@crediblemark/buayar 0.3.0 → 0.3.2

package/dist/index.d.mts

@@ -222,7 +222,7 @@ declare class MidtransClient {
         sandbox?: boolean;
     });
     private getApiBaseUrl;
-    request(method: "GET" | "POST" | "PATCH" | "DELETE", path: string, body: any): Promise<any>;
+    request(method: "GET" | "POST" | "PATCH" | "DELETE", path: string, body?: any): Promise<any>;
     cancelTransaction(orderId: string): Promise<any>;
     refundTransaction(orderId: string, payload: {
         refund_key?: string;
@@ -1278,8 +1278,22 @@ declare function verifyOyWebhook(headers: Record<string, string | string[] | und
  */
 declare function serializeStripeParams(obj: any, prefix?: string): string;
 /**
- * Verifikasi webhook signature Stripe (stripe-signature header)
+ * Verifikasi webhook signature Stripe (stripe-signature header).
+ *
  * Format header: t=1492774577,v1=5257a869e7ecebeda32affa62cd323fa9d214e1b50613e039f08f6362ced773d
+ *
+ * Keamanan:
+ * - Jika signatureHeader atau webhookSecret tidak ada → return false (TIDAK pernah return true).
+ *   Gunakan flag `skipVerification: true` secara eksplisit di kode test jika ingin bypass.
+ * - Pemeriksaan timestamp (replay attack protection): jika selisih antara
+ *   timestamp header dan waktu sekarang melebihi `toleranceSeconds`, return false.
+ * - Perbandingan signature menggunakan `safeCompare` (timing-safe via crypto.timingSafeEqual).
+ *
+ * @param rawPayload  Body request mentah (string atau object; jika object akan di-JSON.stringify)
+ * @param signatureHeader  Nilai header `stripe-signature`
+ * @param webhookSecret   Webhook Signing Secret dari dashboard Stripe (`whsec_...`)
+ * @param toleranceSeconds  Toleransi selisih timestamp (default: 300 detik / 5 menit)
+ * @returns true jika signature valid dan timestamp dalam toleransi; false selainnya
  */
 declare function verifyStripeWebhook(rawPayload: string | any, signatureHeader: string, webhookSecret: string, toleranceSeconds?: number): boolean;
 
@@ -1373,11 +1387,14 @@ declare function sha256(data: string): string;
  */
 declare function sha512(data: string): string;
 /**
- * Generate HMAC-SHA256 hash string (lowercase)
+ * Generate HMAC-SHA256 hash string (lowercase hex)
  */
 declare function hmacSha256(data: string, secret: string): string;
 /**
- * Timing-safe string comparison to prevent timing attacks on signatures
+ * Timing-safe string comparison menggunakan crypto.timingSafeEqual
+ * untuk mencegah timing attack pada perbandingan signature / token.
+ * Menggunakan SHA-256 digest untuk memastikan kedua buffer selalu berukuran 32 bytes,
+ * mencegah kebocoran informasi panjang string dan mengatasi penanganan string non-hex / ganjil oleh Buffer.from.
  */
 declare function safeCompare(a: string, b: string): boolean;
 

package/dist/index.d.ts

@@ -222,7 +222,7 @@ declare class MidtransClient {
         sandbox?: boolean;
     });
     private getApiBaseUrl;
-    request(method: "GET" | "POST" | "PATCH" | "DELETE", path: string, body: any): Promise<any>;
+    request(method: "GET" | "POST" | "PATCH" | "DELETE", path: string, body?: any): Promise<any>;
     cancelTransaction(orderId: string): Promise<any>;
     refundTransaction(orderId: string, payload: {
         refund_key?: string;
@@ -1278,8 +1278,22 @@ declare function verifyOyWebhook(headers: Record<string, string | string[] | und
  */
 declare function serializeStripeParams(obj: any, prefix?: string): string;
 /**
- * Verifikasi webhook signature Stripe (stripe-signature header)
+ * Verifikasi webhook signature Stripe (stripe-signature header).
+ *
  * Format header: t=1492774577,v1=5257a869e7ecebeda32affa62cd323fa9d214e1b50613e039f08f6362ced773d
+ *
+ * Keamanan:
+ * - Jika signatureHeader atau webhookSecret tidak ada → return false (TIDAK pernah return true).
+ *   Gunakan flag `skipVerification: true` secara eksplisit di kode test jika ingin bypass.
+ * - Pemeriksaan timestamp (replay attack protection): jika selisih antara
+ *   timestamp header dan waktu sekarang melebihi `toleranceSeconds`, return false.
+ * - Perbandingan signature menggunakan `safeCompare` (timing-safe via crypto.timingSafeEqual).
+ *
+ * @param rawPayload  Body request mentah (string atau object; jika object akan di-JSON.stringify)
+ * @param signatureHeader  Nilai header `stripe-signature`
+ * @param webhookSecret   Webhook Signing Secret dari dashboard Stripe (`whsec_...`)
+ * @param toleranceSeconds  Toleransi selisih timestamp (default: 300 detik / 5 menit)
+ * @returns true jika signature valid dan timestamp dalam toleransi; false selainnya
  */
 declare function verifyStripeWebhook(rawPayload: string | any, signatureHeader: string, webhookSecret: string, toleranceSeconds?: number): boolean;
 
