@easypayment/medusa-payment-paypal 0.9.17 → 0.9.19

package/.medusa/server/src/modules/paypal/utils/webhook-verify.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Helpers for calling PayPal's `verify-webhook-signature` API correctly.
+ *
+ * PayPal computes the expected signature over the EXACT bytes it transmitted.
+ * Re-serializing the parsed body (`JSON.stringify(req.body)`) can change those
+ * bytes — key ordering, non-ASCII escaping (`José` vs `José`), number and
+ * whitespace formatting — which makes verification intermittently return
+ * FAILURE for legitimate webhooks. When the original raw body is available we
+ * inject it verbatim as `webhook_event`; otherwise we fall back to serializing
+ * the parsed body so behavior never regresses.
+ */
+/** Normalize Medusa's `req.rawBody` (a Buffer when `preserveRawBody` is set) to a string. */
+export declare function rawBodyToString(rawBody: unknown): string | null;
+/**
+ * Compose the JSON request body for `verify-webhook-signature`.
+ *
+ * `fields` are the transmission headers + webhook_id; `webhookEventJson` is the
+ * raw webhook body verbatim (preferred) or a serialized fallback. Undefined /
+ * null header values are omitted. The webhook event is concatenated as raw JSON
+ * (not re-encoded) so the bytes PayPal hashes match what it signed.
+ */
+export declare function composeVerifyRequestBody(fields: Record<string, string | undefined | null>, webhookEventJson: string): string;
+/**
+ * Pick the bytes to use for `webhook_event`: the raw body when present and
+ * non-blank, otherwise a JSON serialization of the parsed body.
+ */
+export declare function resolveWebhookEventJson(rawBody: string | null | undefined, parsedBody: unknown): string;
+//# sourceMappingURL=webhook-verify.d.ts.map

package/.medusa/server/src/modules/paypal/utils/webhook-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verify.d.ts","sourceRoot":"","sources":["../../../../../../src/modules/paypal/utils/webhook-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,6FAA6F;AAC7F,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAc/D;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,EACjD,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAMR;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,UAAU,EAAE,OAAO,GAClB,MAAM,CAKR"}

package/.medusa/server/src/modules/paypal/utils/webhook-verify.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Helpers for calling PayPal's `verify-webhook-signature` API correctly.
+ *
+ * PayPal computes the expected signature over the EXACT bytes it transmitted.
+ * Re-serializing the parsed body (`JSON.stringify(req.body)`) can change those
+ * bytes — key ordering, non-ASCII escaping (`José` vs `José`), number and
+ * whitespace formatting — which makes verification intermittently return
+ * FAILURE for legitimate webhooks. When the original raw body is available we
+ * inject it verbatim as `webhook_event`; otherwise we fall back to serializing
+ * the parsed body so behavior never regresses.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rawBodyToString = rawBodyToString;
+exports.composeVerifyRequestBody = composeVerifyRequestBody;
+exports.resolveWebhookEventJson = resolveWebhookEventJson;
+/** Normalize Medusa's `req.rawBody` (a Buffer when `preserveRawBody` is set) to a string. */
+function rawBodyToString(rawBody) {
+    if (rawBody == null) {
+        return null;
+    }
+    if (typeof rawBody === "string") {
+        return rawBody.length > 0 ? rawBody : null;
+    }
+    if (Buffer.isBuffer(rawBody)) {
+        return rawBody.length > 0 ? rawBody.toString("utf8") : null;
+    }
+    if (rawBody instanceof Uint8Array) {
+        return rawBody.length > 0 ? Buffer.from(rawBody).toString("utf8") : null;
+    }
+    return null;
+}
+/**
+ * Compose the JSON request body for `verify-webhook-signature`.
+ *
+ * `fields` are the transmission headers + webhook_id; `webhookEventJson` is the
+ * raw webhook body verbatim (preferred) or a serialized fallback. Undefined /
+ * null header values are omitted. The webhook event is concatenated as raw JSON
+ * (not re-encoded) so the bytes PayPal hashes match what it signed.
+ */
+function composeVerifyRequestBody(fields, webhookEventJson) {
+    const head = Object.entries(fields)
+        .filter(([, v]) => v !== undefined && v !== null)
+        .map(([k, v]) => `${JSON.stringify(k)}:${JSON.stringify(v)}`)
+        .join(",");
+    return `{${head}${head ? "," : ""}"webhook_event":${webhookEventJson}}`;
+}
+/**
+ * Pick the bytes to use for `webhook_event`: the raw body when present and
+ * non-blank, otherwise a JSON serialization of the parsed body.
+ */
+function resolveWebhookEventJson(rawBody, parsedBody) {
+    if (typeof rawBody === "string" && rawBody.trim().length > 0) {
+        return rawBody;
+    }
+    return JSON.stringify(parsedBody ?? {});
+}
+//# sourceMappingURL=webhook-verify.js.map

package/.medusa/server/src/modules/paypal/utils/webhook-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verify.js","sourceRoot":"","sources":["../../../../../../src/modules/paypal/utils/webhook-verify.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAGH,0CAcC;AAUD,4DASC;AAMD,0DAQC;AAhDD,6FAA6F;AAC7F,SAAgB,eAAe,CAAC,OAAgB;IAC9C,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7D,CAAC;IACD,IAAI,OAAO,YAAY,UAAU,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,wBAAwB,CACtC,MAAiD,EACjD,gBAAwB;IAExB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,OAAO,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,mBAAmB,gBAAgB,GAAG,CAAA;AACzE,CAAC;AAED;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,OAAkC,EAClC,UAAmB;IAEnB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;AACzC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@easypayment/medusa-payment-paypal",
-  "version": "0.9.17",
+  "version": "0.9.19",
   "description": "PayPal integration for Medusa v2",
   "author": "EasyPayment Plugins",
   "license": "MIT",