@misterhomer1992/miit-bot-payment 1.1.6 → 2.0.4

package/src/modules/payments/wayforpay.service.test.ts

@@ -0,0 +1,375 @@
+import { describe, it, beforeEach, mock } from 'node:test';
+import assert from 'node:assert';
+import crypto from 'crypto';
+import { WayForPayService } from './wayforpay.service';
+import type { WayForPayCallbackData } from './wayforpay.types';
+import type { Logger } from '../logger/types';
+
+// Mock logger
+const createMockLogger = (): Logger => ({
+    info: mock.fn(),
+    warning: mock.fn(),
+    error: mock.fn(),
+    debug: mock.fn(),
+});
+
+// Mock callback data
+const createMockCallbackData = (
+    overrides: Partial<WayForPayCallbackData> = {},
+    secretKey: string = 'test-secret-key',
+): WayForPayCallbackData => {
+    const baseData = {
+        merchantAccount: 'test_merchant',
+        orderReference: 'order-123',
+        amount: 100,
+        currency: 'UAH',
+        authCode: 'auth-123',
+        cardPan: '4111****1111',
+        transactionStatus: 'Approved',
+        reasonCode: 1100,
+        email: 'test@example.com',
+        phone: '+380123456789',
+        createdDate: Date.now(),
+        processingDate: Date.now(),
+        cardType: 'VISA',
+        issuerBankCountry: 'UA',
+        issuerBankName: 'Test Bank',
+        recToken: 'rec-token-123',
+        reason: 'Ok',
+        fee: 2.5,
+        paymentSystem: 'VISA',
+        ...overrides,
+    };
+
+    // Calculate the correct signature
+    const signatureData = [
+        baseData.merchantAccount,
+        baseData.orderReference,
+        baseData.amount,
+        baseData.currency,
+        baseData.authCode,
+        baseData.cardPan,
+        baseData.transactionStatus,
+        baseData.reasonCode,
+    ];
+    const signatureString = signatureData.join(';');
+    const merchantSignature = crypto.createHmac('md5', secretKey).update(signatureString).digest('hex');
+
+    return {
+        ...baseData,
+        merchantSignature: overrides.merchantSignature !== undefined ? overrides.merchantSignature : merchantSignature,
+    } as WayForPayCallbackData;
+};
+
+describe('WayForPayService', () => {
+    let logger: Logger;
+    let service: WayForPayService;
+    const merchantAccount = 'test_merchant';
+    const merchantSecretKey = 'test-secret-key';
+    const merchantDomainName = 'example.com';
+    const serviceUrl = 'https://webhook.example.com/wayforpay';
+
+    beforeEach(() => {
+        logger = createMockLogger();
+        service = new WayForPayService({
+            logger,
+            merchantAccount,
+            merchantSecretKey,
+            merchantDomainName,
+            serviceUrl,
+        });
+    });
+
+    describe('constructor', () => {
+        it('should use provided config values', () => {
+            // The service stores these internally, we can verify behavior through other methods
+            const callbackData = createMockCallbackData({}, merchantSecretKey);
+            const result = service.verifyCallbackSignature(callbackData);
+
+            assert.strictEqual(result.isValid, true);
+        });
+
+        it('should handle missing env vars gracefully in constructor', () => {
+            // Creating service without explicit config should not throw
+            const serviceWithoutConfig = new WayForPayService({ logger });
+            // It will use process.env values which may be undefined
+            assert.ok(serviceWithoutConfig);
+        });
+    });
+
+    describe('verifyCallbackSignature', () => {
+        it('should return valid for correctly signed callback', () => {
+            const callbackData = createMockCallbackData({}, merchantSecretKey);
+
+            const result = service.verifyCallbackSignature(callbackData);
+
+            assert.strictEqual(result.isValid, true);
+            assert.strictEqual(result.error, undefined);
+        });
+
+        it('should return invalid for missing signature', () => {
+            const callbackData = createMockCallbackData({ merchantSignature: '' }, merchantSecretKey);
+
+            const result = service.verifyCallbackSignature(callbackData);
+
+            assert.strictEqual(result.isValid, false);
+            assert.strictEqual(result.error, 'Missing merchant signature in callback data');
+        });
+
+        it('should return invalid for incorrect signature', () => {
+            const callbackData = createMockCallbackData({}, merchantSecretKey);
+            callbackData.merchantSignature = 'invalid-signature';
+
+            const result = service.verifyCallbackSignature(callbackData);
+
+            assert.strictEqual(result.isValid, false);
+            assert.strictEqual(result.error, undefined); // No error message, just warning logged
+            assert.strictEqual((logger.warning as any).mock.calls.length, 1);
+        });
+
+        it('should be case-insensitive for signature comparison', () => {
+            const callbackData = createMockCallbackData({}, merchantSecretKey);
+            // Make signature uppercase
+            callbackData.merchantSignature = callbackData.merchantSignature.toUpperCase();
+