@@ -1373,11 +1387,14 @@ declare function sha256(data: string): string;
  */
 declare function sha512(data: string): string;
 /**
- * Generate HMAC-SHA256 hash string (lowercase)
+ * Generate HMAC-SHA256 hash string (lowercase hex)
  */
 declare function hmacSha256(data: string, secret: string): string;
 /**
- * Timing-safe string comparison to prevent timing attacks on signatures
+ * Timing-safe string comparison menggunakan crypto.timingSafeEqual
+ * untuk mencegah timing attack pada perbandingan signature / token.
+ * Menggunakan SHA-256 digest untuk memastikan kedua buffer selalu berukuran 32 bytes,
+ * mencegah kebocoran informasi panjang string dan mengatasi penanganan string non-hex / ganjil oleh Buffer.from.
  */
 declare function safeCompare(a: string, b: string): boolean;
 

package/dist/index.js

@@ -566,7 +566,19 @@ function hmacSha256(data, secret) {
 }
 function safeCompare(a, b) {
   if (typeof a !== "string" || typeof b !== "string") return false;
-  return a.toLowerCase() === b.toLowerCase();
+  if (!a && !b) return true;
+  if (!a || !b) return false;
+  const isHexA = /^[0-9a-fA-F]+$/.test(a);
+  const isHexB = /^[0-9a-fA-F]+$/.test(b);
+  let strA = a;
+  let strB = b;
+  if (isHexA && isHexB && a.length === b.length) {
+    strA = a.toLowerCase();
+    strB = b.toLowerCase();
+  }
+  const hashA = import_crypto.default.createHash("sha256").update(strA).digest();
+  const hashB = import_crypto.default.createHash("sha256").update(strB).digest();
+  return import_crypto.default.timingSafeEqual(hashA, hashB);
 }
 
 // src/providers/duitku/signature.ts
@@ -2061,7 +2073,7 @@ function getXenditAuthHeader(secretKey) {
   return `Basic ${token}`;
 }
 function verifyXenditWebhookToken(headerToken, expectedToken) {
-  if (!headerToken || !expectedToken) return true;
+  if (!headerToken || !expectedToken) return false;
   return safeCompare(headerToken, expectedToken);
 }
 
