@unchainedshop/plugins 4.0.0-rc.9 → 4.0.1

package/src/payment/payrexx/index.ts

@@ -9,7 +9,7 @@ import {
   PaymentError,
 } from '@unchainedshop/core';
 
-const logger = createLogger('unchained:core-payment:payrexx');
+const logger = createLogger('unchained:payrexx');
 
 const Payrexx: IPaymentAdapter = {
   ...PaymentAdapter,
@@ -25,11 +25,7 @@ const Payrexx: IPaymentAdapter = {
   actions: (config, context) => {
     const { modules } = context;
 
-    const getInstance = () => {
-      return config.find((c) => c.key === 'instance')?.value;
-    };
-
-    const api = createPayrexxAPI(getInstance(), process.env.PAYREXX_SECRET);
+    const instance = config.find((c) => c.key === 'instance')?.value;
 
     const adapterActions = {
       ...PaymentAdapter.actions(config, context),
@@ -38,7 +34,7 @@ const Payrexx: IPaymentAdapter = {
         if (!process.env.PAYREXX_SECRET) {
           return PaymentError.INCOMPLETE_CONFIGURATION;
         }
-        if (!getInstance()) {
+        if (!instance) {
           return PaymentError.INCOMPLETE_CONFIGURATION;
         }
         return null;
@@ -55,6 +51,11 @@ const Payrexx: IPaymentAdapter = {
 
       sign: async (transactionContext = {}) => {
         const { orderPayment, userId, order } = context;
+
+        if (!order) throw new Error('No order in context, can only sign with order context');
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
+
         if (orderPayment) {
           // Order Checkout signing (One-time payment)
           const pricing = OrderPricingSheet({
@@ -70,7 +71,10 @@ const Payrexx: IPaymentAdapter = {
         }
 
         // Payment Credential Registration signing
-        const user = await modules.users.findUserById(userId);
+
+        const user = userId && (await modules.users.findUserById(userId));
+        if (!user) throw new Error('User not found, can only sign registrations with user context');
+
         const emailAddress = modules.users.primaryEmail(user)?.address;
         const gateway = await api.createGateway(
           mapUserToGatewayObject({
@@ -107,11 +111,13 @@ const Payrexx: IPaymentAdapter = {
 
       async confirm() {
         const { orderPayment } = context;
-        const { transactionId } = orderPayment;
 
-        if (!transactionId) {
+        if (!orderPayment?.transactionId) {
           return false;
         }
+        const { transactionId } = orderPayment;
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
 
         const gatewayObject = await api.getGateway(transactionId);
 
@@ -140,10 +146,12 @@ const Payrexx: IPaymentAdapter = {
 
       async cancel() {
         const { orderPayment } = context;
-        const { transactionId } = orderPayment;
-        if (!transactionId) {
+        if (!orderPayment?.transactionId) {
           return false;
         }
+        const { transactionId } = orderPayment;
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
 
         const gatewayObject = await api.getGateway(transactionId);
 
@@ -170,10 +178,12 @@ const Payrexx: IPaymentAdapter = {
           throw new Error('You have to provide gatewayId or paymentCredentials');
         }
 
-        const { order } = context;
-        const orderPayment = await modules.orders.payments.findOrderPayment({
-          orderPaymentId: order.paymentId,
-        });
+        const { order, orderPayment } = context;
+
+        if (!order) throw new Error('No order in context, can only charge with order context');
+        if (!orderPayment) throw new Error('Order payment not found');
+
+        const api = createPayrexxAPI(instance!, process.env.PAYREXX_SECRET!);
 
         const gatewayObject = await api.getGateway(gatewayId);
 

package/src/payment/postfinance-checkout/api-client.ts

@@ -1,5 +1,3 @@
-import crypto from 'crypto';
-
 const API_BASE_URL = 'https://checkout.postfinance.ch/api';
 
 interface ApiConfig {
@@ -22,7 +20,7 @@ export class PostFinanceApiClient {
     this.config = config;
   }
 
-  private generateMacHeaders(method: string, path: string): MacHeaders {
+  private async generateMacHeaders(method: string, path: string): Promise<MacHeaders> {
     const version = '1';
     const timestamp = Math.floor(Date.now() / 1000).toString();
     const userId = this.config.userId.toString();
@@ -32,10 +30,17 @@ export class PostFinanceApiClient {
 
     const dataToSign = [version, userId, timestamp, method, resourcePath].join('|');
 
