@unchainedshop/plugins 4.5.0 → 4.6.0

package/README.md

@@ -123,6 +123,32 @@ const platform = await startPlatform({
 });
 ```
 
+## Security
+
+### Payment Plugin Security
+
+All payment plugins implement secure tokenization patterns for PCI DSS SAQ-A eligibility:
+
+| Plugin | Security Method |
+|--------|-----------------|
+| Stripe | PaymentIntent/SetupIntent tokenization |
+| Datatrans | Secure Fields with HMAC-SHA-256 signatures |
+| Saferpay | Redirect with SHA-256 transaction signatures |
+| PayPal | Order ID references |
+| Braintree | Client SDK tokenization |
+| Cryptopay | BIP-32 HD wallet address derivation |
+
+**Signature Algorithms:**
+- HMAC-SHA-256: Datatrans, Payrexx, GridFS file uploads
+- HMAC-SHA-512: PostFinance Checkout
+- SHA-256: Saferpay
+
+### FIPS 140-3 Compatibility
+
+All cryptographic operations use FIPS-approved algorithms. When deployed on FIPS-enabled Node.js (e.g., Chainguard node-fips), plugins operate in FIPS-compliant mode.
+
+See [SECURITY.md](../../SECURITY.md) for complete security documentation.
+
 ## Notes
 
 ### Postfinance Checkout Plugin

package/lib/files/gridfs/adapter.js

@@ -8,7 +8,6 @@ import { filesSettings } from '@unchainedshop/core-files';
 import {} from '@unchainedshop/core';
 import {} from "./index.js";
 const { GRIDFS_PUT_SERVER_PATH = '/gridfs' } = process.env;
-const { ROOT_URL } = process.env;
 const bufferToStream = (buffer) => {
     const stream = new Readable();
     stream.push(buffer);
@@ -32,7 +31,7 @@ export const GridFSAdapter = {
         const expiryDate = resolveExpirationDate();
         const hashedFilename = await buildHashedFilename(directoryName, fileName, expiryDate);
         const signature = await sign(directoryName, hashedFilename, expiryDate.getTime());
-        const putURL = new URL(`${GRIDFS_PUT_SERVER_PATH}/${directoryName}/${encodeURIComponent(fileName)}?e=${expiryDate.getTime()}&s=${signature}`, ROOT_URL).href;
+        const putURL = new URL(`${GRIDFS_PUT_SERVER_PATH}/${directoryName}/${encodeURIComponent(fileName)}?e=${expiryDate.getTime()}&s=${signature}`, process.env.ROOT_URL).href;
         const url = `${GRIDFS_PUT_SERVER_PATH}/${directoryName}/${hashedFilename}`;
         return {
             _id: hashedFilename,

package/lib/files/gridfs/handler-express.js

@@ -7,6 +7,7 @@ import {} from "./module.js";
 import {} from '@unchainedshop/api';
 import { createLogger } from '@unchainedshop/logger';
 import { getFileAdapter } from '@unchainedshop/core-files';
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const { ROOT_URL, GRIDFS_PUT_SERVER_PATH = '/gridfs' } = process.env;
 const logger = createLogger('unchained:gridfs');
 const gridfsHandler = async (req, res) => {
@@ -27,7 +28,8 @@ const gridfsHandler = async (req, res) => {
             const { s: signature, e: expiryTimestamp } = req.query;
             const expiryDate = new Date(parseInt(expiryTimestamp, 10));
             const fileId = await buildHashedFilename(directoryName, fileName, expiryDate);
-            if ((await sign(directoryName, fileId, expiryDate.getTime())) === signature) {
+            const expectedSignature = await sign(directoryName, fileId, expiryDate.getTime());
+            if (await timingSafeStringEqual(expectedSignature, signature)) {
                 const file = await modules.files.findFile({ fileId });
                 if (!file) {
                     res.status(404).send('File not found');
@@ -67,7 +69,10 @@ const gridfsHandler = async (req, res) => {
                 }
                 const fileUploadAdapter = getFileAdapter();
                 const signedUrl = await fileUploadAdapter.createDownloadURL(fileDocument, expiry);
-                if (!signedUrl || new URL(signedUrl, 'file://').searchParams.get('s') !== signature) {
+                const expectedSignature = signedUrl ? new URL(signedUrl, 'file://').searchParams.get('s') : null;
+                if (!signedUrl ||
+                    !expectedSignature ||
+                    !(await timingSafeStringEqual(expectedSignature, signature))) {
