@unchainedshop/plugins 4.0.0-rc.2 → 4.0.0-rc.21

package/src/payment/payrexx/handler-fastify.ts

@@ -2,42 +2,39 @@ import { Context } from '@unchainedshop/api';
 import { createLogger } from '@unchainedshop/logger';
 import { FastifyRequest, RouteHandlerMethod } from 'fastify';
 
-const logger = createLogger('unchained:core-payment:payrexx:handler');
+const logger = createLogger('unchained:payrexx:handler');
 
 export const payrexxHandler: RouteHandlerMethod = async (
   request: FastifyRequest & {
     unchainedContext: Context;
-  },
+  } & { body: Record<string, any> },
   reply,
 ) => {
   const resolvedContext = request.unchainedContext as Context;
   const { modules, services } = resolvedContext;
 
-  const { transaction } = request.body as Record<string, any>;
-
+  const { transaction } = request.body;
   if (!transaction) {
     logger.info(`unhandled event type`, {
       type: Object.keys(request.body).join(','),
     });
     reply.status(200);
-    return reply.send(
-      JSON.stringify({
-        ignored: true,
-        message: `Unhandled event type: ${Object.keys(request.body).join(',')}. Supported type: transaction`,
-      }),
-    );
+    return reply.send({
+      success: false,
+      ignored: true,
+      message: `Unhandled event type: ${Object.keys(request.body).join(',')}. Supported type: transaction`,
+    });
   }
   if (transaction.referenceId === '__IGNORE_WEBHOOK__' || transaction.status === 'waiting') {
     // Ignore confirmed transactions, because those hooks are generated through calling the confirm()
     // method in the payment adapter and could lead to double bookings.
     logger.info(`unhandled transaction state: ${transaction.status}`);
     reply.status(200);
-    return reply.send(
-      JSON.stringify({
-        ignored: true,
-        message: `Unhandled transaction state: ${transaction.status}`,
-      }),
-    );
+    return reply.send({
+      success: false,
+      ignored: true,
+      message: `Unhandled transaction state: ${transaction.status}`,
+    });
   }
 
   logger.info(`Processing event`, {
@@ -58,19 +55,14 @@ export const payrexxHandler: RouteHandlerMethod = async (
         userId,
       });
       reply.status(200);
-      return reply.send(
-        JSON.stringify({
-          message: 'registration successful',
-          paymentProviderId,
-          userId,
-        }),
-      );
+      return reply.send({
+        success: true,
+        paymentProviderId,
+        userId,
+      });
     } else {
       const { referenceId: orderPaymentId, invoice } = transaction;
       logger.info(`checkout with orderPaymentId: ${orderPaymentId}`);
-      await modules.orders.payments.logEvent(orderPaymentId, {
-        transactionId: transaction.id,
-      });
       const orderPayment = await modules.orders.payments.findOrderPayment({
         orderPaymentId,
       });
@@ -78,28 +70,36 @@ export const payrexxHandler: RouteHandlerMethod = async (
         throw new Error(`order payment not found with orderPaymentId: ${orderPaymentId}`);
       }
 
+      await modules.orders.payments.logEvent(orderPaymentId, {
+        transactionId: transaction.id,
+      });
+
       const order = await services.orders.checkoutOrder(orderPayment.orderId, {
         paymentContext: {
           gatewayId: invoice.paymentRequestId,
         },
       });
+      if (!order) throw new Error(`Order with id ${orderPayment.orderId} not found`);
+
       logger.info(`checkout successful`, {
         orderPaymentId,
         orderId: order._id,
       });
       reply.status(200);
-      return reply.send(
-        JSON.stringify({
-          message: 'checkout successful',
-          orderId: order._id,
-        }),
-      );
+      return reply.send({
+        success: true,
+        orderId: order._id,
+      });
     }
   } catch (error) {
     logger.error(error, {
       transactionId: transaction.id,
     });
     reply.status(500);
-    return reply.send(error.message);
+    return reply.send({
+      success: false,
+      message: error.message,
+      name: error.name,
+    });
   }
 };

package/src/payment/payrexx/index.ts

@@ -9,7 +9,7 @@ import {
   PaymentError,
 } from '@unchainedshop/core';
 
-const logger = createLogger('unchained:core-payment:payrexx');
+const logger = createLogger('unchained:payrexx');
 
 const Payrexx: IPaymentAdapter = {
   ...PaymentAdapter,
@@ -25,11 +25,7 @@ const Payrexx: IPaymentAdapter = {
   actions: (config, context) => {
     const { modules } = context;
 
