@easypayment/medusa-paypal 0.1.0

package/src/modules/paypal/types/config.ts

@@ -0,0 +1,47 @@
+export type PayPalModuleConfig = {
+  partnerServiceUrl: string
+  partnerJsUrl: string
+  backendUrl: string
+  sellerNonce: string
+  bnCode?: string
+  partnerMerchantIdSandbox: string
+  partnerMerchantIdLive: string
+  credentialsEncryptionKey?: string
+  credentialsEncryptionKeyPrevious?: string[]
+  alertWebhookUrls?: string[]
+}
+
+const STATIC_CFG: PayPalModuleConfig = {
+  partnerServiceUrl: "https://mbjtechnolabs.com/ppcp-seller-onboarding/seller-onboarding.php",
+  partnerJsUrl: "https://www.paypal.com/webapps/merchantboarding/js/lib/lightbox/partner.js",
+  backendUrl: "http://localhost:9000",
+  sellerNonce: "a1233wtergfsdt4365tzrshgfbaewa36AGa1233wtergfsdt4365tzrshgfbaewa36AG",
+  bnCode: "",
+  partnerMerchantIdSandbox: "K6QLN2LPGQRHL",
+  partnerMerchantIdLive: "GT5R877JNBPLL",
+  credentialsEncryptionKey: "",
+  credentialsEncryptionKeyPrevious: [],
+  alertWebhookUrls: [],
+}
+
+export function getPayPalConfig(): PayPalModuleConfig {
+  const previousKeys = (process.env.PAYPAL_CREDENTIALS_ENCRYPTION_KEY_PREVIOUS || "")
+    .split(",")
+    .map((key) => key.trim())
+    .filter(Boolean)
+
+  return {
+    ...STATIC_CFG,
+    backendUrl: process.env.MEDUSA_BACKEND_URL || STATIC_CFG.backendUrl,
+    credentialsEncryptionKey:
+      process.env.PAYPAL_CREDENTIALS_ENCRYPTION_KEY ||
+      STATIC_CFG.credentialsEncryptionKey,
+    credentialsEncryptionKeyPrevious:
+      previousKeys.length > 0 ? previousKeys : STATIC_CFG.credentialsEncryptionKeyPrevious,
+    alertWebhookUrls:
+      (process.env.PAYPAL_ALERT_WEBHOOK_URLS || "")
+        .split(",")
+        .map((url) => url.trim())
+        .filter(Boolean) || STATIC_CFG.alertWebhookUrls,
+  }
+}

package/src/modules/paypal/utils/amounts.ts

@@ -0,0 +1,41 @@
+const ZERO_DECIMAL_CURRENCIES = new Set([
+  "BIF",
+  "CLP",
+  "DJF",
+  "GNF",
+  "JPY",
+  "KMF",
+  "KRW",
+  "MGA",
+  "PYG",
+  "RWF",
+  "UGX",
+  "VND",
+  "VUV",
+  "XAF",
+  "XOF",
+  "XPF",
+])
+
+const THREE_DECIMAL_CURRENCIES = new Set(["BHD", "JOD", "KWD", "OMR", "TND"])
+
+export function getCurrencyExponent(currencyCode: string) {
+  const code = currencyCode.toUpperCase()
+  if (ZERO_DECIMAL_CURRENCIES.has(code)) {
+    return 0
+  }
+  if (THREE_DECIMAL_CURRENCIES.has(code)) {
+    return 3
+  }
+  return 2
+}
+
+export function formatAmountForPayPal(
+  minorAmount: number,
+  currencyCode: string
+) {
+  const exponent = getCurrencyExponent(currencyCode)
+  const factor = 10 ** exponent
+  const majorAmount = Number(minorAmount || 0) / factor
+  return majorAmount.toFixed(exponent)
+}