-    const macValue = crypto
-      .createHmac('sha512', Buffer.from(this.config.apiSecret, 'base64'))
-      .update(dataToSign, 'utf8')
-      .digest('base64');
+    // Use Web Crypto API instead of crypto.createHmac
+    const secretBytes = Uint8Array.from(atob(this.config.apiSecret), (c) => c.charCodeAt(0));
+    const key = await crypto.subtle.importKey(
+      'raw',
+      secretBytes,
+      { name: 'HMAC', hash: 'SHA-512' },
+      false,
+      ['sign'],
+    );
+    const signature = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(dataToSign));
+    const macValue = btoa(String.fromCharCode(...new Uint8Array(signature)));
 
     return {
       'x-mac-version': version,
@@ -50,7 +55,7 @@ export class PostFinanceApiClient {
     const urlObj = new URL(url);
     // Include both pathname and search (query parameters) for MAC signature
     const pathWithQuery = urlObj.pathname + urlObj.search;
-    const macHeaders = this.generateMacHeaders(method, pathWithQuery);
+    const macHeaders = await this.generateMacHeaders(method, pathWithQuery);
 
     const headers: Record<string, string> = {
       ...macHeaders,

package/src/payment/postfinance-checkout/handler-express.ts

@@ -3,7 +3,7 @@ import { createLogger } from '@unchainedshop/logger';
 import { WebhookData } from './types.js';
 import { getTransaction, getTransactionCompletion } from './api.js';
 
-const logger = createLogger('unchained:core-payment:postfinance-checkout:handler');
+const logger = createLogger('unchained:postfinance-checkout:handler');
 
 export const postfinanceCheckoutHandler = async (req, res) => {
   const context = req.unchainedContext as Context;
@@ -26,19 +26,19 @@ export const postfinanceCheckoutHandler = async (req, res) => {
           transactionId: transactionCompletion.linkedTransaction,
         },
       });
+
+      if (!order) throw new Error(`Order with id ${orderPayment.orderId} not found`);
+
       logger.info(
-        `Transaction ${transactionCompletion.linkedTransaction} marked order payment ID ${transaction.metaData.orderPaymentId} as paid`,
+        `Transaction ${transactionCompletion.linkedTransaction} marked order payment ID ${transaction.metaData?.orderPaymentId} as paid`,
       );
-      res.writeHead(200);
-      res.end(`Order marked as paid: ${order.orderNumber}`);
+      res.status(200).send(`Order marked as paid: ${order.orderNumber}`);
     } catch (e) {
       logger.error(e);
-      res.writeHead(500);
-      res.end(JSON.stringify({ name: e.name, code: e.code, message: e.message }));
+      res.status(500).send({ name: e.name, code: e.code, message: e.message });
     }
   } else {
     logger.error(`Received unknown listenerEntityTechnicalName ${data.listenerEntityTechnicalName}`);
-    res.writeHead(404);
-    res.end();
+    res.status(404).end();
   }
 };

package/src/payment/postfinance-checkout/handler-fastify.ts

@@ -4,7 +4,7 @@ import { WebhookData } from './types.js';
 import { getTransaction, getTransactionCompletion } from './api.js';
 import { FastifyRequest, RouteHandlerMethod } from 'fastify';
 
-const logger = createLogger('unchained:core-payment:postfinance-checkout:handler');
+const logger = createLogger('unchained:postfinance-checkout:handler');
 
 export const postfinanceCheckoutHandler: RouteHandlerMethod = async (
   req: FastifyRequest & {
@@ -32,15 +32,18 @@ export const postfinanceCheckoutHandler: RouteHandlerMethod = async (
           transactionId: transaction.id,
         },
       });
+
+      if (!order) throw new Error(`Order with id ${orderPayment.orderId} not found`);
+
       logger.info(
-        `Transaction ${transaction.id} marked order payment ID ${transaction.metaData.orderPaymentId} as paid`,
+        `Transaction ${transaction.id} marked order payment ID ${transaction.metaData?.orderPaymentId} as paid`,
       );
       reply.status(200);
-      return reply.send(`Order marked as paid: ${order.orderNumber}`);
+      return reply.send({ success: true, orderNumber: order.orderNumber });
     } catch (e) {
       logger.error(e);
       reply.status(500);
-      return reply.send({ name: e.name, code: e.code, message: e.message });
+      return reply.send({ success: false, name: e.name, code: e.code, message: e.message });
     }
   } else {
     logger.error(`Received unknown listenerEntityTechnicalName ${data.listenerEntityTechnicalName}`);

package/src/payment/postfinance-checkout/index.ts

@@ -40,7 +40,7 @@ const {
   PFCHECKOUT_FAILED_URL,
 } = process.env;
 
