@vonpay/checkout-cli 0.4.0 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +2 -2
- package/dist/commands/payment-intents.d.ts.map +1 -1
- package/dist/commands/payment-intents.js +10 -2
- package/dist/commands/payment-intents.js.map +1 -1
- package/dist/commands/trigger.d.ts +9 -13
- package/dist/commands/trigger.d.ts.map +1 -1
- package/dist/commands/trigger.js +67 -42
- package/dist/commands/trigger.js.map +1 -1
- package/dist/utils/listen-forward.d.ts +13 -7
- package/dist/utils/listen-forward.d.ts.map +1 -1
- package/dist/utils/listen-forward.js +21 -14
- package/dist/utils/listen-forward.js.map +1 -1
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -36,14 +36,14 @@ All commands are namespaced under `vonpay checkout`:
|
|
|
36
36
|
| `vonpay checkout refunds create` | Refund a captured intent (full or partial) |
|
|
37
37
|
| `vonpay checkout tokens create` | Create a payment-method token for saved-card / MIT flows |
|
|
38
38
|
| `vonpay checkout capabilities` | Show what this merchant's binder supports |
|
|
39
|
-
| `vonpay checkout trigger <event>` | Trigger a synthetic webhook event against your local endpoint (`session.succeeded`, `session.failed`, `
|
|
39
|
+
| `vonpay checkout trigger <event>` | Trigger a synthetic webhook event against your local endpoint (`session.succeeded`, `session.failed`, `payment_intent.*`, `charge.refunded`) |
|
|
40
40
|
| `vonpay checkout listen` | Stream live webhook delivery attempts; optionally re-forward each to a local URL with `--forward-to` |
|
|
41
41
|
| `vonpay checkout health` | Check API health and latency |
|
|
42
42
|
| `vonpay checkout doctor` | Diagnose runtime + env + live API probe |
|
|
43
43
|
|
|
44
44
|
Run `vonpay checkout <command> --help` for full flag reference.
|
|
45
45
|
|
|
46
|
-
> **`listen --forward-to` signs forwarded events with the v1 scheme**
|
|
46
|
+
> **`listen --forward-to` signs forwarded events with the v1 webhook scheme** — a single `x-vonpay-signature: t=<unix-seconds>,v1=<hex>` header, with the HMAC-SHA256 computed over `${t}.${rawBody}` and a fresh `t` stamped at forward time. There is no separate timestamp header. Verify them in your local handler with `vonpay.webhooks.constructEvent(rawBody, signatureHeader, secret)`. For this local forward loop the signing secret is your API key; production deliveries are keyed by your per-endpoint signing secret (`whsec_…`). This is a known limitation of local forwarding — the platform exposes no per-subscription signing secret on the listen stream, so the forwarder cannot reproduce the production secret.
|
|
47
47
|
|
|
48
48
|
### Common flags
|
|
49
49
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"payment-intents.d.ts","sourceRoot":"","sources":["../../src/commands/payment-intents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,KAAK,
|
|
1
|
+
{"version":3,"file":"payment-intents.d.ts","sourceRoot":"","sources":["../../src/commands/payment-intents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,KAAK,EAGV,QAAQ,EAGT,MAAM,uBAAuB,CAAC;AAe/B,UAAU,UAAU;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,iBAAS,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,CAgC7D;AAoDD,wBAAgB,qBAAqB,IAAI,OAAO,CAoM/C;AAED,eAAO,MAAM,WAAW;;CAEvB,CAAC"}
|
|
@@ -4,6 +4,7 @@ import ora from "ora";
|
|
|
4
4
|
import { requireApiKey } from "../config.js";
|
|
5
5
|
import { makeCheckoutClient } from "../client-factory.js";
|
|
6
6
|
import { parseMetadata } from "../utils/metadata.js";
|
|
7
|
+
import { safeDisplay } from "../utils/sanitize.js";
|
|
7
8
|
import { handleError } from "../utils/errors.js";
|
|
8
9
|
import { requireLiveConfirmation } from "../utils/live-key.js";
|
|
9
10
|
const MIT_INITIATORS = ["merchant", "customer"];
|
|
@@ -52,10 +53,17 @@ function printPaymentIntent(intent) {
|
|
|
52
53
|
console.log(` Amount: ${(intent.amount / 100).toFixed(2)} ${intent.currency}`);
|
|
53
54
|
console.log(` Capture: ${intent.captureMethod}`);
|
|
54
55
|
if (intent.nextAction) {
|
|
55
|
-
|
|
56
|
+
// nextAction is the structured 3DS action object, not a bare URL — reading
|
|
57
|
+
// it as a string would print "[object Object]". `type` and the redirect URL
|
|
58
|
+
// are server-supplied, so sanitize before echoing to the terminal (same
|
|
59
|
+
// pattern as refunds.ts for refund.reason).
