@teleporthq/teleport-plugin-next-workflows 0.43.67 → 0.43.69

package/dist/esm/payments/drivers/coingate-driver-code.js

@@ -0,0 +1,467 @@
+/**
+ * Emits `utils/payments/drivers/coingate.js`: crypto invoices through the
+ * CoinGate Orders API (form-encoded, hosted invoice page, one callback URL per
+ * order).
+ *
+ * A CoinGate callback is unsigned. Each order carries a token only this store
+ * can compute, the callback must echo it, and the order is then read back with
+ * the store's API token — that copy is what the store acts on.
+ *
+ * Crypto wallets cannot be debited, so CoinGate never bills a subscription:
+ * the store bills each cycle itself as an ordinary order (see the store billing
+ * engine). Refunds need the buyer's wallet address and email confirmation, so
+ * they are issued from CoinGate's dashboard and reach the store as a callback.
+ */
+export const generateCoingateDriverCode = () => `'use strict';
+/**
+ * CoinGate driver. Generated by TeleportHQ — changes are overwritten on the next export.
+ */
+module.exports = function createCoingateDriver(core) {
+  var LIVE = 'https://api.coingate.com/v2';
+  var SANDBOX = 'https://api-sandbox.coingate.com/v2';
+  var MISSING_TOKEN = 'COINGATE_API_TOKEN is not configured';
+  // A \`new\` invoice (no currency chosen yet) expires two hours after it was
+  // created, and CoinGate states no expiry for it.
+  var NEW_INVOICE_LIFETIME_MS = 2 * 60 * 60 * 1000;
+  var DAY_MS = 24 * 60 * 60 * 1000;
+
+  function apiToken() {
+    return core.credential('coingate', 'apiToken');
+  }
+
+  // The order's callback token: an HMAC only this store can compute, so a
+  // forged callback cannot even make the store ask CoinGate about an order.
+  // It is keyed on NEXTAUTH_SECRET (else the API token), so rotating that
+  // secret would end the callbacks of every invoice still open: a callback
+  // is also accepted with the token keyed on the API token, which is just as
+  // secret and outlives it.
+  function callbackTokens(orderId) {
+    var payload = 'coingate-callback:' + String(orderId);
+    var tokens = [];
+    [process.env.NEXTAUTH_SECRET, apiToken()].forEach(function (key) {
+      var token = key ? core.hmac('sha256', key, payload, 'hex').slice(0, 40) : '';
+      if (token && tokens.indexOf(token) === -1) {
+        tokens.push(token);
+      }
+    });
+    return tokens;
+  }
+
+  function callbackToken(orderId) {
+    return callbackTokens(orderId)[0] || '';
+  }
+
+  function problem(data, fallback) {
+    if (data && Array.isArray(data.errors) && data.errors.length > 0) {
+      return String(data.message || fallback) + ': ' + data.errors.join(', ');
+    }
+    return (data && data.message) || fallback;
+  }
+
+  // A token is valid only in the environment that issued it and says nothing
+  // about which: the one that accepts it is remembered for this process.
+  async function baseUrl() {
+    var cached = globalThis.__coingateBaseUrlCache;
+    if (cached === LIVE || cached === SANDBOX) {
+      return { url: cached };
+    }
+    var candidates = [LIVE, SANDBOX];
+    for (var i = 0; i < candidates.length; i++) {
+      var answer = await core.request(candidates[i] + '/auth/test', {
+        headers: { Authorization: 'Token ' + apiToken() },
+      });
+      if (answer.ok) {
+        globalThis.__coingateBaseUrlCache = candidates[i];
+        return { url: candidates[i] };
+      }
+      if (answer.status !== 401) {
+        return { error: problem(answer.data, 'CoinGate could not be reached (HTTP ' + answer.status + ')') };
+      }
+    }
+    return { error: 'CoinGate does not accept the API token in either the live or the sandbox environment.' };
+  }
+
+  async function call(method, path, form) {
+    var base = await baseUrl();
+    if (base.error) {
+      return { ok: false, status: 0, data: { message: base.error } };
+    }
+    var headers = { Authorization: 'Token ' + apiToken(), Accept: 'application/json' };
+    if (form) {
+      headers['Content-Type'] = 'application/x-www-form-urlencoded; charset=utf-8';
+    }
+    return core.request(base.url + path, { method: method, headers: headers, body: form ? core.formEncode(form) : undefined });
+  }
+
+  // CoinGate cannot deliver a callback to a private address.