package/src/modules/paypal/utils/crypto.ts

@@ -0,0 +1,51 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "crypto"
+
+const ENCRYPTED_PREFIX = "enc:"
+const ALGORITHM = "aes-256-gcm"
+const IV_LENGTH = 12
+
+function deriveKey(secret: string) {
+  return createHash("sha256").update(secret).digest()
+}
+
+export function isEncryptedSecret(value?: string | null) {
+  return typeof value === "string" && value.startsWith(ENCRYPTED_PREFIX)
+}
+
+export function encryptSecret(value: string, secret: string) {
+  if (!value || isEncryptedSecret(value)) {
+    return value
+  }
+
+  const iv = randomBytes(IV_LENGTH)
+  const cipher = createCipheriv(ALGORITHM, deriveKey(secret), iv)
+  const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()])
+  const tag = cipher.getAuthTag()
+
+  return [
+    ENCRYPTED_PREFIX.slice(0, -1),
+    iv.toString("base64"),
+    tag.toString("base64"),
+    encrypted.toString("base64"),
+  ].join(":")
+}
+
+export function decryptSecret(value: string, secret: string) {
+  if (!isEncryptedSecret(value)) {
+    return value
+  }
+
+  const [, ivBase64, tagBase64, payloadBase64] = value.split(":")
+  if (!ivBase64 || !tagBase64 || !payloadBase64) {
+    throw new Error("Invalid encrypted PayPal secret format.")
+  }
+
+  const iv = Buffer.from(ivBase64, "base64")
+  const tag = Buffer.from(tagBase64, "base64")
+  const payload = Buffer.from(payloadBase64, "base64")
+  const decipher = createDecipheriv(ALGORITHM, deriveKey(secret), iv)
+  decipher.setAuthTag(tag)
+  const decrypted = Buffer.concat([decipher.update(payload), decipher.final()])
+
+  return decrypted.toString("utf8")
+}

package/src/modules/paypal/utils/currencies.ts

@@ -0,0 +1,84 @@
+const PAYPAL_SUPPORTED_CURRENCIES = new Set([
+  "AUD",
+  "BRL",
+  "CAD",
+  "CHF",
+  "CZK",
+  "DKK",
+  "EUR",
+  "GBP",
+  "HKD",
+  "HUF",
+  "ILS",
+  "JPY",
+  "MXN",
+  "MYR",
+  "NOK",
+  "NZD",
+  "PHP",
+  "PLN",
+  "SEK",
+  "SGD",
+  "THB",
+  "TWD",
+  "USD",
+])
+
+type CurrencyCheck = {
+  currency: string
+  overrideCurrency?: string
+  supported: boolean
+  errors: string[]
+}
+
+export function normalizeCurrencyCode(code?: string, fallback = "USD") {
+  const trimmed = String(code || "").trim()
+  return (trimmed || fallback).toUpperCase()
+}
+
+export function isPayPalCurrencySupported(currencyCode: string) {
+  return PAYPAL_SUPPORTED_CURRENCIES.has(normalizeCurrencyCode(currencyCode))
+}
+
+export function getPayPalCurrencyCompatibility(input: {
+  currencyCode?: string
+  paypalCurrencyOverride?: string
+}): CurrencyCheck {
+  const currency = normalizeCurrencyCode(input.currencyCode)
+  const overrideCurrency = input.paypalCurrencyOverride
+    ? normalizeCurrencyCode(input.paypalCurrencyOverride)
+    : undefined
+  const errors: string[] = []
+
+  if (!isPayPalCurrencySupported(currency)) {
+    errors.push(`PayPal does not support currency "${currency}".`)
+  }
+
+  if (overrideCurrency && overrideCurrency !== currency) {
+    errors.push(
+      `PayPal is configured for "${overrideCurrency}", but the store cart uses "${currency}".`
+    )
+  }
+
+  return {
+    currency,
+    overrideCurrency,
+    supported: errors.length === 0,
+    errors,
+  }
+}
+
+export function assertPayPalCurrencySupported(input: {
+  currencyCode?: string
+  paypalCurrencyOverride?: string
+}) {
+  const result = getPayPalCurrencyCompatibility(input)
+  if (!result.supported) {
+    throw new Error(result.errors.join(" "))
+  }
+  return result
+}
+
+export function getPayPalSupportedCurrencies() {
+  return Array.from(PAYPAL_SUPPORTED_CURRENCIES.values())
+}