|
|
60
|
+
console.log(` Next action: ${chalk.yellow(safeDisplay(intent.nextAction.type))}`);
|
|
61
|
+
if (intent.nextAction.type === "redirect_to_url") {
|
|
62
|
+
console.log(` Redirect: ${chalk.yellow(safeDisplay(intent.nextAction.redirectToUrl.url))}`);
|
|
63
|
+
}
|
|
56
64
|
}
|
|
57
65
|
if (intent.declineCode) {
|
|
58
|
-
console.log(` Decline code: ${chalk.red(intent.declineCode)}`);
|
|
66
|
+
console.log(` Decline code: ${chalk.red(safeDisplay(intent.declineCode))}`);
|
|
59
67
|
}
|
|
60
68
|
console.log(` Created: ${intent.createdAt}`);
|
|
61
69
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"payment-intents.js","sourceRoot":"","sources":["../../src/commands/payment-intents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"payment-intents.js","sourceRoot":"","sources":["../../src/commands/payment-intents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AAQtB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,MAAM,cAAc,GAA4B,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AACzE,MAAM,WAAW,GAAyB;IACxC,WAAW;IACX,aAAa;IACb,aAAa;CACd,CAAC;AAeF,SAAS,aAAa,CAAC,IAAgB;IACrC,0EAA0E;IAC1E,yEAAyE;IACzE,eAAe;IACf,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,qBAAqB,GAAG,IAAI,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IAEpE,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CACnC,CAAC,MAAM,CAAC;IACT,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAyB,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,YAAY,gBAAgB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAmB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,gBAAgB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,SAAyB;QACpC,MAAM,EAAE,MAAmB;QAC3B,qBAAqB,EAAE,qBAAsB;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAS3B;IACC,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,KAAK,WAAW;QAC3B,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY;YAC9B,CAAC,CAAC,KAAK,CAAC,IAAI;YACZ,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,iBAAiB;gBACnC,CAAC,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;oBAC1D,CAAC,CAAC,KAAK,CAAC,GAAG;oBACX,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAEvB,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,mBAAmB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CACT,mBAAmB,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CACzE,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,4CAA4C;QAC5C,OAAO,CAAC,GAAG,CACT,mBAAmB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CACvE,CAAC;QACF,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjD,OAAO,CAAC,GAAG,CACT,mBAAmB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,wBAAwB,GAC5B,0FAA0F,CAAC;AAE7F,MAAM,UAAU,qBAAqB;IACnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC,WAAW,CACxD,gEAAgE,CACjE,CAAC;IAEF,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,6BAA6B,CAAC;SAC1C,cAAc,CACb,kBAAkB,EAClB,4CAA4C,EAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CACvB;SACA,cAAc,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;SACnE,MAAM,CACL,yBAAyB,EACzB,qDAAqD,CACtD;SACA,MAAM,CACL,sBAAsB,EACtB,qDAAqD,CACtD;SACA,MAAM,CACL,6BAA6B,EAC7B,kBAAkB,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAChD;SACA,MAAM,CACL,uBAAuB,EACvB,eAAe,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAC1C;SACA,MAAM,CACL,oCAAoC,EACpC,uDAAuD,CACxD;SACA,MAAM,CAAC,yBAAyB,EAAE,kCAAkC,CAAC;SACrE,MAAM,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;SAClD,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;SACnC,MAAM,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,uBAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC;YACxD,IACE,aAAa,KAAK,SAAS;gBAC3B,aAAa,KAAK,WAAW;gBAC7B,aAAa,KAAK,QAAQ,EAC1B,CAAC;gBACD,OAAO,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,6BAA6B,IAAI,CAAC,aAAa,kCAAkC,CAClF,CACF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAEhC,MAAM,MAAM,GAA8B;gBACxC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;aACtC,CAAC;YACF,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,CAAC,aAAa,GAAG,aAAa,CAAC;YACvC,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC7B,CAAC;YACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;YACnB,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAC/C,MAAM,EACN,IAAI,CAAC,cAAc;