@thanhvn14/csvibe 0.1.4 → 0.1.5

package/.github/skills/payment-integration/scripts/sepay-webhook-verify.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+
+/**
+ * SePay Webhook Verification Script
+ *
+ * Verifies SePay webhook authenticity and processes transaction data.
+ * Supports API Key and OAuth2 authentication.
+ *
+ * Usage:
+ *   node sepay-webhook-verify.js <webhook-payload-json>
+ *
+ * Environment Variables:
+ *   SEPAY_WEBHOOK_AUTH_TYPE - Authentication type (api_key or oauth2 or none)
+ *   SEPAY_WEBHOOK_API_KEY - API key for verification (if using api_key)
+ */
+
+const crypto = require('crypto');
+
+class SePayWebhookVerifier {
+  constructor(authType = 'none', apiKey = null) {
+    this.authType = authType;
+    this.apiKey = apiKey;
+  }
+
+  /**
+   * Verify webhook authenticity
+   */
+  verifyAuthentication(headers) {
+    if (this.authType === 'none') {
+      console.log('⚠️  Warning: No authentication configured');
+      return true;
+    }
+
+    if (this.authType === 'api_key') {
+      const authHeader = headers['authorization'] || headers['Authorization'];
+
+      if (!authHeader) {
+        throw new Error('Missing Authorization header');
+      }
+
+      const expectedAuth = `Apikey ${this.apiKey}`;
+      if (authHeader !== expectedAuth) {
+        throw new Error('Invalid API key');
+      }
+
+      return true;
+    }
+
+    if (this.authType === 'oauth2') {
+      const authHeader = headers['authorization'] || headers['Authorization'];
+
+      if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        throw new Error('Missing or invalid OAuth2 Bearer token');
+      }
+
+      // In production, verify token with OAuth2 provider
+      console.log('✓ OAuth2 token present (full verification needed in production)');
+      return true;
+    }
+
+    throw new Error(`Unknown auth type: ${this.authType}`);
+  }
+
+  /**
+   * Check for duplicate transactions
+   */
+  isDuplicate(transactionId, processedIds = new Set()) {
+    return processedIds.has(transactionId);
+  }
+
+  /**
+   * Validate webhook payload structure
+   */
+  validatePayload(payload) {
+    const required = [
+      'id',
+      'gateway',
+      'transactionDate',
+      'accountNumber',
+      'transferType',
+      'transferAmount',
+      'referenceCode'
+    ];
+
+    for (const field of required) {
+      if (!(field in payload)) {
+        throw new Error(`Missing required field: ${field}`);
+      }
+    }
+
+    // Validate transfer type
+    if (!['in', 'out'].includes(payload.transferType)) {
+      throw new Error(`Invalid transferType: ${payload.transferType}`);
+    }
+
+    // Validate amount
+    if (typeof payload.transferAmount !== 'number' || payload.transferAmount <= 0) {
+      throw new Error('Invalid transferAmount');
+    }
+
+    return true;
+  }
+
+  /**
+   * Process webhook payload
+   */
+  process(payload, headers = {}) {
+    try {
+      // 1. Verify authentication
+      this.verifyAuthentication(headers);
+
+      // 2. Validate payload structure
+      this.validatePayload(payload);
+
+      // 3. Extract transaction data
+      const transaction = {
+        id: payload.id,
+        gateway: payload.gateway,
+        transactionDate: new Date(payload.transactionDate),
+        accountNumber: payload.accountNumber,
+        code: payload.code || null,
+        content: payload.content || '',
+        transferType: payload.transferType,
+        transferAmount: payload.transferAmount,
+        accumulated: payload.accumulated || 0,
+        subAccount: payload.subAccount || null,
+        referenceCode: payload.referenceCode
+      };
+
+      return {
+        success: true,
+        transaction,
+        isIncoming: transaction.transferType === 'in',