+            const result = service.verifyCallbackSignature(callbackData);
+
+            assert.strictEqual(result.isValid, true);
+        });
+
+        it('should return error on exception', () => {
+            // Create callback with invalid data that might cause an error
+            const callbackData = null as unknown as WayForPayCallbackData;
+
+            const result = service.verifyCallbackSignature(callbackData);
+
+            assert.strictEqual(result.isValid, false);
+            assert.strictEqual(result.error, 'Error verifying signature');
+        });
+
+        it('should verify signature with different amounts', () => {
+            const callbackData = createMockCallbackData({ amount: 999.99 }, merchantSecretKey);
+
+            const result = service.verifyCallbackSignature(callbackData);
+
+            assert.strictEqual(result.isValid, true);
+        });
+
+        it('should verify signature with different currencies', () => {
+            const callbackData = createMockCallbackData({ currency: 'USD' as any }, merchantSecretKey);
+
+            const result = service.verifyCallbackSignature(callbackData);
+
+            assert.strictEqual(result.isValid, true);
+        });
+    });
+
+    describe('buildWebhookResponse', () => {
+        it('should build accept response with correct structure', () => {
+            const orderReference = 'order-123';
+
+            const result = service.buildWebhookResponse(orderReference, 'accept');
+
+            assert.strictEqual(result.orderReference, orderReference);
+            assert.strictEqual(result.status, 'accept');
+            assert.ok(typeof result.time === 'number');
+            assert.ok(typeof result.signature === 'string');
+            assert.ok(result.signature.length > 0);
+        });
+
+        it('should build decline response', () => {
+            const orderReference = 'order-456';
+
+            const result = service.buildWebhookResponse(orderReference, 'decline');
+
+            assert.strictEqual(result.orderReference, orderReference);
+            assert.strictEqual(result.status, 'decline');
+        });
+
+        it('should generate unique timestamps', async () => {
+            const result1 = service.buildWebhookResponse('order-1', 'accept');
+            await new Promise((resolve) => setTimeout(resolve, 10));
+            const result2 = service.buildWebhookResponse('order-2', 'accept');
+
+            // Timestamps should be different (or very close but result in different signatures)
+            assert.ok(result2.time >= result1.time);
+        });
+
+        it('should generate valid signature for response', () => {
+            const orderReference = 'order-123';
+            const status = 'accept';
+
+            const result = service.buildWebhookResponse(orderReference, status);
+
+            // Manually verify the signature
+            const signatureData = [orderReference, status, result.time];
+            const signatureString = signatureData.join(';');
+            const expectedSignature = crypto.createHmac('md5', merchantSecretKey).update(signatureString).digest('hex');
+
+            assert.strictEqual(result.signature, expectedSignature);
+        });
+    });
+
+    describe('generateSubscriptionPaymentUrl', () => {
+        it('should call the API with correct parameters', async () => {
+            // This method relies on external API (generateRegularPurchase from wayforpay-api)
+            // Full integration testing would require mocking the external module
+            // Here we test that the method exists and handles errors gracefully
+
+            const params = {
+                userId: 'user-123',
+                platform: 'telegram',
+                planId: 'plan-monthly',
+                productName: 'Monthly Subscription',
+                productPrice: 100,
+                currency: 'UAH' as const,
+                regularCount: 3,
+                regularMode: 'monthly' as const,
+                language: 'UA' as const,
+            };
+
+            // Note: This will likely fail because it calls the actual API
+            // In a real test environment, we would mock the wayforpay-api module
+            try {
+                const result = await service.generateSubscriptionPaymentUrl(params);
+                // If API is available, verify structure
+                if (result) {
+                    assert.ok(typeof result.url === 'string');
+                    assert.ok(typeof result.orderReference === 'string');
+                }
+            } catch {
+                // Expected to fail without proper API credentials
+            }
+        });
+
+        it('should return null on API error', async () => {
+            // The method should return null and log error when API fails
+            const params = {
+                userId: 'user-123',
+                platform: 'telegram',
+                planId: 'plan-monthly',
+                productName: 'Monthly Subscription',
+                productPrice: 100,
+                currency: 'UAH' as const,
+            };
+
+            // Create service with invalid credentials to trigger error