@@ -2249,8 +2261,14 @@ var XenditProvider = class extends BasePaymentProvider {
     const orderId = body.external_id || body.reference_id || body.data?.reference_id || body.id || "";
     const amount = body.paid_amount || body.amount || body.data?.amount || 0;
     const status = isPaid ? "paid" : isPending ? "pending" : isExpired ? "expired" : "failed";
+    const webhookToken = config.extra?.webhookToken;
+    const headerToken = config.extra?.callbackToken || config.extra?.headers?.["x-callback-token"] || config.extra?.headers?.["X-Callback-Token"];
+    let isValid = true;
+    if (webhookToken || headerToken) {
+      isValid = verifyXenditWebhookToken(headerToken, webhookToken);
+    }
     return {
-      isValid: true,
+      isValid,
       provider: "xendit",
       orderId: String(orderId),
       amount: Number(amount) || 0,
@@ -2528,11 +2546,12 @@ function verifyDokuWebhookSignature(headers, body, clientId, secretKey, requestT
   const reqId = headers["request-id"] || headers["Request-Id"] || "";
   const reqTimestamp = headers["request-timestamp"] || headers["Request-Timestamp"] || "";
   const incomingSignature = headers["signature"] || headers["Signature"] || "";
-  if (!incomingSignature || !secretKey) return true;
+  if (!incomingSignature || !secretKey) return false;
+  const target = headers["request-target"] || headers["Request-Target"] || requestTarget;
   let component = `Client-Id:${reqClientId || clientId}
 Request-Id:${reqId}
 Request-Timestamp:${reqTimestamp}
-Request-Target:${requestTarget}`;
+Request-Target:${target}`;
   if (body) {
     const rawBody = typeof body === "string" ? body : JSON.stringify(body);
     const digest = import_crypto6.default.createHash("sha256").update(rawBody).digest("base64");
@@ -2756,8 +2775,16 @@ var DokuProvider = class extends BasePaymentProvider {
     const orderId = body.order?.invoice_number || body.invoice_number || body.order_id || "";
     const amount = body.order?.amount || body.amount || 0;
     const status = isPaid ? "paid" : isPending ? "pending" : isExpired ? "expired" : "failed";
+    const secretKey = config.secretKey || config.apiKey || "";
+    const headers = config.extra?.headers || {};
+    const signature = headers["signature"] || headers["Signature"] || config.extra?.dokuSignature || config.extra?.signatureHeader;
+    const clientId = config.merchantCode || config.clientKey || "";
+    let isValid = true;
+    if (signature || headers && (headers["request-id"] || headers["Request-Id"])) {
+      isValid = verifyDokuWebhookSignature(headers, body, clientId, secretKey);
+    }
     return {
-      isValid: true,
+      isValid,
       provider: "doku",
       orderId: String(orderId),
       amount: Number(amount) || 0,
@@ -3014,7 +3041,7 @@ function generatePrismalinkSignature(merchantId, orderId, amount, secretKey) {
   return sha256(raw);
 }
 function verifyPrismalinkSignature(merchantId, orderId, amount, secretKey, incomingSignature) {
-  if (!incomingSignature || !secretKey) return true;
+  if (!incomingSignature || !secretKey) return false;
   const computed = generatePrismalinkSignature(merchantId, orderId, amount, secretKey);
   return safeCompare(incomingSignature, computed);
 }
@@ -3405,7 +3432,7 @@ function generateFaspaySignature(userId, password, billNo) {
   return import_crypto9.default.createHash("sha1").update(md5Hash).digest("hex");
 }
 function verifyFaspaySignature(userId, password, billNo, paymentStatusCode, incomingSignature) {
-  if (!incomingSignature || !password) return true;
+  if (!incomingSignature || !password) return false;
   const md5Hash = import_crypto9.default.createHash("md5").update(`${userId}${password}${billNo}${paymentStatusCode}`).digest("hex");
   const computed = import_crypto9.default.createHash("sha1").update(md5Hash).digest("hex");
   const simpleComputed = generateFaspaySignature(userId, password, billNo);
@@ -3826,9 +3853,9 @@ function generateFinpaySignature(merchantId, orderId, amount, merchantKey) {
   return import_crypto11.default.createHmac("sha512", merchantKey).update(data).digest("hex");
 }
 function verifyFinpaySignature(merchantId, orderId, amount, merchantKey, incomingSignature) {
-  if (!incomingSignature || !merchantKey) return true;
+  if (!incomingSignature || !merchantKey) return false;
   const computed = generateFinpaySignature(merchantId, orderId, amount, merchantKey);
-  return safeCompare(incomingSignature.toLowerCase(), computed.toLowerCase());
+  return safeCompare(incomingSignature, computed);
 }
 
 // src/providers/finpay/provider.ts
@@ -4213,9 +4240,9 @@ function generateNicepayToken(timeStamp, iMid, referenceNo, amt, merchantKey) {
   return sha256(raw);
 }
 function verifyNicepayWebhook(timeStamp, iMid, referenceNo, amt, merchantKey, incomingToken) {
-  if (!incomingToken || !merchantKey) return true;
+  if (!incomingToken || !merchantKey) return false;
   const computed = generateNicepayToken(timeStamp, iMid, referenceNo, amt, merchantKey);
-  return safeCompare(incomingToken.toLowerCase(), computed.toLowerCase());
+  return safeCompare(incomingToken, computed);
 }
 
 // src/providers/nicepay/provider.ts
@@ -4642,9 +4669,9 @@ function generateOyHeaders(username, apiKey) {
   };
 }
 function verifyOyWebhook(headers, expectedUsername) {
-  if (!expectedUsername) return true;
+  if (!expectedUsername) return false;
   const username = headers["x-oy-username"] || headers["X-Oy-Username"] || "";
-  if (!username) return true;
+  if (!username) return false;
   return safeCompare(username.toLowerCase(), expectedUsername.toLowerCase());
 }
 