+        isOutgoing: transaction.transferType === 'out'
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: error.message
+      };
+    }
+  }
+}
+
+// CLI Usage
+if (require.main === module) {
+  const args = process.argv.slice(2);
+
+  if (args.length === 0) {
+    console.log('Usage: node sepay-webhook-verify.js <webhook-payload-json>');
+    console.log('\nEnvironment Variables:');
+    console.log('  SEPAY_WEBHOOK_AUTH_TYPE - Authentication type (api_key, oauth2, none)');
+    console.log('  SEPAY_WEBHOOK_API_KEY - API key for verification');
+    process.exit(1);
+  }
+
+  try {
+    const payload = JSON.parse(args[0]);
+    const authType = process.env.SEPAY_WEBHOOK_AUTH_TYPE || 'none';
+    const apiKey = process.env.SEPAY_WEBHOOK_API_KEY || null;
+
+    const verifier = new SePayWebhookVerifier(authType, apiKey);
+
+    // Mock headers for CLI testing
+    const headers = {};
+    if (authType === 'api_key' && apiKey) {
+      headers['Authorization'] = `Apikey ${apiKey}`;
+    }
+
+    const result = verifier.process(payload, headers);
+
+    if (result.success) {
+      console.log('✓ Webhook verified successfully\n');
+      console.log('Transaction Details:');
+      console.log(`  ID: ${result.transaction.id}`);
+      console.log(`  Gateway: ${result.transaction.gateway}`);
+      console.log(`  Type: ${result.transaction.transferType}`);
+      console.log(`  Amount: ${result.transaction.transferAmount.toLocaleString('vi-VN')} VND`);
+      console.log(`  Reference: ${result.transaction.referenceCode}`);
+      console.log(`  Content: ${result.transaction.content || 'N/A'}`);
+      console.log(`\n  Incoming: ${result.isIncoming ? 'Yes' : 'No'}`);
+      console.log(`  Outgoing: ${result.isOutgoing ? 'Yes' : 'No'}`);
+    } else {
+      console.error('✗ Verification failed:', result.error);
+      process.exit(1);
+    }
+  } catch (error) {
+    console.error('✗ Error:', error.message);
+    process.exit(1);
+  }
+}
+
+module.exports = SePayWebhookVerifier;

package/.github/skills/payment-integration/scripts/test-scripts.js

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+
+/**
+ * Test suite for payment integration scripts
+ */
+
+const SePayWebhookVerifier = require('./sepay-webhook-verify');
+const PolarWebhookVerifier = require('./polar-webhook-verify');
+const CheckoutHelper = require('./checkout-helper');
+
+class TestRunner {
+  constructor() {
+    this.passed = 0;
+    this.failed = 0;
+  }
+
+  test(name, fn) {
+    try {
+      fn();
+      console.log(`✓ ${name}`);
+      this.passed++;
+    } catch (error) {
+      console.error(`✗ ${name}`);
+      console.error(`  Error: ${error.message}`);
+      this.failed++;
+    }
+  }
+
+  assert(condition, message) {
+    if (!condition) {
+      throw new Error(message || 'Assertion failed');
+    }
+  }
+
+  assertEqual(actual, expected, message) {
+    if (actual !== expected) {
+      throw new Error(message || `Expected ${expected}, got ${actual}`);
+    }
+  }
+
+  summary() {
+    console.log(`\nTest Summary: ${this.passed} passed, ${this.failed} failed`);
+    return this.failed === 0;
+  }
+}
+
+// Run tests
+console.log('Running Payment Integration Script Tests\n');
+const runner = new TestRunner();
+
+// SePay Webhook Verifier Tests
+console.log('SePay Webhook Verifier Tests:');
+
+runner.test('should verify valid SePay webhook', () => {
+  const verifier = new SePayWebhookVerifier('none');
+  const payload = {
+    id: 12345,
+    gateway: 'Vietcombank',
+    transactionDate: '2025-01-13 10:00:00',
+    accountNumber: '0123456789',
+    transferType: 'in',
+    transferAmount: 100000,
+    referenceCode: 'REF123',
+    content: 'Order payment'
+  };
+
+  const result = verifier.process(payload);
+  runner.assert(result.success === true, 'Should verify successfully');