-const logger = createLogger('unchained:core-payment:postfinance-checkout');
+const logger = createLogger('unchained:postfinance-checkout');
 
 const newError = ({ code, message }: { code: string; message: string }) => {
   const error = new Error(message);
@@ -104,6 +104,10 @@ const PostfinanceCheckout: IPaymentAdapter = {
       sign: async (transactionContext: any = {}) => {
         const { orderPayment, order } = context;
 
+        if (!order) throw new Error('No order in context, can only sign with order context');
+        if (!orderPayment)
+          throw new Error('No order payment in context, can only sign with order payment context');
+
         const { integrationMode = IntegrationModes.PaymentPage }: { integrationMode: IntegrationModes } =
           transactionContext;
         const completionMode = adapter.getCompletionMode();
@@ -146,7 +150,10 @@ const PostfinanceCheckout: IPaymentAdapter = {
         }
 
         const transactionId = await createTransaction(transaction);
-        let location = null;
+
+        if (!transactionId) throw new Error('Could not create transaction');
+
+        let location: string | null = null;
         if (integrationMode === IntegrationModes.PaymentPage) {
           location = await getPaymentPageUrl(transactionId);
         } else if (integrationMode === IntegrationModes.Lightbox) {
@@ -185,7 +192,11 @@ const PostfinanceCheckout: IPaymentAdapter = {
           });
         }
 
-        const isPaid = await orderIsPaid(context.order, transaction);
+        const { order, orderPayment } = context;
+        if (!orderPayment) throw new Error('No order payment in context, cannot charge payment');
+        if (!order) throw new Error('No order in context, can only sign with order context');
+
+        const isPaid = await orderIsPaid(order, transaction);
         if (!isPaid) {
           logger.error(`Transaction #${transactionId}: Invalid state / Amount incorrect`);
           throw newError({
@@ -194,7 +205,7 @@ const PostfinanceCheckout: IPaymentAdapter = {
           });
         }
 
-        if (transaction.metaData.orderPaymentId !== context.orderPayment._id) {
+        if (transaction.metaData?.orderPaymentId !== orderPayment._id) {
           logger.error(`Transaction #${transactionId}: Invalid state / Amount incorrect`);
           throw newError({
             code: `TRANSACTION_ALREADY_USED`,
@@ -216,10 +227,11 @@ const PostfinanceCheckout: IPaymentAdapter = {
 
       cancel: async () => {
         const { orderPayment, order } = context;
-        const { transactionId } = orderPayment;
-        if (!transactionId) {
+        if (!order) throw new Error('No order in context, can only cancel with order context');
+        if (!orderPayment?.transactionId) {
           return false;
         }
+        const { transactionId } = orderPayment;
         const transaction = await getTransaction(transactionId);
         const refund = transaction.state === TransactionState.FULFILL;
         const pricing = OrderPricingSheet({
@@ -237,10 +249,10 @@ const PostfinanceCheckout: IPaymentAdapter = {
 
       confirm: async () => {
         const { orderPayment } = context;
-        const { transactionId } = orderPayment;
-        if (!transactionId) {
+        if (!orderPayment?.transactionId) {
           return false;
         }
+        const { transactionId } = orderPayment;
         const transaction = await getTransaction(transactionId);
         if (transaction.state === TransactionState.AUTHORIZED) {
           return confirmDeferredTransaction(transactionId);

package/src/payment/saferpay/adapter.ts

@@ -133,8 +133,8 @@ export const WordlineSaferpay: IPaymentAdapter = {
           saferpayTransactionId,
         );
 
-        paymentPageInitInput.Notification.SuccessNotifyUrl = addTransactionId(
-          paymentPageInitInput.Notification.SuccessNotifyUrl,
+        paymentPageInitInput.Notification!.SuccessNotifyUrl = addTransactionId(
+          paymentPageInitInput.Notification!.SuccessNotifyUrl,
           saferpayTransactionId,
         );
 
