@unchainedshop/plugins 4.0.0-rc.8 → 4.0.0

package/src/payment/datatrans-v2/handler-fastify.ts

@@ -10,7 +10,7 @@ const {
   DATATRANS_SECURITY = Security.DYNAMIC_SIGN,
 } = process.env;
 
-const logger = createLogger('unchained:core-payment:datatrans:handler');
+const logger = createLogger('unchained:datatrans:handler');
 
 export const datatransHandler: RouteHandlerMethod = async (
   req: FastifyRequest & {
@@ -21,6 +21,12 @@ export const datatransHandler: RouteHandlerMethod = async (
   const resolvedContext = req.unchainedContext as Context;
   const { modules, services } = resolvedContext;
   const signature = req.headers['datatrans-signature'] as string;
+
+  if (!DATATRANS_SIGN_KEY && !DATATRANS_SIGN2_KEY) {
+    logger.warn('No sign key configured');
+    return reply.send({ success: false, message: 'No sign key configured', name: 'NO_SIGN_KEY' });
+  }
+
   if (signature) {
     const [rawTimestamp, rawHash] = signature.split(',');
     const [, hash] = rawHash.split('=');
@@ -28,13 +34,13 @@ export const datatransHandler: RouteHandlerMethod = async (
 
     const comparableSignature = await generateSignature({
       security: DATATRANS_SECURITY as any,
-      signKey: DATATRANS_SIGN2_KEY || DATATRANS_SIGN_KEY,
+      signKey: DATATRANS_SIGN2_KEY! || DATATRANS_SIGN_KEY!,
     })(timestamp, req.body as string);
 
     if (hash !== comparableSignature) {
-      logger.error(`hash mismatch: ${signature} / ${comparableSignature}`, req.body as string);
+      logger.error(`hash mismatch: ${signature} / ${comparableSignature}`);
       reply.status(403);
-      return reply.send('Hash mismatch');
+      return reply.send({ success: false, message: 'Invalid Signature', name: 'HASH_MISMATCH' });
     }
 
     const transaction: StatusResponseSuccess = JSON.parse(req.body as string) as StatusResponseSuccess;
@@ -70,6 +76,9 @@ export const datatransHandler: RouteHandlerMethod = async (
           const order = await services.orders.checkoutOrder(orderPayment.orderId, {
             paymentContext: { userId, transactionId: transaction.transactionId },
           });
+
+          if (!order) throw new Error(`Order with id ${orderPayment.orderId} not found`);
+
           reply.status(200);
           logger.info(`confirmed checkout for order ${order.orderNumber}`, {
             orderId: order._id,
@@ -77,9 +86,9 @@ export const datatransHandler: RouteHandlerMethod = async (
           return reply.send(order);
         }
       } catch (e) {
-        logger.error(`rejected to checkout with message`, e);
+        logger.error(e);
         reply.status(500);
-        return reply.send({ name: e.name, code: e.code, message: e.message });
+        return reply.send({ success: false, name: e.name, code: e.code, message: e.message });
       }
     }
   }

package/src/payment/datatrans-v2/index.ts

@@ -19,8 +19,10 @@ import {
   PaymentPricingSheet,
   OrderPricingSheet,
 } from '@unchainedshop/core';
+import { Order, OrderPayment } from '@unchainedshop/core-orders';
+import { PaymentConfiguration } from '@unchainedshop/core-payment';
 
-const logger = createLogger('unchained:core-payment:datatrans');
+const logger = createLogger('unchained:datatrans');
 
 // v2
 const {
@@ -43,6 +45,56 @@ const throwIfResponseError = (result) => {
   }
 };
 
