@easypayment/medusa-paypal 0.6.2 → 0.6.4

package/.medusa/server/src/jobs/paypal-reconcile.js

@@ -1,109 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.config = void 0;
-exports.default = paypalReconcile;
-const utils_1 = require("@medusajs/framework/utils");
-const paypal_1 = require("../modules/paypal");
-const provider_ids_1 = require("../modules/paypal/utils/provider-ids");
-const STATUS_MAP = {
-    CREATED: "pending",
-    APPROVED: "authorized",
-    COMPLETED: "captured",
-    VOIDED: "canceled",
-    CANCELLED: "canceled",
-};
-async function paypalReconcile(container) {
-    // FIX 3a: was container.resolve("payment_session") as any
-    // Modules.PAYMENT is the official typed constant for the Medusa payment module.
-    // listPaymentSessions and updatePaymentSession are methods on the payment module service.
-    const paymentModule = container.resolve(utils_1.Modules.PAYMENT);
-    // FIX 3b: was container.resolve<PayPalModuleService>("paypal_onboarding")
-    // PAYPAL_MODULE is the exported constant from modules/paypal/index.ts
-    const paypal = container.resolve(paypal_1.PAYPAL_MODULE);
-    // FIX 3c: was ["pp_paypal_paypal", "pp_paypal_card_paypal_card"]
-    // PAYPAL_PROVIDER_IDS is the exported array from modules/paypal/utils/provider-ids.ts
-    // If the provider IDs ever change in one place, this file updates automatically.
-    const sessions = await paymentModule.listPaymentSessions({
-        provider_id: [...provider_ids_1.PAYPAL_PROVIDER_IDS],
-        status: ["pending", "authorized"],
-    });
-    for (const session of sessions || []) {
-        const data = (session?.data || {});
-        const paypalData = (data.paypal || {});
-        const orderId = String(paypalData.order_id || data.order_id || "");
-        if (!orderId) {
-            continue;
-        }
-        try {
-            const order = await paypal.getOrderDetails(orderId);
-            const status = STATUS_MAP[String(order?.status || "").toUpperCase()];
-            if (!status) {
-                continue;
-            }
-            const previousStatus = session?.status;
-            if (previousStatus && previousStatus !== status) {
-                await paypal.recordPaymentLog("reconcile_drift", {
-                    session_id: session.id,
-                    order_id: orderId,
-                    previous_status: previousStatus,
-                    next_status: status,
-                });
-                await paypal.recordMetric("reconcile_drift");
-                await paypal.sendAlert({
-                    type: "reconcile_drift",
-                    message: `PayPal reconciliation drift detected for order ${orderId}.`,
-                    metadata: {
-                        session_id: session.id,
-                        previous_status: previousStatus,
-                        next_status: status,
-                    },
-                });
-            }
-            // FIX 3d: was paymentSessionService.update(session.id, { ... })
-            // updatePaymentSession is the correct method name on the payment module service.
-            await paymentModule.updatePaymentSession(session.id, {
-                status,
-                amount: session.amount,
-                data: {
-                    ...(session.data || {}),
-                    paypal: {
-                        ...((session.data || {}).paypal || {}),
-                        order,
-                        reconciliation: {
-                            last_reconciled_at: new Date().toISOString(),
-                            last_status: status,
-                            order_status: order?.status,
-                        },
-                    },
-                },
-            });
-            try {
-                await paypal.recordMetric("reconcile_success");
-            }
-            catch {
-                // ignore metrics failures
-            }
-        }
-        catch (error) {
-            try {
-                await paypal.recordMetric("reconcile_failed");
-            }
-            catch {
-                // ignore metrics failures
-            }
-            await paypal.sendAlert({
-                type: "reconcile_failed",
-                message: `PayPal reconciliation failed for order ${orderId}.`,
-                metadata: {
-                    session_id: session.id,
-                },
-            });
-            console.error("[PayPal] reconcile error", error);
-        }
-    }
-}
-exports.config = {
-    name: "paypal-reconcile",
-    schedule: "*/15 * * * *",
-};
-//# sourceMappingURL=paypal-reconcile.js.map

