@unchainedshop/plugins 3.0.0-rc.13 → 3.0.0-rc.15

package/src/payment/apple-iap/handler-express.ts

@@ -0,0 +1,134 @@
+import { Context } from '@unchainedshop/api';
+import { EnrollmentStatus } from '@unchainedshop/core-enrollments';
+import { createLogger } from '@unchainedshop/logger';
+import { fixPeriods } from './fix-periods.js';
+
+const logger = createLogger('unchained:core-payment:iap');
+
+const { APPLE_IAP_SHARED_SECRET } = process.env;
+
+const AppleNotificationTypes = {
+  INITIAL_BUY: 'INITIAL_BUY',
+  DID_RECOVER: 'DID_RECOVER',
+  DID_CHANGE_RENEWAL_STATUS: 'DID_CHANGE_RENEWAL_STATUS',
+  DID_FAIL_TO_RENEW: 'DID_FAIL_TO_RENEW',
+  DID_CHANGE_RENEWAL_PREF: 'DID_CHANGE_RENEWAL_PREF',
+};
+
+export const appleIAPHandler = async (req, res) => {
+  if (req.method === 'POST') {
+    try {
+      const resolvedContext = req.unchainedContext as Context;
+      const { modules, services } = resolvedContext;
+      const responseBody = req.body || {};
+      if (responseBody.password !== APPLE_IAP_SHARED_SECRET) {
+        throw new Error('shared secret not valid');
+      }
+
+      const transactions = responseBody?.unified_receipt?.latest_receipt_info; // eslint-disable-line
+      const latestTransaction = transactions[0];
+
+      if (responseBody.notification_type === AppleNotificationTypes.INITIAL_BUY) {
+        // Find the cart to checkout
+        const orderPayment = await modules.orders.payments.findOrderPaymentByContextData({
+          context: {
+            'meta.transactionIdentifier': latestTransaction.transaction_id,
+          },
+        });
+
+        if (!orderPayment) throw new Error('Could not find any matching order payment');
+
+        const order = await services.orders.checkoutOrder(orderPayment.orderId, {
+          paymentContext: {
+                receiptData: responseBody?.unified_receipt?.latest_receipt, // eslint-disable-line
+          },
+        });
+        const orderId = order._id;
+        const enrollment = await modules.enrollments.findEnrollment({
+          orderId,
+        });
+        await fixPeriods(
+          {
+            transactionId: latestTransaction.original_transaction_id,
+            transactions,
+            enrollmentId: enrollment._id,
+            orderId,
+          },
+          resolvedContext,
+        );
+
+        logger.info(`Apple IAP Webhook: Confirmed checkout for order ${order.orderNumber}`, {
+          orderId: order._id,
+        });
+      } else {
+        // Just store payment credentials, use the enrollments paymentProvider reference and
+        // let the job do the rest
+        const originalOrderPayment = await modules.orders.payments.findOrderPaymentByContextData({
+          context: {
+            'meta.transactionIdentifier': latestTransaction.original_transaction_id,
+          },
+        });
+        if (!originalOrderPayment) throw new Error('Could not find any matching order payment');
+        const originalOrder = await modules.orders.findOrder({
+          orderId: originalOrderPayment.orderId,
+        });
+        const enrollment = await modules.enrollments.findEnrollment({
+          orderId: originalOrder._id,
+        });
+
+        await services.orders.registerPaymentCredentials(enrollment.payment.paymentProviderId, {
+          transactionContext: {
+              receiptData: responseBody?.unified_receipt?.latest_receipt, // eslint-disable-line
+          },
+          userId: enrollment.userId,
+        });
+
+        await fixPeriods(
+          {
+            transactionId: latestTransaction.original_transaction_id,
+            transactions,
+            enrollmentId: enrollment._id,
+            orderId: originalOrder._id,
+          },
+          resolvedContext,
+        );
+
+        logger.info(
+          `Apple IAP Webhook: Processed notification for ${latestTransaction.original_transaction_id} and type ${responseBody.notification_type}`,
+        );
+
+        if (responseBody.notification_type === AppleNotificationTypes.DID_RECOVER) {
+          if (
+            enrollment.status !== EnrollmentStatus.TERMINATED &&
+            responseBody.auto_renew_status === 'false'
+          ) {
+            await services.enrollments.terminateEnrollment(enrollment);
+          }
+        }
+
+        if (responseBody.notification_type === AppleNotificationTypes.DID_CHANGE_RENEWAL_STATUS) {
+          if (
+            enrollment.status !== EnrollmentStatus.TERMINATED &&
+            responseBody.auto_renew_status === 'false'
+          ) {
+            await services.enrollments.terminateEnrollment(enrollment);
+          }
+        }
+        logger.info(`Apple IAP Webhook: Updated enrollment from Apple`);
+      }
+
+      res.writeHead(200);
+      res.end();
+      return;
+    } catch (e) {
+      logger.warn(`Apple IAP Webhook: ${e.message}`, e);
+      res.writeHead(503);
+      res.end(JSON.stringify({ name: e.name, code: e.code, message: e.message }));
+      return;
+    }
+  }
+  res.writeHead(404);
+  res.end();
+};
+
+export default appleIAPHandler;

