@myzonerocks/pact 0.1.7 → 0.1.8

package/dist/src/adapters/mpesa.js

@@ -153,12 +153,12 @@ export class MpesaLeg {
                 },
             ];
         }
-        // The amount Daraja collected must equal the amount we authorized; a partial
-        // or tampered collection settles nothing.
-        const paid = metadataInt(cb.CallbackMetadata?.Item ?? [], "Amount");
-        if (paid !== rec.amount) {
-            throw new Error(`mpesa: confirmed amount ${paid} does not match the authorized ${rec.amount}`);
-        }
+        // The STK push fixed the amount we authorized; a payer approves that exact amount
+        // or cancels, so an approved collection is always the full authorized amount. The
+        // authenticated query above confirms success, so the settled amount is the one we
+        // recorded — it is never read from the unsigned callback, since a forged callback
+        // (the checkout id is not a secret) could otherwise carry a wrong amount and block
+        // a collection the payer completed. The receipt is an audit reference only.
         const receipt = metadataString(cb.CallbackMetadata?.Item ?? [], "MpesaReceiptNumber");
         return [
             {
@@ -185,19 +185,6 @@ function wholeShillings(m) {
     }
     return Number(amount);
 }
-// metadataInt pulls a named numeric value out of the callback metadata items,
-// used to read the paid Amount. M-Pesa amounts are whole shillings but may arrive
-// as a number with a fractional part, so it is floored to the shilling.
-function metadataInt(items, name) {
-    for (const item of items) {
-        if (item.Name !== name) {
-            continue;
-        }
-        const n = Number(item.Value);
-        return Number.isFinite(n) ? Math.floor(n) : 0;
-    }
-    return 0;
-}
 // metadataString pulls a named string value out of the callback metadata items.
 function metadataString(items, name) {
     for (const item of items) {

package/dist/test/mpesa.test.js

@@ -201,13 +201,17 @@ describe("mpesa pay-in", () => {
         const events = await leg.parseWebhook(successCallback(collected.providerRef, "FORGEDRCPT"), {});
         expect(events).toHaveLength(0);
     });
-    it("settles nothing when the callback amount differs from the authorized quote", async () => {
+    it("a forged callback amount cannot block a confirmed collection", async () => {
         const api = new FakeDaraja(counter("tx"));
         const leg = buildLeg(api);
         const q = quote({ srcAmount: kes("5000"), fees: kes("0") });
         const collected = await leg.collect("intent-1", q, emptyAuth, "0711000111");
-        // Daraja confirms success, but the callback body claims only 1500 was paid.
+        // Daraja's authenticated query confirms success; the callback body claims a
+        // different (forged) amount, which must be ignored — the collection still settles.
         api.queryResults.set(collected.providerRef, { resultCode: 0, resultDesc: "", pending: false });
-        await expect(leg.parseWebhook(successCallback(collected.providerRef, "QGR7XYZ123"), {})).rejects.toThrow();
+        const events = await leg.parseWebhook(successCallback(collected.providerRef, "QGR7XYZ123"), {});
+        expect(events).toHaveLength(1);
+        expect(events[0].state).toBe(State.Settled);
+        expect(events[0].providerTxRef).toBe("QGR7XYZ123");
     });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myzonerocks/pact",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "TypeScript SDK for the PACT payment abstraction protocol",
   "license": "Apache-2.0",
   "repository": {

package/src/adapters/mpesa.ts

@@ -270,13 +270,12 @@ export class MpesaLeg implements PayInLeg, PayOutLeg {
         },
       ];
     }
-    // The amount Daraja collected must equal the amount we authorized; a partial
-    // or tampered collection settles nothing.
-    const paid = metadataInt(cb.CallbackMetadata?.Item ?? [], "Amount");
-    if (paid !== rec.amount) {
-      throw new Error(`mpesa: confirmed amount ${paid} does not match the authorized ${rec.amount}`);
-    }
-
+    // The STK push fixed the amount we authorized; a payer approves that exact amount
+    // or cancels, so an approved collection is always the full authorized amount. The
+    // authenticated query above confirms success, so the settled amount is the one we
+    // recorded — it is never read from the unsigned callback, since a forged callback
+    // (the checkout id is not a secret) could otherwise carry a wrong amount and block
+    // a collection the payer completed. The receipt is an audit reference only.
     const receipt = metadataString(cb.CallbackMetadata?.Item ?? [], "MpesaReceiptNumber");
     return [
       {
@@ -321,20 +320,6 @@ function wholeShillings(m: Money): number {
   return Number(amount);
 }
 
-// metadataInt pulls a named numeric value out of the callback metadata items,
-// used to read the paid Amount. M-Pesa amounts are whole shillings but may arrive
-// as a number with a fractional part, so it is floored to the shilling.
-function metadataInt(items: StkCallbackItem[], name: string): number {
-  for (const item of items) {
-    if (item.Name !== name) {
-      continue;
-    }
-    const n = Number(item.Value);
-    return Number.isFinite(n) ? Math.floor(n) : 0;
-  }
-  return 0;
-}
-
 // metadataString pulls a named string value out of the callback metadata items.
 function metadataString(items: StkCallbackItem[], name: string): string {
   for (const item of items) {