package/.medusa/server/src/jobs/paypal-reconcile.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"paypal-reconcile.js","sourceRoot":"","sources":["../../../../src/jobs/paypal-reconcile.ts"],"names":[],"mappings":";;;AAcA,kCA6FC;AA1GD,qDAAmD;AAEnD,8CAAiD;AACjD,uEAA0E;AAE1E,MAAM,UAAU,GAAuE;IACrF,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,UAAU;IACrB,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,UAAU;CACtB,CAAA;AAEc,KAAK,UAAU,eAAe,CAAC,SAA0B;IACtE,0DAA0D;IAC1D,gFAAgF;IAChF,0FAA0F;IAC1F,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,eAAO,CAAC,OAAO,CAAQ,CAAA;IAE/D,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAsB,sBAAa,CAAC,CAAA;IAEpE,iEAAiE;IACjE,sFAAsF;IACtF,iFAAiF;IACjF,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,mBAAmB,CAAC;QACvD,WAAW,EAAE,CAAC,GAAG,kCAAmB,CAAC;QACrC,MAAM,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC;KAClC,CAAC,CAAA;IAGF,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAwB,CAAA;QACzD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAwB,CAAA;QAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAQ;QACV,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;YACpE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,SAAQ;YACV,CAAC;YAED,MAAM,cAAc,GAAG,OAAO,EAAE,MAAM,CAAA;YACtC,IAAI,cAAc,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;gBAChD,MAAM,MAAM,CAAC,gBAAgB,CAAC,iBAAiB,EAAE;oBAC/C,UAAU,EAAE,OAAO,CAAC,EAAE;oBACtB,QAAQ,EAAE,OAAO;oBACjB,eAAe,EAAE,cAAc;oBAC/B,WAAW,EAAE,MAAM;iBACpB,CAAC,CAAA;gBACF,MAAM,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAA;gBAC5C,MAAM,MAAM,CAAC,SAAS,CAAC;oBACrB,IAAI,EAAE,iBAAiB;oBACvB,OAAO,EAAE,kDAAkD,OAAO,GAAG;oBACrE,QAAQ,EAAE;wBACR,UAAU,EAAE,OAAO,CAAC,EAAE;wBACtB,eAAe,EAAE,cAAc;wBAC/B,WAAW,EAAE,MAAM;qBACpB;iBACF,CAAC,CAAA;YACJ,CAAC;YAED,gEAAgE;YAChE,iFAAiF;YACjF,MAAM,aAAa,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE;gBACnD,MAAM;gBACN,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,IAAI,EAAE;oBACJ,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,EAAE;wBACN,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;wBACtC,KAAK;wBACL,cAAc,EAAE;4BACd,kBAAkB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;4BAC5C,WAAW,EAAE,MAAM;4BACnB,YAAY,EAAE,KAAK,EAAE,MAAM;yBAC5B;qBACF;iBACF;aACF,CAAC,CAAA;YACF,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAA;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAA;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,0BAA0B;YAC5B,CAAC;YACD,MAAM,MAAM,CAAC,SAAS,CAAC;gBACrB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,0CAA0C,OAAO,GAAG;gBAC7D,QAAQ,EAAE;oBACR,UAAU,EAAE,OAAO,CAAC,EAAE;iBACvB;aACF,CAAC,CAAA;YACF,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAEY,QAAA,MAAM,GAAG;IACpB,IAAI,EAAE,kBAAkB;IACxB,QAAQ,EAAE,cAAc;CACzB,CAAA"}

package/.medusa/server/src/modules/paypal/utils/crypto.d.ts

@@ -1,4 +0,0 @@
-export declare function isEncryptedSecret(value?: string | null): boolean;
-export declare function encryptSecret(value: string, secret: string): string;
-export declare function decryptSecret(value: string, secret: string): string;
-//# sourceMappingURL=crypto.d.ts.map

package/.medusa/server/src/modules/paypal/utils/crypto.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../../../../src/modules/paypal/utils/crypto.ts"],"names":[],"mappings":"AAUA,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,WAEtD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAgB1D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAkB1D"}