package/src/payment/apple-iap/handler-fastify.ts

@@ -0,0 +1,137 @@
+import { Context } from '@unchainedshop/api';
+import { EnrollmentStatus } from '@unchainedshop/core-enrollments';
+import { createLogger } from '@unchainedshop/logger';
+import { fixPeriods } from './fix-periods.js';
+import { FastifyRequest, RouteHandlerMethod } from 'fastify';
+import { AppleTransactionsModule } from './module.js';
+
+const logger = createLogger('unchained:core-payment:iap');
+
+const { APPLE_IAP_SHARED_SECRET } = process.env;
+
+const AppleNotificationTypes = {
+  INITIAL_BUY: 'INITIAL_BUY',
+  DID_RECOVER: 'DID_RECOVER',
+  DID_CHANGE_RENEWAL_STATUS: 'DID_CHANGE_RENEWAL_STATUS',
+  DID_FAIL_TO_RENEW: 'DID_FAIL_TO_RENEW',
+  DID_CHANGE_RENEWAL_PREF: 'DID_CHANGE_RENEWAL_PREF',
+};
+
+export const appleIAPHandler: RouteHandlerMethod = async (
+  req: FastifyRequest & {
+    unchainedContext: Context & {
+      modules: AppleTransactionsModule;
+    };
+  },
+  reply,
+) => {
+  try {
+    const resolvedContext = req.unchainedContext as Context;
+    const { modules, services } = resolvedContext;
+    const responseBody: Record<string, any> = req.body || {};
+    if (responseBody.password !== APPLE_IAP_SHARED_SECRET) {
+      throw new Error('shared secret not valid');
+    }
+
+      const transactions = responseBody?.unified_receipt?.latest_receipt_info; // eslint-disable-line
+    const latestTransaction = transactions[0];
+
+    if (responseBody.notification_type === AppleNotificationTypes.INITIAL_BUY) {
+      // Find the cart to checkout
+      const orderPayment = await modules.orders.payments.findOrderPaymentByContextData({
+        context: {
+          'meta.transactionIdentifier': latestTransaction.transaction_id,
+        },
+      });
+
+      if (!orderPayment) throw new Error('Could not find any matching order payment');
+
+      const order = await services.orders.checkoutOrder(orderPayment.orderId, {
+        paymentContext: {
+                receiptData: responseBody?.unified_receipt?.latest_receipt, // eslint-disable-line
+        },
+      });
+      const orderId = order._id;
+      const enrollment = await modules.enrollments.findEnrollment({
+        orderId,
+      });
+      await fixPeriods(
+        {
+          transactionId: latestTransaction.original_transaction_id,
+          transactions,
+          enrollmentId: enrollment._id,
+          orderId,
+        },
+        resolvedContext,
+      );
+
+      logger.info(`Apple IAP Webhook: Confirmed checkout for order ${order.orderNumber}`, {
+        orderId: order._id,
+      });
+    } else {
+      // Just store payment credentials, use the enrollments paymentProvider reference and
+      // let the job do the rest
+      const originalOrderPayment = await modules.orders.payments.findOrderPaymentByContextData({
+        context: {
+          'meta.transactionIdentifier': latestTransaction.original_transaction_id,
+        },
+      });
+      if (!originalOrderPayment) throw new Error('Could not find any matching order payment');
+      const originalOrder = await modules.orders.findOrder({
+        orderId: originalOrderPayment.orderId,
+      });
+      const enrollment = await modules.enrollments.findEnrollment({
+        orderId: originalOrder._id,
+      });
+
+      await services.orders.registerPaymentCredentials(enrollment.payment.paymentProviderId, {
+        transactionContext: {
+              receiptData: responseBody?.unified_receipt?.latest_receipt, // eslint-disable-line
+        },
+        userId: enrollment.userId,
+      });
+
+      await fixPeriods(
+        {
+          transactionId: latestTransaction.original_transaction_id,
+          transactions,
+          enrollmentId: enrollment._id,
+          orderId: originalOrder._id,
+        },
+        resolvedContext,
+      );
+
+      logger.info(
+        `Apple IAP Webhook: Processed notification for ${latestTransaction.original_transaction_id} and type ${responseBody.notification_type}`,
+      );
+
+      if (responseBody.notification_type === AppleNotificationTypes.DID_RECOVER) {
+        if (
+          enrollment.status !== EnrollmentStatus.TERMINATED &&
+          responseBody.auto_renew_status === 'false'
+        ) {
+          await services.enrollments.terminateEnrollment(enrollment);
+        }
+      }
+
+      if (responseBody.notification_type === AppleNotificationTypes.DID_CHANGE_RENEWAL_STATUS) {
+        if (
+          enrollment.status !== EnrollmentStatus.TERMINATED &&
+          responseBody.auto_renew_status === 'false'
+        ) {
+          await services.enrollments.terminateEnrollment(enrollment);
+        }
+      }
+      logger.info(`Apple IAP Webhook: Updated enrollment from Apple`);
+    }
+
+    reply.status(200);
+    return reply.send();
+  } catch (e) {
+    logger.warn(`Apple IAP Webhook: ${e.message}`, e);
+    reply.status(503);
+    return reply.send({ name: e.name, code: e.code, message: e.message });
+  }
+};
+
+export default appleIAPHandler;