                     res.status(403).send('Access restricted: Invalid signature.');
                     return;
                 }

package/lib/files/gridfs/handler-fastify.js

@@ -7,6 +7,7 @@ import {} from "./module.js";
 import {} from '@unchainedshop/api';
 import { createLogger } from '@unchainedshop/logger';
 import { getFileAdapter } from '@unchainedshop/core-files';
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const logger = createLogger('unchained:gridfs');
 const { GRIDFS_PUT_SERVER_PATH = '/gridfs' } = process.env;
 const gridfsHandler = async (req, reply) => {
@@ -24,7 +25,8 @@ const gridfsHandler = async (req, reply) => {
             const { s: signature, e: expiryTimestamp } = req.query;
             const expiryDate = new Date(parseInt(expiryTimestamp, 10));
             const fileId = await buildHashedFilename(directoryName, fileName, expiryDate);
-            if ((await sign(directoryName, fileId, expiryDate.getTime())) === signature) {
+            const expectedSignature = await sign(directoryName, fileId, expiryDate.getTime());
+            if (await timingSafeStringEqual(expectedSignature, signature)) {
                 const file = await modules.files.findFile({ fileId });
                 if (!file) {
                     reply.status(404);
@@ -89,7 +91,10 @@ const gridfsHandler = async (req, reply) => {
                 }
                 const fileUploadAdapter = getFileAdapter();
                 const signedUrl = await fileUploadAdapter.createDownloadURL(fileDocument, expiry);
-                if (!signedUrl || new URL(signedUrl, 'file://').searchParams.get('s') !== signature) {
+                const expectedSignature = signedUrl ? new URL(signedUrl, 'file://').searchParams.get('s') : null;
+                if (!signedUrl ||
+                    !expectedSignature ||
+                    !(await timingSafeStringEqual(expectedSignature, signature))) {
                     reply.status(403);
                     logger.error('Invalid signature', { fileName, expiry });
                     return reply.send({

package/lib/files/minio/handler-express.js

@@ -1,16 +1,21 @@
 import { createLogger } from '@unchainedshop/logger';
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const logger = createLogger('unchained:minio');
 const { MINIO_WEBHOOK_AUTH_TOKEN } = process.env;
-const isAuthorized = ({ authorization = '' }) => {
+const isAuthorized = async ({ authorization = '' }) => {
+    if (!MINIO_WEBHOOK_AUTH_TOKEN)
+        return false;
     const [type, token] = authorization.split(' ');
-    return type === 'Bearer' && token === MINIO_WEBHOOK_AUTH_TOKEN;
+    if (type !== 'Bearer' || !token)
+        return false;
+    return timingSafeStringEqual(token, MINIO_WEBHOOK_AUTH_TOKEN);
 };
 const minioHandler = async (req, res) => {
     try {
         if (req.method === 'POST' && req.body) {
             const { headers } = req;
             const { Records = [], EventName } = req.body;
-            if (EventName === 's3:ObjectCreated:Put' && isAuthorized(headers)) {
+            if (EventName === 's3:ObjectCreated:Put' && (await isAuthorized(headers))) {
                 const [{ s3 }] = Records;
                 const { object } = s3;
                 const { size, contentType: type } = object;

package/lib/files/minio/handler-fastify.js

@@ -1,18 +1,23 @@
 import {} from '@unchainedshop/api';
 import { createLogger } from '@unchainedshop/logger';
 import {} from 'fastify';
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const logger = createLogger('unchained:minio');
 const { MINIO_WEBHOOK_AUTH_TOKEN } = process.env;
-const isAuthorized = ({ authorization = '' }) => {
+const isAuthorized = async ({ authorization = '' }) => {
+    if (!MINIO_WEBHOOK_AUTH_TOKEN)
+        return false;
     const [type, token] = authorization.split(' ');
-    return type === 'Bearer' && token === MINIO_WEBHOOK_AUTH_TOKEN;
+    if (type !== 'Bearer' || !token)
+        return false;