-    const getInstance = () => {
-      return config.find((c) => c.key === 'instance')?.value;
-    };
-
-    const api = createPayrexxAPI(getInstance(), process.env.PAYREXX_SECRET);
+    const instance = config.find((c) => c.key === 'instance')?.value;
 
     const adapterActions = {
       ...PaymentAdapter.actions(config, context),
@@ -38,7 +34,7 @@ const Payrexx: IPaymentAdapter = {
         if (!process.env.PAYREXX_SECRET) {
           return PaymentError.INCOMPLETE_CONFIGURATION;
         }
-        if (!getInstance()) {
+        if (!instance) {
           return PaymentError.INCOMPLETE_CONFIGURATION;
         }
         return null;
@@ -55,6 +51,11 @@ const Payrexx: IPaymentAdapter = {
 
       sign: async (transactionContext = {}) => {
         const { orderPayment, userId, order } = context;
+
+        if (!order) throw new Error('No order in context, can only sign with order context');
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
+
         if (orderPayment) {
           // Order Checkout signing (One-time payment)
           const pricing = OrderPricingSheet({
@@ -70,7 +71,10 @@ const Payrexx: IPaymentAdapter = {
         }
 
         // Payment Credential Registration signing
-        const user = await modules.users.findUserById(userId);
+
+        const user = userId && (await modules.users.findUserById(userId));
+        if (!user) throw new Error('User not found, can only sign registrations with user context');
+
         const emailAddress = modules.users.primaryEmail(user)?.address;
         const gateway = await api.createGateway(
           mapUserToGatewayObject({
@@ -107,11 +111,13 @@ const Payrexx: IPaymentAdapter = {
 
       async confirm() {
         const { orderPayment } = context;
-        const { transactionId } = orderPayment;
 
-        if (!transactionId) {
+        if (!orderPayment?.transactionId) {
           return false;
         }
+        const { transactionId } = orderPayment;
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
 
         const gatewayObject = await api.getGateway(transactionId);
 
@@ -140,10 +146,12 @@ const Payrexx: IPaymentAdapter = {
 
       async cancel() {
         const { orderPayment } = context;
-        const { transactionId } = orderPayment;
-        if (!transactionId) {
+        if (!orderPayment?.transactionId) {
           return false;
         }
+        const { transactionId } = orderPayment;
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
 
         const gatewayObject = await api.getGateway(transactionId);
 
@@ -170,10 +178,12 @@ const Payrexx: IPaymentAdapter = {
           throw new Error('You have to provide gatewayId or paymentCredentials');
         }
 
-        const { order } = context;
-        const orderPayment = await modules.orders.payments.findOrderPayment({
-          orderPaymentId: order.paymentId,
-        });
+        const { order, orderPayment } = context;
+
+        if (!order) throw new Error('No order in context, can only charge with order context');
+        if (!orderPayment) throw new Error('Order payment not found');
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
 
         const gatewayObject = await api.getGateway(gatewayId);
 

