@payware/mcp-server 1.1.0 → 1.2.0

package/src/utils/code-examples/merchant/transactions.js

@@ -158,14 +158,14 @@ def create_jwt_token(request_body=None, use_sandbox=True):
         'typ': 'JWT'
     }
 
-    # Add content MD5 for requests with body
+    # Add content SHA-256 for requests with body
     body_string = None
     if request_body:
         body_string = create_minimized_json(request_body)
-        content_md5 = base64.b64encode(
-            hashlib.md5(body_string.encode('utf-8')).digest()
+        content_sha256 = base64.b64encode(
+            hashlib.sha256(body_string.encode('utf-8')).digest()
         ).decode('utf-8')
-        header['contentMd5'] = content_md5
+        header['contentSha256'] = content_sha256
 
     # Create JWT payload
     payload = {
@@ -179,7 +179,7 @@ def create_jwt_token(request_body=None, use_sandbox=True):
     return token, body_string
 
 def create_minimized_json(data):
-    """Create deterministic minimized JSON for MD5 calculation"""
+    """Create deterministic minimized JSON for SHA-256 calculation"""
     def sort_dict(obj):
         if isinstance(obj, dict):
             return {k: sort_dict(v) for k, v in sorted(obj.items())}
@@ -415,15 +415,15 @@ function createJWTToken(requestBody = null, useSandbox = true) {
     typ: 'JWT'
   };
 
-  // Add content MD5 for requests with body
+  // Add content SHA-256 for requests with body
   let bodyString = null;
   if (requestBody) {
     bodyString = createMinimizedJSON(requestBody);
-    const contentMd5 = crypto
-      .createHash('md5')
+    const contentSha256 = crypto
+      .createHash('sha256')
       .update(bodyString, 'utf8')
       .digest('base64');
-    header.contentMd5 = contentMd5;
+    header.contentSha256 = contentSha256;
   }
 
   // Create JWT payload

package/src/utils/code-examples.js

@@ -2,7 +2,7 @@
  * Generate code examples for different programming languages
  *
  * PAYWARE REQUIREMENT: All examples must demonstrate using the EXACT same
- * compact JSON string for both JWT contentMd5 calculation and HTTP body.
+ * compact JSON string for both JWT contentSha256 calculation and HTTP body.
  *
  * Examples use deterministic serialization to guarantee this consistency.
  */
@@ -41,7 +41,7 @@ with open('private_key.pem', 'r') as f:
 def create_deterministic_json(data):
     """Create consistent compact JSON for payware API
 
-    REQUIREMENT: The exact same string must be used for JWT contentMd5 and HTTP body.
+    REQUIREMENT: The exact same string must be used for JWT contentSha256 and HTTP body.
     SOLUTION: Sort keys to guarantee consistent output across all platforms.
     """
     # Sort keys recursively to ensure deterministic output
@@ -66,11 +66,11 @@ def create_jwt_token(request_body=None):
         'typ': 'JWT'
     }
 
-    # Add content MD5 for POST requests
+    # Add content SHA-256 for POST requests
     if request_body:
         body_string = create_deterministic_json(request_body)
-        content_md5 = base64.b64encode(hashlib.md5(body_string.encode('utf-8')).digest()).decode('utf-8')
-        header['contentMd5'] = content_md5
+        content_sha256 = base64.b64encode(hashlib.sha256(body_string.encode('utf-8')).digest()).decode('utf-8')
+        header['contentSha256'] = content_sha256
 
     # JWT payload
     payload = {
@@ -106,8 +106,8 @@ def create_transaction():
         'Api-Version': '1'
     }
 
-    # CRITICAL: Send the EXACT same string used for JWT contentMd5 calculation
-    # This prevents ERR_INVALID_MD5 authentication errors
+    # CRITICAL: Send the EXACT same string used for JWT contentSha256 calculation
+    # This prevents ERR_INVALID_CONTENT_HASH authentication errors
     response = requests.post(f"{SANDBOX_URL}/transactions", data=deterministic_body, headers=headers)
     return response.json()
 
@@ -161,9 +161,9 @@ def create_jwt_token(request_body=None):
         'typ': 'JWT'
     }
 
