@opengis/pay 1.1.10 → 1.1.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengis/pay",
-  "version": "1.1.10",
+  "version": "1.1.12",
   "type": "module",
   "description": "pay plugins for billing",
   "main": "plugin.js",
@@ -21,7 +21,6 @@
   },
   "dependencies": {
     "@opengis/admin": "^0.2.14",
-    "@opengis/fastify-auth": "^1.0.53",
     "@opengis/fastify-table": "^1.1.96",
     "cross-env": "^7.0.3",
     "fastify": "^4.26.1",
@@ -29,6 +28,8 @@
     "request-promise": "^4.2.6"
   },
   "devDependencies": {
+    "@opengis/fastify-auth": "^1.0.57",
+    "@panzoom/panzoom": "^4.5.1",
     "@vue/eslint-config-prettier": "^9.0.0",
     "@vue/eslint-config-typescript": "^12.0.0",
     "eslint": "^8.49.0",
@@ -43,9 +44,8 @@
     "vitepress-plugin-mermaid": "^2.0.16",
     "vitepress-plugin-tabs": "^0.5.0",
     "vitepress-sidebar": "^1.22.0",
-    "vue": "^3.4.21",
-    "@panzoom/panzoom": "^4.5.1"
+    "vue": "^3.4.21"
   },
   "author": "Softpro",
   "license": "ISC"
-}
+}

package/plugin.js

@@ -22,6 +22,9 @@ async function plugin(app) {
   app.route({
     method: 'POST',
     url: `${prefix}/portmone/:id/:status`,
+    config: {
+      policy: ['public'],
+    },
     handler: portmoneStatus,
   });
 

package/server/routes/portmone.redirect.js

@@ -26,7 +26,7 @@ export default async function PortmoneRedirect(req, reply) {
   } = req;
 
   const { host, payeeId } = config.integrations?.pay || {};
-  const domain = `${req.hostname.split(':').shift()}`;
+  const domain = req.hostname.split(':').shift();
 
   if (!host) {
     return { message: 'empty integration host', status: 400 };
@@ -56,11 +56,11 @@ export default async function PortmoneRedirect(req, reply) {
     return { message: 'account_id is required', status: 400 };
   }
 
-  if ((!headers?.referer || !headers.referer.includes(domain)) && !config.auth?.disableRestricted) {
+  if ((!headers?.referer || !headers.referer.includes(domain))) {
     logger.file('payments/warn', {
       message: 'invalid referer', domain, referer: headers?.referer, uid: user?.uid,
     });
-    return { message: 'access restricted', status: 403 };
+    if (!config.auth?.disableRestricted) return { message: 'access restricted: referer', status: 403 };
   }
 
   const { payment_id: paymentId } = data.payment_id
@@ -88,13 +88,15 @@ export default async function PortmoneRedirect(req, reply) {
     return { message: 'payment not found', status: 404 };
   }
 
+  const protocol = headers?.referer.split('://').shift();
+
   const formData = {
     payee_id: payeeId,
     description: `Послуга - поповнення рахунку на суму ${paymentAmount} грн`,
     shop_order_number: paymentId,
     bill_amount: paymentAmount,
-    success_url: `${domain}${config?.prefix || '/api'}/portmone/${paymentId}/success`,
-    failure_url: `${domain}${config?.prefix || '/api'}/portmone/${paymentId}/error`,
+    success_url: `${protocol || 'https'}://${domain}${config?.prefix || '/api'}/portmone/${paymentId}/success`,
+    failure_url: `${protocol || 'https'}://${domain}${config?.prefix || '/api'}/portmone/${paymentId}/error`,
     lang: 'ua',
   };
 

package/server/routes/portmone.status.js

@@ -65,7 +65,7 @@ export default async function portmoneStatus(req, reply) {
     const refill = body?.billAmount || refillSum || 0;
 
     // request portmone trx info to recheck request data is valid?
-    if (!config.debug && !origin?.startsWith(host) && !config.auth?.disableRestricted) {
+    if (!origin?.startsWith(host)) {
       logger.file('payments/warn', {
         type: 'status',
         paymentId,
@@ -74,7 +74,7 @@ export default async function portmoneStatus(req, reply) {
         refill,
         message: 'invalid referer',
       });
-      return { message: 'access restricted', status: 403 };
+      if (!config.auth?.disableRestricted) return { message: 'access restricted: host', status: 403 };
     }
 
     logger.file('payments', {