package/src/payment/apple-iap/index.ts

@@ -1,2 +1,6 @@
 export * from './adapter.js';
-export * from './module/configureAppleTransactionsModule.js';
+
+import appleTransactionsModule, { type AppleTransactionsModule } from './module.js';
+
+export type { AppleTransactionsModule };
+export default appleTransactionsModule;

package/src/payment/apple-iap/{module/configureAppleTransactionsModule.ts → module.ts}

@@ -1,4 +1,4 @@
-import { AppleTransaction, AppleTransactionsCollection } from '../db/AppleTransactionsCollection.js';
+import { AppleTransaction, AppleTransactionsCollection } from './db/AppleTransactionsCollection.js';
 
 export const configureAppleTransactionsModule = async ({ db }) => {
   const AppleTransactions = await AppleTransactionsCollection(db);
@@ -18,4 +18,12 @@ export const configureAppleTransactionsModule = async ({ db }) => {
   };
 };
 
-export type AppleTransactionsModule = Awaited<ReturnType<typeof configureAppleTransactionsModule>>;
+export default {
+  appleTransactions: {
+    configure: configureAppleTransactionsModule,
+  },
+};
+
+export type AppleTransactionsModule = {
+  appleTransactions: Awaited<ReturnType<typeof configureAppleTransactionsModule>>;
+};

package/src/payment/apple-iap/verify-receipt.ts

@@ -0,0 +1,27 @@
+const { APPLE_IAP_ENVIRONMENT = 'sandbox' } = process.env;
+
+// https://developer.apple.com/documentation/storekit/in-app_purchase/validating_receipts_with_the_app_store
+const environments = {
+  sandbox: 'https://sandbox.itunes.apple.com/verifyReceipt',
+  production: 'https://buy.itunes.apple.com/verifyReceipt',
+};
+
+export const verifyReceipt = async ({ receiptData, password }): Promise<any> => {
+  const payload: any = {
+    'receipt-data': receiptData,
+  };
+  if (password) {
+    payload.password = password;
+  }
+  const result = await fetch(environments[APPLE_IAP_ENVIRONMENT], {
+    body: JSON.stringify(payload),
+    method: 'POST',
+    // eslint-disable-next-line
+    // @ts-ignore
+    duplex: 'half',
+    headers: {
+      'Content-Type': 'application/json',
+    },
+  });
+  return result.json();
+};

