@paykit-sdk/redsys 1.2.0 → 1.3.0

package/dist/index.js

@@ -22,6 +22,12 @@ var CURRENCY_MAP = {
   GBP: 826,
   JPY: 392
 };
+var CURRENCY_NUM_TO_CODE = Object.fromEntries(
+  Object.entries(CURRENCY_MAP).map(([code, num]) => [
+    String(num),
+    code
+  ])
+);
 var RESPONSE_CODES = {
   "0000": "Transaction approved",
   "0101": "Card expired",
@@ -57,7 +63,7 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
   }
   _getRedsysUrl() {
     if (this.opts.redsysUrl) return this.opts.redsysUrl;
-    return this.opts.isSandbox ? "https://sis.redsys.es/sis/realizarPago" : "https://sis-t.REDsys.es:25443/sis/realizarPago";
+    return this.opts.isSandbox ? "https://sis-t.redsys.es:25443/sis/realizarPago" : "https://sis.redsys.es/sis/realizarPago";
   }
   _getCurrencyNum(currency) {
     return CURRENCY_MAP[currency.toUpperCase()] ?? 978;
@@ -85,17 +91,35 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
     return Buffer.from(jsonStr).toString("base64");
   }
   /**
-   * Generate HMAC-SHA256 signature for inSite
-   *
-   * Signature = HMAC-SHA256(secretKey, base64(params) + orderId)
-   * Order is important: base64Params + orderId (both as-is, no separators)
+   * Derive the per-order key required by Redsys HMAC_SHA256_V1:
+   * 3DES-CBC-encrypt the order number (zero-padded to a multiple of
+   * 8 bytes) with the base64-decoded merchant secret and a zero IV.
+   */
+  _deriveOrderKey(orderId) {
+    const key = Buffer.from(this.opts.secretKey, "base64");
+    const iv = Buffer.alloc(8, 0);
+    const cipher = crypto.createCipheriv("des-ede3-cbc", key, iv);
+    cipher.setAutoPadding(false);
+    const padded = Buffer.alloc(Math.ceil(orderId.length / 8) * 8, 0);
+    padded.write(orderId, "utf8");
+    return Buffer.concat([cipher.update(padded), cipher.final()]);
+  }
+  /**
+   * Redsys HMAC_SHA256_V1 signature:
+   * HMAC-SHA256(deriveOrderKey(order), base64Params) as Base64.
    */
   _sign(orderId, base64Params) {
-    const data = base64Params + orderId;
-    return crypto.createHmac(
-      "sha256",
-      Buffer.from(this.opts.secretKey, "base64")
-    ).update(data).digest("base64").replace(/\+/g, "-").replace(/\//g, "/").replace(/=+$/, "");
+    return crypto.createHmac("sha256", this._deriveOrderKey(orderId)).update(base64Params).digest("base64");
+  }
+  /**
+   * Compare signatures in constant time, accepting both standard and
+   * URL-safe Base64 (Redsys uses URL-safe in some channels).
