@vobs/payment 0.1.0 → 0.1.1

package/dist/handlers.d.ts

@@ -29,5 +29,8 @@ export interface HttpRequestContext {
 }
 type RouteResult = HttpResponse;
 /** Create a dispatch function (pure logic, no framework dependency). */
-export declare function paymentHttpDispatch(manager: PaymentManager): (ctx: HttpRequestContext) => Promise<RouteResult>;
+export interface PaymentHttpDispatchOptions {
+    readonly authorize?: (action: 'close' | 'confirm', orderId: string, context: HttpRequestContext) => boolean | Promise<boolean>;
+}
+export declare function paymentHttpDispatch(manager: PaymentManager, options?: PaymentHttpDispatchOptions): (ctx: HttpRequestContext) => Promise<RouteResult>;
 export {};

package/dist/handlers.js

@@ -28,12 +28,17 @@ function errorStatus(err) {
             return 409;
         case 'channel_unavailable':
             return 503;
+        case 'configuration_error':
+            return 500;
         default:
             return 500;
     }
 }
-/** Create a dispatch function (pure logic, no framework dependency). */
-export function paymentHttpDispatch(manager) {
+export function paymentHttpDispatch(manager, options = {}) {
+    const authorize = options.authorize;
+    async function isAuthorized(action, orderId, context) {
+        return (await authorize?.(action, orderId, context)) === true;
+    }
     return async function dispatch(ctx) {
         const { method, path } = ctx;
         if (method === 'GET' && path === '/payment/available-methods') {
@@ -47,6 +52,9 @@ export function paymentHttpDispatch(manager) {
             catch {
                 return json(400, { error: 'bad_json' });
             }
+            if (!req || typeof req !== 'object' || Array.isArray(req)) {
+                return json(400, { error: 'bad_request' });
+            }
             const outcome = await manager.createOrder(req);
             if ('error' in outcome) {
                 return json(errorStatus(outcome), outcome);
@@ -64,6 +72,9 @@ export function paymentHttpDispatch(manager) {
         const closeMatch = path.match(/^\/api\/payment\/orders\/([^/]+)\/close$/);
         if (closeMatch && method === 'POST') {
             const orderId = closeMatch[1];
+            if (!(await isAuthorized('close', orderId, ctx))) {
+                return json(403, { error: 'forbidden' });
+            }
             const status = manager.close(orderId);
             if (!status)
                 return json(404, { error: 'order_not_found' });
@@ -72,6 +83,9 @@ export function paymentHttpDispatch(manager) {
         const confirmMatch = path.match(/^\/api\/payment\/orders\/([^/]+)\/confirm$/);
         if (confirmMatch && method === 'POST') {
             const orderId = confirmMatch[1];
+            if (!(await isAuthorized('confirm', orderId, ctx))) {
+                return json(403, { error: 'forbidden' });
+            }
             const status = manager.confirm(orderId);
             if (!status)
                 return json(404, { error: 'order_not_found' });

package/dist/index.d.ts

@@ -14,11 +14,12 @@
  *
  * const manager = createPaymentManager({
  *   apiKey: process.env.PAYMENT_API_KEY!,
+ *   getNotifyUrl: (driver) => `https://pay.example.com/payment/callback/${driver}`,
  *   getOrderAmount: (orderId) => orderDao.find(orderId)?.amount,  // server-side pricing (red line)
  *   onVerified: ({ orderId }) => orderDao.markPaid(orderId),       // idempotent
  * })
  * manager.registerDriver(createMockDriver(store))                  // swap in a real channel driver for P1
- * const dispatch = paymentHttpDispatch(manager)
+ * const dispatch = paymentHttpDispatch(manager, { authorize: requireAdmin })
  * // in your server: app.post('/api/payment/orders', async (req) => dispatch({ method:'POST', path:'/api/payment/orders', body: await req.text() }))
  * ```
  */

package/dist/index.js

@@ -14,11 +14,12 @@
  *
  * const manager = createPaymentManager({
  *   apiKey: process.env.PAYMENT_API_KEY!,
+ *   getNotifyUrl: (driver) => `https://pay.example.com/payment/callback/${driver}`,
  *   getOrderAmount: (orderId) => orderDao.find(orderId)?.amount,  // server-side pricing (red line)
  *   onVerified: ({ orderId }) => orderDao.markPaid(orderId),       // idempotent
  * })
  * manager.registerDriver(createMockDriver(store))                  // swap in a real channel driver for P1
- * const dispatch = paymentHttpDispatch(manager)
+ * const dispatch = paymentHttpDispatch(manager, { authorize: requireAdmin })
  * // in your server: app.post('/api/payment/orders', async (req) => dispatch({ method:'POST', path:'/api/payment/orders', body: await req.text() }))
  * ```
  */