package/.medusa/server/src/modules/paypal/utils/crypto.js

@@ -1,47 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isEncryptedSecret = isEncryptedSecret;
-exports.encryptSecret = encryptSecret;
-exports.decryptSecret = decryptSecret;
-const crypto_1 = require("crypto");
-const ENCRYPTED_PREFIX = "enc:";
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 12;
-function deriveKey(secret) {
-    return (0, crypto_1.createHash)("sha256").update(secret).digest();
-}
-function isEncryptedSecret(value) {
-    return typeof value === "string" && value.startsWith(ENCRYPTED_PREFIX);
-}
-function encryptSecret(value, secret) {
-    if (!value || isEncryptedSecret(value)) {
-        return value;
-    }
-    const iv = (0, crypto_1.randomBytes)(IV_LENGTH);
-    const cipher = (0, crypto_1.createCipheriv)(ALGORITHM, deriveKey(secret), iv);
-    const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    return [
-        ENCRYPTED_PREFIX.slice(0, -1),
-        iv.toString("base64"),
-        tag.toString("base64"),
-        encrypted.toString("base64"),
-    ].join(":");
-}
-function decryptSecret(value, secret) {
-    if (!isEncryptedSecret(value)) {
-        return value;
-    }
-    const [, ivBase64, tagBase64, payloadBase64] = value.split(":");
-    if (!ivBase64 || !tagBase64 || !payloadBase64) {
-        throw new Error("Invalid encrypted PayPal secret format.");
-    }
-    const iv = Buffer.from(ivBase64, "base64");
-    const tag = Buffer.from(tagBase64, "base64");
-    const payload = Buffer.from(payloadBase64, "base64");
-    const decipher = (0, crypto_1.createDecipheriv)(ALGORITHM, deriveKey(secret), iv);
-    decipher.setAuthTag(tag);
-    const decrypted = Buffer.concat([decipher.update(payload), decipher.final()]);
-    return decrypted.toString("utf8");
-}
-//# sourceMappingURL=crypto.js.map

package/.medusa/server/src/modules/paypal/utils/crypto.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../../../../src/modules/paypal/utils/crypto.ts"],"names":[],"mappings":";;AAUA,8CAEC;AAED,sCAgBC;AAED,sCAkBC;AAlDD,mCAAkF;AAElF,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAC/B,MAAM,SAAS,GAAG,aAAa,CAAA;AAC/B,MAAM,SAAS,GAAG,EAAE,CAAA;AAEpB,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAA;AACrD,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAqB;IACrD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;AACxE,CAAC;AAED,SAAgB,aAAa,CAAC,KAAa,EAAE,MAAc;IACzD,IAAI,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,SAAS,CAAC,CAAA;IACjC,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IAE/B,OAAO;QACL,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7B,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtB,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC7B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACb,CAAC;AAED,SAAgB,aAAa,CAAC,KAAa,EAAE,MAAc;IACzD,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/D,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;IACnE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACxB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAE7E,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACnC,CAAC"}

package/src/api/admin/paypal/rotate-credentials/route.ts

@@ -1,8 +0,0 @@
-import type { MedusaRequest, MedusaResponse } from "@medusajs/framework/http"
-import type PayPalModuleService from "../../../../modules/paypal/service"
-
-export async function POST(req: MedusaRequest, res: MedusaResponse) {
-  const paypal = req.scope.resolve<PayPalModuleService>("paypal_onboarding")
-  const result = await paypal.rotateCredentialEncryptionKey()
-  return res.json(result)
-}