+   */
+  _signatureMatches(received, expected) {
+    const normalize = (s) => Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+    const receivedBuf = normalize(received);
+    const expectedBuf = normalize(expected);
+    return receivedBuf.length === expectedBuf.length && crypto.timingSafeEqual(receivedBuf, expectedBuf);
   }
   /**
    * Create checkout for inSite
@@ -299,9 +323,13 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
     );
   };
   createCustomer = async (params) => {
-    throw new core.ProviderNotSupportedError("createCustomer", "gopay", {
-      reason: "Redsys doesn't support creating customers"
-    });
+    throw new core.ProviderNotSupportedError(
+      "createCustomer",
+      this.providerName,
+      {
+        reason: "Redsys doesn't support creating customers"
+      }
+    );
   };
   retrieveCustomer = async (_id) => {
     return null;
@@ -435,33 +463,38 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
     const dsOrder = params.Ds_Order;
     const dsAmount = params.Ds_Amount;
     const dsMerchantData = params.Ds_MerchantData;
+    const currency = CURRENCY_NUM_TO_CODE[String(params.Ds_Currency ?? "")] ?? "EUR";
     const signature = dataAsObject.Ds_Signature;
     const expectedSig = this._sign(dsOrder, paramsBase64);
-    const sigOk = signature === expectedSig;
-    if (!sigOk) {
+    if (!signature || !this._signatureMatches(signature, expectedSig)) {
       throw new core.WebhookError("Invalid Redsys webhook signature", {
         provider: this.providerName
       });
     }
     const events = [];
+    const amountNum = Number(dsAmount);
     if (dsResponse === "0000" || dsResponse.startsWith("00")) {
-      const customerId = core.parseJSON(
-        Buffer.from(dsMerchantData, "base64").toString("utf-8"),
+      const customerId = dsMerchantData ? core.parseJSON(
+        Buffer.from(String(dsMerchantData), "base64").toString(
+          "utf-8"
+        ),
         core.Schema.object({
           customerId: core.Schema.string().optional()
         })
-      )?.customerId ?? null;
-      const amountNum = Number(dsAmount) / 100;
+      )?.customerId ?? null : null;
       const paymentId = `${dsOrder}_${params.Ds_AuthorisationCode ?? "unknown"}`;
       events.push(
         {
-          event: "redsys.payment.succeeded",
+          id: crypto.randomBytes(8).toString("hex"),
+          type: "redsys.payment.succeeded",
+          created: Math.floor(Date.now() / 1e3),
           data: {
             order_id: dsOrder,
             amount: amountNum,
             response_code: dsResponse,
             customer_id: customerId
-          }
+          },
+          is_raw: true
         },
         core.paykitEvent$InboundSchema({
           type: "payment.succeeded",
@@ -470,7 +503,7 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
           data: {
             id: paymentId,
             amount: amountNum,
-            currency: "EUR",
+            currency,
             customer: customerId ? { id: customerId } : null,
             status: "succeeded",
             metadata: {},
@@ -483,12 +516,15 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
     } else {
       events.push(
         {
-          event: "redsys.payment.failed",
+          id: crypto.randomBytes(8).toString("hex"),
+          type: "redsys.payment.failed",
+          created: Math.floor(Date.now() / 1e3),
           data: {
             order_id: dsOrder,
             response_code: dsResponse,
             error_message: RESPONSE_CODES[dsResponse] ?? `Code ${dsResponse}`
-          }
+          },
+          is_raw: true
         },
         core.paykitEvent$InboundSchema({
           type: "payment.failed",
@@ -496,8 +532,8 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
           id: crypto.randomBytes(8).toString("hex").slice(0, 15),
           data: {
             id: dsOrder,
-            amount: Number(dsAmount) / 100,
-            currency: "EUR",
+            amount: amountNum,
+            currency,
             customer: null,
             status: "failed",
             metadata: {},

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { schema, Schema, AbstractPayKitProvider, HTTPClient, NotImplementedError, createCheckoutSchema, ValidationError, validateRequiredKeys, isIdCustomer, isEmailCustomer, stringifyMetadataValues, PAYKIT_METADATA_KEY, ResourceNotFoundError, createPaymentSchema, OperationFailedError, ProviderNotSupportedError, createRefundSchema, WebhookError, parseJSON, paykitEvent$InboundSchema } from '@paykit-sdk/core';
-import { randomBytes, createHmac } from 'crypto';
+import { randomBytes, createCipheriv, createHmac, timingSafeEqual } from 'crypto';
 
 // src/index.ts
 var RedsysOptionsSchema = schema()(
@@ -20,6 +20,12 @@ var CURRENCY_MAP = {
   GBP: 826,
   JPY: 392
 };
+var CURRENCY_NUM_TO_CODE = Object.fromEntries(
+  Object.entries(CURRENCY_MAP).map(([code, num]) => [
+    String(num),
+    code
+  ])
+);
 var RESPONSE_CODES = {
   "0000": "Transaction approved",
   "0101": "Card expired",
@@ -55,7 +61,7 @@ var RedsysProvider = class extends AbstractPayKitProvider {
   }
   _getRedsysUrl() {
     if (this.opts.redsysUrl) return this.opts.redsysUrl;
-    return this.opts.isSandbox ? "https://sis.redsys.es/sis/realizarPago" : "https://sis-t.REDsys.es:25443/sis/realizarPago";
+    return this.opts.isSandbox ? "https://sis-t.redsys.es:25443/sis/realizarPago" : "https://sis.redsys.es/sis/realizarPago";
   }
   _getCurrencyNum(currency) {
     return CURRENCY_MAP[currency.toUpperCase()] ?? 978;
@@ -83,17 +89,35 @@ var RedsysProvider = class extends AbstractPayKitProvider {
     return Buffer.from(jsonStr).toString("base64");
   }
   /**
-   * Generate HMAC-SHA256 signature for inSite
-   *
-   * Signature = HMAC-SHA256(secretKey, base64(params) + orderId)
-   * Order is important: base64Params + orderId (both as-is, no separators)
+   * Derive the per-order key required by Redsys HMAC_SHA256_V1:
+   * 3DES-CBC-encrypt the order number (zero-padded to a multiple of
+   * 8 bytes) with the base64-decoded merchant secret and a zero IV.