+            const invalidService = new WayForPayService({
+                logger,
+                merchantAccount: '',
+                merchantSecretKey: '',
+                merchantDomainName: '',
+            });
+
+            const result = await invalidService.generateSubscriptionPaymentUrl(params);
+
+            // Should return null on error (API would fail)
+            assert.strictEqual(result, null);
+        });
+    });
+
+    describe('generateOneTimePaymentUrl', () => {
+        it('should call the API with correct parameters', async () => {
+            const params = {
+                userId: 'user-123',
+                platform: 'telegram',
+                productId: 'token-pack-small',
+                productName: 'Token Pack - 10000 tokens',
+                productPrice: 49,
+                currency: 'UAH' as const,
+                language: 'UA' as const,
+                returnUrl: 'https://example.com/return',
+            };
+
+            // Note: This will likely fail because it calls the actual API
+            try {
+                const result = await service.generateOneTimePaymentUrl(params);
+                if (result) {
+                    assert.ok(typeof result.url === 'string');
+                    assert.ok(typeof result.orderReference === 'string');
+                }
+            } catch {
+                // Expected to fail without proper API credentials
+            }
+        });
+
+        it('should return null on API error', async () => {
+            const params = {
+                userId: 'user-123',
+                platform: 'telegram',
+                productId: 'token-pack-small',
+                productName: 'Token Pack',
+                productPrice: 49,
+                currency: 'UAH' as const,
+            };
+
+            // Create service with invalid credentials to trigger error
+            const invalidService = new WayForPayService({
+                logger,
+                merchantAccount: '',
+                merchantSecretKey: '',
+                merchantDomainName: '',
+            });
+
+            const result = await invalidService.generateOneTimePaymentUrl(params);
+
+            // Should return null on error
+            assert.strictEqual(result, null);
+        });
+    });
+
+    describe('signature calculation', () => {
+        it('should handle special characters in signature data', () => {
+            const callbackData = createMockCallbackData(
+                {
+                    orderReference: 'order-with-special-chars-&-symbols',
+                },
+                merchantSecretKey,
+            );
+
+            const result = service.verifyCallbackSignature(callbackData);
+
+            assert.strictEqual(result.isValid, true);
+        });
+
+        it('should handle numeric reasonCode', () => {
+            const callbackData = createMockCallbackData(
+                {
+                    reasonCode: '1100' as any,
+                },
+                merchantSecretKey,
+            );
+
+            const result = service.verifyCallbackSignature(callbackData);
+
+            assert.strictEqual(result.isValid, true);
+        });
+
+        it('should handle string reasonCode', () => {
+            const callbackData = createMockCallbackData(
+                {
+                    reasonCode: '1100' as any,
+                },
+                merchantSecretKey,
+            );
+
+            // Recalculate signature with string reasonCode
+            const signatureData = [
+                callbackData.merchantAccount,
+                callbackData.orderReference,
+                callbackData.amount,
+                callbackData.currency,
+                callbackData.authCode,
+                callbackData.cardPan,
+                callbackData.transactionStatus,
+                '1100',
+            ];
+            const signatureString = signatureData.join(';');
+            callbackData.merchantSignature = crypto.createHmac('md5', merchantSecretKey).update(signatureString).digest('hex');
+
+            const result = service.verifyCallbackSignature(callbackData);
+
+            assert.strictEqual(result.isValid, true);
+        });
+    });
+});

package/src/modules/payments/wayforpay.service.ts

@@ -0,0 +1,284 @@
+import crypto from 'crypto';
+import moment from 'moment';
+import { generateRegularPurchase, generatePurchase, Currency, Language } from '@misterhomer1992/wayforpay-api';
+import { Logger } from '../logger/types';
+import { isObject, isBadOrEmptyString } from '../../utils';
+import { createSubscriptionOrderReference } from './utils';
+import type {
+    IWayForPayService,
+    GenerateSubscriptionPaymentParams,
+    GenerateOneTimePaymentParams,
+    PaymentUrlResult,
+    SignatureVerificationResult,
+    WayForPayCallbackData,
+    WayForPayWebhookResponse,
+} from './wayforpay.types';
+
+const SIGNATURE_DELIMITER = ';';
+
+interface WayforpayResponse {
+    url?: string;
+    [key: string]: unknown;
+}
+
+/**
+ * WayForPayService provides integration with the WayForPay payment provider.