+    return timingSafeStringEqual(token, MINIO_WEBHOOK_AUTH_TOKEN);
 };
 const minioHandler = async (req, res) => {
     try {
         if (req.body) {
             const { headers } = req;
             const { Records = [], EventName } = req.body;
-            if (EventName === 's3:ObjectCreated:Put' && isAuthorized(headers)) {
+            if (EventName === 's3:ObjectCreated:Put' && (await isAuthorized(headers))) {
                 const [{ s3 }] = Records;
                 const { object } = s3;
                 const { size, contentType: type } = object;

package/lib/payment/apple-iap/adapter.js

@@ -104,7 +104,7 @@ const AppleIAP = {
                     orderId: order._id,
                 });
                 return {
-                    transactionIdentifier,
+                    transactionId: transactionIdentifier,
                 };
             },
         };

package/lib/payment/apple-iap/handler-express.js

@@ -23,11 +23,7 @@ export const appleIAPHandler = async (req, res) => {
             const transactions = responseBody?.unified_receipt?.latest_receipt_info;
             const latestTransaction = transactions[0];
             if (responseBody.notification_type === AppleNotificationTypes.INITIAL_BUY) {
-                const orderPayment = await modules.orders.payments.findOrderPaymentByContextData({
-                    context: {
-                        'meta.transactionIdentifier': latestTransaction.transaction_id,
-                    },
-                });
+                const orderPayment = await modules.orders.payments.findOrderPaymentByTransactionId(latestTransaction.transaction_id);
                 if (!orderPayment)
                     throw new Error('Could not find any matching order payment');
                 const order = await services.orders.checkoutOrder(orderPayment.orderId, {
@@ -54,11 +50,7 @@ export const appleIAPHandler = async (req, res) => {
                 });
             }
             else {
-                const originalOrderPayment = await modules.orders.payments.findOrderPaymentByContextData({
-                    context: {
-                        'meta.transactionIdentifier': latestTransaction.original_transaction_id,
-                    },
-                });
+                const originalOrderPayment = await modules.orders.payments.findOrderPaymentByTransactionId(latestTransaction.original_transaction_id);
                 if (!originalOrderPayment)
                     throw new Error('Could not find any matching order payment');
                 const originalOrder = await modules.orders.findOrder({
@@ -101,7 +93,7 @@ export const appleIAPHandler = async (req, res) => {
             return;
         }
         catch (e) {
-            logger.warn(`Apple IAP Webhook: ${e.message}`, e);
+            logger.warn(`Apple IAP Webhook: ${e.name} - ${e.message}`);
             res.status(503).send({ name: e.name, code: e.code, message: e.message });
             return;
         }

package/lib/payment/apple-iap/handler-fastify.js

@@ -24,11 +24,7 @@ export const appleIAPHandler = async (req, reply) => {
         const transactions = responseBody?.unified_receipt?.latest_receipt_info;
         const latestTransaction = transactions[0];
         if (responseBody.notification_type === AppleNotificationTypes.INITIAL_BUY) {
-            const orderPayment = await modules.orders.payments.findOrderPaymentByContextData({
-                context: {
-                    'meta.transactionIdentifier': latestTransaction.transaction_id,
-                },
-            });
+            const orderPayment = await modules.orders.payments.findOrderPaymentByTransactionId(latestTransaction.transaction_id);
             if (!orderPayment)
                 throw new Error('Could not find any matching order payment');
             const order = await services.orders.checkoutOrder(orderPayment.orderId, {
@@ -55,11 +51,7 @@ export const appleIAPHandler = async (req, reply) => {
             });
         }
         else {