+const getMarketplaceSplits = async ({
+  order,
+  orderPayment,
+  config,
+}: {
+  order: Order;
+  orderPayment: OrderPayment;
+  config: PaymentConfiguration;
+}): Promise<
+  {
+    subMerchantId: string;
+    amount: number;
+    commission: number;
+  }[]
+> => {
+  const pricingForOrderPayment = PaymentPricingSheet({
+    calculation: orderPayment.calculation,
+    currencyCode: order.currencyCode,
+  });
+  const pricing = OrderPricingSheet({
+    calculation: order.calculation,
+    currencyCode: order.currencyCode,
+  });
+
+  const { amount: total } = pricing.total({ useNetPrice: false });
+
+  return Promise.all(
+    config
+      .filter((item) => item.key === 'marketplaceSplit')
+      .map((item) => {
+        const [subMerchantId, staticDiscountId, sharePercentage] =
+          item.value || ''.split(';').map((f) => f.trim());
+
+        const { amount: discountSum } = pricingForOrderPayment.total({
+          category: PaymentPricingRowCategory.Discount,
+          discountId: staticDiscountId,
+        });
+        const shareFactor = sharePercentage ? parseInt(sharePercentage, 10) / 100 : 1;
+        const amount = Math.round(total * shareFactor);
+        const commission = Math.round(discountSum * -1 * shareFactor);
+
+        return {
+          subMerchantId,
+          amount,
+          commission,
+        };
+      }),
+  );
+};
+
 const Datatrans: IPaymentAdapter = {
   ...PaymentAdapter,
 
@@ -67,8 +119,11 @@ const Datatrans: IPaymentAdapter = {
     };
 
     const api = () => {
-      if (!DATATRANS_SECRET) throw new Error('Credentials not Set');
-      return createDatatransAPI(DATATRANS_API_ENDPOINT, getMerchantId(), DATATRANS_SECRET);
+      const merchantId = getMerchantId();
+      if (!DATATRANS_SECRET) throw new Error('Credential DATATRANS_SECRET not Set');
+      if (!merchantId) throw new Error('Credential Merchant ID not configured');
+      if (!DATATRANS_API_ENDPOINT) throw new Error('Credential DATATRANS_API_ENDPOINT not Set');
+      return createDatatransAPI(DATATRANS_API_ENDPOINT, merchantId!, DATATRANS_SECRET);
     };
 
     const shouldSettleInUnchained = () => {
@@ -78,58 +133,21 @@ const Datatrans: IPaymentAdapter = {
       }, true);
     };
 
-    const getMarketplaceSplits = async (): Promise<
-      {
-        subMerchantId: string;
-        amount: number;
-        commission: number;
-      }[]
-    > => {
+    const authorize = async ({ paymentCredentials, ...arbitraryFields }): Promise<string> => {
       const { order, orderPayment } = context;
 
-      const pricingForOrderPayment = PaymentPricingSheet({
-        calculation: orderPayment.calculation,
-        currencyCode: order.currencyCode,
-      });
-      const pricing = OrderPricingSheet({
-        calculation: order.calculation,
-        currencyCode: order.currencyCode,
-      });
-
-      const { amount: total } = pricing.total({ useNetPrice: false });
-
-      return Promise.all(
-        config
-          .filter((item) => item.key === 'marketplaceSplit')
-          .map((item) => {
-            const [subMerchantId, staticDiscountId, sharePercentage] = item.value
-              .split(';')
-              .map((f) => f.trim());
-
-            const { amount: discountSum } = pricingForOrderPayment.total({
-              category: PaymentPricingRowCategory.Discount,
-              discountId: staticDiscountId,
-            });
-            const shareFactor = sharePercentage ? parseInt(sharePercentage, 10) / 100 : 1;
-            const amount = Math.round(total * shareFactor);
-            const commission = Math.round(discountSum * -1 * shareFactor);
-
-            return {
-              subMerchantId,
-              amount,
-              commission,
-            };
-          }),
-      );
-    };
+      if (!orderPayment) throw new Error('Order Payment missing in context');
+      if (!order) throw new Error('Order missing in context');
 