+  runner.assert(result.transaction.id === 12345, 'Should parse transaction ID');
+  runner.assert(result.isIncoming === true, 'Should detect incoming transfer');
+});
+
+runner.test('should reject invalid SePay transfer type', () => {
+  const verifier = new SePayWebhookVerifier('none');
+  const payload = {
+    id: 12345,
+    gateway: 'Vietcombank',
+    transactionDate: '2025-01-13 10:00:00',
+    accountNumber: '0123456789',
+    transferType: 'invalid',
+    transferAmount: 100000,
+    referenceCode: 'REF123'
+  };
+
+  const result = verifier.process(payload);
+  runner.assert(result.success === false, 'Should fail validation');
+  runner.assert(result.error.includes('Invalid transferType'), 'Should report invalid transfer type');
+});
+
+runner.test('should verify SePay webhook with API key', () => {
+  const verifier = new SePayWebhookVerifier('api_key', 'test_key_123');
+  const payload = {
+    id: 12345,
+    gateway: 'Vietcombank',
+    transactionDate: '2025-01-13 10:00:00',
+    accountNumber: '0123456789',
+    transferType: 'in',
+    transferAmount: 100000,
+    referenceCode: 'REF123'
+  };
+
+  const headers = { Authorization: 'Apikey test_key_123' };
+  const result = verifier.process(payload, headers);
+  runner.assert(result.success === true, 'Should verify with valid API key');
+});
+
+runner.test('should reject SePay webhook with invalid API key', () => {
+  const verifier = new SePayWebhookVerifier('api_key', 'test_key_123');
+  const payload = {
+    id: 12345,
+    gateway: 'Vietcombank',
+    transactionDate: '2025-01-13 10:00:00',
+    accountNumber: '0123456789',
+    transferType: 'in',
+    transferAmount: 100000,
+    referenceCode: 'REF123'
+  };
+
+  const headers = { Authorization: 'Apikey wrong_key' };
+  const result = verifier.process(payload, headers);
+  runner.assert(result.success === false, 'Should reject invalid API key');
+});
+
+// Polar Webhook Verifier Tests
+console.log('\nPolar Webhook Verifier Tests:');
+
+runner.test('should verify valid Polar webhook', () => {
+  const crypto = require('crypto');
+  const secret = Buffer.from('test_secret_key').toString('base64');
+  const verifier = new PolarWebhookVerifier(secret);
+
+  const payload = JSON.stringify({
+    type: 'order.paid',
+    data: { id: 'order_123', amount: 2000 }
+  });
+
+  const timestamp = Math.floor(Date.now() / 1000);
+  const signedPayload = `${timestamp}.${payload}`;
+  const signature = crypto
+    .createHmac('sha256', Buffer.from(secret, 'base64'))
+    .update(signedPayload)
+    .digest('base64');
+
+  const headers = {
+    'webhook-id': 'msg_123',
+    'webhook-timestamp': timestamp.toString(),
+    'webhook-signature': `v1=${signature}`
+  };
+
+  const result = verifier.process(payload, headers);
+  if (!result.success) {
+    throw new Error(`Verification failed: ${result.error}`);
+  }
+  runner.assert(result.success === true, 'Should verify successfully');
+  runner.assertEqual(result.event.type, 'order.paid', 'Should parse event type');
+});
+
+runner.test('should reject Polar webhook with invalid signature', () => {
+  const secret = Buffer.from('test_secret_key').toString('base64');
+  const verifier = new PolarWebhookVerifier(secret);
+
+  const payload = JSON.stringify({
+    type: 'order.paid',
+    data: { id: 'order_123' }
+  });
+
+  const headers = {
+    'webhook-id': 'msg_123',
+    'webhook-timestamp': Math.floor(Date.now() / 1000).toString(),
+    'webhook-signature': 'v1=invalid_signature'
+  };
+
+  const result = verifier.process(payload, headers);
+  runner.assert(result.success === false, 'Should reject invalid signature');
+});
+
+runner.test('should categorize Polar event types', () => {
+  runner.assertEqual(PolarWebhookVerifier.getEventCategory('order.paid'), 'order');