-            const originalOrderPayment = await modules.orders.payments.findOrderPaymentByContextData({
-                context: {
-                    'meta.transactionIdentifier': latestTransaction.original_transaction_id,
-                },
-            });
+            const originalOrderPayment = await modules.orders.payments.findOrderPaymentByTransactionId(latestTransaction.original_transaction_id);
             if (!originalOrderPayment)
                 throw new Error('Could not find any matching order payment');
             const originalOrder = await modules.orders.findOrder({

package/lib/payment/cryptopay/handle-webhook.js

@@ -28,13 +28,23 @@ export default async function handleWebhook({ secret, wallet, price, ping, }, co
             }));
         if (orderPayment) {
             const order = await modules.orders.findOrder({ orderId: orderPayment.orderId });
+            if (!order) {
+                logger.error('Order not found for payment', { orderPaymentId, orderId: orderPayment.orderId });
+                throw new Error('Order not found');
+            }
             if (order.status === null) {
+                logger.info('Initiating checkout for new order', { orderId: order._id });
                 await services.orders.checkoutOrder(order._id, {});
             }
             else if (order.status === OrderStatus.PENDING) {
+                logger.info('Processing pending order after payment update', { orderId: order._id });
                 await services.orders.processOrder(order, {});
             }
             else {
+                logger.warn('Order already processed, ignoring webhook', {
+                    orderId: order._id,
+                    status: order.status,
+                });
                 throw new Error('Already processed');
             }
         }

package/lib/payment/datatrans-v2/handler-express.js

@@ -20,7 +20,7 @@ export const datatransHandler = async (req, res) => {
             signKey: DATATRANS_SIGN2_KEY || DATATRANS_SIGN_KEY,
         })(timestamp, req.body);
         if (hash !== comparableSignature) {
-            logger.error(`hash mismatch: ${signature} / ${comparableSignature}`, req.body);
+            logger.error(`hash mismatch: ${signature} / ${comparableSignature}`);
             res.status(403).send('Hash mismatch');
             return;
         }
@@ -61,7 +61,7 @@ export const datatransHandler = async (req, res) => {
                 }
             }
             catch (e) {
-                logger.error(`rejected to checkout with message`, e);
+                logger.error(`rejected to checkout: ${e.name} - ${e.message}`);
                 res.status(500).send({ name: e.name, code: e.code, message: e.message });
                 return;
             }

package/lib/payment/saferpay/adapter.js

@@ -2,7 +2,6 @@ import { mongodb } from '@unchainedshop/mongodb';
 import { SaferpayClient } from "./api/index.js";
 import { buildSignature } from "./buildSignature.js";
 import { OrderPricingSheet, PaymentAdapter, PaymentDirector, PaymentError, } from '@unchainedshop/core';
-const { SAFERPAY_BASE_URL = 'https://test.saferpay.com/api', SAFERPAY_CUSTOMER_ID, SAFERPAY_WEBHOOK_PATH = '/payment/saferpay/webhook', SAFERPAY_RETURN_PATH = '/saferpay/return', ROOT_URL = 'http://localhost:4010', EMAIL_WEBSITE_URL, SAFERPAY_USER, SAFERPAY_PW, } = process.env;
 const newSaferpayError = ({ code, message }) => {
     const error = new Error(message || code);
     error.name = `SAFERPAY_${code}`;
@@ -23,6 +22,7 @@ export const WordlineSaferpay = {
     },
     actions: (config, context) => {
         const { modules } = context;
+        const { SAFERPAY_BASE_URL = 'https://test.saferpay.com/api', SAFERPAY_CUSTOMER_ID, SAFERPAY_WEBHOOK_PATH = '/payment/saferpay/webhook', SAFERPAY_RETURN_PATH = '/saferpay/return', ROOT_URL = 'http://localhost:4010', EMAIL_WEBSITE_URL, SAFERPAY_USER, SAFERPAY_PW, } = process.env;
         const createSaferPayClient = () => {
             if (!SAFERPAY_CUSTOMER_ID || !SAFERPAY_USER || !SAFERPAY_PW)