gBACjB,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;gBACzC,CAAC,CAAC,SAAS,CACd,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;gBACrD,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,sCAAsC,CAAC;SACnD,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;SAC7C,MAAM,CACL,6BAA6B,EAC7B,uDAAuD,EACvD,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CACvB;SACA,MAAM,CAAC,yBAAyB,EAAE,kCAAkC,CAAC;SACrE,MAAM,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;SAClD,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;SACnC,MAAM,CACL,KAAK,EACH,EAAU,EACV,IAKC,EACD,EAAE;QACF,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,uBAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,CAAC,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC;QAE3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,CAChD,EAAE,EACF,IAAI,CAAC,eAAe,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;gBAC3C,CAAC,CAAC,SAAS,EACb,IAAI,CAAC,cAAc;gBACjB,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;gBACzC,CAAC,CAAC,SAAS,CACd,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,MAAM,YAAY,GAChB,IAAI,CAAC,eAAe,KAAK,SAAS;oBAChC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,GAAG;oBAC7E,CAAC,CAAC,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAC,CAAC;gBACrE,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gDAAgD,CAAC;SAC7D,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAC;SAC7C,MAAM,CAAC,yBAAyB,EAAE,kCAAkC,CAAC;SACrE,MAAM,CAAC,gBAAgB,EAAE,wBAAwB,CAAC;SAClD,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;SACnC,MAAM,CACL,KAAK,EACH,EAAU,EACV,IAIC,EACD,EAAE;QACF,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,uBAAuB,CAAC,MAAM,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,CAAC,2BAA2B,CAAC,CAAC,KAAK,EAAE,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAC7C,EAAE,EACF,IAAI,CAAC,cAAc;gBACjB,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;gBACzC,CAAC,CAAC,SAAS,CACd,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;gBACpD,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CACF,CAAC;IAEJ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,aAAa;CACd,CAAC"}
|
|
@@ -1,23 +1,19 @@
|
|
|
1
1
|
import { Command } from "commander";
|
|
2
|
-
export declare const SUPPORTED_EVENTS: readonly ["session.succeeded", "session.failed", "payment_intent.succeeded", "payment_intent.failed", "payment_intent.cancelled", "
|
|
2
|
+
export declare const SUPPORTED_EVENTS: readonly ["session.succeeded", "session.failed", "payment_intent.succeeded", "payment_intent.failed", "payment_intent.cancelled", "charge.refunded"];
|
|
3
3
|
type SupportedEvent = (typeof SUPPORTED_EVENTS)[number];
|
|
4
|
-
interface
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
timestamp: string;
|
|
12
|
-
transactionId?: string;
|
|
13
|
-
refundId?: string;
|
|
14
|
-
paymentIntentId?: string;
|
|
4
|
+
interface WebhookEnvelope {
|
|
5
|
+
id: string;
|
|
6
|
+
type: SupportedEvent;
|
|
7
|
+
created: number;
|
|
8
|
+
livemode: boolean;
|
|
9
|
+
merchant_id: string;
|
|
10
|
+
data: Record<string, unknown>;
|
|
15
11
|
}
|
|
16
12
|
export declare function buildPayload(event: SupportedEvent, opts: {
|
|
17
13
|
sessionId?: string;
|
|
18
14
|
amount?: number;
|
|
19
15
|
currency?: string;
|
|
20
|
-
}):
|
|
16
|
+
}): WebhookEnvelope;
|
|
21
17
|
export declare function triggerCommand(): Command;
|
|
22
18
|
export {};
|
|
23
19
|
//# sourceMappingURL=trigger.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"trigger.d.ts","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,eAAO,MAAM,gBAAgB,sJAOnB,CAAC;AACX,KAAK,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAMxD,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AA4CD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/D,eAAe,CAgBjB;AAED,wBAAgB,cAAc,IAAI,OAAO,CAwFxC"}
|
package/dist/commands/trigger.js
CHANGED
|
@@ -3,49 +3,68 @@ import { createHmac, randomUUID } from "node:crypto";
|
|
|
3
3
|
import chalk from "chalk";
|
|
4
4
|
import ora from "ora";
|
|
5
5
|
import { requireApiKey } from "../config.js";
|
|
6
|
+
// Real server-emitted event keys this local trigger can synthesize. The
|
|
7
|
+
// fictional `refund.created` was removed — the server emits `charge.refunded`.
