@unchainedshop/core-payment 4.5.0 → 4.6.0

package/README.md

@@ -94,6 +94,37 @@ const providers = await paymentModule.findSupported({
 | `PAYMENT_PROVIDER_UPDATE` | Provider updated |
 | `PAYMENT_PROVIDER_REMOVE` | Provider deleted |
 
+## Security (PCI DSS)
+
+This module is designed for **PCI DSS SAQ-A eligibility**:
+
+### Tokenization
+
+- **No card data storage**: Credit card numbers (PAN) and CVV are never stored
+- **Provider tokens only**: Only payment provider-issued tokens are stored
+- **Secure credentials**: Payment credentials contain references, not card data
+
+```typescript
+// PaymentCredentials structure - tokens only, no card data
+type PaymentCredentials = {
+  paymentProviderId: string;
+  userId: string;
+  token?: string;        // Provider-issued token (NOT card number)
+  isPreferred?: boolean;
+  meta: any;             // Provider-specific metadata
+};
+```
+
+### Payment Flow
+
+All payment integrations use tokenization patterns:
+1. Card data collected by payment provider (Stripe, Datatrans, etc.)
+2. Provider returns secure token
+3. Unchained stores only the token reference
+4. Subsequent charges use the token
+
+See [SECURITY.md](../../SECURITY.md) for complete PCI DSS compliance documentation.
+
 ## License
 
 EUPL-1.2

package/lib/module/configurePaymentCredentialsModule.d.ts

@@ -9,13 +9,19 @@ export declare const configurePaymentCredentialsModule: (PaymentCredentials: mon
     credentialsExists: ({ paymentCredentialsId, }: {
         paymentCredentialsId: string;
     }) => Promise<boolean>;
-    findPaymentCredential: ({ paymentCredentialsId, userId, paymentProviderId, }: {
+    findPaymentCredential: ({ paymentCredentialsId, userId, paymentProviderId, isPreferred, }: {
         paymentCredentialsId?: string;
         userId?: string;
         paymentProviderId?: string;
+        isPreferred?: boolean;
     }, options?: mongodb.FindOptions) => Promise<PaymentCredentialsType | null>;
     findPaymentCredentials: (query: mongodb.Filter<PaymentCredentialsType>, options?: mongodb.FindOptions) => Promise<PaymentCredentialsType[]>;
-    upsertCredentials: ({ userId, paymentProviderId, _id, token, ...meta }: Pick<PaymentCredentialsType, "userId" | "paymentProviderId" | "_id" | "token"> & Record<string, any>) => Promise<PaymentCredentialsType>;
+    upsertCredentials: ({ userId, paymentProviderId, _id, token, ...meta }: Partial<PaymentCredentialsType> & {
+        userId: PaymentCredentialsType["userId"];
+        paymentProviderId: PaymentCredentialsType["paymentProviderId"];
+        _id?: PaymentCredentialsType["_id"];
+        token?: PaymentCredentialsType["token"];
+    } & Record<string, any>) => Promise<PaymentCredentialsType>;
     removeCredentials: (paymentCredentialsId: string) => Promise<mongodb.WithId<PaymentCredentialsType> | null>;
     deleteUserPaymentCredentials: (userId: string) => Promise<number>;
 };

package/lib/module/configurePaymentCredentialsModule.js

@@ -28,10 +28,10 @@ export const configurePaymentCredentialsModule = (PaymentCredentials) => {
             const credentialsCount = await PaymentCredentials.countDocuments(generateDbFilterById(paymentCredentialsId), { limit: 1 });
             return !!credentialsCount;
         },
-        findPaymentCredential: async ({ paymentCredentialsId, userId, paymentProviderId, }, options) => {
+        findPaymentCredential: async ({ paymentCredentialsId, userId, paymentProviderId, isPreferred, }, options) => {
             return PaymentCredentials.findOne(paymentCredentialsId
-                ? generateDbFilterById(paymentCredentialsId)
-                : { userId, paymentProviderId }, options);
+                ? generateDbFilterById(paymentCredentialsId, isPreferred ? { isPreferred: true } : {})
+                : { userId, paymentProviderId, ...(isPreferred ? { isPreferred: true } : {}) }, options);
         },
         findPaymentCredentials: async (query, options) => {
             const credentials = await PaymentCredentials.find(query, options).toArray();