package/src/payment/postfinance-checkout/api-client.ts

@@ -0,0 +1,111 @@
+const API_BASE_URL = 'https://checkout.postfinance.ch/api';
+
+interface ApiConfig {
+  spaceId: number;
+  userId: number;
+  apiSecret: string;
+}
+
+interface MacHeaders {
+  'x-mac-version': string;
+  'x-mac-userid': string;
+  'x-mac-timestamp': string;
+  'x-mac-value': string;
+}
+
+export class PostFinanceApiClient {
+  private config: ApiConfig;
+
+  constructor(config: ApiConfig) {
+    this.config = config;
+  }
+
+  private async generateMacHeaders(method: string, path: string): Promise<MacHeaders> {
+    const version = '1';
+    const timestamp = Math.floor(Date.now() / 1000).toString();
+    const userId = this.config.userId.toString();
+
+    // Use path as-is since it already includes /api from the URL
+    const resourcePath = path;
+
+    const dataToSign = [version, userId, timestamp, method, resourcePath].join('|');
+
+    // Use Web Crypto API instead of crypto.createHmac
+    const secretBytes = Uint8Array.from(atob(this.config.apiSecret), (c) => c.charCodeAt(0));
+    const key = await crypto.subtle.importKey(
+      'raw',
+      secretBytes,
+      { name: 'HMAC', hash: 'SHA-512' },
+      false,
+      ['sign'],
+    );
+    const signature = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(dataToSign));
+    const macValue = btoa(String.fromCharCode(...new Uint8Array(signature)));
+
+    return {
+      'x-mac-version': version,
+      'x-mac-userid': userId,
+      'x-mac-timestamp': timestamp,
+      'x-mac-value': macValue,
+    };
+  }
+
+  async request<T>(method: string, endpoint: string, body?: any): Promise<T> {
+    const url = `${API_BASE_URL}${endpoint}`;
+    const urlObj = new URL(url);
+    // Include both pathname and search (query parameters) for MAC signature
+    const pathWithQuery = urlObj.pathname + urlObj.search;
+    const macHeaders = await this.generateMacHeaders(method, pathWithQuery);
+
+    const headers: Record<string, string> = {
+      ...macHeaders,
+      'Content-Type': 'application/json',
+      Accept: 'application/json',
+    };
+
+    const options: RequestInit = {
+      method,
+      headers,
+    };
+
+    if (body && method !== 'GET') {
+      options.body = JSON.stringify(body);
+    }
+
+    const response = await fetch(url, options);
+
+    if (!response.ok) {
+      const errorData = await response.json().catch(() => ({}));
+      throw new Error(
+        `PostFinance API error: ${response.status} ${response.statusText} ${JSON.stringify(errorData)}`,
+      );
+    }
+
+    const responseText = await response.text();
+    const contentType = response.headers.get('content-type');
+
+    if (contentType && contentType.includes('application/json')) {
+      try {
+        return JSON.parse(responseText);
+      } catch {
+        // If JSON parsing fails but content-type is json, return as text
+        // This handles PostFinance's payment-page-url endpoint that returns plain text with json content-type
+        return responseText as any;
+      }
+    } else {
+      return responseText as any;
+    }
+  }
+
+  get<T>(endpoint: string): Promise<T> {
+    return this.request<T>('GET', endpoint);
+  }
+
+  post<T>(endpoint: string, body: any): Promise<T> {
+    return this.request<T>('POST', endpoint, body);
+  }
+
+  patch<T>(endpoint: string, body: any): Promise<T> {
+    return this.request<T>('PATCH', endpoint, body);
+  }
+}

package/src/payment/postfinance-checkout/api-types.ts

@@ -0,0 +1,111 @@
+// PostFinance Checkout API Types
+
+export enum TransactionState {
+  CREATE = 'CREATE',
+  PENDING = 'PENDING',
+  CONFIRMED = 'CONFIRMED',
+  PROCESSING = 'PROCESSING',
+  FAILED = 'FAILED',
+  AUTHORIZED = 'AUTHORIZED',
+  VOIDED = 'VOIDED',
+  COMPLETED = 'COMPLETED',
+  FULFILL = 'FULFILL',
+  DECLINE = 'DECLINE',
+}
+
+export enum TokenizationMode {
+  FORCE_UPDATE = 'FORCE_UPDATE',
+  ALLOW = 'ALLOW',
+  ALLOW_ONE_CLICK_PAYMENT = 'ALLOW_ONE_CLICK_PAYMENT',
+  DENY = 'DENY',
+}
+
+export enum TransactionCompletionBehavior {
+  COMPLETE_IMMEDIATELY = 'COMPLETE_IMMEDIATELY',
+  COMPLETE_DEFERRED = 'COMPLETE_DEFERRED',
+  USE_CONFIGURATION = 'USE_CONFIGURATION',
+}
+
+export enum LineItemType {
+  SHIPPING = 'SHIPPING',
+  DISCOUNT = 'DISCOUNT',
+  FEE = 'FEE',
+  PRODUCT = 'PRODUCT',
+  TIP = 'TIP',
+}
+
+export enum RefundType {
+  MERCHANT_INITIATED_ONLINE = 'MERCHANT_INITIATED_ONLINE',
+  MERCHANT_INITIATED_OFFLINE = 'MERCHANT_INITIATED_OFFLINE',
+  CUSTOMER_INITIATED_AUTOMATIC = 'CUSTOMER_INITIATED_AUTOMATIC',
+  CUSTOMER_INITIATED_MANUAL = 'CUSTOMER_INITIATED_MANUAL',
+}
+
+export enum CreationEntityState {
+  CREATE = 'CREATE',
+  ACTIVE = 'ACTIVE',
+  INACTIVE = 'INACTIVE',
+  DELETING = 'DELETING',
+  DELETED = 'DELETED',
+}
+
+export interface LineItem {
+  name: string;
+  type: LineItemType;
+  quantity: number;
+  uniqueId: string;
+  amountIncludingTax: number;
+}
+
+export interface TransactionCreate {
+  currency: string;
+  customerId?: string;
+  tokenizationMode?: TokenizationMode;
+  completionBehavior?: TransactionCompletionBehavior;
+  lineItems?: LineItem[];
+  successUrl?: string;
+  failedUrl?: string;
+  metaData?: Record<string, any>;
+}
+
+export interface Transaction {
+  id: number;
+  state: TransactionState;
+  currency: string;
+  completedAmount?: number;
+  authorizationAmount?: number;
+  metaData?: Record<string, any>;
+  token?: {
+    id: number;
+    [key: string]: any;
+  };
+}
+
+export interface TransactionCompletion {
+  id: number;
+  state: string;
+  transaction: number;
+  linkedTransaction?: number;
+}
+
+export interface Token {
+  id: number;
+  state: CreationEntityState;
+  name?: string;
+  customerId?: string;
+  enabledForOneClickPayment?: boolean;
+}
+
+export interface RefundCreate {
+  transaction: number;
+  externalId: string;
+  amount: number;
+  type: RefundType;
+}
+
+export interface Refund {
+  id: number;
+  state: string;
+  amount: number;
+  transaction: number;
+}