@@ -166,6 +166,10 @@ export const WordlineSaferpay: IPaymentAdapter = {
           mongodb.ObjectId.createFromHexString(transactionId),
         );
 
+        if (!saferpayTransaction?.token) {
+          throw new Error('No initialized transaction Token');
+        }
+
         const api = createSaferPayClient();
         const paymentPageAssert = await api.paymentPageAssert(orderPayment, {
           Token: saferpayTransaction.token,
@@ -205,6 +209,10 @@ export const WordlineSaferpay: IPaymentAdapter = {
           mongodb.ObjectId.createFromHexString(transactionId),
         );
 
+        if (!saferpayTransaction?.token) {
+          throw new Error('No initialized transaction Token');
+        }
+
         const api = createSaferPayClient();
         const paymentPageAssert = await api.paymentPageAssert(orderPayment, {
           Token: saferpayTransaction.token,
@@ -236,6 +244,10 @@ export const WordlineSaferpay: IPaymentAdapter = {
           mongodb.ObjectId.createFromHexString(transactionId),
         );
 
+        if (!saferpayTransaction?.token) {
+          throw new Error('No initialized transaction Token');
+        }
+
         const api = createSaferPayClient();
         const paymentPageAssert = await api.paymentPageAssert(orderPayment, {
           Token: saferpayTransaction.token,

package/src/payment/saferpay/handler-express.ts

@@ -3,7 +3,7 @@ import { createLogger } from '@unchainedshop/logger';
 import { buildSignature } from './buildSignature.js';
 import { SaferpayTransactionsModule } from './module.js';
 
-const logger = createLogger('unchained:core-payment:saferpay:handler');
+const logger = createLogger('unchained:saferpay:handler');
 
 export const saferpayHandler = async (request, response) => {
   const resolvedContext = request.unchainedContext as Context & {
@@ -22,8 +22,7 @@ export const saferpayHandler = async (request, response) => {
 
   if ((request.method !== 'GET' && request.method !== 'HEAD') || !isValidRequest) {
     logger.warn(`unhandled http method ${request.method} or orderPaymentId missing in query`);
-    response.writeHead(404);
-    response.end();
+    response.status(404).end();
     return;
   }
 
@@ -47,24 +46,26 @@ export const saferpayHandler = async (request, response) => {
         transactionId,
       },
     });
+
+    if (!order) throw new Error(`Order with id ${orderPayment.orderId} not found`);
+
     logger.info(`checkout successful`, {
       orderPaymentId,
       orderId: order._id,
     });
-    response.writeHead(200);
-    response.end(
-      JSON.stringify({
-        message: 'checkout successful',
-        orderPaymentId,
-        orderId: order._id,
-      }),
-    );
+    response.status(200).send({
+      message: 'checkout successful',
+      orderPaymentId,
+      orderId: order._id,
+    });
   } catch (error) {
     logger.error(error, {
       orderPaymentId,
       transactionId,
     });
-    response.writeHead(500);
-    response.end(error.message);
+    response.status(500).send({
+      message: error.message,
+      name: error.name,
+    });
   }
 };

package/src/payment/saferpay/handler-fastify.ts

@@ -4,7 +4,7 @@ import { buildSignature } from './buildSignature.js';
 import { SaferpayTransactionsModule } from './module.js';
 import { FastifyRequest, RouteHandlerMethod } from 'fastify';
 
-const logger = createLogger('unchained:core-payment:saferpay:handler');
+const logger = createLogger('unchained:saferpay:handler');
 
 export const saferpayHandler: RouteHandlerMethod = async (
   request: FastifyRequest & {
@@ -52,24 +52,29 @@ export const saferpayHandler: RouteHandlerMethod = async (
         transactionId,
       },
     });
+
+    if (!order) throw new Error(`Order with id ${orderPayment.orderId} not found`);
+
     logger.info(`checkout successful`, {
       orderPaymentId,
       orderId: order._id,
     });
     reply.status(200);
-    return reply.send(
-      JSON.stringify({
-        message: 'checkout successful',
-        orderPaymentId,
-        orderId: order._id,
-      }),
-    );
+    return reply.send({
+      success: true,
+      orderPaymentId,
+      orderId: order._id,
+    });
   } catch (error) {
     logger.error(error, {
       orderPaymentId,
       transactionId,
     });
     reply.status(500);
-    return reply.send(error.message);
+    return reply.send({
+      success: false,
+      message: error.message,
+      name: error.name,
+    });
   }
 };

package/src/payment/stripe/handler-express.ts

@@ -2,7 +2,7 @@ import { Context } from '@unchainedshop/api';
 import { createLogger } from '@unchainedshop/logger';
 import stripeClient from './stripe.js';
 