-    const authorize = async ({ paymentCredentials, ...arbitraryFields }): Promise<string> => {
-      const { order, orderPayment } = context;
       const refno = Buffer.from(orderPayment._id, 'hex').toString('base64');
       const userId = order?.userId || context?.userId;
       const refno2 = userId;
       const { currencyCode, amount } = roundedAmountFromOrder(order);
-      const splits = await getMarketplaceSplits();
+      const splits = await getMarketplaceSplits({
+        orderPayment,
+        order,
+        config,
+      });
       const result = await api().authorize({
         ...arbitraryFields,
         amount,
@@ -158,6 +176,7 @@ const Datatrans: IPaymentAdapter = {
       ...arbitraryFields
     }): Promise<string> => {
       const { order } = context;
+      if (!order) throw new Error('Order missing in context');
       const { currencyCode, amount } = roundedAmountFromOrder(order);
       const result = await api().authorizeAuthenticated({
         ...arbitraryFields,
@@ -174,6 +193,7 @@ const Datatrans: IPaymentAdapter = {
 
     const isTransactionAmountValid = (transaction: StatusResponseSuccess): boolean => {
       const { order } = context;
+      if (!order) throw new Error('Order missing in context');
       const { currencyCode, amount } = roundedAmountFromOrder(order);
       if (
         transaction.currency !== currencyCode ||
@@ -207,9 +227,15 @@ const Datatrans: IPaymentAdapter = {
     };
 
     const settle = async ({ transactionId, refno, refno2, extensions }): Promise<boolean> => {
-      const { order } = context;
+      const { order, orderPayment } = context;
+      if (!orderPayment) throw new Error('Order Payment missing in context');
+      if (!order) throw new Error('Order missing in context');
       const { currencyCode, amount } = roundedAmountFromOrder(order);
-      const splits = await getMarketplaceSplits();
+      const splits = await getMarketplaceSplits({
+        orderPayment,
+        order,
+        config,
+      });
       const result = await api().settle({
         transactionId,
         amount,
@@ -320,6 +346,9 @@ const Datatrans: IPaymentAdapter = {
       async confirm() {
         if (!shouldSettleInUnchained()) return false;
         const { orderPayment, transactionContext } = context;
+
+        if (!orderPayment) throw new Error('Order Payment missing in context');
+
         const { transactionId } = orderPayment;
 
         const { extensions } = transactionContext || {};
@@ -350,6 +379,9 @@ const Datatrans: IPaymentAdapter = {
       async cancel() {
         if (!shouldSettleInUnchained()) return false;
         const { orderPayment } = context;
+
+        if (!orderPayment) throw new Error('Order Payment missing in context');
+
         const { transactionId } = orderPayment;
         if (!transactionId) {
           return false;

package/src/payment/paypal-checkout.ts

@@ -17,7 +17,7 @@ try {
   /* */
 }
 
-const logger = createLogger('unchained:core-payment:paypal-checkout');
+const logger = createLogger('unchained:paypal-checkout');
 
 const { PAYPAL_CLIENT_ID, PAYPAL_SECRET, PAYPAL_ENVIRONMENT = 'sandbox' } = process.env;
 
@@ -72,12 +72,14 @@ const PaypalCheckout: IPaymentAdapter = {
       },
 
       sign: async () => {
-        return PAYPAL_CLIENT_ID;
+        return PAYPAL_CLIENT_ID || null;
       },
 
       charge: async ({ orderID }) => {
         const { order } = context;
 
+        if (!order) throw new Error('Order missing in payment context');
+
         if (!orderID) {
           throw new Error('You have to provide orderID in paymentContext');
         }

package/src/payment/payrexx/api/index.ts

@@ -51,7 +51,7 @@ const createPayrexxAPI = (instance: string, secret: string) => {
       throw new Error(await result.text());
     },
 
-    async getGateway(id): Promise<GatewayObject> {
+    async getGateway(id): Promise<GatewayObject | null> {
       const result = await fetchPayrexx(`Gateway/${id}`, 'GET');
       if (!result.ok) throw new Error(await result.text());
       const { status, data } = await result.json();

package/src/payment/payrexx/api/makeFetcher.ts

@@ -6,8 +6,8 @@ const logger = createLogger('unchained:payrexx');
 
 export default (
   baseUrl = 'https://api.payrexx.com/v1.0/',
-  instance: string = null,
-  secret: string = null,
+  instance: string,
+  secret: string,
 ): ((path: string, method: 'GET' | 'DELETE' | 'PUT' | 'POST', data?: any) => Promise<Response>) => {
   if (MOCK_APIS) {
     return async (path): Promise<Response> => {

package/src/payment/payrexx/handler-express.ts

@@ -1,7 +1,7 @@
 import { Context } from '@unchainedshop/api';
 import { createLogger } from '@unchainedshop/logger';
 