package/src/jobs/paypal-reconcile.ts

@@ -1,113 +0,0 @@
-import type { MedusaContainer } from "@medusajs/framework/types"
-import { Modules } from "@medusajs/framework/utils"
-import type PayPalModuleService from "../modules/paypal/service"
-import { PAYPAL_MODULE } from "../modules/paypal"
-import { PAYPAL_PROVIDER_IDS } from "../modules/paypal/utils/provider-ids"
-
-const STATUS_MAP: Record<string, "pending" | "authorized" | "captured" | "canceled"> = {
-  CREATED: "pending",
-  APPROVED: "authorized",
-  COMPLETED: "captured",
-  VOIDED: "canceled",
-  CANCELLED: "canceled",
-}
-
-export default async function paypalReconcile(container: MedusaContainer) {
-  // FIX 3a: was container.resolve("payment_session") as any
-  // Modules.PAYMENT is the official typed constant for the Medusa payment module.
-  // listPaymentSessions and updatePaymentSession are methods on the payment module service.
-  const paymentModule = container.resolve(Modules.PAYMENT) as any
-
-  // FIX 3b: was container.resolve<PayPalModuleService>("paypal_onboarding")
-  // PAYPAL_MODULE is the exported constant from modules/paypal/index.ts
-  const paypal = container.resolve<PayPalModuleService>(PAYPAL_MODULE)
-
-  // FIX 3c: was ["pp_paypal_paypal", "pp_paypal_card_paypal_card"]
-  // PAYPAL_PROVIDER_IDS is the exported array from modules/paypal/utils/provider-ids.ts
-  // If the provider IDs ever change in one place, this file updates automatically.
-  const sessions = await paymentModule.listPaymentSessions({
-    provider_id: [...PAYPAL_PROVIDER_IDS],
-    status: ["pending", "authorized"],
-  })
-
-
-  for (const session of sessions || []) {
-    const data = (session?.data || {}) as Record<string, any>
-    const paypalData = (data.paypal || {}) as Record<string, any>
-    const orderId = String(paypalData.order_id || data.order_id || "")
-    if (!orderId) {
-      continue
-    }
-
-    try {
-      const order = await paypal.getOrderDetails(orderId)
-      const status = STATUS_MAP[String(order?.status || "").toUpperCase()]
-      if (!status) {
-        continue
-      }
-
-      const previousStatus = session?.status
-      if (previousStatus && previousStatus !== status) {
-        await paypal.recordPaymentLog("reconcile_drift", {
-          session_id: session.id,
-          order_id: orderId,
-          previous_status: previousStatus,
-          next_status: status,
-        })
-        await paypal.recordMetric("reconcile_drift")
-        await paypal.sendAlert({
-          type: "reconcile_drift",
-          message: `PayPal reconciliation drift detected for order ${orderId}.`,
-          metadata: {
-            session_id: session.id,
-            previous_status: previousStatus,
-            next_status: status,
-          },
-        })
-      }
-
-      // FIX 3d: was paymentSessionService.update(session.id, { ... })
-      // updatePaymentSession is the correct method name on the payment module service.
-      await paymentModule.updatePaymentSession(session.id, {
-        status,
-        amount: session.amount,
-        data: {
-          ...(session.data || {}),
-          paypal: {
-            ...((session.data || {}).paypal || {}),
-            order,
-            reconciliation: {
-              last_reconciled_at: new Date().toISOString(),
-              last_status: status,
-              order_status: order?.status,
-            },
-          },
-        },
-      })
-      try {
-        await paypal.recordMetric("reconcile_success")
-      } catch {
-        // ignore metrics failures
-      }
-    } catch (error) {
-      try {
-        await paypal.recordMetric("reconcile_failed")
-      } catch {
-        // ignore metrics failures
-      }
-      await paypal.sendAlert({
-        type: "reconcile_failed",
-        message: `PayPal reconciliation failed for order ${orderId}.`,
-        metadata: {
-          session_id: session.id,
-        },
-      })
-      console.error("[PayPal] reconcile error", error)
-    }
-  }
-}
-
-export const config = {
-  name: "paypal-reconcile",
-  schedule: "*/15 * * * *",
-}

package/src/modules/paypal/utils/crypto.ts

@@ -1,51 +0,0 @@
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from "crypto"
-
-const ENCRYPTED_PREFIX = "enc:"
-const ALGORITHM = "aes-256-gcm"
-const IV_LENGTH = 12
-
-function deriveKey(secret: string) {
-  return createHash("sha256").update(secret).digest()
-}
-
-export function isEncryptedSecret(value?: string | null) {
-  return typeof value === "string" && value.startsWith(ENCRYPTED_PREFIX)
-}
-
-export function encryptSecret(value: string, secret: string) {
-  if (!value || isEncryptedSecret(value)) {
-    return value
-  }
-
-  const iv = randomBytes(IV_LENGTH)
-  const cipher = createCipheriv(ALGORITHM, deriveKey(secret), iv)
-  const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()])
-  const tag = cipher.getAuthTag()
-
-  return [
-    ENCRYPTED_PREFIX.slice(0, -1),
-    iv.toString("base64"),
-    tag.toString("base64"),
-    encrypted.toString("base64"),
-  ].join(":")
-}
-
-export function decryptSecret(value: string, secret: string) {
-  if (!isEncryptedSecret(value)) {
-    return value
-  }
-
-  const [, ivBase64, tagBase64, payloadBase64] = value.split(":")
-  if (!ivBase64 || !tagBase64 || !payloadBase64) {
-    throw new Error("Invalid encrypted PayPal secret format.")
-  }
-
-  const iv = Buffer.from(ivBase64, "base64")
-  const tag = Buffer.from(tagBase64, "base64")
-  const payload = Buffer.from(payloadBase64, "base64")
-  const decipher = createDecipheriv(ALGORITHM, deriveKey(secret), iv)
-  decipher.setAuthTag(tag)
-  const decrypted = Buffer.concat([decipher.update(payload), decipher.final()])
-
-  return decrypted.toString("utf8")
-}