@unchainedshop/plugins 3.1.10 → 4.0.0-rc.2

package/src/payment/cryptopay/derive-btc-address.ts

@@ -0,0 +1,48 @@
+import { HDKey } from '@scure/bip32';
+import { NETWORK, p2wpkh, TEST_NETWORK } from '@scure/btc-signer';
+
+// const resolvePath = (prefix) => {
+//   if (prefix === 'x') return `m/44'/0'`;
+//   if (prefix === 'y') return `m/49'/0'`;
+//   if (prefix === 'z') return `m/84'/0'`;
+//   if (prefix === 't') return `m/44'/1'`;
+//   if (prefix === 'u') return `m/49'/1'`;
+//   if (prefix === 'v') return `m/84'/1'`;
+//   return `m`;
+// };
+
+const resolveNetwork = (prefix) => {
+  if (['x', 'y', 'z'].includes(prefix)) return NETWORK;
+  return TEST_NETWORK;
+};
+
+export default (xpub, index) => {
+  const prefix = xpub.slice(0, 1);
+  if (prefix !== 'z' && prefix !== 'v')
+    throw new Error('Cryptopay only supports native segwit (zpub/vpub) extended key format for BTC');
+
+  const hardenedMaster = HDKey.fromExtendedKey(
+    xpub,
+    prefix === 'z'
+      ? {
+          public: 0x04b24746, // zpub public
+          private: 0x04b2430c, // zpriv private
+        }
+      : {
+          public: 0x045f1cf6,
+          private: 0x045f18bc,
+        },
+  );
+  hardenedMaster.wipePrivateData(); // Neuter
+
+  const child = hardenedMaster.deriveChild(0).deriveChild(index);
+
+  // We don't need this AFAIK:
+  // const derivationPath = resolvePath(prefix);
+  // const child = hardenedMaster.derive(`${derivationPath}/0/${btcDerivationNumber}`);
+
+  const network = resolveNetwork(prefix);
+  const pubKey = p2wpkh(child.publicKey /* hex.decode( as string)*/, network);
+
+  return pubKey.address;
+};

package/src/payment/cryptopay/derive-eth-address.test.ts

@@ -0,0 +1,22 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert';
+import deriveEthAddress from './derive-eth-address.js';
+
+describe('ETH Address Derivation', () => {
+  it('returns a deterministic BIP44 child address', () => {
+    assert.equal(
+      deriveEthAddress(
+        'xpub6DTksA6DsGUgbEp1U29v3qGTt5P99iKThaqGEzerTfD73ZAg1F8j15TxWTPEjjA1uw1Zmwwc5dgVCXwTL2ZNhvdoLWNdqVuL1MDJMsQCLLs',
+        1,
+      ),
+      '0x11CF7d607A1Dc45a002592891fF25DAAE6eC7dE9',
+    );
+    assert.equal(
+      deriveEthAddress(
+        'xpub6DTksA6DsGUgbEp1U29v3qGTt5P99iKThaqGEzerTfD73ZAg1F8j15TxWTPEjjA1uw1Zmwwc5dgVCXwTL2ZNhvdoLWNdqVuL1MDJMsQCLLs',
+        2,
+      ),
+      '0x61663D505e3aB5b61a5344eA2c64b644c08013ea',
+    );
+  });
+});