-const logger = createLogger('unchained:core-payment:stripe:handler');
+const logger = createLogger('unchained:stripe:handler');
 
 export const WebhookEventTypes = {
   PAYMENT_INTENT_SUCCEEDED: 'payment_intent.succeeded',
@@ -18,11 +18,19 @@ export const stripeHandler = async (request, response) => {
   try {
     const stripe = stripeClient();
     const sig = request.headers['stripe-signature'];
+    if (!sig) {
+      throw new Error('stripe-signature header was not provided for webhook');
+    }
+    if (!process.env.STRIPE_ENDPOINT_SECRET) {
+      throw new Error('env STRIPE_ENDPOINT_SECRET is required for webhook handling');
+    }
     event = stripe.webhooks.constructEvent(request.body, sig, process.env.STRIPE_ENDPOINT_SECRET);
   } catch (err) {
     logger.error(`Error constructing event: ${err.message}`);
-    response.writeHead(400);
-    response.end(err.message);
+    response.status(400).send({
+      message: err.message,
+      name: err.name,
+    });
     return;
   }
 
@@ -30,13 +38,10 @@ export const stripeHandler = async (request, response) => {
     logger.info(`unhandled event type`, {
       type: event.type,
     });
-    response.writeHead(200);
-    response.end(
-      JSON.stringify({
-        ignored: true,
-        message: `Unhandled event type: ${event.type}. Supported types: ${Object.values(WebhookEventTypes).join(', ')}`,
-      }),
-    );
+    response.status(200).send({
+      ignored: true,
+      message: `Unhandled event type: ${event.type}. Supported types: ${Object.values(WebhookEventTypes).join(', ')}`,
+    });
     return;
   }
 
@@ -47,13 +52,10 @@ export const stripeHandler = async (request, response) => {
       type: event.type,
       environment: environmentInMetadata,
     });
-    response.writeHead(200);
-    response.end(
-      JSON.stringify({
-        ignored: true,
-        message: `Unhandled event environment: ${environmentInMetadata}. Supported environment: ${environmentInEnv}`,
-      }),
-    );
+    response.status(200).send({
+      ignored: true,
+      message: `Unhandled event environment: ${environmentInMetadata}. Supported environment: ${environmentInEnv}`,
+    });
     return;
   }
 
@@ -84,18 +86,17 @@ export const stripeHandler = async (request, response) => {
         },
       });
 
+      if (!order) throw new Error(`Order with id ${orderPayment.orderId} not found`);
+
       logger.info(`checkout successful`, {
         orderPaymentId,
         orderId: order._id,
         type: event.type,
       });
-      response.writeHead(200);
-      response.end(
-        JSON.stringify({
-          message: 'checkout successful',
-          orderId: order._id,
-        }),
-      );
+      response.status(200).send({
+        message: 'checkout successful',
+        orderId: order._id,
+      });
     } else if (event.type === WebhookEventTypes.SETUP_INTENT_SUCCEEDED) {
       const setupIntent = event.data.object;
       const { paymentProviderId, userId } = setupIntent.metadata || {};
@@ -118,19 +119,18 @@ export const stripeHandler = async (request, response) => {
         paymentCredentialsId: paymentCredentials?._id,
         type: event.type,
       });
-      response.writeHead(200);
-      response.end(
-        JSON.stringify({
-          message: 'payment credentials registration successful',
-          paymentCredentialsId: paymentCredentials?._id,
-        }),
-      );
+      response.status(200).send({
+        message: 'payment credentials registration successful',
+        paymentCredentialsId: paymentCredentials?._id,
+      });
     }
   } catch (error) {
     logger.error(error, {
       type: event.type,
     });
-    response.writeHead(500);
-    response.end(error.message);
+    response.status(500).send({
+      message: error.message,
+      name: error.name,
+    });
   }
 };