package/src/payment/postfinance-checkout/api.ts

@@ -1,91 +1,55 @@
-import * as pf from 'postfinancecheckout';
+import { PostFinanceApiClient } from './api-client.js';
+import {
+  Transaction,
+  TransactionCreate,
+  TransactionCompletion,
+  Token,
+  RefundCreate,
+  RefundType,
+} from './api-types.js';
 
-const { PostFinanceCheckout } = pf;
 const { PFCHECKOUT_SPACE_ID, PFCHECKOUT_USER_ID, PFCHECKOUT_SECRET } = process.env;
 const SPACE_ID = parseInt(PFCHECKOUT_SPACE_ID as string, 10);
 const USER_ID = parseInt(PFCHECKOUT_USER_ID as string, 10);
 
-const getConfig = () => {
-  return {
-    space_id: SPACE_ID,
-    user_id: USER_ID,
-    api_secret: PFCHECKOUT_SECRET,
-  };
-};
-
-const getTransactionService = () => {
-  return new PostFinanceCheckout.api.TransactionService(getConfig());
-};
-
-const getTransactionCompletionService = () => {
-  return new PostFinanceCheckout.api.TransactionCompletionService(getConfig());
-};
-
-const getTransactionVoidService = () => {
-  return new PostFinanceCheckout.api.TransactionVoidService(getConfig());
-};
-
-const getRefundService = () => {
-  return new PostFinanceCheckout.api.RefundService(getConfig());
-};
-
-const getTransactionPaymentPageService = () => {
-  return new PostFinanceCheckout.api.TransactionPaymentPageService(getConfig());
-};
-
-const getTransactionIframeService = () => {
-  return new PostFinanceCheckout.api.TransactionIframeService(getConfig());
-};
+let apiClient: PostFinanceApiClient;
 
-const getTransactionLightboxService = () => {
-  return new PostFinanceCheckout.api.TransactionLightboxService(getConfig());
+const getApiClient = () => {
+  if (!apiClient) {
+    apiClient = new PostFinanceApiClient({
+      spaceId: SPACE_ID,
+      userId: USER_ID,
+      apiSecret: PFCHECKOUT_SECRET as string,
+    });
+  }
+  return apiClient;
 };
 
-const getTokenService = () => {
-  return new PostFinanceCheckout.api.TokenService(getConfig());
+export const getTransaction = async (transactionId: string): Promise<Transaction> => {
+  const client = getApiClient();
+  return client.get<Transaction>(`/transaction/read?spaceId=${SPACE_ID}&id=${transactionId}`);
 };
 
-export const getTransaction = async (
-  transactionId: string,
-): Promise<pf.PostFinanceCheckout.model.Transaction> => {
-  const transactionService = getTransactionService();
-  const transaction = await transactionService.read(SPACE_ID, parseInt(transactionId, 10));
-  return transaction.body;
+export const getTransactionCompletion = async (id: string): Promise<TransactionCompletion> => {
+  const client = getApiClient();
+  return client.get<TransactionCompletion>(`/transaction-completion/read?spaceId=${SPACE_ID}&id=${id}`);
 };
 
-export const getTransactionCompletion = async (
-  entityId: string,
-): Promise<pf.PostFinanceCheckout.model.TransactionCompletion> => {
-  const transactionCompletionService = getTransactionCompletionService();
-  const transactionCompletion = await transactionCompletionService.read(
-    SPACE_ID,
-    parseInt(entityId, 10),
-  );
-  return transactionCompletion.body;
+export const getToken = async (spaceId: number, tokenId: number): Promise<Token> => {
+  const client = getApiClient();
+  return client.get<Token>(`/token/read?spaceId=${spaceId || SPACE_ID}&id=${tokenId}`);
 };
 