+ * Supports both subscription (regular) and one-time payment flows.
+ */
+export class WayForPayService implements IWayForPayService {
+    private readonly logger: Logger;
+    private readonly merchantAccount: string;
+    private readonly merchantSecretKey: string;
+    private readonly merchantDomainName: string;
+    private readonly serviceUrl?: string;
+
+    constructor({
+        logger,
+        merchantAccount,
+        merchantSecretKey,
+        merchantDomainName,
+        serviceUrl,
+    }: {
+        logger: Logger;
+        merchantAccount?: string;
+        merchantSecretKey?: string;
+        merchantDomainName?: string;
+        serviceUrl?: string;
+    }) {
+        this.logger = logger;
+        this.merchantAccount = merchantAccount || (process.env.WAYFORPAY_MERCHANT_ACCOUNT as string);
+        this.merchantSecretKey = merchantSecretKey || (process.env.WAYFORPAY_MERCHANT_SECRET_KEY as string);
+        this.merchantDomainName = merchantDomainName || (process.env.WAYFORPAY_MERCHANT_DOMAIN as string);
+        this.serviceUrl = serviceUrl || process.env.WAYFORPAY_SERVICE_URL;
+    }
+
+    /**
+     * Generates a payment URL for subscription (regular) payments.
+     */
+    public async generateSubscriptionPaymentUrl(
+        params: GenerateSubscriptionPaymentParams,
+    ): Promise<PaymentUrlResult | null> {
+        const {
+            userId,
+            platform,
+            planId,
+            productName,
+            productPrice,
+            currency,
+            regularCount = 3,
+            regularMode = 'daily',
+            language = 'UA',
+            dateNext,
+        } = params;
+
+        try {
+            const orderDate = Date.now();
+            const formattedUtc = moment.utc().toISOString();
+            const orderReference = createSubscriptionOrderReference({
+                userId,
+                platform,
+                planId,
+                utcDate: formattedUtc,
+            });
+
+            const response = (await generateRegularPurchase({
+                merchantAccount: this.merchantAccount,
+                merchantDomainName: this.merchantDomainName,
+                merchantSecretKey: this.merchantSecretKey,
+                orderDate,
+                orderReference,
+                productName: [productName],
+                productPrice: [productPrice],
+                currency: currency as Currency,
+                language: language as Language,
+                serviceUrl: this.serviceUrl,
+                regularMode,
+                regularCount,
+                dateNext,
+            })) as WayforpayResponse;
+
+            if (!isObject(response) || isBadOrEmptyString(response.url)) {
+                this.logger.error({
+                    message: 'Invalid response from WayForPay generateRegularPurchase',
+                    payload: {
+                        orderReference,
+                        response: JSON.stringify(response),
+                    },
+                });
+                return null;
+            }
+
+            return {
+                url: response.url,
+                orderReference,
+            };
+        } catch (error) {
+            this.logger.error({
+                message: 'Error in WayForPayService generateSubscriptionPaymentUrl',
+                payload: {
+                    userId,
+                    platform,
+                    planId,
+                    productName,
+                    productPrice,
+                    currency,
+                    error: JSON.stringify(error),
+                },
+            });
+            return null;
+        }
+    }
+
+    /**
+     * Generates a payment URL for one-time payments.