package/src/payment/cryptopay/{middleware.ts → handler-express.ts}

@@ -1,18 +1,16 @@
 import { createLogger } from '@unchainedshop/logger';
 import { Context } from '@unchainedshop/api';
 import { OrderStatus } from '@unchainedshop/core-orders';
-import { CryptopayModule } from './module/configureCryptopayModule.js';
+import { CryptopayModule } from './module.js';
 import { ProductPriceRate } from '@unchainedshop/core-products';
 
 const { CRYPTOPAY_SECRET, CRYPTOPAY_MAX_RATE_AGE = '360' } = process.env;
 
 const logger = createLogger('unchained:core-payment:cryptopay');
 
-export const cryptopayHandler = async (req, res) => {
+const cryptopayHandler = async (req, res) => {
   const resolvedContext = req.unchainedContext as Context & {
-    modules: {
-      cryptopay: CryptopayModule;
-    };
+    modules: CryptopayModule;
   };
   const { modules, services } = resolvedContext;
 
@@ -88,3 +86,5 @@ export const cryptopayHandler = async (req, res) => {
   res.writeHead(404);
   res.end(JSON.stringify({ success: false }));
 };
+
+export default cryptopayHandler;

package/src/payment/cryptopay/handler-fastify.ts

@@ -0,0 +1,89 @@
+import { FastifyRequest, RouteHandlerMethod } from 'fastify';
+import { createLogger } from '@unchainedshop/logger';
+import { Context } from '@unchainedshop/api';
+import { OrderStatus } from '@unchainedshop/core-orders';
+import { CryptopayModule } from './module.js';
+import { ProductPriceRate } from '@unchainedshop/core-products';
+
+const { CRYPTOPAY_SECRET, CRYPTOPAY_MAX_RATE_AGE = '360' } = process.env;
+
+const logger = createLogger('unchained:core-payment:cryptopay');
+
+const cryptopayHandler: RouteHandlerMethod = async (
+  req: FastifyRequest & {
+    unchainedContext: Context & {
+      modules: CryptopayModule;
+    };
+  },
+  reply,
+) => {
+  const { modules, services } = req.unchainedContext;
+
+  try {
+    const { secret, price, wallet, ping } = req.body as Record<string, any>;
+    if (secret !== CRYPTOPAY_SECRET) {
+      logger.warn(`Cryptopay Plugin: Invalid Cryptopay Secret provided`);
+      throw new Error('Secret invalid');
+    }
+
+    if (wallet) {
+      const { address, blockHeight, amount, contract, decimals, currency } = wallet;
+      const { orderPaymentId } = await modules.cryptopay.updateWalletAddress({
+        addressId: address,
+        blockHeight,
+        amount,
+        contract,
+        decimals,
+        currency,
+      });
+      const orderPayment =
+        orderPaymentId &&
+        (await modules.orders.payments.findOrderPayment({
+          orderPaymentId,
+        }));
+
+      if (orderPayment) {
+        // Try to process order to next status
+        // TODO: Not sure if it's correct to use processOrder here if status is PENDING!
+        const order = await modules.orders.findOrder({ orderId: orderPayment.orderId });
+        if (order.status === null) {
+          await services.orders.checkoutOrder(order._id, {});
+        } else if (order.status === OrderStatus.PENDING) {
+          await services.orders.processOrder(order, {});
+        } else {
+          throw new Error('Already processed');
+        }
+      }
+    }
+
+    if (price) {
+      const { baseCurrency, token, rate, timestamp } = price;
+
+      const timestampDate = new Date(timestamp);
+      const expiresAt = new Date(new Date().getTime() + parseInt(CRYPTOPAY_MAX_RATE_AGE, 10) * 1000);
+
+      const rateData: ProductPriceRate = {
+        baseCurrency,
+        quoteCurrency: token,
+        rate,
+        expiresAt,
+        timestamp: timestampDate,
+      };
+      logger.info(`update rate ${JSON.stringify(price)}, ${JSON.stringify(rateData)}`);
+      await modules.products.prices.rates.updateRates([rateData]);
+    }
+
+    if (ping) {
+      const { blockHeight, currency } = ping;
+      await modules.cryptopay.updateMostRecentBlock(currency, blockHeight);
+    }
+
+    reply.status(200);
+    return reply.send({ success: true });
+  } catch (e) {
+    reply.status(500);
+    return reply.send({ success: false, error: e.message });
+  }
+};
+
+export default cryptopayHandler;