+   */
+  _deriveOrderKey(orderId) {
+    const key = Buffer.from(this.opts.secretKey, "base64");
+    const iv = Buffer.alloc(8, 0);
+    const cipher = createCipheriv("des-ede3-cbc", key, iv);
+    cipher.setAutoPadding(false);
+    const padded = Buffer.alloc(Math.ceil(orderId.length / 8) * 8, 0);
+    padded.write(orderId, "utf8");
+    return Buffer.concat([cipher.update(padded), cipher.final()]);
+  }
+  /**
+   * Redsys HMAC_SHA256_V1 signature:
+   * HMAC-SHA256(deriveOrderKey(order), base64Params) as Base64.
    */
   _sign(orderId, base64Params) {
-    const data = base64Params + orderId;
-    return createHmac(
-      "sha256",
-      Buffer.from(this.opts.secretKey, "base64")
-    ).update(data).digest("base64").replace(/\+/g, "-").replace(/\//g, "/").replace(/=+$/, "");
+    return createHmac("sha256", this._deriveOrderKey(orderId)).update(base64Params).digest("base64");
+  }
+  /**
+   * Compare signatures in constant time, accepting both standard and
+   * URL-safe Base64 (Redsys uses URL-safe in some channels).
+   */
+  _signatureMatches(received, expected) {
+    const normalize = (s) => Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+    const receivedBuf = normalize(received);
+    const expectedBuf = normalize(expected);
+    return receivedBuf.length === expectedBuf.length && timingSafeEqual(receivedBuf, expectedBuf);
   }
   /**
    * Create checkout for inSite
@@ -297,9 +321,13 @@ var RedsysProvider = class extends AbstractPayKitProvider {
     );
   };
   createCustomer = async (params) => {
-    throw new ProviderNotSupportedError("createCustomer", "gopay", {
-      reason: "Redsys doesn't support creating customers"
-    });
+    throw new ProviderNotSupportedError(
+      "createCustomer",
+      this.providerName,
+      {
+        reason: "Redsys doesn't support creating customers"
+      }
+    );
   };
   retrieveCustomer = async (_id) => {
     return null;
@@ -433,33 +461,38 @@ var RedsysProvider = class extends AbstractPayKitProvider {
     const dsOrder = params.Ds_Order;
     const dsAmount = params.Ds_Amount;
     const dsMerchantData = params.Ds_MerchantData;
+    const currency = CURRENCY_NUM_TO_CODE[String(params.Ds_Currency ?? "")] ?? "EUR";
     const signature = dataAsObject.Ds_Signature;
     const expectedSig = this._sign(dsOrder, paramsBase64);
-    const sigOk = signature === expectedSig;
-    if (!sigOk) {
+    if (!signature || !this._signatureMatches(signature, expectedSig)) {
       throw new WebhookError("Invalid Redsys webhook signature", {
         provider: this.providerName
       });
     }
     const events = [];
+    const amountNum = Number(dsAmount);
     if (dsResponse === "0000" || dsResponse.startsWith("00")) {
-      const customerId = parseJSON(
-        Buffer.from(dsMerchantData, "base64").toString("utf-8"),
+      const customerId = dsMerchantData ? parseJSON(
+        Buffer.from(String(dsMerchantData), "base64").toString(
+          "utf-8"
+        ),
         Schema.object({
           customerId: Schema.string().optional()
         })
-      )?.customerId ?? null;
-      const amountNum = Number(dsAmount) / 100;
+      )?.customerId ?? null : null;
       const paymentId = `${dsOrder}_${params.Ds_AuthorisationCode ?? "unknown"}`;
       events.push(
         {
-          event: "redsys.payment.succeeded",
+          id: randomBytes(8).toString("hex"),