-    # Add content MD5 for requests with body
+    # Add content SHA-256 for requests with body
     if request_body:
-        # PAYWARE REQUIREMENT: Same string for JWT MD5 and HTTP body
+        # PAYWARE REQUIREMENT: Same string for JWT SHA-256 and HTTP body
         # SOLUTION: Use deterministic serialization (sorted keys)
         def sort_dict(obj):
             if isinstance(obj, dict):
@@ -175,8 +175,8 @@ def create_jwt_token(request_body=None):
 
         sorted_data = sort_dict(request_body)
         body_string = json.dumps(sorted_data, separators=(',', ':'))
-        content_md5 = base64.b64encode(hashlib.md5(body_string.encode('utf-8')).digest()).decode('utf-8')
-        header['contentMd5'] = content_md5
+        content_sha256 = base64.b64encode(hashlib.sha256(body_string.encode('utf-8')).digest()).decode('utf-8')
+        header['contentSha256'] = content_sha256
 
     # JWT payload
     payload = {
@@ -233,7 +233,7 @@ def create_transaction(jwt_token):
         }
     }
 
-    # PAYWARE REQUIREMENT: Same string for JWT MD5 and HTTP body
+    # PAYWARE REQUIREMENT: Same string for JWT SHA-256 and HTTP body
     # SOLUTION: Use deterministic serialization (sorted keys)
     def sort_dict(obj):
         if isinstance(obj, dict):
@@ -254,7 +254,7 @@ def create_transaction(jwt_token):
 
     return response.json()
 
-# Note: JWT token must include contentMd5 hash for the request body
+# Note: JWT token must include contentSha256 hash for the request body
 # Use the auth_only example to create a proper token with body hash`;
 
     default:
@@ -290,7 +290,7 @@ const SANDBOX_URL = 'https://sandbox.payware.eu/api';
 const PRIVATE_KEY = fs.readFileSync('private_key.pem', 'utf8');
 
 function createDeterministicJSON(data) {
-  // PAYWARE REQUIREMENT: Same compact JSON for JWT MD5 and HTTP body
+  // PAYWARE REQUIREMENT: Same compact JSON for JWT SHA-256 and HTTP body
   // SOLUTION: Sort keys to guarantee consistent output
   function sortObject(obj) {
     if (Array.isArray(obj)) {
@@ -318,12 +318,12 @@ function createJWTToken(requestBody = null) {
     typ: 'JWT'
   };
 
-  // Add content MD5 for POST requests
+  // Add content SHA-256 for POST requests
   let deterministicBody = null;
   if (requestBody) {
     deterministicBody = createDeterministicJSON(requestBody);
-    const contentMd5 = crypto.createHash('md5').update(deterministicBody, 'utf8').digest('base64');
-    header.contentMd5 = contentMd5;
+    const contentSha256 = crypto.createHash('sha256').update(deterministicBody, 'utf8').digest('base64');
+    header.contentSha256 = contentSha256;
   }
 
   // JWT payload
@@ -361,8 +361,8 @@ async function createTransaction() {
   };
 
   try {
-    // CRITICAL: Send the EXACT same string used for JWT contentMd5 calculation
-    // This prevents ERR_INVALID_MD5 authentication errors
+    // CRITICAL: Send the EXACT same string used for JWT contentSha256 calculation
+    // This prevents ERR_INVALID_CONTENT_HASH authentication errors
     const response = await axios.post(\`\${SANDBOX_URL}/transactions\`, deterministicBody, {
       headers,
       // Tell axios to send the string as-is, don't serialize it again
@@ -429,9 +429,9 @@ function createJWTToken(requestBody = null) {
     typ: 'JWT'
   };
 
-  // Add content MD5 for requests with body
+  // Add content SHA-256 for requests with body
   if (requestBody) {
-    // PAYWARE REQUIREMENT: Same string for JWT MD5 and HTTP body
+    // PAYWARE REQUIREMENT: Same string for JWT SHA-256 and HTTP body
     // SOLUTION: Use deterministic serialization (sorted keys)
     function sortObject(obj) {
       if (Array.isArray(obj)) {
@@ -448,8 +448,8 @@ function createJWTToken(requestBody = null) {
 
     const sortedData = sortObject(requestBody);
     const bodyString = JSON.stringify(sortedData);
-    const contentMd5 = crypto.createHash('md5').update(bodyString, 'utf8').digest('base64');
-    header.contentMd5 = contentMd5;
+    const contentSha256 = crypto.createHash('sha256').update(bodyString, 'utf8').digest('base64');
+    header.contentSha256 = contentSha256;
   }
 