package/src/payment/cryptopay/index.ts

@@ -1,6 +1,7 @@
-import CryptopayPlugin from './plugin.js';
+import './plugin.js';
 
-export * from './middleware.js';
-export * from './module/configureCryptopayModule.js';
+import cryptopayModules, { type CryptopayModule } from './module.js';
 
-export default CryptopayPlugin;
+export type { CryptopayModule };
+
+export default cryptopayModules;

package/src/payment/cryptopay/{module/configureCryptopayModule.ts → module.ts}

@@ -1,7 +1,7 @@
 import { mongodb } from '@unchainedshop/mongodb';
-import { CryptopayTransaction, CryptopayTransactionsCollection } from '../db/CryptopayTransactions.js';
+import { CryptopayTransaction, CryptopayTransactionsCollection } from './db/CryptopayTransactions.js';
 
-export const configureCryptopayModule = ({ db }) => {
+const configureCryptopayModule = ({ db }) => {
   const CryptoTransactions = CryptopayTransactionsCollection(db);
 
   const getWalletAddress = async (addressId: string): Promise<CryptopayTransaction> => {
@@ -120,4 +120,12 @@ export const configureCryptopayModule = ({ db }) => {
   };
 };
 
-export type CryptopayModule = ReturnType<typeof configureCryptopayModule>;
+export default {
+  cryptopay: {
+    configure: configureCryptopayModule,
+  },
+};
+
+export type CryptopayModule = {
+  cryptopay: ReturnType<typeof configureCryptopayModule>;
+};

package/src/payment/cryptopay/plugin.ts

@@ -10,7 +10,7 @@ import {
   PaymentError,
   OrderPricingSheet,
 } from '@unchainedshop/core';
-import { CryptopayModule } from './module/configureCryptopayModule.js';
+import { CryptopayModule } from './module.js';
 
 const logger = createLogger('unchained:core-payment:cryptopay');
 
@@ -59,7 +59,7 @@ const Cryptopay: IPaymentAdapter = {
   },
 
   actions: (config, context) => {
-    const { modules } = context as typeof context & { modules: { cryptopay: CryptopayModule } };
+    const { modules } = context as typeof context & { modules: CryptopayModule };
 
     const setConversionRates = async (currencyCode: string, existingAddresses: any[]) => {
       const originCurrencyObj = await modules.currencies.findCurrency({ isoCode: currencyCode });
@@ -267,7 +267,7 @@ const Cryptopay: IPaymentAdapter = {
 
         1. Check that generated crypto addresses are unique and no order payments share the same crypto address, only repeat when derivations completely exhausted.
         2. When derivation path get's close to "exhaustedness" (95%), send a special e-mail alert to tell the user should generate a new xpub.
-        3. Extend the middleware to report the highest seen block number so we can calculate confirmations, 
+        3. Extend the handler to report the highest seen block number so we can calculate confirmations, 
         4. Order rejection should trigger an e-mail advising the vendor to actively send back funds
 
         To allow paying in ETH or BTC or Tokens for CHF orders, it should work like this:

package/src/payment/datatrans-v2/{middleware.ts → handler-express.ts}

@@ -9,7 +9,7 @@ const {
   DATATRANS_SECURITY = Security.DYNAMIC_SIGN,
 } = process.env;
 