package/src/modules/paypal/utils/provider-ids.ts

@@ -0,0 +1,53 @@
+export const PAYPAL_WALLET_PROVIDER_IDS = ["paypal"] as const
+export const PAYPAL_CARD_PROVIDER_IDS = ["paypal_card"] as const
+export const PAYPAL_LEGACY_PROVIDER_IDS = [
+  "pp_paypal_paypal",
+  "pp_paypal_card_paypal",
+  "pp",
+  "card",
+] as const
+
+export const PAYPAL_PROVIDER_IDS = [
+  ...PAYPAL_WALLET_PROVIDER_IDS,
+  ...PAYPAL_CARD_PROVIDER_IDS,
+] as const
+
+export const PAYPAL_PROVIDER_IDS_WITH_LEGACY = [
+  ...PAYPAL_PROVIDER_IDS,
+  ...PAYPAL_LEGACY_PROVIDER_IDS,
+] as const
+
+export const isPayPalProviderId = (providerId?: string | null) => {
+  if (!providerId) return false
+  return PAYPAL_PROVIDER_IDS.includes(providerId as (typeof PAYPAL_PROVIDER_IDS)[number])
+}
+
+export const isLegacyPayPalProviderId = (providerId?: string | null) => {
+  if (!providerId) return false
+  return PAYPAL_LEGACY_PROVIDER_IDS.includes(
+    providerId as (typeof PAYPAL_LEGACY_PROVIDER_IDS)[number]
+  )
+}
+
+const LEGACY_PROVIDER_ID_MAP: Record<
+  (typeof PAYPAL_LEGACY_PROVIDER_IDS)[number],
+  (typeof PAYPAL_PROVIDER_IDS)[number]
+> = {
+  pp_paypal_paypal: "paypal",
+  pp_paypal_card_paypal: "paypal_card",
+  pp: "paypal",
+  card: "paypal_card",
+}
+
+export const normalizePayPalProviderId = (providerId?: string | null) => {
+  if (!providerId) return null
+  if (isPayPalProviderId(providerId)) {
+    return providerId as (typeof PAYPAL_PROVIDER_IDS)[number]
+  }
+  if (isLegacyPayPalProviderId(providerId)) {
+    return LEGACY_PROVIDER_ID_MAP[
+      providerId as (typeof PAYPAL_LEGACY_PROVIDER_IDS)[number]
+    ]
+  }
+  return null
+}