-const logger = createLogger('unchained:core-payment:payrexx:handler');
+const logger = createLogger('unchained:payrexx:handler');
 
 export const payrexxHandler = async (request, response) => {
   const resolvedContext = request.unchainedContext as Context;
@@ -13,26 +13,20 @@ export const payrexxHandler = async (request, response) => {
     logger.info(`unhandled event type`, {
       type: Object.keys(request.body).join(','),
     });
-    response.writeHead(200);
-    response.end(
-      JSON.stringify({
-        ignored: true,
-        message: `Unhandled event type: ${Object.keys(request.body).join(',')}. Supported type: transaction`,
-      }),
-    );
+    response.status(200).send({
+      ignored: true,
+      message: `Unhandled event type: ${Object.keys(request.body).join(',')}. Supported type: transaction`,
+    });
     return;
   }
   if (transaction.referenceId === '__IGNORE_WEBHOOK__' || transaction.status === 'waiting') {
     // Ignore confirmed transactions, because those hooks are generated through calling the confirm()
     // method in the payment adapter and could lead to double bookings.
     logger.info(`unhandled transaction state: ${transaction.status}`);
-    response.writeHead(200);
-    response.end(
-      JSON.stringify({
-        ignored: true,
-        message: `Unhandled transaction state: ${transaction.status}`,
-      }),
-    );
+    response.status(200).send({
+      ignored: true,
+      message: `Unhandled transaction state: ${transaction.status}`,
+    });
     return;
   }
 
@@ -53,14 +47,11 @@ export const payrexxHandler = async (request, response) => {
         paymentProviderId,
         userId,
       });
-      response.writeHead(200);
-      response.end(
-        JSON.stringify({
-          message: 'registration successful',
-          paymentProviderId,
-          userId,
-        }),
-      );
+      response.status(200).send({
+        message: 'registration successful',
+        paymentProviderId,
+        userId,
+      });
     } else {
       const { referenceId: orderPaymentId, invoice } = transaction;
       logger.info(`checkout with orderPaymentId: ${orderPaymentId}`);
@@ -79,23 +70,24 @@ export const payrexxHandler = async (request, response) => {
           gatewayId: invoice.paymentRequestId,
         },
       });
+      if (!order) throw new Error(`Order with id ${orderPayment.orderId} not found`);
+
       logger.info(`checkout successful`, {
         orderPaymentId,
         orderId: order._id,
       });
-      response.writeHead(200);
-      response.end(
-        JSON.stringify({
-          message: 'checkout successful',
-          orderId: order._id,
-        }),
-      );
+      response.status(200).send({
+        message: 'checkout successful',
+        orderId: order._id,
+      });
     }
   } catch (error) {
     logger.error(error, {
       transactionId: transaction.id,
     });
-    response.writeHead(500);
-    response.end(error.message);
+    response.status(500).send({
+      message: error.message,
+      name: error.name,
+    });
   }
 };

package/src/payment/payrexx/handler-fastify.ts

@@ -2,42 +2,39 @@ import { Context } from '@unchainedshop/api';
 import { createLogger } from '@unchainedshop/logger';
 import { FastifyRequest, RouteHandlerMethod } from 'fastify';
 
-const logger = createLogger('unchained:core-payment:payrexx:handler');
+const logger = createLogger('unchained:payrexx:handler');
 
 export const payrexxHandler: RouteHandlerMethod = async (
   request: FastifyRequest & {
     unchainedContext: Context;
-  },
+  } & { body: Record<string, any> },
   reply,
 ) => {
   const resolvedContext = request.unchainedContext as Context;
   const { modules, services } = resolvedContext;
 