package/dist/manager.d.ts

@@ -16,7 +16,7 @@
  */
 import type { AuditEntry, CallbackResult, CreateOrderRequest, CreateOrderResult, GetOrderAmount, OrderState, OrderStatus, PaymentAlert, PaymentConfig, PaymentDriver, PaymentScene, VerifiedResult } from './types.js';
 import { type PaymentStore } from './store.js';
-export type OrderErrorCode = 'order_not_found' | 'amount_mismatch' | 'amount_exceeds_limit' | 'order_conflict' | 'channel_unavailable' | 'bad_request';
+export type OrderErrorCode = 'order_not_found' | 'amount_mismatch' | 'amount_exceeds_limit' | 'order_conflict' | 'channel_unavailable' | 'configuration_error' | 'bad_request';
 export type OrderError = {
     readonly error: OrderErrorCode;
     readonly message?: string;
@@ -30,6 +30,8 @@ export interface PaymentManagerOptions {
     readonly store?: PaymentStore;
     /** Callback signature key (HMAC-SHA256). Inject via KMS/env in production. */
     readonly apiKey?: string;
+    /** Build the public callback URL for a channel driver. Required for non-zero-amount orders. */
+    readonly getNotifyUrl?: (driverName: string) => string;
     /** Server-pricing hook (business: orderId → amount in fen; undefined = order not found). */
     readonly getOrderAmount?: GetOrderAmount;
     /** Business action after booking (deliver/activate) — must be idempotent; on failure the business must retry or compensate manually. */