package/src/modules/paypal/webhook-processor.ts

@@ -0,0 +1,313 @@
+import type { MedusaContainer } from "@medusajs/framework/types"
+import type PayPalModuleService from "./service"
+import { isPayPalProviderId } from "./utils/provider-ids"
+
+export const EVENT_STATUS_MAP: Record<string, "authorized" | "captured" | "canceled" | "error"> = {
+  "CHECKOUT.ORDER.APPROVED": "authorized",
+  "CHECKOUT.ORDER.CANCELLED": "canceled",
+  "PAYMENT.CAPTURE.COMPLETED": "captured",
+  "PAYMENT.CAPTURE.DENIED": "error",
+  "PAYMENT.CAPTURE.REFUNDED": "canceled",
+  "PAYMENT.CAPTURE.REVERSED": "canceled",
+  "PAYMENT.AUTHORIZATION.CREATED": "authorized",
+  "PAYMENT.AUTHORIZATION.VOIDED": "canceled",
+  "PAYMENT.AUTHORIZATION.DENIED": "error",
+  "PAYMENT.REFUND.COMPLETED": "canceled",
+  "PAYMENT.REFUND.DENIED": "error",
+}
+
+export const REQUIRED_EVENT_PREFIXES = [
+  "PAYMENT.CAPTURE.",
+  "CHECKOUT.ORDER.",
+  "PAYMENT.AUTHORIZATION.",
+  "PAYMENT.REFUND.",
+  "CUSTOMER.DISPUTE.",
+]
+
+export function isAllowedEventType(eventType: string) {
+  return REQUIRED_EVENT_PREFIXES.some((prefix) => eventType.startsWith(prefix))
+}
+
+export function normalizeResource(payload: Record<string, any>) {
+  const resource = payload?.resource
+  if (!resource) {
+    return {}
+  }
+  if (typeof resource === "string") {
+    try {
+      return JSON.parse(resource)
+    } catch {
+      return {}
+    }
+  }
+  return resource
+}
+
+export function normalizeEventVersion(payload: Record<string, any>) {
+  const raw =
+    payload?.event_version ??
+    payload?.resource_version ??
+    payload?.resource?.resource_version ??
+    payload?.resource?.version ??
+    null
+
+  if (!raw) {
+    return null
+  }
+
+  return String(raw).trim().replace(/^v/i, "")
+}
+
+export function extractIdentifiers(resource: any) {
+  const relatedIds = resource?.supplementary_data?.related_ids || {}
+  const orderId =
+    relatedIds?.order_id ||
+    resource?.purchase_units?.[0]?.custom_id ||
+    resource?.custom_id ||
+    resource?.purchase_units?.[0]?.reference_id
+  const captureId =
+    relatedIds?.capture_id ||
+    resource?.id ||
+    resource?.purchase_units?.[0]?.payments?.captures?.[0]?.id
+  const refundId =
+    relatedIds?.refund_id ||
+    resource?.id ||
+    resource?.purchase_units?.[0]?.payments?.refunds?.[0]?.id
+  const cartId =
+    resource?.custom_id ||
+    resource?.purchase_units?.[0]?.custom_id ||
+    resource?.purchase_units?.[0]?.reference_id
+
+  return { orderId, captureId, refundId, cartId, resource }
+}
+
+export function extractDisputeDetails(resource: any) {
+  const disputeId = String(resource?.dispute_id || resource?.id || "")
+  const disputedTx = Array.isArray(resource?.disputed_transactions)
+    ? resource.disputed_transactions[0]
+    : null
+  const transactionId = disputedTx?.transaction_id || undefined
+  const sellerTransactionId = disputedTx?.seller_transaction_id || undefined
+  const customId = disputedTx?.custom_id || resource?.custom_id || undefined
+  const orderId =
+    resource?.order_id ||
+    resource?.supplementary_data?.related_ids?.order_id ||
+    customId ||
+    undefined
+  const cartId = customId || undefined
+  const amount =
+    resource?.dispute_amount?.value ||
+    resource?.amount?.value ||
+    resource?.dispute_amount?.amount ||
+    undefined
+  const currencyCode =
+    resource?.dispute_amount?.currency_code ||
+    resource?.amount?.currency_code ||
+    resource?.dispute_amount?.currency ||
+    undefined
+
+  return {
+    disputeId,
+    status: resource?.status || null,
+    reason: resource?.reason || null,
+    stage: resource?.dispute_life_cycle_stage || resource?.stage || null,
+    amount: amount ? String(amount) : null,
+    currencyCode: currencyCode ? String(currencyCode) : null,
+    transactionId: transactionId ? String(transactionId) : null,
+    sellerTransactionId: sellerTransactionId ? String(sellerTransactionId) : null,
+    orderId: orderId ? String(orderId) : null,
+    cartId: cartId ? String(cartId) : null,
+  }
+}
+
+async function resolveDisputeOrderId(
+  container: MedusaContainer,
+  orderId?: string | null,
+  cartId?: string | null
+) {
+  const query = container.resolve("query") as any
+  const cleanedOrderId = orderId?.trim()
+  const cleanedCartId = cartId?.trim()
+
+  if (cleanedOrderId) {
+    try {
+      const { data } = await query.graph({
+        entity: "order",
+        fields: ["id"],
+        filters: { id: cleanedOrderId },
+      })
+      const match = data?.[0]?.id
+      if (match) {
+        return String(match)
+      }
+    } catch {
+      // ignore order lookup failures
+    }
+  }
+
+  if (cleanedCartId) {
+    try {
+      const { data } = await query.graph({
+        entity: "order",
+        fields: ["id", "cart_id"],
+        filters: { cart_id: cleanedCartId },
+      })
+      const match = data?.[0]?.id
+      if (match) {
+        return String(match)
+      }
+    } catch {
+      // ignore order lookup failures
+    }
+  }
+
+  return null
+}
+