-export const getToken = async (
-  spaceId: number,
-  tokenId: number,
-): Promise<pf.PostFinanceCheckout.model.Token> => {
-  const tokenService = getTokenService();
-  const token = await tokenService.read(spaceId || SPACE_ID, tokenId);
-  return token.body;
-};
-
-export const createTransaction = async (
-  transaction: pf.PostFinanceCheckout.model.TransactionCreate,
-): Promise<number | null> => {
-  const transactionService = getTransactionService();
-  const transactionCreateRes = await transactionService.create(SPACE_ID, transaction);
-  const transactionCreate = transactionCreateRes.body;
-  return transactionCreate.id || null;
+export const createTransaction = async (transaction: TransactionCreate): Promise<number | null> => {
+  const client = getApiClient();
+  const result = await client.post<Transaction>(`/transaction/create?spaceId=${SPACE_ID}`, transaction);
+  return result.id || null;
 };
 
 export const voidTransaction = async (transactionId: string): Promise<boolean> => {
-  const transactionVoidService = getTransactionVoidService();
+  const client = getApiClient();
   try {
-    await transactionVoidService.voidOnline(SPACE_ID, parseInt(transactionId, 10));
+    await client.post(`/transaction-void/voidOnline?spaceId=${SPACE_ID}&id=${transactionId}`, {});
     return true;
   } catch {
     return false;
@@ -97,15 +61,15 @@ export const refundTransaction = async (
   orderId: string,
   amount: number,
 ): Promise<boolean> => {
-  const refundService = getRefundService();
-  const refund: pf.PostFinanceCheckout.model.RefundCreate = {
+  const client = getApiClient();
+  const refund: RefundCreate = {
     transaction: parseInt(transactionId, 10),
     externalId: orderId,
     amount,
-    type: PostFinanceCheckout.model.RefundType.MERCHANT_INITIATED_ONLINE,
+    type: RefundType.MERCHANT_INITIATED_ONLINE,
   };
   try {
-    await refundService.refund(SPACE_ID, refund);
+    await client.post(`/refund/refund?spaceId=${SPACE_ID}`, refund);
     return true;
   } catch {
     return false;
@@ -113,9 +77,12 @@ export const refundTransaction = async (
 };
 
 export const confirmDeferredTransaction = async (transactionId: string): Promise<boolean> => {
-  const transactionCompletionService = getTransactionCompletionService();
+  const client = getApiClient();
   try {
-    await transactionCompletionService.completeOnline(SPACE_ID, parseInt(transactionId, 10));
+    await client.post(
+      `/transaction-completion/completeOnline?spaceId=${SPACE_ID}&transactionId=${transactionId}`,
+      {},
+    );
     return true;
   } catch {
     return false;
@@ -123,19 +90,25 @@ export const confirmDeferredTransaction = async (transactionId: string): Promise
 };
 
 export const getPaymentPageUrl = async (transactionId: number): Promise<string> => {
-  const transactionPaymentPageService = getTransactionPaymentPageService();
-  const paymentPageUrl = await transactionPaymentPageService.paymentPageUrl(SPACE_ID, transactionId);
-  return paymentPageUrl.body;
+  const client = getApiClient();
+  const result = await client.get<string>(
+    `/transaction-payment-page/payment-page-url?spaceId=${SPACE_ID}&id=${transactionId}`,
+  );
+  return result;
 };
 
 export const getLightboxJavascriptUrl = async (transactionId: number): Promise<string> => {
-  const transactionLightboxService = getTransactionLightboxService();
-  const javascriptUrl = await transactionLightboxService.javascriptUrl(SPACE_ID, transactionId);
-  return javascriptUrl.body;
+  const client = getApiClient();
+  const result = await client.get<string>(
+    `/transaction-lightbox/javascript-url?spaceId=${SPACE_ID}&id=${transactionId}`,
+  );
+  return result;
 };
 
 export const getIframeJavascriptUrl = async (transactionId: number): Promise<string> => {
-  const transactionIframeService = getTransactionIframeService();
-  const javascriptUrl = await transactionIframeService.javascriptUrl(SPACE_ID, transactionId);
-  return javascriptUrl.body;
+  const client = getApiClient();
+  const result = await client.get<string>(
+    `/transaction-iframe/javascript-url?spaceId=${SPACE_ID}&id=${transactionId}`,
+  );
+  return result;
 };