                 throw new Error('Credentials not Set');

package/lib/payment/saferpay/handler-express.js

@@ -1,5 +1,6 @@
 import { createLogger } from '@unchainedshop/logger';
 import { buildSignature } from "./buildSignature.js";
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const logger = createLogger('unchained:saferpay:handler');
 export const saferpayHandler = async (request, response) => {
     const resolvedContext = request.unchainedContext;
@@ -25,7 +26,7 @@ export const saferpayHandler = async (request, response) => {
             throw new Error(`order payment not found with orderPaymentId: ${orderPaymentId}`);
         }
         const correctSignature = await buildSignature(transactionId, orderPaymentId);
-        if (correctSignature !== signature) {
+        if (!(await timingSafeStringEqual(correctSignature, signature))) {
             throw new Error('Invalid signature');
         }
         const order = await services.orders.checkoutOrder(orderPayment.orderId, {

package/lib/payment/saferpay/handler-fastify.js

@@ -1,5 +1,6 @@
 import { createLogger } from '@unchainedshop/logger';
 import { buildSignature } from "./buildSignature.js";
+import { timingSafeStringEqual } from '@unchainedshop/utils';
 const logger = createLogger('unchained:saferpay:handler');
 export const saferpayHandler = async (request, reply) => {
     const resolvedContext = request.unchainedContext;
@@ -25,7 +26,7 @@ export const saferpayHandler = async (request, reply) => {
             throw new Error(`order payment not found with orderPaymentId: ${orderPaymentId}`);
         }
         const correctSignature = await buildSignature(transactionId, orderPaymentId);
-        if (correctSignature !== signature) {
+        if (!(await timingSafeStringEqual(correctSignature, signature))) {
             throw new Error('Invalid signature');
         }
         const order = await services.orders.checkoutOrder(orderPayment.orderId, {

package/lib/pricing/order-items-discount.d.ts

@@ -1 +1,2 @@
-export {};
+import { type OrderDiscountConfiguration, type IOrderPricingAdapter } from '@unchainedshop/core';
+export declare const OrderItemsDiscount: IOrderPricingAdapter<OrderDiscountConfiguration>;

package/lib/pricing/order-items-discount.js

@@ -1,6 +1,6 @@
 import { ProductPricingSheet, OrderPricingDirector, OrderPricingAdapter, OrderPricingRowCategory, resolveRatioAndTaxDivisorForPricingSheet, } from '@unchainedshop/core';
 import { calculation as calcUtils } from '@unchainedshop/utils';
-const OrderItemsDiscount = {
+export const OrderItemsDiscount = {
     ...OrderPricingAdapter,
     key: 'shop.unchained.pricing.order-items-discount',
     version: '1.0.0',

package/lib/pricing/order-items.d.ts

@@ -1 +1,2 @@
-export {};
+import { type IOrderPricingAdapter } from '@unchainedshop/core';
+export declare const OrderItems: IOrderPricingAdapter;

package/lib/pricing/order-items.js

@@ -1,5 +1,5 @@
 import { OrderPricingDirector, OrderPricingAdapter, ProductPricingSheet, } from '@unchainedshop/core';
-const OrderItems = {
+export const OrderItems = {
     ...OrderPricingAdapter,
     key: 'shop.unchained.pricing.order-items',
     version: '1.0.0',

package/lib/pricing/order-payment.d.ts

@@ -1 +1,2 @@
-export {};
+import { type IOrderPricingAdapter } from '@unchainedshop/core';
+export declare const OrderPayment: IOrderPricingAdapter;

package/lib/pricing/order-payment.js

@@ -1,5 +1,5 @@
 import { OrderPricingDirector, OrderPricingAdapter, PaymentPricingSheet, } from '@unchainedshop/core';
-const OrderPayment = {
+export const OrderPayment = {
     ...OrderPricingAdapter,
     key: 'shop.unchained.pricing.order-payment',
     version: '1.0.0',

package/lib/pricing/product-catalog-price-options.d.ts

@@ -1 +1,2 @@
-export {};
+import { type IProductPricingAdapter } from '@unchainedshop/core';
+export declare const ProductPriceOptions: IProductPricingAdapter;

package/lib/pricing/product-catalog-price-options.js

@@ -1,5 +1,5 @@