@@ -4806,7 +4833,7 @@ var OyProvider = class extends BasePaymentProvider {
     }
   }
   async verifyCallback(body, config) {
-    const username = config.clientKey || config.merchantCode || config.merchantId || "";
+    const username = config.clientKey || config.merchantCode || config.merchantId || config.extra?.username || "";
     const orderId = body.partner_tx_id || body.partner_trx_id || body.trx_id || "";
     const amount = body.amount || body.settlement_amount || 0;
     const rawStatus = (body.status || body.tx_status || "").toUpperCase();
@@ -4815,8 +4842,14 @@ var OyProvider = class extends BasePaymentProvider {
     const isExpired = rawStatus === "EXPIRED";
     const isFailed = rawStatus === "FAILED" || !isPaid && !isPending && !isExpired;
     const status = isPaid ? "paid" : isPending ? "pending" : isExpired ? "expired" : "failed";
+    const headers = config.extra?.headers || {};
+    const oyUsernameHeader = headers["x-oy-username"] || headers["X-Oy-Username"] || config.extra?.oyUsername;
+    let isValid = true;
+    if (oyUsernameHeader || username && headers && Object.keys(headers).length > 0) {
+      isValid = verifyOyWebhook(headers, username);
+    }
     return {
-      isValid: true,
+      isValid,
       provider: "oy",
       orderId: String(orderId),
       amount: Number(amount) || 0,
@@ -5076,13 +5109,16 @@ function serializeStripeParams(obj, prefix = "") {
 }
 function verifyStripeWebhook(rawPayload, signatureHeader, webhookSecret, toleranceSeconds = 300) {
   if (!signatureHeader || !webhookSecret) {
-    return true;
+    return false;
   }
   const items = signatureHeader.split(",");
   let timestamp = "";
   const signatures = [];
   for (const item of items) {
-    const [key, value] = item.trim().split("=");
+    const eqIdx = item.indexOf("=");
+    if (eqIdx === -1) continue;
+    const key = item.slice(0, eqIdx).trim();
+    const value = item.slice(eqIdx + 1).trim();
     if (key === "t") {
       timestamp = value;
     } else if (key === "v1") {
@@ -5092,10 +5128,18 @@ function verifyStripeWebhook(rawPayload, signatureHeader, webhookSecret, toleran
   if (!timestamp || signatures.length === 0) {
     return false;
   }
+  const tsNum = Number(timestamp);
+  if (Number.isNaN(tsNum) || tsNum <= 0) {
+    return false;
+  }
+  const nowSec = Math.floor(Date.now() / 1e3);
+  if (Math.abs(nowSec - tsNum) > toleranceSeconds) {
+    return false;
+  }
   const payloadString = typeof rawPayload === "string" ? rawPayload : JSON.stringify(rawPayload);
   const signedPayload = `${timestamp}.${payloadString}`;
   const expectedSignature = hmacSha256(signedPayload, webhookSecret);
-  return signatures.some((sig) => safeCompare(sig.toLowerCase(), expectedSignature.toLowerCase()));
+  return signatures.some((sig) => safeCompare(sig, expectedSignature));
 }
 
 // src/providers/stripe/provider.ts
@@ -5721,7 +5765,8 @@ function verifyAdyenWebhook(notificationItem, hmacKey) {
     const signedData = fields.join(":");
     const keyBytes = Buffer.from(hmacKey, "hex");
     const expected = (0, import_crypto16.createHmac)("sha256", keyBytes).update(signedData, "utf8").digest("base64");
-    return expected === notificationItem.additionalData?.hmacSignature;
+    const provided = notificationItem.additionalData?.hmacSignature || "";
+    return safeCompare(expected, provided);
   } catch {
     return false;
   }
@@ -5834,7 +5879,7 @@ var AdyenProvider = class extends BasePaymentProvider {
     const hmacKey = config.extra?.hmacKey || config.secretKey || "";
     const notificationItems = body?.notificationItems || [body];
     const item = notificationItems[0]?.NotificationRequestItem || notificationItems[0] || body;
-    const isValid = hmacKey ? verifyAdyenWebhook(item, hmacKey) : true;
+    const isValid = hmacKey ? verifyAdyenWebhook(item, hmacKey) : false;
     const eventCode = (item.eventCode || "").toUpperCase();
     const success = item.success === "true" || item.success === true;
     const orderId = item.merchantReference || item.pspReference || "";
@@ -5952,13 +5997,13 @@ var AdyenProvider = class extends BasePaymentProvider {
 };
 
 // src/providers/checkoutcom/signature.ts
-var import_crypto17 = require("crypto");
+var import_crypto18 = require("crypto");
 function verifyCheckoutComWebhook(body, signatureHeader, secret) {
   if (!secret || !signatureHeader || !body) return false;
   try {
-    const expected = (0, import_crypto17.createHmac)("sha256", secret).update(body, "utf8").digest("hex");
+    const expected = (0, import_crypto18.createHmac)("sha256", secret).update(body, "utf8").digest("hex");
     const provided = signatureHeader.replace(/^sha256=/, "");
-    return expected === provided;
+    return safeCompare(expected, provided);
   } catch {
     return false;
   }
@@ -6059,7 +6104,7 @@ var CheckoutComProvider = class extends BasePaymentProvider {
     const signatureHeader = config.extra?.signatureHeader || "";
     const rawBody = typeof body === "string" ? body : JSON.stringify(body);
     const parsedBody = typeof body === "string" ? JSON.parse(body) : body;
-    const isValid = signatureHeader ? verifyCheckoutComWebhook(rawBody, signatureHeader, webhookSecret) : true;
+    const isValid = signatureHeader ? verifyCheckoutComWebhook(rawBody, signatureHeader, webhookSecret) : false;
     const eventType = parsedBody?.type || "";
     const data = parsedBody?.data || parsedBody;
     const orderId = data?.reference || data?.metadata?.order_id || data?.id || "";
@@ -6176,12 +6221,12 @@ var CheckoutComProvider = class extends BasePaymentProvider {
 };
 