   // JWT payload
@@ -617,7 +617,7 @@ ${code}
 - Includes required \`Api-Version: 1\` header
 - Uses proper request body structure with \`trData\` and \`trOptions\`
 - JWT includes \`aud: 'https://payware.eu'\` claim
-- POST requests include \`contentMd5\` hash in JWT header
+- POST requests include \`contentSha256\` hash in JWT header
 - Amount format uses decimal strings (e.g., '10.00')
 - Uses \`reasonL1\`/\`reasonL2\` instead of \`description\`
 

package/src/utils/format-request.js

@@ -241,7 +241,7 @@ ${formatted.request.trData.reasonL2 ? `- Description L2: ${formatted.request.trD
 ${formatted.request.callbackUrl ? `- Callback URL: ${formatted.request.callbackUrl}` : ''}
 
 **Usage:**
-Use the minimized JSON format for API calls to ensure MD5 consistency:
+Use the minimized JSON format for API calls to ensure SHA-256 consistency:
 \`\`\`javascript
 const response = await fetch('https://sandbox.payware.eu/api/transactions', {
   method: 'POST',
@@ -249,11 +249,11 @@ const response = await fetch('https://sandbox.payware.eu/api/transactions', {
     'Authorization': 'Bearer YOUR_JWT_TOKEN',
     'Content-Type': 'application/json'
   },
-  body: '${minimizedJSON}'  // Use pre-minimized string for MD5 consistency
+  body: '${minimizedJSON}'  // Use pre-minimized string for SHA-256 consistency
 });
 \`\`\`
 
-**⚠️ Important:** Always use the minimized JSON format to ensure the MD5 hash in your JWT token matches the request body.
+**⚠️ Important:** Always use the minimized JSON format to ensure the SHA-256 hash in your JWT token matches the request body.
 
 **Formatted:** ${formatted.formatted}
 **Timestamp:** ${formatted.timestamp}`

package/src/utils/json-formatter.js

@@ -4,14 +4,14 @@
  */
 
 import { createDeterministicJSON, validateJSONConsistency } from '../core/utils/json-serializer.js';
-import { generateContentMd5 } from '../core/auth/jwt-token.js';
+import { generateContentSha256 } from '../core/auth/jwt-token.js';
 
 /**
  * Format JSON with deterministic serialization tool
  */
 export const formatJSONDeterministicTool = {
   name: "payware_utils_format_json_deterministic",
-  description: "Format JSON payload with deterministic key sorting for consistent MD5 calculation and payware API compliance",
+  description: "Format JSON payload with deterministic key sorting for consistent SHA-256 calculation and payware API compliance",
   inputSchema: {
     type: "object",
     properties: {
@@ -24,9 +24,9 @@ export const formatJSONDeterministicTool = {
         description: "Show comparison between standard and deterministic JSON",
         default: true
       },
-      calculateMD5: {
+      calculateSHA256: {
         type: "boolean",
-        description: "Calculate MD5 hash for JWT contentMd5 usage",
+        description: "Calculate SHA-256 hash for JWT contentSha256 usage",
         default: true
       },
       validateConsistency: {
@@ -43,7 +43,7 @@ export const formatJSONDeterministicTool = {
     const {
       payload,
       showComparison = true,
-      calculateMD5 = true,
+      calculateSHA256 = true,
       validateConsistency = false
     } = args;
 
@@ -57,8 +57,8 @@ export const formatJSONDeterministicTool = {
       const prettyJson = JSON.stringify(payload, null, 2);
       const deterministicJson = createDeterministicJSON(payload);
 
-      // Calculate MD5 hash
-      const md5Hash = calculateMD5 ? generateContentMd5(payload) : null;
+      // Calculate SHA-256 hash
+      const sha256Hash = calculateSHA256 ? generateContentSha256(payload) : null;
 