+  function reachableCallbackUrl(baseUrlValue) {
+    var url = core.webhookUrl(baseUrlValue, 'coingate');
+    return /^https?:\\/\\/(localhost|127\\.|0\\.0\\.0\\.0|\\[::1\\])/i.test(url) ? undefined : url || undefined;
+  }
+
+  // CoinGate needs a title and description of 3+ characters each.
+  function text(value, fallback, max) {
+    var result = String(value || '').trim();
+    return (result.length >= 3 ? result : fallback).slice(0, max);
+  }
+
+  function describeLines(lineItems, fallback) {
+    if (!Array.isArray(lineItems) || lineItems.length === 0) {
+      return fallback;
+    }
+    return lineItems
+      .map(function (item) {
+        return (Number(item.quantity) || 1) + ' x ' + String(item.name || 'Item');
+      })
+      .join(', ');
+  }
+
+  async function createCheckout(input) {
+    if (!apiToken()) {
+      return { checkoutUrl: '', sessionId: '', error: MISSING_TOKEN };
+    }
+    var metadata = input.metadata || {};
+    if (!metadata.orderId) {
+      return { checkoutUrl: '', sessionId: '', error: 'A CoinGate invoice needs the store order it pays.' };
+    }
+    try {
+      var form = {
+        order_id: String(metadata.orderId),
+        price_amount: core.decimalString(input.amount, input.currency),
+        price_currency: String(input.currency || '').toUpperCase(),
+        title: text(metadata.orderNumber ? 'Order ' + metadata.orderNumber : input.description, 'Order', 150),
+        description: text(describeLines(input.lineItems, input.description), 'Order', 500),
+        callback_url: reachableCallbackUrl(input.baseUrl),
+        success_url: input.successUrl || undefined,
+        cancel_url: input.cancelUrl || undefined,
+        token: callbackToken(metadata.orderId),
+      };
+      var receiveCurrency = core.credential('coingate', 'receiveCurrency');
+      if (receiveCurrency) {
+        form.receive_currency = receiveCurrency.toUpperCase();
+      }
+      if (input.customerEmail) {
+        form.shopper = { type: 'personal', email: String(input.customerEmail) };
+      }
+      var answer = await call('POST', '/orders', form);
+      if (!answer.ok || !answer.data || !answer.data.payment_url) {
+        return { checkoutUrl: '', sessionId: '', error: problem(answer.data, 'CoinGate refused the invoice (HTTP ' + answer.status + ')') };
+      }
+      return { checkoutUrl: String(answer.data.payment_url), sessionId: String(answer.data.id || '') };
+    } catch (err) {
+      return { checkoutUrl: '', sessionId: '', error: core.describeError(err) };
+    }
+  }
+
+  // The first cycle of a store-billed subscription is an ordinary invoice for
+  // what is due now; the store's billing engine issues every later one.
+  async function createSubscriptionCheckout(input) {
+    if (Math.max(0, Math.floor(Number(input.trialDays) || 0)) > 0) {
+      return { checkoutUrl: '', sessionId: '', error: 'A crypto subscription cannot start with a free trial: nothing can be collected until the first invoice is paid.' };
+    }
+    var regular = Number(input.amount);
+    var due = Number(input.amountDue);
+    var firstCharge = isFinite(due) && due < regular ? due : regular;
+    if (!(firstCharge > 0)) {
+      return { checkoutUrl: '', sessionId: '', error: 'A gift card cannot cover the whole first payment of a subscription' };
+    }
+    var result = await createCheckout(Object.assign({}, input, { amount: firstCharge, lineItems: undefined }));
+    return result.error ? result : { checkoutUrl: result.checkoutUrl, sessionId: result.sessionId, providerSubscriptionId: '' };
+  }
+
+  // What became of an invoice the store opened earlier. A new or pending one
+  // is paid on its own invoice page (a pending one already shows the buyer
+  // where to send the coins); a confirming one waits on the network; a paid or
+  // refunded one took the money. An invalid, expired or canceled invoice
+  // takes no more through the store (a coin sent to it late is recorded when
+  // CoinGate reports it), nor does one CoinGate does not know.
