_MERCHANTCODE       @options[:login]
+          xml.DS_MERCHANT_MERCHANTSIGNATURE  build_signature(data) unless sha256_authentication?
 
           # Only when card is present
           if data[:card]
@@ -314,9 +392,11 @@ module ActiveMerchant #:nodoc:
             xml.DS_MERCHANT_PAN        data[:card][:pan]
             xml.DS_MERCHANT_EXPIRYDATE data[:card][:date]
             xml.DS_MERCHANT_CVV2       data[:card][:cvv]
+            xml.DS_MERCHANT_IDENTIFIER 'REQUIRED' if data[:store_in_vault]
+          elsif data[:credit_card_token]
+            xml.DS_MERCHANT_IDENTIFIER data[:credit_card_token]
           end
         end
-        xml.target!
       end
 
       def parse(data)
@@ -348,18 +428,23 @@ module ActiveMerchant #:nodoc:
       end
 
       def validate_signature(data)
-        str = data[:ds_amount] +
-              data[:ds_order].to_s +
-              data[:ds_merchantcode] +
-              data[:ds_currency] +
-              data[:ds_response] +
-              data[:ds_cardnumber].to_s +
-              data[:ds_transactiontype].to_s +
-              data[:ds_securepayment].to_s +
-              @options[:secret_key]
-
-        sig = Digest::SHA1.hexdigest(str)
-        data[:ds_signature].to_s.downcase == sig
+        if sha256_authentication?
+          sig = Base64.strict_encode64(mac256(get_key(data[:ds_order].to_s), xml_signed_fields(data)))
+          sig.upcase == data[:ds_signature].to_s.upcase
+        else
+          str = data[:ds_amount] +
+            data[:ds_order].to_s +
+            data[:ds_merchantcode] +
+            data[:ds_currency] +
+            data[:ds_response] +
+            data[:ds_cardnumber].to_s +
+            data[:ds_transactiontype].to_s +
+            data[:ds_securepayment].to_s +
+            @options[:secret_key]
+
+          sig = Digest::SHA1.hexdigest(str)
+          data[:ds_signature].to_s.downcase == sig
+        end
       end
 
       def build_authorization(params)
@@ -373,6 +458,7 @@ module ActiveMerchant #:nodoc:
 
       def currency_code(currency)
         return currency if currency =~ /^\d+$/
+        raise ArgumentError, "Unknown currency #{currency}" unless CURRENCY_CODES[currency]
         CURRENCY_CODES[currency]
       end
 
@@ -389,6 +475,52 @@ module ActiveMerchant #:nodoc:
       def is_success_response?(code)
         (code.to_i < 100) || [400, 481, 500, 900].include?(code.to_i)
       end
+
+      def clean_order_id(order_id)
+        cleansed = order_id.gsub(/[^\da-zA-Z]/, '')
+        if cleansed =~ /^\d{4}/
+          cleansed[0..11]
+        else
+          "%04d%s" % [rand(0..9999), cleansed[0...8]]
+        end
+      end
+
+      def sha256_authentication?
+        @options[:signature_algorithm] == "sha256"
+      end
+
+      def sign_request(xml_request_string, order_id)
+        key = encrypt(@options[:secret_key], order_id)
+        Base64.strict_encode64(mac256(key, xml_request_string))
+      end
+
+      def encrypt(key, order_id)
+        block_length = 8
+        cipher = OpenSSL::Cipher.new('DES3')
+        cipher.encrypt
+
+        cipher.key = Base64.strict_decode64(key)
+        # The OpenSSL default of an all-zeroes ("\\0") IV is used.
+        cipher.padding = 0
+
+        order_id += "\0" until order_id.bytesize % block_length == 0 # Pad with zeros
+
+        output = cipher.update(order_id) + cipher.final
+        output
+      end
+
+      def mac256(key, data)
+        OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), key, data)
+      end
+
+      def xml_signed_fields(data)
+        data[:ds_amount] + data[:ds_order] + data[:ds_merchantcode] + data[:ds_currency] +
+          data[:ds_response] + data[:ds_transactiontype] + data[:ds_securepayment]
+      end
+
+      def get_key(order_id)
+        encrypt(@options[:secret_key], order_id)
+      end
     end
   end
 end