+     */
+    public async generateOneTimePaymentUrl(params: GenerateOneTimePaymentParams): Promise<PaymentUrlResult | null> {
+        const { userId, platform, productId, productName, productPrice, currency, language = 'UA', returnUrl } = params;
+
+        try {
+            const orderDate = Date.now();
+            const formattedUtc = moment.utc().toISOString();
+            const orderReference = createSubscriptionOrderReference({
+                userId,
+                platform,
+                planId: productId,
+                utcDate: formattedUtc,
+            });
+
+            const response = (await generatePurchase({
+                merchantAccount: this.merchantAccount,
+                merchantDomainName: this.merchantDomainName,
+                merchantSecretKey: this.merchantSecretKey,
+                orderDate,
+                orderReference,
+                productName: [productName],
+                productPrice: [productPrice],
+                currency: currency as Currency,
+                language: language as Language,
+                serviceUrl: this.serviceUrl,
+                returnUrl,
+            })) as WayforpayResponse;
+
+            if (!isObject(response) || isBadOrEmptyString(response.url)) {
+                this.logger.error({
+                    message: 'Invalid response from WayForPay generatePurchase',
+                    payload: {
+                        orderReference,
+                        response: JSON.stringify(response),
+                    },
+                });
+                return null;
+            }
+
+            return {
+                url: response.url,
+                orderReference,
+            };
+        } catch (error) {
+            this.logger.error({
+                message: 'Error in WayForPayService generateOneTimePaymentUrl',
+                payload: {
+                    userId,
+                    platform,
+                    productId,
+                    productName,
+                    productPrice,
+                    currency,
+                    error: JSON.stringify(error),
+                },
+            });
+            return null;
+        }
+    }
+
+    /**
+     * Verifies the signature of a WayForPay webhook callback.
+     * The signature is calculated as HMAC_MD5 of concatenated values.
+     */
+    public verifyCallbackSignature(callbackData: WayForPayCallbackData): SignatureVerificationResult {
+        try {
+            const {
+                merchantAccount,
+                orderReference,
+                amount,
+                currency,
+                authCode,
+                cardPan,
+                transactionStatus,
+                reasonCode,
+                merchantSignature,
+            } = callbackData;
+
+            if (!merchantSignature) {
+                return {
+                    isValid: false,
+                    error: 'Missing merchant signature in callback data',
+                };
+            }
+
+            // WayForPay signature is calculated from these fields in this exact order
+            const signatureData = [
+                merchantAccount,
+                orderReference,
+                amount,
+                currency,
+                authCode,
+                cardPan,
+                transactionStatus,
+                reasonCode,
+            ];
+
+            const signatureString = signatureData.join(SIGNATURE_DELIMITER);
+            const calculatedSignature = crypto
+                .createHmac('md5', this.merchantSecretKey)
+                .update(signatureString)
+                .digest('hex');
+
+            const isValid = calculatedSignature.toLowerCase() === merchantSignature.toLowerCase();
+
+            if (!isValid) {
+                this.logger.warning({
+                    message: 'WayForPay signature verification failed',
+                    payload: {
+                        orderReference,
+                        expectedSignature: calculatedSignature,
+                        receivedSignature: merchantSignature,
+                    },
+                });
+            }
+
+            return { isValid };
+        } catch (error) {
+            this.logger.error({
+                message: 'Error in WayForPayService verifyCallbackSignature',
+                payload: {
+                    orderReference: callbackData?.orderReference,
+                    error: JSON.stringify(error),
+                },
+            });
+            return {
+                isValid: false,
+                error: 'Error verifying signature',
+            };
+        }
+    }
+
+    /**
+     * Builds a response to send back to WayForPay after processing a webhook.
+     * WayForPay expects a signed response to confirm receipt.
+     */
+    public buildWebhookResponse(orderReference: string, status: 'accept' | 'decline'): WayForPayWebhookResponse {
+        const time = Date.now();
+
+        const signatureData = [orderReference, status, time];
+        const signatureString = signatureData.join(SIGNATURE_DELIMITER);
+        const signature = crypto.createHmac('md5', this.merchantSecretKey).update(signatureString).digest('hex');
+
+        return {
+            orderReference,
+            status,
+            time,
+            signature,
+        };
+    }
+}