+          type: "redsys.payment.succeeded",
+          created: Math.floor(Date.now() / 1e3),
           data: {
             order_id: dsOrder,
             amount: amountNum,
             response_code: dsResponse,
             customer_id: customerId
-          }
+          },
+          is_raw: true
         },
         paykitEvent$InboundSchema({
           type: "payment.succeeded",
@@ -468,7 +501,7 @@ var RedsysProvider = class extends AbstractPayKitProvider {
           data: {
             id: paymentId,
             amount: amountNum,
-            currency: "EUR",
+            currency,
             customer: customerId ? { id: customerId } : null,
             status: "succeeded",
             metadata: {},
@@ -481,12 +514,15 @@ var RedsysProvider = class extends AbstractPayKitProvider {
     } else {
       events.push(
         {
-          event: "redsys.payment.failed",
+          id: randomBytes(8).toString("hex"),
+          type: "redsys.payment.failed",
+          created: Math.floor(Date.now() / 1e3),
           data: {
             order_id: dsOrder,
             response_code: dsResponse,
             error_message: RESPONSE_CODES[dsResponse] ?? `Code ${dsResponse}`
-          }
+          },
+          is_raw: true
         },
         paykitEvent$InboundSchema({
           type: "payment.failed",
@@ -494,8 +530,8 @@ var RedsysProvider = class extends AbstractPayKitProvider {
           id: randomBytes(8).toString("hex").slice(0, 15),
           data: {
             id: dsOrder,
-            amount: Number(dsAmount) / 100,
-            currency: "EUR",
+            amount: amountNum,
+            currency,
             customer: null,
             status: "failed",
             metadata: {},

package/dist/redsys-provider.d.mts

@@ -64,12 +64,21 @@ declare class RedsysProvider extends AbstractPayKitProvider implements PayKitPro
      */
     private _buildMerchantParams;
     /**
-     * Generate HMAC-SHA256 signature for inSite
-     *
-     * Signature = HMAC-SHA256(secretKey, base64(params) + orderId)
-     * Order is important: base64Params + orderId (both as-is, no separators)
+     * Derive the per-order key required by Redsys HMAC_SHA256_V1:
+     * 3DES-CBC-encrypt the order number (zero-padded to a multiple of
+     * 8 bytes) with the base64-decoded merchant secret and a zero IV.
+     */
+    private _deriveOrderKey;
+    /**
+     * Redsys HMAC_SHA256_V1 signature:
+     * HMAC-SHA256(deriveOrderKey(order), base64Params) as Base64.
      */
     private _sign;
+    /**
+     * Compare signatures in constant time, accepting both standard and
+     * URL-safe Base64 (Redsys uses URL-safe in some channels).
+     */
+    private _signatureMatches;
     /**
      * Create checkout for inSite
      *

package/dist/redsys-provider.d.ts

@@ -64,12 +64,21 @@ declare class RedsysProvider extends AbstractPayKitProvider implements PayKitPro
      */
     private _buildMerchantParams;
     /**
-     * Generate HMAC-SHA256 signature for inSite
-     *
-     * Signature = HMAC-SHA256(secretKey, base64(params) + orderId)
-     * Order is important: base64Params + orderId (both as-is, no separators)
+     * Derive the per-order key required by Redsys HMAC_SHA256_V1:
+     * 3DES-CBC-encrypt the order number (zero-padded to a multiple of
+     * 8 bytes) with the base64-decoded merchant secret and a zero IV.