-  const { transaction } = request.body as Record<string, any>;
-
+  const { transaction } = request.body;
   if (!transaction) {
     logger.info(`unhandled event type`, {
       type: Object.keys(request.body).join(','),
     });
     reply.status(200);
-    return reply.send(
-      JSON.stringify({
-        ignored: true,
-        message: `Unhandled event type: ${Object.keys(request.body).join(',')}. Supported type: transaction`,
-      }),
-    );
+    return reply.send({
+      success: false,
+      ignored: true,
+      message: `Unhandled event type: ${Object.keys(request.body).join(',')}. Supported type: transaction`,
+    });
   }
   if (transaction.referenceId === '__IGNORE_WEBHOOK__' || transaction.status === 'waiting') {
     // Ignore confirmed transactions, because those hooks are generated through calling the confirm()
     // method in the payment adapter and could lead to double bookings.
     logger.info(`unhandled transaction state: ${transaction.status}`);
     reply.status(200);
-    return reply.send(
-      JSON.stringify({
-        ignored: true,
-        message: `Unhandled transaction state: ${transaction.status}`,
-      }),
-    );
+    return reply.send({
+      success: false,
+      ignored: true,
+      message: `Unhandled transaction state: ${transaction.status}`,
+    });
   }
 
   logger.info(`Processing event`, {
@@ -58,19 +55,14 @@ export const payrexxHandler: RouteHandlerMethod = async (
         userId,
       });
       reply.status(200);
-      return reply.send(
-        JSON.stringify({
-          message: 'registration successful',
-          paymentProviderId,
-          userId,
-        }),
-      );
+      return reply.send({
+        success: true,
+        paymentProviderId,
+        userId,
+      });
     } else {
       const { referenceId: orderPaymentId, invoice } = transaction;
       logger.info(`checkout with orderPaymentId: ${orderPaymentId}`);
-      await modules.orders.payments.logEvent(orderPaymentId, {
-        transactionId: transaction.id,
-      });
       const orderPayment = await modules.orders.payments.findOrderPayment({
         orderPaymentId,
       });
@@ -78,28 +70,36 @@ export const payrexxHandler: RouteHandlerMethod = async (
         throw new Error(`order payment not found with orderPaymentId: ${orderPaymentId}`);
       }
 
+      await modules.orders.payments.logEvent(orderPaymentId, {
+        transactionId: transaction.id,
+      });
+
       const order = await services.orders.checkoutOrder(orderPayment.orderId, {
         paymentContext: {
           gatewayId: invoice.paymentRequestId,
         },
       });
+      if (!order) throw new Error(`Order with id ${orderPayment.orderId} not found`);
+
       logger.info(`checkout successful`, {
         orderPaymentId,
         orderId: order._id,
       });
       reply.status(200);
-      return reply.send(
-        JSON.stringify({
-          message: 'checkout successful',
-          orderId: order._id,
-        }),
-      );
+      return reply.send({
+        success: true,
+        orderId: order._id,
+      });
     }
   } catch (error) {
     logger.error(error, {
       transactionId: transaction.id,
     });
     reply.status(500);
-    return reply.send(error.message);
+    return reply.send({
+      success: false,
+      message: error.message,
+      name: error.name,
+    });
   }
 };

package/src/payment/payrexx/index.ts

@@ -9,7 +9,7 @@ import {
   PaymentError,
 } from '@unchainedshop/core';
 
-const logger = createLogger('unchained:core-payment:payrexx');
+const logger = createLogger('unchained:payrexx');
 
 const Payrexx: IPaymentAdapter = {
   ...PaymentAdapter,
@@ -25,11 +25,7 @@ const Payrexx: IPaymentAdapter = {
   actions: (config, context) => {
     const { modules } = context;
 
-    const getInstance = () => {
-      return config.find((c) => c.key === 'instance')?.value;
-    };
-
-    const api = createPayrexxAPI(getInstance(), process.env.PAYREXX_SECRET);
+    const instance = config.find((c) => c.key === 'instance')?.value;
 
     const adapterActions = {
       ...PaymentAdapter.actions(config, context),
@@ -38,7 +34,7 @@ const Payrexx: IPaymentAdapter = {
         if (!process.env.PAYREXX_SECRET) {
           return PaymentError.INCOMPLETE_CONFIGURATION;
         }
-        if (!getInstance()) {
+        if (!instance) {
           return PaymentError.INCOMPLETE_CONFIGURATION;
         }
         return null;
@@ -55,6 +51,11 @@ const Payrexx: IPaymentAdapter = {
 
       sign: async (transactionContext = {}) => {
         const { orderPayment, userId, order } = context;
+
+        if (!order) throw new Error('No order in context, can only sign with order context');
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
+
         if (orderPayment) {
           // Order Checkout signing (One-time payment)
           const pricing = OrderPricingSheet({
@@ -70,7 +71,10 @@ const Payrexx: IPaymentAdapter = {
         }
 