 // src/providers/razorpay/signature.ts
-var import_crypto18 = require("crypto");
+var import_crypto20 = require("crypto");
 function verifyRazorpayWebhook(rawBody, signature, webhookSecret) {
   if (!webhookSecret || !signature || !rawBody) return false;
   try {
-    const expected = (0, import_crypto18.createHmac)("sha256", webhookSecret).update(rawBody).digest("hex");
-    return expected === signature;
+    const expected = (0, import_crypto20.createHmac)("sha256", webhookSecret).update(rawBody).digest("hex");
+    return safeCompare(expected, signature);
   } catch {
     return false;
   }
@@ -6290,7 +6335,7 @@ var RazorpayProvider = class extends BasePaymentProvider {
     const signatureHeader = config.extra?.signatureHeader || "";
     const rawBody = typeof body === "string" ? body : JSON.stringify(body);
     const parsedBody = typeof body === "string" ? JSON.parse(body) : body;
-    const isValid = signatureHeader ? verifyRazorpayWebhook(rawBody, signatureHeader, webhookSecret) : true;
+    const isValid = signatureHeader ? verifyRazorpayWebhook(rawBody, signatureHeader, webhookSecret) : false;
     const eventType = parsedBody?.event || "";
     const payload = parsedBody?.payload;
     const paymentEntity = payload?.payment?.entity || payload?.payment_link?.entity || parsedBody;
@@ -6406,13 +6451,13 @@ var RazorpayProvider = class extends BasePaymentProvider {
 };
 
 // src/providers/square/signature.ts
-var import_crypto19 = require("crypto");
+var import_crypto22 = require("crypto");
 function verifySquareWebhook(rawBody, signatureHeader, signatureKey, notificationUrl) {
   if (!signatureKey || !signatureHeader || !rawBody) return false;
   try {
     const payload = notificationUrl + rawBody;
-    const expected = (0, import_crypto19.createHmac)("sha256", signatureKey).update(payload).digest("base64");
-    return expected === signatureHeader;
+    const expected = (0, import_crypto22.createHmac)("sha256", signatureKey).update(payload).digest("base64");
+    return safeCompare(expected, signatureHeader);
   } catch {
     return false;
   }
@@ -6532,7 +6577,7 @@ var SquareProvider = class extends BasePaymentProvider {
     const notificationUrl = config.callbackUrl || config.extra?.notificationUrl || "";
     const rawBody = typeof body === "string" ? body : JSON.stringify(body);
     const parsedBody = typeof body === "string" ? JSON.parse(body) : body;
-    const isValid = signatureHeader ? verifySquareWebhook(rawBody, signatureHeader, signatureKey, notificationUrl) : true;
+    const isValid = signatureHeader ? verifySquareWebhook(rawBody, signatureHeader, signatureKey, notificationUrl) : false;
     const eventType = parsedBody?.type || "";
     const data = parsedBody?.data?.object || parsedBody?.data || parsedBody;
     const payment = data?.payment || data;
@@ -6651,7 +6696,7 @@ var SquareProvider = class extends BasePaymentProvider {
 };
 
 // src/providers/payu/signature.ts
-var import_crypto20 = require("crypto");
+var import_crypto24 = require("crypto");
 function verifyPayuWebhook(rawBody, signatureHeader, md5Key) {
   if (!md5Key || !signatureHeader || !rawBody) return false;
   try {
@@ -6662,12 +6707,13 @@ function verifyPayuWebhook(rawBody, signatureHeader, md5Key) {
     }
     const providedSig = parts["signature"];
     const algorithm = (parts["algorithm"] || "MD5").toUpperCase();
+    if (!providedSig) return false;
     if (algorithm === "MD5") {
-      const expected = (0, import_crypto20.createHash)("md5").update(rawBody + md5Key).digest("hex");
-      return expected === providedSig;
+      const expected = (0, import_crypto24.createHash)("md5").update(rawBody + md5Key).digest("hex");
+      return safeCompare(expected, providedSig);
     } else if (algorithm === "SHA-256") {
-      const expected = (0, import_crypto20.createHash)("sha256").update(rawBody + md5Key).digest("hex");
-      return expected === providedSig;
+      const expected = (0, import_crypto24.createHash)("sha256").update(rawBody + md5Key).digest("hex");
+      return safeCompare(expected, providedSig);
     }
     return false;
   } catch {
@@ -6805,7 +6851,7 @@ var PayuProvider = class extends BasePaymentProvider {
     const signatureHeader = config.extra?.signatureHeader || "";
     const rawBody = typeof body === "string" ? body : JSON.stringify(body);
     const parsedBody = typeof body === "string" ? JSON.parse(body) : body;
-    const isValid = signatureHeader ? verifyPayuWebhook(rawBody, signatureHeader, md5Key) : true;
+    const isValid = signatureHeader ? verifyPayuWebhook(rawBody, signatureHeader, md5Key) : false;
     const order = parsedBody?.order || parsedBody;
     const orderId = order.extOrderId || order.orderId || "";
     const amount = Number(order.totalAmount || 0);
@@ -6942,7 +6988,7 @@ var PayuProvider = class extends BasePaymentProvider {
 };
 