+     */
+    private _deriveOrderKey;
+    /**
+     * Redsys HMAC_SHA256_V1 signature:
+     * HMAC-SHA256(deriveOrderKey(order), base64Params) as Base64.
      */
     private _sign;
+    /**
+     * Compare signatures in constant time, accepting both standard and
+     * URL-safe Base64 (Redsys uses URL-safe in some channels).
+     */
+    private _signatureMatches;
     /**
      * Create checkout for inSite
      *

package/dist/redsys-provider.js

@@ -22,6 +22,12 @@ var CURRENCY_MAP = {
   GBP: 826,
   JPY: 392
 };
+var CURRENCY_NUM_TO_CODE = Object.fromEntries(
+  Object.entries(CURRENCY_MAP).map(([code, num]) => [
+    String(num),
+    code
+  ])
+);
 var RESPONSE_CODES = {
   "0000": "Transaction approved",
   "0101": "Card expired",
@@ -57,7 +63,7 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
   }
   _getRedsysUrl() {
     if (this.opts.redsysUrl) return this.opts.redsysUrl;
-    return this.opts.isSandbox ? "https://sis.redsys.es/sis/realizarPago" : "https://sis-t.REDsys.es:25443/sis/realizarPago";
+    return this.opts.isSandbox ? "https://sis-t.redsys.es:25443/sis/realizarPago" : "https://sis.redsys.es/sis/realizarPago";
   }
   _getCurrencyNum(currency) {
     return CURRENCY_MAP[currency.toUpperCase()] ?? 978;
@@ -85,17 +91,35 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
     return Buffer.from(jsonStr).toString("base64");
   }
   /**
-   * Generate HMAC-SHA256 signature for inSite
-   *
-   * Signature = HMAC-SHA256(secretKey, base64(params) + orderId)
-   * Order is important: base64Params + orderId (both as-is, no separators)
+   * Derive the per-order key required by Redsys HMAC_SHA256_V1:
+   * 3DES-CBC-encrypt the order number (zero-padded to a multiple of
+   * 8 bytes) with the base64-decoded merchant secret and a zero IV.
+   */
+  _deriveOrderKey(orderId) {
+    const key = Buffer.from(this.opts.secretKey, "base64");
+    const iv = Buffer.alloc(8, 0);
+    const cipher = crypto.createCipheriv("des-ede3-cbc", key, iv);
+    cipher.setAutoPadding(false);
+    const padded = Buffer.alloc(Math.ceil(orderId.length / 8) * 8, 0);
+    padded.write(orderId, "utf8");
+    return Buffer.concat([cipher.update(padded), cipher.final()]);
+  }
+  /**
+   * Redsys HMAC_SHA256_V1 signature:
+   * HMAC-SHA256(deriveOrderKey(order), base64Params) as Base64.
    */
   _sign(orderId, base64Params) {
-    const data = base64Params + orderId;
-    return crypto.createHmac(
-      "sha256",
-      Buffer.from(this.opts.secretKey, "base64")
-    ).update(data).digest("base64").replace(/\+/g, "-").replace(/\//g, "/").replace(/=+$/, "");
+    return crypto.createHmac("sha256", this._deriveOrderKey(orderId)).update(base64Params).digest("base64");
+  }
+  /**
+   * Compare signatures in constant time, accepting both standard and
+   * URL-safe Base64 (Redsys uses URL-safe in some channels).