       // Get key ordering information
       const originalKeys = Object.keys(payload);
@@ -115,27 +115,27 @@ ${isAlreadySorted ?
   '- ✅ Your object keys are already in sorted order' :
   `- ❌ Keys will be reordered: ${originalKeys.join(' → ')} becomes ${sortedKeys.join(' → ')}`}
 - ✅ Deterministic JSON ensures consistent serialization across platforms
-- ✅ Required for accurate MD5 hash calculation in JWT tokens
+- ✅ Required for accurate SHA-256 hash calculation in JWT tokens
 ` : ''}
 
 ## ✅ **payware API Ready JSON**
 
-Use this exact JSON string for both JWT MD5 calculation and HTTP request body:
+Use this exact JSON string for both JWT SHA-256 calculation and HTTP request body:
 
 \`\`\`json
 ${deterministicJson}
 \`\`\`
 
-${calculateMD5 ? `## 🔒 **MD5 Hash for JWT**
+${calculateSHA256 ? `## 🔒 **SHA-256 Hash for JWT**
 
-**contentMd5**: \`${md5Hash}\`
+**contentSha256**: \`${sha256Hash}\`
 
 **Usage in JWT Header**:
 \`\`\`json
 {
   "alg": "RS256",
   "typ": "JWT",
-  "contentMd5": "${md5Hash}"
+  "contentSha256": "${sha256Hash}"
 }
 \`\`\`
 ` : ''}
@@ -187,22 +187,22 @@ ${consistencyTest ? `## 🧪 **Consistency Validation**
 
 **All Match**: ${consistencyTest.allMatch ? '✅ Consistent' : '❌ Inconsistent'}
 
-${!consistencyTest.allMatch ? '⚠️ **Warning**: Inconsistent serialization detected. This could cause MD5 mismatches.' : ''}
+${!consistencyTest.allMatch ? '⚠️ **Warning**: Inconsistent serialization detected. This could cause SHA-256 mismatches.' : ''}
 ` : ''}
 
 ## ⚠️ **PAYWARE Critical Requirements**
 
-1. **Same String Requirement**: The EXACT same compact JSON string must be used for both JWT contentMd5 and HTTP request body
+1. **Same String Requirement**: The EXACT same compact JSON string must be used for both JWT contentSha256 and HTTP request body
 2. **Compact Format**: No extra whitespace (spaces, newlines) in JSON
 3. **Consistent Serialization**: Use deterministic serialization to prevent variations
-4. **MD5 Consistency**: Any difference will cause ERR_INVALID_MD5 authentication failures
+4. **SHA-256 Consistency**: Any difference will cause ERR_INVALID_CONTENT_HASH authentication failures
 
 Note: Sorted keys are our METHOD to guarantee requirement #1, not a payware requirement itself.
 
 ## 🔗 **Next Steps**
 
 1. Use the deterministic JSON above in your API request
-2. Include the MD5 hash in your JWT header${calculateMD5 ? ` (\`${md5Hash}\`)` : ''}
+2. Include the SHA-256 hash in your JWT header${calculateSHA256 ? ` (\`${sha256Hash}\`)` : ''}
 3. Send the exact same JSON string in your HTTP request body
 4. Verify with \`payware_authentication_validate_jwt\` tool
 
@@ -211,7 +211,7 @@ Note: Sorted keys are our METHOD to guarantee requirement #1, not a payware requ
 - Tool: payware_utils_format_json_deterministic
 - Keys Processed: ${originalKeys.length}
 - Sorting Required: ${!isAlreadySorted}
-- MD5 Calculated: ${calculateMD5}
+- SHA-256 Calculated: ${calculateSHA256}
 - Executed: ${new Date().toISOString()}
 - Status: ✅ Complete`
         }]
@@ -228,10 +228,10 @@ Note: Sorted keys are our METHOD to guarantee requirement #1, not a payware requ
 - Invalid JSON structure
 - Circular references in payload
 - Non-serializable values (functions, undefined, etc.)
-- Different JSON strings used for JWT MD5 vs HTTP body
+- Different JSON strings used for JWT SHA-256 vs HTTP body
 
-**Debug Steps for MD5 Errors**:
-1. Verify the SAME string is used for JWT contentMd5 and HTTP body
+**Debug Steps for SHA-256 Errors**:
+1. Verify the SAME string is used for JWT contentSha256 and HTTP body
 2. Check for extra whitespace or formatting differences
 3. Ensure consistent property ordering (use deterministic serialization)
 4. Validate that objects are properly serializable