 // src/providers/braintree/signature.ts
-var import_crypto21 = require("crypto");
+var import_crypto26 = require("crypto");
 function verifyBraintreeWebhook(btSignature, btPayload, privateKey) {
   if (!privateKey || !btSignature || !btPayload) return false;
   try {
@@ -6950,9 +6996,9 @@ function verifyBraintreeWebhook(btSignature, btPayload, privateKey) {
     if (parts.length < 2) return false;
     const providedHmac = parts[1];
     const payload = Buffer.from(btPayload, "base64").toString("utf8");
-    const secretHash = (0, import_crypto21.createHash)("sha1").update(privateKey).digest("hex");
-    const expected = (0, import_crypto21.createHmac)("sha1", secretHash).update(payload).digest("hex");
-    return expected === providedHmac;
+    const secretHash = (0, import_crypto26.createHash)("sha1").update(privateKey).digest("hex");
+    const expected = (0, import_crypto26.createHmac)("sha1", secretHash).update(payload).digest("hex");
+    return safeCompare(expected, providedHmac);
   } catch {
     return false;
   }
@@ -7058,7 +7104,7 @@ var BraintreeProvider = class extends BasePaymentProvider {
     const privateKey = config.apiKey || config.secretKey || "";
     const btSignature = config.extra?.btSignature || "";
     const btPayload = config.extra?.btPayload || "";
-    const isValid = btSignature && btPayload ? verifyBraintreeWebhook(btSignature, btPayload, privateKey) : true;
+    const isValid = btSignature && btPayload ? verifyBraintreeWebhook(btSignature, btPayload, privateKey) : false;
     const parsedBody = typeof body === "string" ? JSON.parse(body) : body;
     const subject = parsedBody?.subject || parsedBody;
     const transaction = subject?.transaction || subject?.disbursement || parsedBody;
@@ -7178,11 +7224,11 @@ var BraintreeProvider = class extends BasePaymentProvider {
 };
 