|
|
6
8
|
export const SUPPORTED_EVENTS = [
|
|
7
9
|
"session.succeeded",
|
|
8
10
|
"session.failed",
|
|
9
11
|
"payment_intent.succeeded",
|
|
10
12
|
"payment_intent.failed",
|
|
11
13
|
"payment_intent.cancelled",
|
|
12
|
-
"
|
|
14
|
+
"charge.refunded",
|
|
13
15
|
];
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
const isRefund = event === "refund.created";
|
|
25
|
-
// A transaction row is written for any terminal success — a settled
|
|
26
|
-
// session, a captured payment intent, or a refund.
|
|
27
|
-
const hasTransaction = event === "session.succeeded" ||
|
|
28
|
-
event === "payment_intent.succeeded" ||
|
|
29
|
-
isRefund;
|
|
30
|
-
const payload = {
|
|
31
|
-
event,
|
|
32
|
-
sessionId: opts.sessionId ?? `session_test_${randomUUID().slice(0, 8)}`,
|
|
33
|
-
merchantId: `merchant_test_${randomUUID().slice(0, 8)}`,
|
|
34
|
-
amount: opts.amount ?? 1499,
|
|
35
|
-
currency: opts.currency ?? "USD",
|
|
36
|
-
status: STATUS_BY_EVENT[event],
|
|
37
|
-
timestamp: new Date().toISOString(),
|
|
16
|
+
// Per-event `data` shapes matching the server's buildEventData() for the
|
|
17
|
+
// events this trigger supports. Synthetic-but-realistic values; the failure
|
|
18
|
+
// fixtures use codes already on the normalized allowlist.
|
|
19
|
+
function buildEventData(event, ids, amount, currency) {
|
|
20
|
+
const base = {
|
|
21
|
+
session_id: ids.sessionId,
|
|
22
|
+
payment_intent_id: ids.paymentIntentId,
|
|
23
|
+
transaction_id: ids.transactionId,
|
|
24
|
+
amount,
|
|
25
|
+
currency,
|
|
38
26
|
};
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
27
|
+
switch (event) {
|
|
28
|
+
case "session.succeeded":
|
|
29
|
+
case "payment_intent.succeeded":
|
|
30
|
+
return base;
|
|
31
|
+
case "session.failed":
|
|
32
|
+
case "payment_intent.failed":
|
|
33
|
+
return {
|
|
34
|
+
...base,
|
|
35
|
+
failure_reason: "Card declined",
|
|
36
|
+
failure_code: "card_declined",
|
|
37
|
+
network_decline_code: "05",
|
|
38
|
+
};
|
|
39
|
+
case "payment_intent.cancelled":
|
|
40
|
+
return { ...base, cancellation_reason: "buyer_abandoned" };
|
|
41
|
+
case "charge.refunded":
|
|
42
|
+
return {
|
|
43
|
+
...base,
|
|
44
|
+
refund_id: `vpr_test_${randomUUID().slice(0, 8)}`,
|
|
45
|
+
reason: "customer_request",
|
|
46
|
+
is_partial: false,
|
|
47
|
+
original_charge_amount: amount,
|
|
48
|
+
card: null,
|
|
49
|
+
};
|
|
44
50
|
}
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
51
|
+
}
|
|
52
|
+
export function buildPayload(event, opts) {
|
|
53
|
+
const amount = opts.amount ?? 1499;
|
|
54
|
+
const currency = opts.currency ?? "USD";
|
|
55
|
+
const ids = {
|
|
56
|
+
sessionId: opts.sessionId ?? `cs_test_${randomUUID().slice(0, 8)}`,
|
|
57
|
+
transactionId: `vp_tx_test_${randomUUID().slice(0, 8)}`,
|
|
58
|
+
paymentIntentId: `vpi_test_${randomUUID().slice(0, 8)}`,
|
|
59
|
+
};
|
|
60
|
+
return {
|
|
61
|
+
id: `vp_evt_test_${randomUUID().slice(0, 8)}`,
|
|
62
|
+
type: event,
|
|
63
|
+
created: Math.floor(Date.now() / 1000),
|
|
64
|
+
livemode: false,
|
|
65
|
+
merchant_id: `vp_mer_test_${randomUUID().slice(0, 8)}`,
|
|
66
|
+
data: buildEventData(event, ids, amount, currency),
|
|
67
|
+
};