+  runner.assertEqual(PolarWebhookVerifier.getEventCategory('subscription.active'), 'subscription');
+  runner.assertEqual(PolarWebhookVerifier.getEventCategory('customer.created'), 'customer');
+  runner.assert(PolarWebhookVerifier.isPaymentEvent('order.paid') === true);
+  runner.assert(PolarWebhookVerifier.isSubscriptionEvent('subscription.active') === true);
+});
+
+// Checkout Helper Tests
+console.log('\nCheckout Helper Tests:');
+
+runner.test('should generate SePay checkout fields', () => {
+  const config = {
+    merchantId: 'SP-TEST-123',
+    secretKey: 'test_secret',
+    orderInvoiceNumber: 'ORD001',
+    orderAmount: 100000,
+    successUrl: 'https://example.com/success',
+    errorUrl: 'https://example.com/error',
+    cancelUrl: 'https://example.com/cancel',
+    env: 'sandbox'
+  };
+
+  const result = CheckoutHelper.generateSePayCheckout(config);
+  runner.assert(result.fields !== undefined, 'Should generate fields');
+  runner.assert(result.fields.signature !== undefined, 'Should generate signature');
+  runner.assertEqual(result.fields.merchant_id, 'SP-TEST-123', 'Should include merchant ID');
+  runner.assert(result.formUrl.includes('sandbox'), 'Should use sandbox URL');
+});
+
+runner.test('should generate Polar checkout config', () => {
+  const config = {
+    productPriceId: 'price_123',
+    successUrl: 'https://example.com/success',
+    externalCustomerId: 'user_123',
+    accessToken: 'test_token',
+    server: 'sandbox'
+  };
+
+  const result = CheckoutHelper.generatePolarCheckout(config);
+  runner.assert(result.config !== undefined, 'Should generate config');
+  runner.assertEqual(result.config.product_price_id, 'price_123', 'Should include price ID');
+  runner.assertEqual(result.config.external_customer_id, 'user_123', 'Should include customer ID');
+  runner.assert(result.apiEndpoint.includes('sandbox'), 'Should use sandbox endpoint');
+});
+
+runner.test('should reject Polar config with relative URL', () => {
+  try {
+    CheckoutHelper.generatePolarCheckout({
+      productPriceId: 'price_123',
+      successUrl: '/success' // Relative URL
+    });
+    runner.assert(false, 'Should throw error for relative URL');
+  } catch (error) {
+    runner.assert(error.message.includes('absolute URL'), 'Should require absolute URL');
+  }
+});
+
+// Run summary
+const success = runner.summary();
+process.exit(success ? 0 : 1);

package/.github/skills/plans-kanban/assets/dashboard-template.html

@@ -0,0 +1,119 @@
+<!DOCTYPE html>
+<html lang="en" data-theme="light">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Plans Dashboard</title>
+  <link rel="icon" type="image/png" href="/assets/favicon.png">
+  <!-- Apply stored theme BEFORE CSS loads to prevent FOUC -->
+  <script>
+    (function(){
+      var h=document.documentElement;
+      var t=localStorage.getItem('theme');
+      if(t)h.dataset.theme=t;
+      else if(window.matchMedia('(prefers-color-scheme:dark)').matches)h.dataset.theme='dark';
+    })();
+  </script>
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=Libre+Baskerville:wght@400;700&family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="/assets/novel-theme.css">
+  <link rel="stylesheet" href="/assets/dashboard.css">
+</head>
+<body class="dashboard-view {{has-plans}}">
+  <a href="#main-content" class="skip-link">Skip to main content</a>
+
+  <header class="dashboard-header">
+    <div class="header-left">
+      <h1>Plans</h1>
+      <div class="header-stats">
+        <span class="header-stat"><strong>{{stat-total}}</strong> total</span>
+        <span class="header-stat-divider"></span>
+        <span class="header-stat"><strong>{{stat-completed}}</strong> done</span>
+        <span class="header-stat-divider"></span>