package/src/payment/cryptopay/derive-eth-address.ts

@@ -0,0 +1,38 @@
+import { HDKey } from '@scure/bip32';
+import { keccak_256 } from '@noble/hashes/sha3';
+import { secp256k1 } from '@noble/curves/secp256k1';
+
+function getChecksumAddress(address) {
+  const chars = address.split('');
+  const expanded = new Uint8Array(40);
+  for (let i = 0; i < 40; i++) {
+    expanded[i] = chars[i].charCodeAt(0);
+  }
+  const hashed = keccak_256(expanded);
+
+  for (let i = 0; i < 40; i += 2) {
+    if (hashed[i >> 1] >> 4 >= 8) {
+      chars[i] = chars[i].toUpperCase();
+    }
+    if ((hashed[i >> 1] & 0x0f) >= 8) {
+      chars[i + 1] = chars[i + 1].toUpperCase();
+    }
+  }
+
+  return '0x' + chars.join('');
+}
+
+export default (xpub, index) => {
+  const hardenedMaster = HDKey.fromExtendedKey(xpub);
+  hardenedMaster.wipePrivateData(); // Neuter
+
+  const child = hardenedMaster.deriveChild(0).deriveChild(index);
+
+  // ETH Address (secp256k1 + keccak_256 + checksum)
+  const childSigningKey = secp256k1.ProjectivePoint.fromHex(child.publicKey).toRawBytes(false);
+  const address = Buffer.from(keccak_256(childSigningKey.slice(1)))
+    .toString('hex')
+    .substring(24);
+
+  return getChecksumAddress(address);
+};

package/src/payment/cryptopay/handle-webhook.ts

@@ -0,0 +1,103 @@
+import { createLogger } from '@unchainedshop/logger';
+import { Context } from '@unchainedshop/api';
+import { OrderStatus } from '@unchainedshop/core-orders';
+import { CryptopayModule } from './module.js';
+import { ProductPriceRate } from '@unchainedshop/core-products';
+
+const { CRYPTOPAY_SECRET, CRYPTOPAY_MAX_RATE_AGE = '360' } = process.env;
+
+const logger = createLogger('unchained:core-payment:cryptopay');
+
+export default async function handleWebhook(
+  {
+    secret,
+    wallet,
+    price,
+    ping,
+  }: {
+    secret: string;
+    wallet?: {
+      address: string;
+      blockHeight: number;
+      amount: string;
+      contract?: string;
+      decimals?: number;
+      currencyCode: string;
+    };
+    price?: {
+      baseCurrency: string;
+      token: string;
+      rate: number;
+      timestamp: string; // ISO date string
+    };
+    ping?: {
+      blockHeight: number;
+      currencyCode: string;
+    };
+  },
+  context: Context & {
+    modules: CryptopayModule;
+  },
+) {
+  const { modules, services } = context;
+
+  if (secret !== CRYPTOPAY_SECRET) {
+    logger.warn(`webhook called with invalid secret`);
+    throw new Error('Secret invalid');
+  }
+
+  if (wallet) {
+    const { address, blockHeight, amount, contract, decimals, currencyCode } = wallet;
+    logger.debug('webhook received wallet data', wallet);
+    const { orderPaymentId } = await modules.cryptopay.updateWalletAddress({
+      address,
+      blockHeight,
+      amount,
+      contract,
+      decimals,
+      currencyCode,
+    });
+
+    const orderPayment =
+      orderPaymentId &&
+      (await modules.orders.payments.findOrderPayment({
+        orderPaymentId,
+      }));
+
+    if (orderPayment) {
+      // Try to process order to next status
+      // TODO: Not sure if it's correct to use processOrder here if status is PENDING!
+      const order = await modules.orders.findOrder({ orderId: orderPayment.orderId });
+      if (order.status === null) {
+        await services.orders.checkoutOrder(order._id, {});
+      } else if (order.status === OrderStatus.PENDING) {
+        await services.orders.processOrder(order, {});
+      } else {
+        throw new Error('Already processed');
+      }
+    }
+  }
+
+  if (price) {
+    logger.debug('webhook received price data', price);
+    const { baseCurrency, token, rate, timestamp } = price;
+
+    const timestampDate = new Date(timestamp);
+    const expiresAt = new Date(new Date().getTime() + parseInt(CRYPTOPAY_MAX_RATE_AGE, 10) * 1000);
+
+    const rateData: ProductPriceRate = {
+      baseCurrency,
+      quoteCurrency: token,
+      rate,
+      expiresAt,
+      timestamp: timestampDate,
+    };
+    await modules.products.prices.rates.updateRates([rateData]);
+  }
+
+  if (ping) {
+    logger.debug('webhook received ping data', ping);
+    const { blockHeight, currencyCode } = ping;
+    await modules.cryptopay.updateMostRecentBlock(currencyCode, blockHeight);
+  }
+}