 import { ProductPricingDirector, ProductPricingAdapter, } from '@unchainedshop/core';
-const ProductPrice = {
+export const ProductPriceOptions = {
     ...ProductPricingAdapter,
     key: 'shop.unchained.pricing.product-price-options',
     version: '1.0',
@@ -25,7 +25,7 @@ const ProductPrice = {
                         amount: itemTotal,
                         isTaxable: Boolean(price.isTaxable),
                         isNetPrice: Boolean(price.isNetPrice),
-                        meta: { adapter: ProductPrice.key },
+                        meta: { adapter: ProductPriceOptions.key },
                     });
                 }
             },
@@ -48,4 +48,4 @@ const ProductPrice = {
         };
     },
 };
-ProductPricingDirector.registerAdapter(ProductPrice);
+ProductPricingDirector.registerAdapter(ProductPriceOptions);

package/lib/pricing/product-discount.d.ts

@@ -1 +1,2 @@
-export {};
+import { type ProductDiscountConfiguration, type IProductPricingAdapter } from '@unchainedshop/core';
+export declare const ProductDiscount: IProductPricingAdapter<ProductDiscountConfiguration>;

package/lib/pricing/product-discount.js

@@ -1,6 +1,6 @@
 import { calculation as calcUtils } from '@unchainedshop/utils';
 import { ProductPricingDirector, ProductPricingAdapter, ProductPricingRowCategory, } from '@unchainedshop/core';
-const ProductDiscount = {
+export const ProductDiscount = {
     ...ProductPricingAdapter,
     key: 'shop.unchained.pricing.product-discount',
     version: '1.0.0',

package/lib/warehousing/eth-minter.js

@@ -5,7 +5,6 @@ import { systemLocale } from '@unchainedshop/utils';
 import { generateDbObjectId } from '@unchainedshop/mongodb';
 import { getFileAdapter } from '@unchainedshop/core-files';
 import { createLogger } from '@unchainedshop/logger';
-const { MINTER_TOKEN_OFFSET = '0', ROOT_URL = 'http://localhost:4010' } = process.env;
 const logger = createLogger('unchained:eth-minter');
 const ETHMinter = {
     ...WarehousingAdapter,
@@ -18,6 +17,7 @@ const ETHMinter = {
         return type === WarehousingProviderType.VIRTUAL;
     },
     actions: (configuration, context) => {
+        const { MINTER_TOKEN_OFFSET = '0', ROOT_URL = 'http://localhost:4010' } = process.env;
         const { product, orderPosition, token, modules, locale } = context;
         const { contractAddress, contractStandard, tokenId, supply, ercMetadataProperties } = product?.tokenization || {};
         const getTokensCreated = async () => {

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@unchainedshop/plugins",
-  "version": "4.5.0",
+  "description": "Official plugin collection for the Unchained Engine with payment, delivery, and pricing adapters",
+  "version": "4.6.0",
   "main": "lib/plugins-index.js",
   "types": "lib/plugins-index.d.ts",
   "exports": {
@@ -36,18 +37,18 @@
   },
   "homepage": "https://github.com/unchainedshop/unchained#readme",
   "dependencies": {
-    "@unchainedshop/api": "^4.5.0",
-    "@unchainedshop/core-delivery": "^4.5.0",
-    "@unchainedshop/core-enrollments": "^4.5.0",
-    "@unchainedshop/core-orders": "^4.5.0",
-    "@unchainedshop/core-payment": "^4.5.0",
-    "@unchainedshop/core-products": "^4.5.0",
-    "@unchainedshop/core-warehousing": "^4.5.0",
-    "@unchainedshop/core-worker": "^4.5.0",
-    "@unchainedshop/events": "^4.5.0",
-    "@unchainedshop/file-upload": "^4.5.0",
-    "@unchainedshop/logger": "^4.5.0",
-    "@unchainedshop/utils": "^4.5.0"
+    "@unchainedshop/api": "^4.6.0",
+    "@unchainedshop/core-delivery": "^4.6.0",
+    "@unchainedshop/core-enrollments": "^4.6.0",
+    "@unchainedshop/core-orders": "^4.6.0",
+    "@unchainedshop/core-payment": "^4.6.0",
+    "@unchainedshop/core-products": "^4.6.0",
+    "@unchainedshop/core-warehousing": "^4.6.0",
+    "@unchainedshop/core-worker": "^4.6.0",
+    "@unchainedshop/events": "^4.6.0",
+    "@unchainedshop/file-upload": "^4.6.0",
+    "@unchainedshop/logger": "^4.6.0",
+    "@unchainedshop/utils": "^4.6.0"
   },
   "peerDependencies": {
     "@aws-sdk/client-eventbridge": ">= 3.714 < 4",