+  async function inspectCheckout(input) {
+    var reference = String((input && input.reference) || '').trim();
+    if (!/^[0-9]+$/.test(reference)) {
+      return { state: 'closed', checkoutUrl: '' };
+    }
+    if (!apiToken()) {
+      return { state: '', checkoutUrl: '', error: MISSING_TOKEN };
+    }
+    try {
+      var answer = await call('GET', '/orders/' + encodeURIComponent(reference));
+      if (answer.status === 404) {
+        return { state: 'closed', checkoutUrl: '' };
+      }
+      if (!answer.ok || !answer.data) {
+        return { state: '', checkoutUrl: '', error: problem(answer.data, 'CoinGate could not be asked about order ' + reference) };
+      }
+      var state = invoiceState(answer.data);
+      if (state === 'open') {
+        return answer.data.payment_url
+          ? { state: 'open', checkoutUrl: String(answer.data.payment_url) }
+          : { state: 'confirming', checkoutUrl: '' };
+      }
+      return { state: state, checkoutUrl: '' };
+    } catch (err) {
+      return { state: '', checkoutUrl: '', error: core.describeError(err) };
+    }
+  }
+
+  function invoiceState(order) {
+    var status = String((order && order.status) || '');
+    if (status === 'new' || status === 'pending') {
+      return 'open';
+    }
+    if (status === 'confirming') {
+      return 'confirming';
+    }
+    return status === 'paid' || status === 'refunded' || status === 'partially_refunded' ? 'paid' : 'closed';
+  }
+
+  // CoinGate cannot cancel an invoice: one still waiting for coins stays
+  // payable until it expires, and says when. Any other is answered as it is.
+  async function closeCheckout(input) {
+    var reference = String((input && input.reference) || '').trim();
+    if (!/^[0-9]+$/.test(reference)) {
+      return { state: 'closed', checkoutUrl: '', openUntil: '' };
+    }
+    if (!apiToken()) {
+      return { state: '', error: MISSING_TOKEN };
+    }
+    try {
+      var answer = await call('GET', '/orders/' + encodeURIComponent(reference));
+      if (answer.status === 404) {
+        return { state: 'closed', checkoutUrl: '', openUntil: '' };
+      }
+      if (!answer.ok || !answer.data) {
+        return { state: '', error: problem(answer.data, 'CoinGate could not be asked about order ' + reference) };
+      }
+      var state = invoiceState(answer.data);
+      return state === 'open'
+        ? { state: 'open', checkoutUrl: String(answer.data.payment_url || ''), openUntil: openUntil(answer.data) }
+        : { state: state, checkoutUrl: '', openUntil: '' };
+    } catch (err) {
+      return { state: '', error: core.describeError(err) };
+    }
+  }
+
+  // When an open invoice runs out: CoinGate's own expiry, else — for a \`new\`
+  // one, which carries none — two hours after it was created; '' when unknown.
+  function openUntil(order) {
+    if (order.expire_at) {
+      return String(order.expire_at);
+    }
+    var created = Date.parse(String(order.created_at || ''));
+    return order.status === 'new' && isFinite(created) ? core.isoTime(created + NEW_INVOICE_LIFETIME_MS) : '';
+  }
+
+  // A day as CoinGate's order list filters on it: \`YYYY-MM-DD\` in UTC.
+  function isoDay(ms) {
+    return core.isoTime(ms).slice(0, 10);
+  }
+
+  // The invoices opened for an order around the moment it was placed (they
+  // carry the order as their \`order_id\`). CoinGate filters the list by whole
+  // days, so a day either side is asked for (whatever day CoinGate's clock
+  // is on) and the exact time is checked here.