package/lib/module/configurePaymentModule.d.ts

@@ -24,13 +24,19 @@ export declare const configurePaymentModule: ({ db, options: paymentOptions, }:
         credentialsExists: ({ paymentCredentialsId, }: {
             paymentCredentialsId: string;
         }) => Promise<boolean>;
-        findPaymentCredential: ({ paymentCredentialsId, userId, paymentProviderId, }: {
+        findPaymentCredential: ({ paymentCredentialsId, userId, paymentProviderId, isPreferred, }: {
             paymentCredentialsId?: string;
             userId?: string;
             paymentProviderId?: string;
+            isPreferred?: boolean;
         }, options?: import("mongodb").FindOptions) => Promise<import("../db/PaymentCredentialsCollection.ts").PaymentCredentials | null>;
         findPaymentCredentials: (query: import("mongodb").Filter<import("../db/PaymentCredentialsCollection.ts").PaymentCredentials>, options?: import("mongodb").FindOptions) => Promise<import("../db/PaymentCredentialsCollection.ts").PaymentCredentials[]>;
-        upsertCredentials: ({ userId, paymentProviderId, _id, token, ...meta }: Pick<import("../db/PaymentCredentialsCollection.ts").PaymentCredentials, "userId" | "paymentProviderId" | "_id" | "token"> & Record<string, any>) => Promise<import("../db/PaymentCredentialsCollection.ts").PaymentCredentials>;
+        upsertCredentials: ({ userId, paymentProviderId, _id, token, ...meta }: Partial<import("../db/PaymentCredentialsCollection.ts").PaymentCredentials> & {
+            userId: import("../db/PaymentCredentialsCollection.ts").PaymentCredentials["userId"];
+            paymentProviderId: import("../db/PaymentCredentialsCollection.ts").PaymentCredentials["paymentProviderId"];
+            _id?: import("../db/PaymentCredentialsCollection.ts").PaymentCredentials["_id"];
+            token?: import("../db/PaymentCredentialsCollection.ts").PaymentCredentials["token"];
+        } & Record<string, any>) => Promise<import("../db/PaymentCredentialsCollection.ts").PaymentCredentials>;
         removeCredentials: (paymentCredentialsId: string) => Promise<import("mongodb").WithId<import("../db/PaymentCredentialsCollection.ts").PaymentCredentials> | null>;
         deleteUserPaymentCredentials: (userId: string) => Promise<number>;
     };

package/lib/module/configurePaymentProvidersModule.js

@@ -1,5 +1,5 @@
 import { emit, registerEvents } from '@unchainedshop/events';
-import { generateDbFilterById, generateDbObjectId, mongodb } from '@unchainedshop/mongodb';
+import { generateDbFilterById, generateDbObjectId, mongodb, escapeRegexString, } from '@unchainedshop/mongodb';
 import pMemoize from 'p-memoize';
 import ExpiryMap from 'expiry-map';
 const PAYMENT_PROVIDER_EVENTS = [
@@ -17,7 +17,7 @@ export const buildFindSelector = ({ includeDeleted = false, queryString, payment
         selector.type = type;
     }
     if (queryString) {
-        const regex = new RegExp(queryString, 'i');
+        const regex = new RegExp(escapeRegexString(queryString), 'i');
         selector.$or = [{ _id: regex }, { adapterKey: regex }];
     }
     return selector;

package/lib/payment-index.d.ts

@@ -1,4 +1,6 @@
 export * from './module/configurePaymentModule.ts';
+export * from './module/configurePaymentCredentialsModule.ts';
+export * from './module/configurePaymentProvidersModule.ts';
 export * from './payment-settings.ts';
 export * from './db/PaymentCredentialsCollection.ts';
 export * from './db/PaymentProvidersCollection.ts';

package/lib/payment-index.js

@@ -1,4 +1,6 @@
 export * from "./module/configurePaymentModule.js";
+export * from "./module/configurePaymentCredentialsModule.js";
+export * from "./module/configurePaymentProvidersModule.js";
 export * from "./payment-settings.js";
 export * from "./db/PaymentCredentialsCollection.js";
 export * from "./db/PaymentProvidersCollection.js";

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@unchainedshop/core-payment",
-  "version": "4.5.0",
+  "description": "Payment provider management module for the Unchained Engine",
+  "version": "4.6.0",
   "main": "lib/payment-index.js",
   "types": "lib/payment-index.d.ts",
   "type": "module",
@@ -34,9 +35,9 @@
   },
   "homepage": "https://github.com/unchainedshop/unchained#readme",
   "dependencies": {
-    "@unchainedshop/events": "^4.5.0",
-    "@unchainedshop/logger": "^4.5.0",
-    "@unchainedshop/utils": "^4.5.0",
+    "@unchainedshop/events": "^4.6.0",
+    "@unchainedshop/logger": "^4.6.0",
+    "@unchainedshop/utils": "^4.6.0",
     "expiry-map": "^2.0.0",
     "p-memoize": "^8.0.0"
   },