+   */
+  _signatureMatches(received, expected) {
+    const normalize = (s) => Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+    const receivedBuf = normalize(received);
+    const expectedBuf = normalize(expected);
+    return receivedBuf.length === expectedBuf.length && crypto.timingSafeEqual(receivedBuf, expectedBuf);
   }
   /**
    * Create checkout for inSite
@@ -299,9 +323,13 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
     );
   };
   createCustomer = async (params) => {
-    throw new core.ProviderNotSupportedError("createCustomer", "gopay", {
-      reason: "Redsys doesn't support creating customers"
-    });
+    throw new core.ProviderNotSupportedError(
+      "createCustomer",
+      this.providerName,
+      {
+        reason: "Redsys doesn't support creating customers"
+      }
+    );
   };
   retrieveCustomer = async (_id) => {
     return null;
@@ -435,33 +463,38 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
     const dsOrder = params.Ds_Order;
     const dsAmount = params.Ds_Amount;
     const dsMerchantData = params.Ds_MerchantData;
+    const currency = CURRENCY_NUM_TO_CODE[String(params.Ds_Currency ?? "")] ?? "EUR";
     const signature = dataAsObject.Ds_Signature;
     const expectedSig = this._sign(dsOrder, paramsBase64);
-    const sigOk = signature === expectedSig;
-    if (!sigOk) {
+    if (!signature || !this._signatureMatches(signature, expectedSig)) {
       throw new core.WebhookError("Invalid Redsys webhook signature", {
         provider: this.providerName
       });
     }
     const events = [];
+    const amountNum = Number(dsAmount);
     if (dsResponse === "0000" || dsResponse.startsWith("00")) {
-      const customerId = core.parseJSON(
-        Buffer.from(dsMerchantData, "base64").toString("utf-8"),
+      const customerId = dsMerchantData ? core.parseJSON(
+        Buffer.from(String(dsMerchantData), "base64").toString(
+          "utf-8"
+        ),
         core.Schema.object({
           customerId: core.Schema.string().optional()
         })
-      )?.customerId ?? null;
-      const amountNum = Number(dsAmount) / 100;
+      )?.customerId ?? null : null;
       const paymentId = `${dsOrder}_${params.Ds_AuthorisationCode ?? "unknown"}`;
       events.push(
         {
-          event: "redsys.payment.succeeded",
+          id: crypto.randomBytes(8).toString("hex"),
+          type: "redsys.payment.succeeded",
+          created: Math.floor(Date.now() / 1e3),
           data: {
             order_id: dsOrder,
             amount: amountNum,
             response_code: dsResponse,
             customer_id: customerId
-          }
+          },
+          is_raw: true
         },
         core.paykitEvent$InboundSchema({
           type: "payment.succeeded",
@@ -470,7 +503,7 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
           data: {
             id: paymentId,
             amount: amountNum,
-            currency: "EUR",
+            currency,
             customer: customerId ? { id: customerId } : null,
             status: "succeeded",
             metadata: {},
@@ -483,12 +516,15 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
     } else {
       events.push(
         {
-          event: "redsys.payment.failed",
+          id: crypto.randomBytes(8).toString("hex"),
+          type: "redsys.payment.failed",
+          created: Math.floor(Date.now() / 1e3),
           data: {
             order_id: dsOrder,
             response_code: dsResponse,
             error_message: RESPONSE_CODES[dsResponse] ?? `Code ${dsResponse}`
-          }