+  async function findCheckouts(input) {
+    var orderId = String((input && input.orderId) || '').trim();
+    var span = core.searchWindow(input && input.placedAt);
+    if (!orderId || !span) {
+      return { error: 'The order to look up names no id or no time it was placed.' };
+    }
+    if (!apiToken()) {
+      return { error: MISSING_TOKEN };
+    }
+    try {
+      var references = [];
+      for (var page = 1; page <= core.SEARCH_PAGE_LIMIT; page++) {
+        var answer = await call(
+          'GET',
+          '/orders?per_page=100&page=' +
+            page +
+            '&created_at[from]=' +
+            isoDay(span.from - DAY_MS) +
+            '&created_at[to]=' +
+            isoDay(span.to + DAY_MS)
+        );
+        if (!answer.ok || !answer.data) {
+          return { error: problem(answer.data, 'CoinGate could not list its orders') };
+        }
+        var orders = Array.isArray(answer.data.orders) ? answer.data.orders : [];
+        orders.forEach(function (order) {
+          var created = Date.parse(String((order && order.created_at) || ''));
+          var inSpan = !isFinite(created) || (created >= span.from && created <= span.to);
+          if (order && order.id && String(order.order_id || '') === orderId && inSpan) {
+            references.push(String(order.id));
+          }
+        });
+        if (orders.length === 0 || page >= Number(answer.data.total_pages || 1)) {
+          return { references: references };
+        }
+      }
+      return { error: 'CoinGate has more orders around the time this order was placed than the store can search.' };
+    } catch (err) {
+      return { error: core.describeError(err) };
+    }
+  }
+
+  async function ensurePlan() {
+    return { ok: 'true', planId: '', providerProductId: '', created: 'false' };
+  }
+
+  async function manageSubscription() {
+    return {
+      ok: 'false',
+      status: '',
+      cancelAtPeriodEnd: 'false',
+      currentPeriodStart: '',
+      currentPeriodEnd: '',
+      error: 'CoinGate subscriptions are billed by the store, not by CoinGate.',
+    };
+  }
+
+  async function billingPortal() {
+    return { ok: 'false', url: '', error: 'CoinGate has no billing page for subscribers.' };
+  }
+
+  async function refund(input) {
+    return {
+      success: false,
+      refundId: '',
+      amount: 0,
+      currency: String(input.currency || '').toUpperCase(),
+      status: '',
+      error: "CoinGate refunds go to the buyer's wallet: issue this one from the CoinGate dashboard, and the store records it when CoinGate reports it.",
+    };
+  }
+
+  // A refund callback — CoinGate posts one when a refund is created and each
+  // time it moves on — carries no token: its \`id\` is the refund's, its
+  // \`order_id\` CoinGate's own order id. An order callback always carries the
+  // token the store set.
+  function isRefundCallback(body) {
+    return !body.token && body.request_amount !== undefined && /^[0-9]+$/.test(String(body.order_id || '').trim());
+  }
+
+  // A refund callback is verified by reading the order and its refunds back
+  // with the store's key: the refund must be one of them. The order read back
+  // (with those refunds) is the event, marked as a refund callback so it
+  // never settles the order's payment again.
+  async function verifyRefundCallback(body) {
+    var refundId = String(body.id || '').trim();
+    var coingateId = String(body.order_id || '').trim();
+    if (!/^[0-9]+$/.test(refundId)) {
+      return { ok: false, reason: 'The CoinGate refund callback names no refund.' };
+    }
+    if (!apiToken()) {
+      return { ok: false, retry: true, reason: MISSING_TOKEN };
+    }
+    try {
+      var path = '/orders/' + encodeURIComponent(coingateId);
+      var order = await call('GET', path);
+      if (!order.ok || !order.data) {
+        return { ok: false, retry: order.status !== 404, reason: problem(order.data, 'CoinGate could not be asked about order ' + coingateId + '.') };
+      }
+      var refunds = await call('GET', path + '/refunds?per_page=100');
+      if (!refunds.ok || !refunds.data) {
+        return { ok: false, retry: refunds.status !== 404, reason: problem(refunds.data, 'CoinGate could not list the refunds of order ' + coingateId + '.') };
+      }
+      var list = Array.isArray(refunds.data.refunds) ? refunds.data.refunds : [];
+      var known = list.some(function (refund) {
+        return refund && String(refund.id) === refundId;
+      });
+      if (!known) {
+        return { ok: false, reason: 'CoinGate lists no refund ' + refundId + ' on order ' + coingateId + '.' };
+      }
+      var event = Object.assign({}, order.data, { teleportCallback: 'refund' });
+      if (!Array.isArray(event.refunds)) {
+        event.refunds = list;
+      }
+      return { ok: true, body: event };
+    } catch (err) {
+      return { ok: false, retry: true, reason: core.describeError(err) };
+    }
+  }
+
+  // The callback (JSON or form, per the merchant's CoinGate app) must echo the
+  // order's token; the order read back by its CoinGate id must be the same
+  // store order. A token mismatch is refused outright (never retried); an
+  // outage asks CoinGate to call again. A refund callback is verified above.