+        <span class="header-stat"><strong>{{stat-in-progress}}</strong> active</span>
+      </div>
+    </div>
+
+    <div class="header-controls">
+      <div class="search-box">
+        <svg class="search-icon" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+          <circle cx="11" cy="11" r="8"/><path d="m21 21-4.35-4.35"/>
+        </svg>
+        <input type="search" id="plan-search" placeholder="Search plans..." aria-label="Search plans">
+      </div>
+
+      <select id="sort-select" aria-label="Sort plans by">
+        <option value="date-desc">Newest First</option>
+        <option value="date-asc">Oldest First</option>
+        <option value="name-asc">Name A-Z</option>
+        <option value="name-desc">Name Z-A</option>
+        <option value="progress-desc">Most Progress</option>
+        <option value="progress-asc">Least Progress</option>
+      </select>
+
+      <div class="filter-pills" role="group" aria-label="Filter by status">
+        <button class="filter-pill active" data-filter="all" aria-pressed="true">All</button>
+        <button class="filter-pill" data-filter="completed" aria-pressed="false">Done</button>
+        <button class="filter-pill" data-filter="in-progress" aria-pressed="false">Active</button>
+        <button class="filter-pill" data-filter="pending" aria-pressed="false">Pending</button>
+      </div>
+
+      <div role="status" aria-live="polite" class="result-count">
+        <strong>{{plan-count}}</strong> plans
+      </div>
+
+      <div class="view-toggle" role="group" aria-label="View mode">
+        <button class="view-toggle-btn active" data-view="kanban" aria-pressed="true" title="Kanban view">
+          <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <rect x="3" y="3" width="5" height="18" rx="1"/><rect x="10" y="3" width="5" height="12" rx="1"/><rect x="17" y="3" width="5" height="8" rx="1"/>
+          </svg>
+        </button>
+        <button class="view-toggle-btn" data-view="grid" aria-pressed="false" title="Grid view">
+          <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+            <rect x="3" y="3" width="7" height="7" rx="1"/><rect x="14" y="3" width="7" height="7" rx="1"/><rect x="3" y="14" width="7" height="7" rx="1"/><rect x="14" y="14" width="7" height="7" rx="1"/>
+          </svg>
+        </button>
+      </div>
+
+      <button id="theme-toggle" class="icon-btn" aria-label="Toggle theme">
+        <svg class="sun-icon" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+          <circle cx="12" cy="12" r="5"/><path d="M12 1v2M12 21v2M4.22 4.22l1.42 1.42M18.36 18.36l1.42 1.42M1 12h2M21 12h2M4.22 19.78l1.42-1.42M18.36 5.64l1.42-1.42"/>
+        </svg>
+        <svg class="moon-icon" width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+          <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z"/>
+        </svg>
+      </button>
+    </div>
+  </header>
+
+  <main id="main-content" role="main" aria-label="Plans Dashboard">
+    {{timeline-section}}
+
+    <!-- Kanban Board View -->
+    <div class="kanban-board" aria-label="Kanban board">
+      {{kanban-columns}}
+    </div>
+
+    <div class="loading-skeleton" aria-hidden="true">
+      <div class="skeleton-card"></div>
+      <div class="skeleton-card"></div>
+      <div class="skeleton-card"></div>
+      <div class="skeleton-card"></div>
+      <div class="skeleton-card"></div>
+      <div class="skeleton-card"></div>
+    </div>
+
+    <section class="plans-grid" aria-label="Plans list">
+      {{plans-grid}}
+    </section>
+
+    {{empty-state}}
+  </main>
+
+  <div id="sr-announce" role="status" aria-live="polite" aria-atomic="true" class="visually-hidden"></div>
+
+  <script>window.__plans = {{plans-json}};</script>
+  <script src="/assets/dashboard.js"></script>
+</body>
+</html>