+          },
+          is_raw: true
         },
         core.paykitEvent$InboundSchema({
           type: "payment.failed",
@@ -496,8 +532,8 @@ var RedsysProvider = class extends core.AbstractPayKitProvider {
           id: crypto.randomBytes(8).toString("hex").slice(0, 15),
           data: {
             id: dsOrder,
-            amount: Number(dsAmount) / 100,
-            currency: "EUR",
+            amount: amountNum,
+            currency,
             customer: null,
             status: "failed",
             metadata: {},

package/dist/redsys-provider.mjs

@@ -1,5 +1,5 @@
 import { schema, Schema, AbstractPayKitProvider, HTTPClient, NotImplementedError, createCheckoutSchema, ValidationError, validateRequiredKeys, isIdCustomer, isEmailCustomer, stringifyMetadataValues, PAYKIT_METADATA_KEY, ResourceNotFoundError, createPaymentSchema, OperationFailedError, ProviderNotSupportedError, createRefundSchema, WebhookError, parseJSON, paykitEvent$InboundSchema } from '@paykit-sdk/core';
-import { randomBytes, createHmac } from 'crypto';
+import { randomBytes, createCipheriv, createHmac, timingSafeEqual } from 'crypto';
 
 // src/redsys-provider.ts
 var RedsysOptionsSchema = schema()(
@@ -20,6 +20,12 @@ var CURRENCY_MAP = {
   GBP: 826,
   JPY: 392
 };
+var CURRENCY_NUM_TO_CODE = Object.fromEntries(
+  Object.entries(CURRENCY_MAP).map(([code, num]) => [
+    String(num),
+    code
+  ])
+);
 var RESPONSE_CODES = {
   "0000": "Transaction approved",
   "0101": "Card expired",
@@ -55,7 +61,7 @@ var RedsysProvider = class extends AbstractPayKitProvider {
   }
   _getRedsysUrl() {
     if (this.opts.redsysUrl) return this.opts.redsysUrl;
-    return this.opts.isSandbox ? "https://sis.redsys.es/sis/realizarPago" : "https://sis-t.REDsys.es:25443/sis/realizarPago";
+    return this.opts.isSandbox ? "https://sis-t.redsys.es:25443/sis/realizarPago" : "https://sis.redsys.es/sis/realizarPago";
   }
   _getCurrencyNum(currency) {
     return CURRENCY_MAP[currency.toUpperCase()] ?? 978;
@@ -83,17 +89,35 @@ var RedsysProvider = class extends AbstractPayKitProvider {
     return Buffer.from(jsonStr).toString("base64");
   }
   /**
-   * Generate HMAC-SHA256 signature for inSite
-   *
-   * Signature = HMAC-SHA256(secretKey, base64(params) + orderId)
-   * Order is important: base64Params + orderId (both as-is, no separators)
+   * Derive the per-order key required by Redsys HMAC_SHA256_V1:
+   * 3DES-CBC-encrypt the order number (zero-padded to a multiple of
+   * 8 bytes) with the base64-decoded merchant secret and a zero IV.
+   */
+  _deriveOrderKey(orderId) {
+    const key = Buffer.from(this.opts.secretKey, "base64");
+    const iv = Buffer.alloc(8, 0);
+    const cipher = createCipheriv("des-ede3-cbc", key, iv);
+    cipher.setAutoPadding(false);
+    const padded = Buffer.alloc(Math.ceil(orderId.length / 8) * 8, 0);
+    padded.write(orderId, "utf8");
+    return Buffer.concat([cipher.update(padded), cipher.final()]);
+  }
+  /**
+   * Redsys HMAC_SHA256_V1 signature:
+   * HMAC-SHA256(deriveOrderKey(order), base64Params) as Base64.
    */
   _sign(orderId, base64Params) {
-    const data = base64Params + orderId;
-    return createHmac(
-      "sha256",
-      Buffer.from(this.opts.secretKey, "base64")
-    ).update(data).digest("base64").replace(/\+/g, "-").replace(/\//g, "/").replace(/=+$/, "");
+    return createHmac("sha256", this._deriveOrderKey(orderId)).update(base64Params).digest("base64");
+  }
+  /**
+   * Compare signatures in constant time, accepting both standard and
+   * URL-safe Base64 (Redsys uses URL-safe in some channels).