 // src/providers/twocheckout/signature.ts
-var import_crypto22 = require("crypto");
+var import_crypto28 = require("crypto");
 function buildTwoCheckoutAuth(merchantCode, secretKey) {
   const date = Math.floor(Date.now() / 1e3).toString();
   const raw = merchantCode + date;
-  const hmac = (0, import_crypto22.createHmac)("sha256", secretKey).update(raw).digest("hex");
+  const hmac = (0, import_crypto28.createHmac)("sha256", secretKey).update(raw).digest("hex");
   const header = `code="${merchantCode}" date="${date}" hash="${hmac}"`;
   return { header, date };
 }
@@ -7190,8 +7236,8 @@ function verifyTwoCheckoutWebhook(secretWord, saleId, productId, invoiceId, prov
   if (!secretWord || !providedHash) return false;
   try {
     const raw = secretWord + saleId + productId + invoiceId;
-    const expected = (0, import_crypto22.createHash)("md5").update(raw).digest("hex").toUpperCase();
-    return expected === (providedHash || "").toUpperCase();
+    const expected = (0, import_crypto28.createHash)("md5").update(raw).digest("hex");
+    return safeCompare(expected, providedHash);
   } catch {
     return false;
   }
@@ -7290,7 +7336,7 @@ var TwoCheckoutProvider = class extends BasePaymentProvider {
     const productId = parsedBody?.IPN_PID?.[0] || parsedBody?.product_id || "";
     const invoiceId = parsedBody?.IPN_PNAME?.[0] || parsedBody?.invoice_id || "";
     const providedHash = parsedBody?.HASH || parsedBody?.hash || "";
-    const isValid = secretWord ? verifyTwoCheckoutWebhook(secretWord, saleId, productId, invoiceId, providedHash) : true;
+    const isValid = secretWord ? verifyTwoCheckoutWebhook(secretWord, saleId, productId, invoiceId, providedHash) : false;
     const orderId = parsedBody?.REFNOEXT || parsedBody?.ext_ref_no || parsedBody?.SALE_ID || "";
     const amount = Math.round(Number(parsedBody?.IPN_TOTAL_GENERAL || parsedBody?.total || 0) * 100);
     const statusRaw = (parsedBody?.ORDERSTATUS || parsedBody?.order_status || "").toUpperCase();
@@ -8980,7 +9026,7 @@ function resolveConfigFromEnv(customConfig) {
     merchantCode = merchantCode || env.IPAYMU_VA || env.IPAYMU_MERCHANT_CODE || env.BUAYAR_MERCHANT_CODE || env.PG_MERCHANT_CODE || env.PAYMENT_MERCHANT_CODE;
   } else if (provider === "doku") {
     merchantCode = merchantCode || env.DOKU_CLIENT_ID || env.DOKU_MERCHANT_ID || env.BUAYAR_MERCHANT_CODE || env.PG_MERCHANT_CODE || env.PAYMENT_MERCHANT_CODE;
-    clientKey = clientKey || env.DOKU_CLIENT_ID || env.BUAYAR_CLIENT_KEY;
+    clientKey = clientKey || customConfig?.merchantCode || env.DOKU_CLIENT_ID || env.BUAYAR_CLIENT_KEY;
   } else if (provider === "prismalink") {
     merchantCode = merchantCode || env.PRISMALINK_MERCHANT_ID || env.BUAYAR_MERCHANT_CODE || env.PG_MERCHANT_CODE || env.PAYMENT_MERCHANT_CODE;
     merchantId = merchantId || env.PRISMALINK_MERCHANT_ID || env.BUAYAR_MERCHANT_ID;
@@ -8996,7 +9042,7 @@ function resolveConfigFromEnv(customConfig) {
     merchantId = merchantId || env.NICEPAY_IMID || env.BUAYAR_MERCHANT_ID;
   } else if (provider === "oy" || provider === "oyindonesia") {
     merchantCode = merchantCode || env.OY_USERNAME || env.BUAYAR_MERCHANT_CODE || env.PG_MERCHANT_CODE || env.PAYMENT_MERCHANT_CODE;
-    clientKey = clientKey || env.OY_USERNAME || env.BUAYAR_CLIENT_KEY;
+    clientKey = clientKey || customConfig?.merchantCode || env.OY_USERNAME || env.BUAYAR_CLIENT_KEY;
   } else if (provider === "stripe") {
     clientKey = clientKey || env.STRIPE_PUBLIC_KEY || env.STRIPE_PUBLISHABLE_KEY || env.BUAYAR_CLIENT_KEY || env.BUAYAR_PUBLIC_KEY;
     merchantCode = merchantCode || clientKey || "stripe";
@@ -9032,12 +9078,12 @@ function resolveConfigFromEnv(customConfig) {
   const projectId = customConfig?.projectId || env.BUAYAR_PROJECT_ID || env.PG_PROJECT_ID || env.PROJECT_ID || env.SQUARE_LOCATION_ID;
   const publicKey = customConfig?.publicKey || env.BUAYAR_PUBLIC_KEY || env.PG_PUBLIC_KEY || env.PUBLIC_KEY || env.STRIPE_PUBLIC_KEY || env.STRIPE_PUBLISHABLE_KEY || env.CHECKOUTCOM_PUBLIC_KEY;
   const privateKey = customConfig?.privateKey || env.BUAYAR_PRIVATE_KEY || env.PG_PRIVATE_KEY || env.PRIVATE_KEY || env.BRAINTREE_PRIVATE_KEY;
-  const secretKey = customConfig?.secretKey || env.BUAYAR_SECRET_KEY || env.PG_SECRET_KEY || env.SECRET_KEY || env.XENDIT_SECRET_KEY || env.DOKU_SECRET_KEY || env.PRISMALINK_SECRET_KEY || env.FASPAY_PASSWORD || env.FINPAY_MERCHANT_KEY || env.NICEPAY_KEY || env.OY_API_KEY || env.STRIPE_SECRET_KEY || env.PAYPAL_CLIENT_SECRET || env.CHECKOUTCOM_SECRET_KEY || env.RAZORPAY_KEY_SECRET || env.SQUARE_ACCESS_TOKEN || env.BRAINTREE_PRIVATE_KEY || env.TWOCHECKOUT_SECRET_KEY;