package/src/payment/cryptopay/handler-express.ts

@@ -1,83 +1,17 @@
 import { createLogger } from '@unchainedshop/logger';
-import { Context } from '@unchainedshop/api';
-import { OrderStatus } from '@unchainedshop/core-orders';
-import { CryptopayModule } from './module.js';
-import { ProductPriceRate } from '@unchainedshop/core-products';
-
-const { CRYPTOPAY_SECRET, CRYPTOPAY_MAX_RATE_AGE = '360' } = process.env;
+import handleWebhook from './handle-webhook.js';
 
 const logger = createLogger('unchained:core-payment:cryptopay');
 
 const cryptopayHandler = async (req, res) => {
-  const resolvedContext = req.unchainedContext as Context & {
-    modules: CryptopayModule;
-  };
-  const { modules, services } = resolvedContext;
-
   if (req.method === 'POST') {
     try {
-      const { secret, price, wallet, ping } = req.body;
-      if (secret !== CRYPTOPAY_SECRET) {
-        logger.warn(`Cryptopay Plugin: Invalid Cryptopay Secret provided`);
-        throw new Error('Secret invalid');
-      }
-
-      if (wallet) {
-        const { address, blockHeight, amount, contract, decimals, currency } = wallet;
-        const { orderPaymentId } = await modules.cryptopay.updateWalletAddress({
-          addressId: address,
-          blockHeight,
-          amount,
-          contract,
-          decimals,
-          currency,
-        });
-        const orderPayment =
-          orderPaymentId &&
-          (await modules.orders.payments.findOrderPayment({
-            orderPaymentId,
-          }));
-
-        if (orderPayment) {
-          // Try to process order to next status
-          // TODO: Not sure if it's correct to use processOrder here if status is PENDING!
-          const order = await modules.orders.findOrder({ orderId: orderPayment.orderId });
-          if (order.status === null) {
-            await services.orders.checkoutOrder(order._id, {});
-          } else if (order.status === OrderStatus.PENDING) {
-            await services.orders.processOrder(order, {});
-          } else {
-            throw new Error('Already processed');
-          }
-        }
-      }
-
-      if (price) {
-        const { baseCurrency, token, rate, timestamp } = price;
-
-        const timestampDate = new Date(timestamp);
-        const expiresAt = new Date(new Date().getTime() + parseInt(CRYPTOPAY_MAX_RATE_AGE, 10) * 1000);
-
-        const rateData: ProductPriceRate = {
-          baseCurrency,
-          quoteCurrency: token,
-          rate,
-          expiresAt,
-          timestamp: timestampDate,
-        };
-        logger.info(`update rate ${JSON.stringify(price)}, ${JSON.stringify(rateData)}`);
-        await resolvedContext.modules.products.prices.rates.updateRates([rateData]);
-      }
-
-      if (ping) {
-        const { blockHeight, currency } = ping;
-        await modules.cryptopay.updateMostRecentBlock(currency, blockHeight);
-      }
-
+      await handleWebhook(req.body, req.unchainedContext);
       res.writeHead(200);
       res.end(JSON.stringify({ success: true }));
       return;
     } catch (e) {
+      logger.error(e);
       res.writeHead(500);
       res.end(JSON.stringify({ success: false, error: e.message }));
       return;

package/src/payment/cryptopay/handler-fastify.ts

@@ -1,86 +1,21 @@
-import { FastifyRequest, RouteHandlerMethod } from 'fastify';
 import { createLogger } from '@unchainedshop/logger';
-import { Context } from '@unchainedshop/api';
-import { OrderStatus } from '@unchainedshop/core-orders';
-import { CryptopayModule } from './module.js';
-import { ProductPriceRate } from '@unchainedshop/core-products';
-
-const { CRYPTOPAY_SECRET, CRYPTOPAY_MAX_RATE_AGE = '360' } = process.env;
+import handleWebhook from './handle-webhook.js';
 