+   */
+  _signatureMatches(received, expected) {
+    const normalize = (s) => Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+    const receivedBuf = normalize(received);
+    const expectedBuf = normalize(expected);
+    return receivedBuf.length === expectedBuf.length && timingSafeEqual(receivedBuf, expectedBuf);
   }
   /**
    * Create checkout for inSite
@@ -297,9 +321,13 @@ var RedsysProvider = class extends AbstractPayKitProvider {
     );
   };
   createCustomer = async (params) => {
-    throw new ProviderNotSupportedError("createCustomer", "gopay", {
-      reason: "Redsys doesn't support creating customers"
-    });
+    throw new ProviderNotSupportedError(
+      "createCustomer",
+      this.providerName,
+      {
+        reason: "Redsys doesn't support creating customers"
+      }
+    );
   };
   retrieveCustomer = async (_id) => {
     return null;
@@ -433,33 +461,38 @@ var RedsysProvider = class extends AbstractPayKitProvider {
     const dsOrder = params.Ds_Order;
     const dsAmount = params.Ds_Amount;
     const dsMerchantData = params.Ds_MerchantData;
+    const currency = CURRENCY_NUM_TO_CODE[String(params.Ds_Currency ?? "")] ?? "EUR";
     const signature = dataAsObject.Ds_Signature;
     const expectedSig = this._sign(dsOrder, paramsBase64);
-    const sigOk = signature === expectedSig;
-    if (!sigOk) {
+    if (!signature || !this._signatureMatches(signature, expectedSig)) {
       throw new WebhookError("Invalid Redsys webhook signature", {
         provider: this.providerName
       });
     }
     const events = [];
+    const amountNum = Number(dsAmount);
     if (dsResponse === "0000" || dsResponse.startsWith("00")) {
-      const customerId = parseJSON(
-        Buffer.from(dsMerchantData, "base64").toString("utf-8"),
+      const customerId = dsMerchantData ? parseJSON(
+        Buffer.from(String(dsMerchantData), "base64").toString(
+          "utf-8"
+        ),
         Schema.object({
           customerId: Schema.string().optional()
         })
-      )?.customerId ?? null;
-      const amountNum = Number(dsAmount) / 100;
+      )?.customerId ?? null : null;
       const paymentId = `${dsOrder}_${params.Ds_AuthorisationCode ?? "unknown"}`;
       events.push(
         {
-          event: "redsys.payment.succeeded",
+          id: randomBytes(8).toString("hex"),
+          type: "redsys.payment.succeeded",
+          created: Math.floor(Date.now() / 1e3),
           data: {
             order_id: dsOrder,
             amount: amountNum,
             response_code: dsResponse,
             customer_id: customerId
-          }
+          },
+          is_raw: true
         },
         paykitEvent$InboundSchema({
           type: "payment.succeeded",
@@ -468,7 +501,7 @@ var RedsysProvider = class extends AbstractPayKitProvider {
           data: {
             id: paymentId,
             amount: amountNum,
-            currency: "EUR",
+            currency,
             customer: customerId ? { id: customerId } : null,
             status: "succeeded",
             metadata: {},
@@ -481,12 +514,15 @@ var RedsysProvider = class extends AbstractPayKitProvider {
     } else {
       events.push(
         {
-          event: "redsys.payment.failed",
+          id: randomBytes(8).toString("hex"),
+          type: "redsys.payment.failed",
+          created: Math.floor(Date.now() / 1e3),
           data: {
             order_id: dsOrder,
             response_code: dsResponse,
             error_message: RESPONSE_CODES[dsResponse] ?? `Code ${dsResponse}`
-          }
+          },
+          is_raw: true
         },
         paykitEvent$InboundSchema({
           type: "payment.failed",
@@ -494,8 +530,8 @@ var RedsysProvider = class extends AbstractPayKitProvider {
           id: randomBytes(8).toString("hex").slice(0, 15),
           data: {
             id: dsOrder,
-            amount: Number(dsAmount) / 100,
-            currency: "EUR",
+            amount: amountNum,
+            currency,
             customer: null,
             status: "failed",
             metadata: {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paykit-sdk/redsys",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Redsys inSite provider for PayKit",
   "main": "dist/index.js",
   "module": "dist/index.esm.js",
@@ -8,9 +8,6 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "tsup"
-  },
   "paykit": {
     "type": "provider"
   },
@@ -27,12 +24,12 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@paykit-sdk/core": ">=1.2.0"
+    "@paykit-sdk/core": "^1.2.3"
   },
   "devDependencies": {
-    "@paykit-sdk/core": "workspace:*",
     "tsup": "^8.5.0",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.2",
+    "@paykit-sdk/core": "1.3.0"
   },
   "publishConfig": {
     "access": "public"
@@ -43,5 +40,10 @@
   },
   "bugs": {
     "url": "https://github.com/usepaykit/paykit-sdk/issues"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run --config ../../vitest.config.ts packages/redsys/src",
+    "typecheck": "tsc --noEmit"
   }
-}
+}