|
|
49
68
|
}
|
|
50
69
|
export function triggerCommand() {
|
|
51
70
|
return new Command("trigger")
|
|
@@ -63,18 +82,23 @@ export function triggerCommand() {
|
|
|
63
82
|
const apiKey = requireApiKey();
|
|
64
83
|
const payload = buildPayload(event, opts);
|
|
65
84
|
const body = JSON.stringify(payload);
|
|
66
|
-
|
|
67
|
-
|
|
85
|
+
// v1 webhook signature contract: ONE `x-vonpay-signature` header of
|
|
86
|
+
// shape `t=<unix-seconds>,v1=<hex>`, HMAC-SHA256 over `${t}.${body}`.
|
|
87
|
+
// There is no separate timestamp header. For this local trigger the
|
|
88
|
+
// signing secret is your API key (verify with
|
|
89
|
+
// `constructEvent(rawBody, signatureHeader, apiKey)`).
|
|
90
|
+
const t = Math.floor(Date.now() / 1000);
|
|
91
|
+
const v1 = createHmac("sha256", apiKey)
|
|
92
|
+
.update(`${t}.${body}`)
|
|
68
93
|
.digest("hex");
|
|
69
|
-
const
|
|
94
|
+
const signatureHeader = `t=${t},v1=${v1}`;
|
|
70
95
|
const spinner = ora(`Sending ${event} to ${opts.url}...`).start();
|
|
71
96
|
try {
|
|
72
97
|
const response = await fetch(opts.url, {
|
|
73
98
|
method: "POST",
|
|
74
99
|
headers: {
|
|
75
100
|
"Content-Type": "application/json",
|
|
76
|
-
"
|
|
77
|
-
"X-VonPay-Timestamp": timestamp,
|
|
101
|
+
"x-vonpay-signature": signatureHeader,
|
|
78
102
|
"User-Agent": "VonPay-Webhook/1.0 (CLI trigger)",
|
|
79
103
|
},
|
|
80
104
|
body,
|
|
@@ -87,9 +111,10 @@ export function triggerCommand() {
|
|
|
87
111
|
else {
|
|
88
112
|
console.log(chalk.yellow(`⚠ ${event} delivered but got ${response.status} response`));
|
|
89
113
|
}
|
|
90
|
-
console.log(chalk.dim(`
|
|
91
|
-
console.log(chalk.dim(` Amount: ${payload.amount} ${payload.currency}`));
|
|
92
|
-
console.log(chalk.dim(`\n Verify with: vonpay.webhooks.constructEvent(rawBody,
|
|
114
|
+
console.log(chalk.dim(` Event: ${payload.id} (${payload.type})`));
|
|
115
|
+
console.log(chalk.dim(` Amount: ${payload.data.amount} ${payload.data.currency}`));
|
|
116
|
+
console.log(chalk.dim(`\n Verify with: vonpay.webhooks.constructEvent(rawBody, signatureHeader, secret)`));
|
|
117
|
+
console.log(chalk.dim(` (local dev: 'secret' is your API key here — production webhooks are signed with your endpoint's whsec_… secret, NOT your API key)`));
|
|
93
118
|
}
|
|
94
119
|
catch (err) {
|
|
95
120
|
spinner.stop();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"trigger.js","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mBAAmB;IACnB,gBAAgB;IAChB,0BAA0B;IAC1B,uBAAuB;IACvB,0BAA0B;IAC1B,
|
|
1
|
+
{"version":3,"file":"trigger.js","sourceRoot":"","sources":["../../src/commands/trigger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,wEAAwE;AACxE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mBAAmB;IACnB,gBAAgB;IAChB,0BAA0B;IAC1B,uBAAuB;IACvB,0BAA0B;IAC1B,iBAAiB;CACT,CAAC;AAgBX,yEAAyE;AACzE,4EAA4E;AAC5E,0DAA0D;AAC1D,SAAS,cAAc,CACrB,KAAqB,EACrB,GAA0E,EAC1E,MAAc,EACd,QAAgB;IAEhB,MAAM,IAAI,GAAG;QACX,UAAU,EAAE,GAAG,CAAC,SAAS;QACzB,iBAAiB,EAAE,GAAG,CAAC,eAAe;QACtC,cAAc,EAAE,GAAG,CAAC,aAAa;QACjC,MAAM;QACN,QAAQ;KACT,CAAC;IACF,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,mBAAmB,CAAC;QACzB,KAAK,0BAA0B;YAC7B,OAAO,IAAI,CAAC;QACd,KAAK,gBAAgB,CAAC;QACtB,KAAK,uBAAuB;YAC1B,OAAO;gBACL,GAAG,IAAI;gBACP,cAAc,EAAE,eAAe;gBAC/B,YAAY,EAAE,eAAe;gBAC7B,oBAAoB,EAAE,IAAI;aAC3B,CAAC;QACJ,KAAK,0BAA0B;YAC7B,OAAO,EAAE,GAAG,IAAI,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;QAC7D,KAAK,iBAAiB;YACpB,OAAO;gBACL,GAAG,IAAI;gBACP,SAAS,EAAE,YAAY,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;gBACjD,MAAM,EAAE,kBAAkB;gBAC1B,UAAU,EAAE,KAAK;gBACjB,sBAAsB,EAAE,MAAM;gBAC9B,IAAI,EAAE,IAAI;aACX,CAAC;IACN,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAqB,EACrB,IAAgE;IAEhE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG;QACV,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QAClE,aAAa,EAAE,cAAc,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACvD,eAAe,EAAE,YAAY,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;KACxD,CAAC;IACF,OAAO;QACL,EAAE,EAAE,eAAe,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QAC7C,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACtC,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,eAAe,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACtD,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;SAC1B,WAAW,CAAC,0CAA0C,CAAC;SACvD,QAAQ,CAAC,SAAS,EAAE,eAAe,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;SAClE,cAAc,CAAC,aAAa,EAAE,yDAAyD,CAAC;SACxF,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SAChD,MAAM,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SAC3E,MAAM,CAAC,mBAAmB,EAAE,eAAe,CAAC;SAC5C,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAAI,EAAE,EAAE;QACpC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAuB,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,kBAAkB,KAAK,gBAAgB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrE,CACF,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAuB,EAAE,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,oEAAoE;QACpE,sEAAsE;QACtE,oEAAoE;QACpE,8CAA8C;QAC9C,uDAAuD;QACvD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aACpC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;aACtB,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAE1C,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QAElE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,oBAAoB,EAAE,eAAe;oBACrC,YAAY,EAAE,kCAAkC;iBACjD;gBACD,IAAI;gBACJ,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACxE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,KAAK,KAAK,sBAAsB,QAAQ,CAAC,MAAM,WAAW,CAC3D,CACF,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACrE,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,cAAc,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAC7D,CACF,CAAC;YACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,mFAAmF,CACpF,CACF,CAAC;YACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,qIAAqI,CACtI,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACxD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,6BAA6B,CAAC,CAAC,CAAC;YAC9E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACjE,CACF,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
|
|
@@ -8,12 +8,14 @@ import type { ForwardOutcome } from "./listen-output.js";
|
|
|
8
8
|
*
|
|
9
9
|
* 1. Fetches the full event record via GET /v1/webhook_events/:id
|
|
10
10
|
* (the public webhook-event read endpoint)
|
|
11
|
-
* 2.