 const logger = createLogger('unchained:core-payment:cryptopay');
+import { FastifyRequest, RouteHandlerMethod } from 'fastify';
 
 const cryptopayHandler: RouteHandlerMethod = async (
   req: FastifyRequest & {
-    unchainedContext: Context & {
-      modules: CryptopayModule;
-    };
+    unchainedContext: any;
   },
   reply,
 ) => {
-  const { modules, services } = req.unchainedContext;
-
   try {
-    const { secret, price, wallet, ping } = req.body as Record<string, any>;
-    if (secret !== CRYPTOPAY_SECRET) {
-      logger.warn(`Cryptopay Plugin: Invalid Cryptopay Secret provided`);
-      throw new Error('Secret invalid');
-    }
-
-    if (wallet) {
-      const { address, blockHeight, amount, contract, decimals, currency } = wallet;
-      const { orderPaymentId } = await modules.cryptopay.updateWalletAddress({
-        addressId: address,
-        blockHeight,
-        amount,
-        contract,
-        decimals,
-        currency,
-      });
-      const orderPayment =
-        orderPaymentId &&
-        (await modules.orders.payments.findOrderPayment({
-          orderPaymentId,
-        }));
-
-      if (orderPayment) {
-        // Try to process order to next status
-        // TODO: Not sure if it's correct to use processOrder here if status is PENDING!
-        const order = await modules.orders.findOrder({ orderId: orderPayment.orderId });
-        if (order.status === null) {
-          await services.orders.checkoutOrder(order._id, {});
-        } else if (order.status === OrderStatus.PENDING) {
-          await services.orders.processOrder(order, {});
-        } else {
-          throw new Error('Already processed');
-        }
-      }
-    }
-
-    if (price) {
-      const { baseCurrency, token, rate, timestamp } = price;
-
-      const timestampDate = new Date(timestamp);
-      const expiresAt = new Date(new Date().getTime() + parseInt(CRYPTOPAY_MAX_RATE_AGE, 10) * 1000);
-
-      const rateData: ProductPriceRate = {
-        baseCurrency,
-        quoteCurrency: token,
-        rate,
-        expiresAt,
-        timestamp: timestampDate,
-      };
-      logger.info(`update rate ${JSON.stringify(price)}, ${JSON.stringify(rateData)}`);
-      await modules.products.prices.rates.updateRates([rateData]);
-    }
-
-    if (ping) {
-      const { blockHeight, currency } = ping;
-      await modules.cryptopay.updateMostRecentBlock(currency, blockHeight);
-    }
-
+    await handleWebhook(req.body as any, req.unchainedContext);
     reply.status(200);
     return reply.send({ success: true });
   } catch (e) {
+    logger.error(e);
     reply.status(500);
     return reply.send({ success: false, error: e.message });
   }

package/src/payment/cryptopay/module.ts

@@ -4,14 +4,15 @@ import { CryptopayTransaction, CryptopayTransactionsCollection } from './db/Cryp
 const configureCryptopayModule = ({ db }) => {
   const CryptoTransactions = CryptopayTransactionsCollection(db);
 
-  const getWalletAddress = async (addressId: string): Promise<CryptopayTransaction> => {
-    return CryptoTransactions.findOne({ _id: addressId.toLowerCase() });
+  const getWalletAddress = async (address: string, contract?: string): Promise<CryptopayTransaction> => {
+    const addressId = [address, contract].filter(Boolean).join(':');
+    return CryptoTransactions.findOne({ _id: addressId });
   };
 