+function mergeRefunds(existing: any[], incoming: any[]) {
+  const seen = new Set<string>()
+  const merged: any[] = []
+
+  for (const refund of [...existing, ...incoming]) {
+    const id = refund?.id ? String(refund.id) : ""
+    if (id && seen.has(id)) {
+      continue
+    }
+    if (id) {
+      seen.add(id)
+    }
+    merged.push(refund)
+  }
+
+  return merged
+}
+
+async function updatePaymentSession(
+  container: MedusaContainer,
+  cartId: string,
+  status: string,
+  data: Record<string, unknown>
+) {
+  const paymentCollectionService = container.resolve("payment_collection") as any
+  const paymentSessionService = container.resolve("payment_session") as any
+
+  const pc = await paymentCollectionService.retrieveByCartId(cartId).catch(() => null)
+  if (!pc?.id) {
+    return
+  }
+
+  const sessions = await paymentSessionService.list({ payment_collection_id: pc.id })
+  const paypalSession = sessions?.find((s: any) => isPayPalProviderId(s.provider_id))
+  if (!paypalSession) {
+    return
+  }
+
+  const existingData = (paypalSession.data || {}) as Record<string, any>
+  const existingPaypal = (existingData.paypal || {}) as Record<string, any>
+  const existingRefunds = Array.isArray(existingPaypal.refunds) ? existingPaypal.refunds : []
+  const incomingRefunds = Array.isArray(data.refunds) ? data.refunds : null
+  const nextRefunds = incomingRefunds
+    ? mergeRefunds(existingRefunds, incomingRefunds)
+    : existingRefunds
+
+  await paymentSessionService.update(paypalSession.id, {
+    status,
+    data: {
+      ...existingData,
+      paypal: {
+        ...existingPaypal,
+        ...data,
+        refunds: nextRefunds,
+      },
+    },
+  })
+}
+
+export function computeNextRetryAt(attemptCount: number) {
+  const scheduleMinutes = [5, 15, 30, 60, 120]
+  const delayMinutes = scheduleMinutes[Math.min(attemptCount - 1, scheduleMinutes.length - 1)]
+  if (!delayMinutes || attemptCount <= 0) {
+    return null
+  }
+  return new Date(Date.now() + delayMinutes * 60 * 1000)
+}
+
+export async function processPayPalWebhookEvent(
+  container: MedusaContainer,
+  input: {
+    eventType: string
+    payload: Record<string, any>
+  }
+) {
+  const paypal = container.resolve<PayPalModuleService>("paypal_onboarding")
+  const resource = normalizeResource(input.payload)
+  const { orderId, captureId, refundId, cartId } = extractIdentifiers(resource)
+  const disputeDetails =
+    input.eventType.startsWith("CUSTOMER.DISPUTE.") ? extractDisputeDetails(resource) : null
+  const refundReason =
+    String(resource?.note_to_payer || resource?.reason || resource?.seller_note || "").trim() ||
+    undefined
+  const refundReasonCode =
+    String(resource?.reason_code || resource?.reasonCode || "").trim() || undefined
+
+  if (input.eventType.startsWith("CUSTOMER.DISPUTE.")) {
+    if (disputeDetails?.disputeId) {
+      const resolvedOrderId = await resolveDisputeOrderId(
+        container,
+        disputeDetails.orderId,
+        disputeDetails.cartId
+      )
+      await paypal.upsertDispute({
+        dispute_id: disputeDetails.disputeId,
+        status: disputeDetails.status,
+        reason: disputeDetails.reason,
+        stage: disputeDetails.stage,
+        amount: disputeDetails.amount,
+        currency_code: disputeDetails.currencyCode,
+        transaction_id: disputeDetails.transactionId,
+        seller_transaction_id: disputeDetails.sellerTransactionId,
+        order_id: resolvedOrderId || disputeDetails.orderId,
+        cart_id: disputeDetails.cartId,
+        payload: resource,
+      })
+    }
+  }
+
+  const status = EVENT_STATUS_MAP[input.eventType]
+  if (status && cartId) {
+    const refundEntry =
+      refundId || resource?.status
+        ? [
+            {
+              id: refundId,
+              status: resource?.status,
+              reason: refundReason,
+              reason_code: refundReasonCode,
+              amount: (resource as any)?.amount,
+              raw: resource,
+            },
+          ]
+        : null
+
+    await updatePaymentSession(container, cartId, status, {
+      order_id: orderId,
+      capture_id: captureId,
+      refund_id: refundId,
+      refund_status: resource?.status,
+      refund_reason: refundReason,
+      refund_reason_code: refundReasonCode,
+      refunds: refundEntry || undefined,
+      webhook_event_type: input.eventType,
+      webhook_resource: resource,
+    })
+  }
+
+  return {
+    orderId,
+    captureId,
+    refundId,
+    cartId,
+    disputeId: disputeDetails?.disputeId,
+    resource,
+  }
+}

package/tsconfig.json

@@ -0,0 +1,31 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": [
+      "ES2022",
+      "DOM"
+    ],
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "jsx": "react-jsx",
+    "rootDir": ".",
+    "outDir": "dist",
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "strict": false
+  },
+  "include": [
+    "src/**/*.ts",
+    "src/**/*.tsx"
+  ],
+  "exclude": [
+    "node_modules",
+    "dist",
+    ".medusa"
+  ]
+}