|
|
12
|
-
*
|
|
13
|
-
* `
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
11
|
+
* 2. Signs it with the v1 webhook contract — a single
|
|
12
|
+
* `x-vonpay-signature: t=<unix-seconds>,v1=<hex>` header whose
|
|
13
|
+
* HMAC-SHA256 is computed over `${t}.${body}` (the same shape the
|
|
14
|
+
* SDK's `webhooks.constructEvent` verifies). For this local dev loop
|
|
15
|
+
* the signing secret is your API key, so verify with
|
|
16
|
+
* `webhooks.constructEvent(rawBody, signatureHeader, yourApiKey)`.
|
|
17
|
+
* 3. POSTs to the local URL with that single header, matching the live
|
|
18
|
+
* delivery shape. The `t` is stamped HERE, at forward time — see the
|
|
17
19
|
* `forwardPayload` body for the fresh-timestamp rationale.
|
|
18
20
|
*
|
|
19
21
|
* Bounded by a per-forward timeout (default 5s) and never retries —
|
|
@@ -26,7 +28,11 @@ import type { ForwardOutcome } from "./listen-output.js";
|
|
|
26
28
|
interface ForwardOptions {
|
|
27
29
|
/** Local URL to POST the payload to. */
|
|
28
30
|
url: URL;
|
|
29
|
-
/**
|
|
31
|
+
/** Secret used to key the v1 HMAC. The listen stream exposes no
|
|
32
|
+
* per-endpoint signing secret, so for this local forward loop the API
|
|
33
|
+
* key (vp_sk_*) is used as a stand-in — verify the forwarded delivery
|
|
34
|
+
* with `constructEvent(rawBody, signatureHeader, sameKey)`. Production
|
|
35
|
+
* deliveries are keyed by the per-endpoint signing secret (whsec_…). */
|
|
30
36
|
signingSecret: string;
|
|
31
37
|
/** Per-forward timeout. Default 5_000. */
|
|
32
38
|
timeoutMs?: number;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"listen-forward.d.ts","sourceRoot":"","sources":["../../src/utils/listen-forward.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD
|
|
1
|
+
{"version":3,"file":"listen-forward.d.ts","sourceRoot":"","sources":["../../src/utils/listen-forward.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,UAAU,cAAc;IACtB,wCAAwC;IACxC,GAAG,EAAE,GAAG,CAAC;IACT;;;;6EAIyE;IACzE,aAAa,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,cAAc,CAAC,CAsEzB"}
|
|
@@ -6,21 +6,29 @@ import { createHmac } from "node:crypto";
|
|
|
6
6
|
*/
|
|
7
7
|
export async function forwardPayload(payload, opts) {
|
|
8
8
|
const body = JSON.stringify(payload);
|
|
9
|
-
// Stamp the moment we forward — NOT the server's original
|
|
9
|
+
// Stamp `t` at the moment we forward — NOT the server's original
|
|
10
10
|
// delivery-attempt time. The CLI is the *re-sender* for this local
|
|
11
11
|
// delivery: the dev's handler calls `webhooks.constructEvent`, which
|
|
12
|
-
// rejects any `
|
|
13
|
-
// original timestamp (carried on the SSE
|
|
14
|
-
// routinely minutes old — retries,
|
|
15
|
-
// dev scrolled back through — so
|
|
16
|
-
//
|
|
17
|
-
//
|
|
18
|
-
//
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
12
|
+
// rejects any `t` outside the freshness window (>5 min old / >30 sec
|
|
13
|
+
// future). The server's original timestamp (carried on the SSE
|
|
14
|
+
// `webhook.attempt` frame) is routinely minutes old — retries,
|
|
15
|
+
// processing lag, a transcript the dev scrolled back through — so
|
|
16
|
+
// replaying it would trip the window. A fresh `t` here matches Stripe
|
|
17
|
+
// CLI's re-sign posture. Unlike the old bare-hex shape, `t` IS folded
|
|
18
|
+
// into the HMAC per the v1 contract (`${t}.${body}`).