-  const updateMostRecentBlock = async (currency: string, blockHeight: number): Promise<void> => {
+  const updateMostRecentBlock = async (currencyCode: string, blockHeight: number): Promise<void> => {
     await CryptoTransactions.updateMany(
       {
-        currency,
+        currencyCode,
       },
       {
         $set: {
@@ -22,26 +23,26 @@ const configureCryptopayModule = ({ db }) => {
   };
 
   const mapOrderPaymentToWalletAddress = async ({
-    addressId,
+    address,
     contract,
-    currency,
+    currencyCode,
     orderPaymentId,
   }: {
-    addressId: string;
-    contract: string;
-    currency: string;
+    address: string;
+    contract?: string;
+    currencyCode: string;
     orderPaymentId: string;
   }): Promise<CryptopayTransaction> => {
-    await CryptoTransactions.updateOne(
+    const addressId = [address, contract].filter(Boolean).join(':');
+
+    return CryptoTransactions.findOneAndUpdate(
       {
-        _id: addressId.toLowerCase(),
+        _id: addressId,
       },
       {
         $setOnInsert: {
-          _id: addressId.toLowerCase(),
-          contract,
-          currency,
-          decimals: null,
+          _id: addressId,
+          currencyCode,
           mostRecentBlockHeight: 0,
           blockHeight: 0,
           amount: mongodb.Decimal128.fromString('0'),
@@ -52,62 +53,65 @@ const configureCryptopayModule = ({ db }) => {
           updated: new Date(),
         },
       },
-      { upsert: true },
+      { upsert: true, returnDocument: 'after' },
     );
-
-    return CryptoTransactions.findOne({ _id: addressId.toLowerCase() });
   };
 
-  const getNextDerivationNumber = async (currency: string): Promise<number> => {
-    return (await CryptoTransactions.countDocuments({ currency })) + 1;
+  const getNextDerivationNumber = async (currencyCode: string): Promise<number> => {
+    return (await CryptoTransactions.countDocuments({ currencyCode })) + 1;
   };
 
   const getWalletAddressesByOrderPaymentId = async (
     orderPaymentId: string,
   ): Promise<CryptopayTransaction[]> => {
-    return CryptoTransactions.find({
-      orderPaymentId,
-    }).toArray();
+    return CryptoTransactions.find(
+      {
+        orderPaymentId,
+      },
+      {
+        sort: {
+          created: 1, // Sort by creation date, most recent first
+        },
+      },
+    ).toArray();
   };
 
   const updateWalletAddress = async ({
-    addressId,
+    address,
     blockHeight,
     amount,
     contract,
-    currency,
+    currencyCode,
     decimals,
   }: {
-    addressId: string;
+    address: string;
     blockHeight: number;
-    amount: string;
-    contract: string;
-    currency: string;
+    amount: string | number;
+    contract?: string;
+    currencyCode: string;
     decimals: number;
   }): Promise<CryptopayTransaction> => {
-    await CryptoTransactions.updateOne(
+    const addressId = [address, contract].filter(Boolean).join(':');
+    return CryptoTransactions.findOneAndUpdate(
       {
-        _id: addressId.toLowerCase(),
+        _id: addressId,
       },
       {
         $setOnInsert: {
-          _id: addressId.toLowerCase(),
-          currency,
-          contract,
+          _id: addressId,
           created: new Date(),
         },
         $set: {
+          currencyCode,
           decimals,
           blockHeight,
           mostRecentBlockHeight: blockHeight,
-          amount: mongodb.Decimal128.fromString(amount),
+          amount: mongodb.Decimal128.fromString(typeof amount === 'number' ? `${amount}` : amount),
           updated: new Date(),
         },
       },
-      { upsert: true },
+      { upsert: true, returnDocument: 'after' },
     );
-
-    return CryptoTransactions.findOne({ _id: addressId.toLowerCase() });
   };
 
   return {
@@ -126,6 +130,6 @@ export default {
   },
 };
 
-export type CryptopayModule = {
+export interface CryptopayModule {
   cryptopay: ReturnType<typeof configureCryptopayModule>;
-};
+}