package/dist/manager.js

@@ -17,13 +17,14 @@
 import { applyClose, applyConfirm, applyPaidCallback } from './state-machine.js';
 import { createMemoryStore } from './store.js';
 import { verifySignedCallback } from './verify.js';
-const DEFAULT_API_KEY = 'dev-secret-0123456789abcdef';
 export function createPaymentManager(options = {}) {
     const config = options.config ?? {};
     const store = options.store ?? createMemoryStore();
-    const apiKey = options.apiKey ?? DEFAULT_API_KEY;
+    const apiKey = options.apiKey;
     const getOrderAmount = options.getOrderAmount;
+    const getNotifyUrl = options.getNotifyUrl;
     const drivers = new Map();
+    const orderLocks = new Map();
     const notifyVerified = options.onVerified;
     const notifyAlert = options.onAlert;
     const audit = (entry) => {
@@ -50,8 +51,37 @@ export function createPaymentManager(options = {}) {
             createdAt: Date.now(),
         };
     }
+    async function withOrderLock(orderId, operation) {
+        const previous = orderLocks.get(orderId);
+        let release;
+        const current = new Promise((resolve) => {
+            release = resolve;
+        });
+        orderLocks.set(orderId, current);
+        await previous;
+        try {
+            return await operation();
+        }
+        finally {
+            release?.();
+            if (orderLocks.get(orderId) === current)
+                orderLocks.delete(orderId);
+        }
+    }
     async function createOrder(req) {
+        return withOrderLock(req.orderId, () => createOrderLocked(req));
+    }
+    async function createOrderLocked(req) {
         const orderId = req.orderId;
+        if (!orderId || !req.subject || !Number.isSafeInteger(req.amount) || req.amount < 0) {
+            return {
+                error: 'bad_request',
+                message: 'orderId, subject, and a non-negative integer amount are required',
+            };
+        }
+        if (!getOrderAmount) {
+            return { error: 'configuration_error', message: 'getOrderAmount is required' };
+        }
         // ① idempotency: same idempotencyKey returns the same order
         if (req.idempotencyKey) {
             const existingId = store.getOrderByIdempotencyKey(req.idempotencyKey);
@@ -69,15 +99,18 @@ export function createPaymentManager(options = {}) {
             }
         }
         // ② server-side pricing: amount from business (security red line — never trust the client amount)
-        let expected = req.amount;
-        if (getOrderAmount) {
-            expected = await getOrderAmount(orderId);
-            if (expected === undefined) {
-                return { error: 'order_not_found' };
-            }
-            if (req.amount !== expected) {
-                return { error: 'amount_mismatch', expected };
-            }
+        const expected = await getOrderAmount(orderId);
+        if (expected === undefined) {
+            return { error: 'order_not_found' };
+        }
+        if (!Number.isSafeInteger(expected) || expected < 0) {
+            return {
+                error: 'configuration_error',
+                message: 'getOrderAmount must return a non-negative integer amount',
+            };
+        }
+        if (req.amount !== expected) {
+            return { error: 'amount_mismatch', expected };
         }
         // ③ per-order limit: reject over-limit (avoids channel errors/risk control)
         if (config.maxAmount && expected > config.maxAmount) {
@@ -86,7 +119,7 @@ export function createPaymentManager(options = {}) {
         // ④ duplicate guard: an unpaid order already exists
         const existingOrder = store.getOrder(orderId);
         if (existingOrder && existingOrder.state === 'created') {
-            const strategy = config.duplicateOrderStrategy ?? 'ask';
+            const strategy = req.duplicateStrategy ?? config.duplicateOrderStrategy ?? 'ask';
             if (strategy === 'ask') {
                 return {
                     kind: 'duplicate',
@@ -131,6 +164,10 @@ export function createPaymentManager(options = {}) {
         }
         // ⑥ place the order via the channel
         const driver = driverOf(req.driver ?? availableDrivers()[0]?.name ?? '');
+        const notifyUrl = getNotifyUrl?.(driver.name);
+        if (!notifyUrl) {
+            return { error: 'configuration_error', message: 'getNotifyUrl is required for paid orders' };
+        }
         let init;
         try {
             init = await driver.createOrder({
@@ -138,14 +175,14 @@ export function createPaymentManager(options = {}) {
                 amount: expected,
                 subject: req.subject,
                 scene: req.scene ?? 'pc',
-                notifyUrl: '',
+                notifyUrl,
             });
         }
         catch (error) {
             alert({ level: 'error', code: 'channel_error', message: String(error), driver: driver.name });
             return { error: 'channel_unavailable', message: String(error) };
         }
-        const record = newOrder({ orderId, amount: expected, subject: req.subject, scene: req.scene ?? 'pc', notifyUrl: '' }, driver, 'created');
+        const record = newOrder({ orderId, amount: expected, subject: req.subject, scene: req.scene ?? 'pc', notifyUrl }, driver, 'created');
         record.init = init;
         store.saveOrder(record);
         if (req.idempotencyKey)
@@ -269,6 +306,9 @@ export function createPaymentManager(options = {}) {
         const signature = ctx.headers['x-signature'];
         const isGenericProtocol = Boolean(timestamp && nonce && signature);
         if (isGenericProtocol) {
+            if (!apiKey) {
+                return { ok: false, status: 500, body: { ok: false, error: 'api_key_not_configured' } };
+            }
             // generic verification protocol (X-* headers + HMAC-SHA256): for mock/self-built backends
             const verified = await verifySignedCallback({
                 apiKey,

package/dist/types.d.ts

@@ -104,6 +104,7 @@ export interface CreateOrderRequest {
     readonly subject: string;
     readonly scene?: PaymentScene;
     readonly driver?: string;
+    readonly duplicateStrategy?: 'reuse' | 'replace' | 'reject' | 'ask';
     readonly idempotencyKey?: string;
 }
 /** Create-order result. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vobs/payment",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Payment factory backend SDK for vobs — channel drivers, order state machine, callback verification (signature + replay protection), server-side pricing and amount risk control (Experimental).",
   "type": "module",
   "publishConfig": {