|
|
19
|
+
const t = Math.floor(Date.now() / 1000);
|
|
20
|
+
// v1 signature contract (vonpay-checkout/docs/webhook-signature-v1.md):
|
|
21
|
+
// ONE header `x-vonpay-signature: t=<unix-seconds>,v1=<hex>`, HMAC-SHA256
|
|
22
|
+
// over `${t}.${body}`. There is NO separate timestamp header. Rotation
|
|
23
|
+
// (multiple `v1=` entries) does not apply to this synthetic local loop —
|
|
24
|
+
// we sign with a single secret (the API key). When the server ships a
|
|
25
|
+
// per-subscription signing secret on the SSE `webhook.attempt` frame,
|
|
26
|
+
// sign with that here instead of the API key. (The 0.0.0.0 loopback
|
|
27
|
+
// warning already shipped in forward-to.ts.)
|
|
28
|
+
const v1 = createHmac("sha256", opts.signingSecret)
|
|
29
|
+
.update(`${t}.${body}`)
|
|
23
30
|
.digest("hex");
|
|
31
|
+
const signatureHeader = `t=${t},v1=${v1}`;
|
|
24
32
|
const timeoutMs = opts.timeoutMs ?? 5_000;
|
|
25
33
|
const localController = new AbortController();
|
|
26
34
|
const timeoutId = setTimeout(() => localController.abort(), timeoutMs);
|
|
@@ -31,8 +39,7 @@ export async function forwardPayload(payload, opts) {
|
|
|
31
39
|
method: "POST",
|
|
32
40
|
headers: {
|
|
33
41
|
"Content-Type": "application/json",
|
|
34
|
-
"
|
|
35
|
-
"X-VonPay-Timestamp": timestamp,
|
|
42
|
+
"x-vonpay-signature": signatureHeader,
|
|
36
43
|
"User-Agent": "vonpay-cli-listen",
|
|
37
44
|
},
|
|
38
45
|
body,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"listen-forward.js","sourceRoot":"","sources":["../../src/utils/listen-forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"listen-forward.js","sourceRoot":"","sources":["../../src/utils/listen-forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA6CzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgC,EAChC,IAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAErC,iEAAiE;IACjE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,+DAA+D;IAC/D,+DAA+D;IAC/D,kEAAkE;IAClE,sEAAsE;IACtE,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAExC,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,oEAAoE;IACpE,6CAA6C;IAC7C,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC;SAChD,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;SACtB,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAExE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YAC3C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,oBAAoB,EAAE,eAAe;gBACrC,YAAY,EAAE,mBAAmB;aAClC;YACD,IAAI;YACJ,MAAM,EAAE,cAAc;SACvB,CAAC,CAAC;QACH,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,SAAS,IAAI,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,OAAsB;IACvC,IAAI,OAAQ,WAA4C,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC5E,OAAQ,WAAqE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,4DAA4D;YAC5D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,UAAU,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC;AAC3B,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vonpay/checkout-cli",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.5.0",
|
|
4
4
|
"description": "Von Payments CLI — developer tools for checkout integration",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
"commander": "^13.0.0",
|
|
19
19
|
"chalk": "^5.4.0",
|
|
20
20
|
"ora": "^8.2.0",
|
|
21
|
-
"@vonpay/checkout-node": "0.
|
|
21
|
+
"@vonpay/checkout-node": "0.11.0"
|
|
22
22
|
},
|
|
23
23
|
"devDependencies": {
|
|
24
24
|
"typescript": "^5.7.0",
|