-const logger = createLogger('unchained:core-payment:datatrans:webhook');
+const logger = createLogger('unchained:core-payment:datatrans:handler');
 
 export const datatransHandler = async (req, res) => {
   const resolvedContext = req.unchainedContext as Context;

package/src/payment/datatrans-v2/handler-fastify.ts

@@ -0,0 +1,88 @@
+import { createLogger } from '@unchainedshop/logger';
+import { Context } from '@unchainedshop/api';
+import generateSignature, { Security } from './generateSignature.js';
+import { StatusResponseSuccess } from './api/types.js';
+import { FastifyRequest, RouteHandlerMethod } from 'fastify';
+
+const {
+  DATATRANS_SIGN_KEY,
+  DATATRANS_SIGN2_KEY,
+  DATATRANS_SECURITY = Security.DYNAMIC_SIGN,
+} = process.env;
+
+const logger = createLogger('unchained:core-payment:datatrans:handler');
+
+export const datatransHandler: RouteHandlerMethod = async (
+  req: FastifyRequest & {
+    unchainedContext: Context;
+  },
+  reply,
+) => {
+  const resolvedContext = req.unchainedContext as Context;
+  const { modules, services } = resolvedContext;
+  const signature = req.headers['datatrans-signature'] as string;
+  if (signature) {
+    const [rawTimestamp, rawHash] = signature.split(',');
+    const [, hash] = rawHash.split('=');
+    const [, timestamp] = rawTimestamp.split('=');
+
+    const comparableSignature = await generateSignature({
+      security: DATATRANS_SECURITY as any,
+      signKey: DATATRANS_SIGN2_KEY || DATATRANS_SIGN_KEY,
+    })(timestamp, req.body as string);
+
+    if (hash !== comparableSignature) {
+      logger.error(`hash mismatch: ${signature} / ${comparableSignature}`, req.body as string);
+      reply.status(403);
+      return reply.send('Hash mismatch');
+    }
+
+    const transaction: StatusResponseSuccess = JSON.parse(req.body as string) as StatusResponseSuccess;
+
+    logger.info(`received request`, {
+      type: transaction.type,
+    });
+
+    if (transaction.status === 'authorized') {
+      const userId = transaction.refno2;
+      const referenceId = Buffer.from(transaction.refno, 'base64').toString('hex');
+
+      try {
+        if (transaction.type === 'card_check') {
+          const paymentProviderId = referenceId;
+          const paymentCredentials = await services.orders.registerPaymentCredentials(
+            paymentProviderId,
+            { userId, transactionContext: { transactionId: transaction.transactionId } },
+          );
+          logger.info(`registered payment credentials for ${userId}`, {
+            userId,
+          });
+          reply.status(200);
+          return reply.send(paymentCredentials);
+        }
+        if (transaction.type === 'payment') {
+          const orderPaymentId = referenceId;
+          const orderPayment = await modules.orders.payments.findOrderPayment({
+            orderPaymentId,
+          });
+          if (!orderPayment) throw new Error(`Order Payment with id ${orderPaymentId} not found`);
+
+          const order = await services.orders.checkoutOrder(orderPayment.orderId, {
+            paymentContext: { userId, transactionId: transaction.transactionId },
+          });
+          reply.status(200);
+          logger.info(`confirmed checkout for order ${order.orderNumber}`, {
+            orderId: order._id,
+          });
+          return reply.send(order);
+        }
+      } catch (e) {
+        logger.error(`rejected to checkout with message`, e);
+        reply.status(500);
+        return reply.send({ name: e.name, code: e.code, message: e.message });
+      }
+    }
+  }
+  reply.status(404);
+  return reply.send();
+};

package/src/payment/datatrans-v2/index.ts

@@ -20,8 +20,6 @@ import {
   OrderPricingSheet,
 } from '@unchainedshop/core';
 
-export * from './middleware.js';
-
 const logger = createLogger('unchained:core-payment:datatrans');
 
 // v2

package/src/payment/payrexx/{middleware.ts → handler-express.ts}

@@ -1,7 +1,7 @@
 import { Context } from '@unchainedshop/api';
 import { createLogger } from '@unchainedshop/logger';
 
-const logger = createLogger('unchained:core-payment:payrexx:webhook');
+const logger = createLogger('unchained:core-payment:payrexx:handler');
 
 export const payrexxHandler = async (request, response) => {
   const resolvedContext = request.unchainedContext as Context;