+  const secretKey = customConfig?.secretKey || customConfig?.apiKey || customConfig?.serverKey || env.BUAYAR_SECRET_KEY || env.PG_SECRET_KEY || env.SECRET_KEY || env.XENDIT_SECRET_KEY || env.DOKU_SECRET_KEY || env.PRISMALINK_SECRET_KEY || env.FASPAY_PASSWORD || env.FINPAY_MERCHANT_KEY || env.NICEPAY_KEY || env.OY_API_KEY || env.STRIPE_SECRET_KEY || env.PAYPAL_CLIENT_SECRET || env.CHECKOUTCOM_SECRET_KEY || env.RAZORPAY_KEY_SECRET || env.SQUARE_ACCESS_TOKEN || env.BRAINTREE_PRIVATE_KEY || env.TWOCHECKOUT_SECRET_KEY;
   const callbackUrl = customConfig?.callbackUrl || env.BUAYAR_CALLBACK_URL || env.PG_CALLBACK_URL || env.PAYMENT_CALLBACK_URL;
   const returnUrl = customConfig?.returnUrl || env.BUAYAR_RETURN_URL || env.PG_RETURN_URL || env.PAYMENT_RETURN_URL;
   const extra = {
     webhookToken: env.XENDIT_WEBHOOK_TOKEN || env.BUAYAR_WEBHOOK_TOKEN,
-    webhookSecret: env.STRIPE_WEBHOOK_SECRET || env.CHECKOUTCOM_WEBHOOK_SECRET || env.BUAYAR_WEBHOOK_SECRET,
+    webhookSecret: env.STRIPE_WEBHOOK_SECRET || env.CHECKOUTCOM_WEBHOOK_SECRET || env.RAZORPAY_WEBHOOK_SECRET || env.BUAYAR_WEBHOOK_SECRET,
     merchantName: env.FASPAY_MERCHANT_NAME || env.BUAYAR_MERCHANT_NAME,
     userId: env.FASPAY_USER_ID,
     iMid: env.NICEPAY_IMID,
@@ -9143,38 +9189,46 @@ var Buayar = class {
   async verifyWebhook(payload, headers, configOverride) {
     const mergedConfig = { ...this.config, ...configOverride };
     if (headers) {
+      if (!mergedConfig.extra) mergedConfig.extra = {};
+      mergedConfig.extra.headers = headers;
       const stripeSig = headers["stripe-signature"] || headers["Stripe-Signature"];
       if (stripeSig) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.signatureHeader = Array.isArray(stripeSig) ? stripeSig[0] : stripeSig;
       }
       const ckoSig = headers["cko-signature"] || headers["Cko-Signature"];
       if (ckoSig) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.signatureHeader = Array.isArray(ckoSig) ? ckoSig[0] : ckoSig;
       }
       const rzpSig = headers["x-razorpay-signature"] || headers["X-Razorpay-Signature"];
       if (rzpSig) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.signatureHeader = Array.isArray(rzpSig) ? rzpSig[0] : rzpSig;
       }
       const squareSig = headers["x-square-hmacsha256-signature"] || headers["x-square-signature"];
       if (squareSig) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.signatureHeader = Array.isArray(squareSig) ? squareSig[0] : squareSig;
       }
       const payuSig = headers["openpayu-signature"] || headers["OpenPayU-Signature"];
       if (payuSig) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.signatureHeader = Array.isArray(payuSig) ? payuSig[0] : payuSig;
       }
       const btSig = headers["bt_signature"];
       const btPayload = headers["bt_payload"];
       if (btSig && btPayload) {
-        if (!mergedConfig.extra) mergedConfig.extra = {};
         mergedConfig.extra.btSignature = Array.isArray(btSig) ? btSig[0] : btSig;
         mergedConfig.extra.btPayload = Array.isArray(btPayload) ? btPayload[0] : btPayload;
       }
+      const xenditToken = headers["x-callback-token"] || headers["X-Callback-Token"];
+      if (xenditToken) {
+        mergedConfig.extra.callbackToken = Array.isArray(xenditToken) ? xenditToken[0] : xenditToken;
+      }
+      const dokuSig = headers["signature"] || headers["Signature"];
+      if (dokuSig) {
+        mergedConfig.extra.dokuSignature = Array.isArray(dokuSig) ? dokuSig[0] : dokuSig;
+      }
+      const oyUser = headers["x-oy-username"] || headers["X-Oy-Username"];
+      if (oyUser) {
+        mergedConfig.extra.oyUsername = Array.isArray(oyUser) ? oyUser[0] : oyUser;
+      }
     }
     let providerName = configOverride?.provider || this.provider;
     if (payload) {
@@ -9208,8 +9262,6 @@ var Buayar = class {
         providerName = "adyen";
       } else if (payload.type && payload.data?._links && (payload.type.startsWith("payment_") || payload.type.startsWith("refund_"))) {
         providerName = "checkoutcom";
-      } else if (payload.event && payload.payload?.payment?.entity) {
-        providerName = "razorpay";
       } else if (payload.type && payload.data?.object?.status && payload.merchant_id) {
         providerName = "square";
       } else if (payload.order && payload.order?.status && payload.order?.extOrderId) {