         // Payment Credential Registration signing
-        const user = await modules.users.findUserById(userId);
+
+        const user = userId && (await modules.users.findUserById(userId));
+        if (!user) throw new Error('User not found, can only sign registrations with user context');
+
         const emailAddress = modules.users.primaryEmail(user)?.address;
         const gateway = await api.createGateway(
           mapUserToGatewayObject({
@@ -107,11 +111,13 @@ const Payrexx: IPaymentAdapter = {
 
       async confirm() {
         const { orderPayment } = context;
-        const { transactionId } = orderPayment;
 
-        if (!transactionId) {
+        if (!orderPayment?.transactionId) {
           return false;
         }
+        const { transactionId } = orderPayment;
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
 
         const gatewayObject = await api.getGateway(transactionId);
 
@@ -140,10 +146,12 @@ const Payrexx: IPaymentAdapter = {
 
       async cancel() {
         const { orderPayment } = context;
-        const { transactionId } = orderPayment;
-        if (!transactionId) {
+        if (!orderPayment?.transactionId) {
           return false;
         }
+        const { transactionId } = orderPayment;
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
 
         const gatewayObject = await api.getGateway(transactionId);
 
@@ -170,10 +178,12 @@ const Payrexx: IPaymentAdapter = {
           throw new Error('You have to provide gatewayId or paymentCredentials');
         }
 
-        const { order } = context;
-        const orderPayment = await modules.orders.payments.findOrderPayment({
-          orderPaymentId: order.paymentId,
-        });
+        const { order, orderPayment } = context;
+
+        if (!order) throw new Error('No order in context, can only charge with order context');
+        if (!orderPayment) throw new Error('Order payment not found');
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
 
         const gatewayObject = await api.getGateway(gatewayId);
 

package/src/payment/postfinance-checkout/api-client.ts

@@ -1,5 +1,3 @@
-import crypto from 'crypto';
-
 const API_BASE_URL = 'https://checkout.postfinance.ch/api';
 
 interface ApiConfig {
@@ -22,7 +20,7 @@ export class PostFinanceApiClient {
     this.config = config;
   }
 
-  private generateMacHeaders(method: string, path: string): MacHeaders {
+  private async generateMacHeaders(method: string, path: string): Promise<MacHeaders> {
     const version = '1';
     const timestamp = Math.floor(Date.now() / 1000).toString();
     const userId = this.config.userId.toString();
@@ -32,10 +30,17 @@ export class PostFinanceApiClient {
 
     const dataToSign = [version, userId, timestamp, method, resourcePath].join('|');
 
-    const macValue = crypto
-      .createHmac('sha512', Buffer.from(this.config.apiSecret, 'base64'))
-      .update(dataToSign, 'utf8')
-      .digest('base64');
+    // Use Web Crypto API instead of crypto.createHmac
+    const secretBytes = Uint8Array.from(atob(this.config.apiSecret), (c) => c.charCodeAt(0));
+    const key = await crypto.subtle.importKey(
+      'raw',
+      secretBytes,
+      { name: 'HMAC', hash: 'SHA-512' },
+      false,
+      ['sign'],
+    );
+    const signature = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(dataToSign));
+    const macValue = btoa(String.fromCharCode(...new Uint8Array(signature)));
 
     return {
       'x-mac-version': version,
@@ -50,7 +55,7 @@ export class PostFinanceApiClient {
     const urlObj = new URL(url);
     // Include both pathname and search (query parameters) for MAC signature
     const pathWithQuery = urlObj.pathname + urlObj.search;
-    const macHeaders = this.generateMacHeaders(method, pathWithQuery);
+    const macHeaders = await this.generateMacHeaders(method, pathWithQuery);
 
     const headers: Record<string, string> = {
       ...macHeaders,