+  async function verifyWebhook(input) {
+    var body = input.body || {};
+    if (isRefundCallback(body)) {
+      return verifyRefundCallback(body);
+    }
+    var coingateId = String(body.id || '').trim();
+    var orderId = String(body.order_id || '').trim();
+    var echoed = String(body.token || '');
+    var tokenMatches =
+      !!orderId &&
+      callbackTokens(orderId).some(function (token) {
+        return core.safeEqual(echoed, token);
+      });
+    if (!coingateId || !tokenMatches) {
+      return { ok: false, reason: 'The CoinGate callback does not carry this order’s token.' };
+    }
+    var read = await readOrder(coingateId);
+    if (read.ok && String(read.body.order_id || '') !== orderId) {
+      return { ok: false, reason: 'The CoinGate order ' + coingateId + ' belongs to another store order.' };
+    }
+    return read;
+  }
+
+  // The order read back with the store's token, as the event a callback
+  // hands the store. An outage asks for another try; an order CoinGate does
+  // not know does not.
+  async function readOrder(coingateId) {
+    if (!apiToken()) {
+      return { ok: false, retry: true, reason: MISSING_TOKEN };
+    }
+    try {
+      var answer = await call('GET', '/orders/' + encodeURIComponent(coingateId));
+      if (!answer.ok || !answer.data) {
+        return { ok: false, retry: answer.status !== 404, reason: problem(answer.data, 'CoinGate could not be asked about order ' + coingateId + '.') };
+      }
+      return { ok: true, body: answer.data };
+    } catch (err) {
+      return { ok: false, retry: true, reason: core.describeError(err) };
+    }
+  }
+
+  // An invoice whose callback never came (CoinGate cannot call a private
+  // address) is settled from CoinGate itself, as the callback would have:
+  // nothing but the CoinGate order id comes from the request.
+  var ORDER_ID_PATTERN = /^[0-9]{1,20}$/;
+
+  async function reconcile(request) {
+    var kind = String((request && request.kind) || '');
+    var id = String((request && request.id) || '').trim();
+    if (kind !== 'checkout' || !ORDER_ID_PATTERN.test(id)) {
+      return { ok: false, reason: 'The request names no CoinGate order to settle.' };
+    }
+    var read = await readOrder(id);
+    if (read.ok && invoiceState(read.body) === 'open') {
+      return { ok: false, reason: 'CoinGate order ' + id + ' is still waiting for its coins.' };
+    }
+    return read;
+  }
+
+  function reconcileKinds(reference) {
+    return ORDER_ID_PATTERN.test(String(reference || '').trim()) ? ['checkout'] : [];
+  }
+
+  return {
+    id: 'coingate',
+    createCheckout: createCheckout,
+    createSubscriptionCheckout: createSubscriptionCheckout,
+    inspectCheckout: inspectCheckout,
+    closeCheckout: closeCheckout,
+    findCheckouts: findCheckouts,
+    ensurePlan: ensurePlan,
+    refund: refund,
+    manageSubscription: manageSubscription,
+    billingPortal: billingPortal,
+    reconcile: reconcile,
+    reconcileKinds: reconcileKinds,
+    verifyWebhook: verifyWebhook,
+  };
+};
+`;
+//# sourceMappingURL=coingate-driver-code.js.map

package/dist/esm/payments/drivers/coingate-driver-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coingate-driver-code.js","sourceRoot":"","sources":["../../../../src/payments/drivers/coingate-driver-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAW,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmcvD,CAAA"}

package/dist/esm/payments/drivers/mollie-driver-code.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Emits `utils/payments/drivers/mollie.js`: the Payments API (hosted checkout,
+ * one webhook URL per payment), refunds, and subscriptions through a FIRST
+ * payment that creates the customer's mandate.
+ *
+ * Mollie posts only `id=tr_…` to a webhook and signs nothing: the payment is
+ * always read back with the store's key, and that copy is what the store acts
+ * on. A subscription does not exist until its first payment is paid, so the
+ * webhook that learns of that payment also creates it (idempotently), with
+ * the plan the checkout stored in the payment's metadata.
+ *
+ * A subscription is addressed through its customer, so the store keeps its
+ * provider id as `<customer id>:<subscription id>`.
+ */
+export declare const generateMollieDriverCode: () => string;
+//# sourceMappingURL=mollie-driver-code.d.ts.map

package/dist/esm/payments/drivers/mollie-driver-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mollie-driver-code.d.ts","sourceRoot":"","sources":["../../../../src/payments/drivers/mollie-driver-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB,QAAO,MA2lB3C,CAAA"}