cokit-cli 1.0.1 → 1.0.3

package/skills/ck-payment-integration/scripts/polar-webhook-verify.js

@@ -0,0 +1,202 @@
+#!/usr/bin/env node
+
+/**
+ * Polar Webhook Verification Script
+ *
+ * Verifies Polar webhook signatures following Standard Webhooks specification.
+ *
+ * Usage:
+ *   node polar-webhook-verify.js <webhook-payload-json> <webhook-secret>
+ *
+ * Environment Variables:
+ *   POLAR_WEBHOOK_SECRET - Webhook secret (base64 encoded)
+ */
+
+const crypto = require('crypto');
+
+class PolarWebhookVerifier {
+  constructor(secret) {
+    if (!secret) {
+      throw new Error('Webhook secret is required');
+    }
+    // Decode base64 secret
+    this.secret = Buffer.from(secret, 'base64');
+  }
+
+  /**
+   * Verify webhook signature
+   */
+  verifySignature(payload, headers) {
+    const webhookId = headers['webhook-id'];
+    const webhookTimestamp = headers['webhook-timestamp'];
+    const webhookSignature = headers['webhook-signature'];
+
+    if (!webhookId || !webhookTimestamp || !webhookSignature) {
+      throw new Error('Missing required webhook headers');
+    }
+
+    // Check timestamp (reject if > 5 minutes old)
+    const timestamp = parseInt(webhookTimestamp);
+    const now = Math.floor(Date.now() / 1000);
+
+    if (Math.abs(now - timestamp) > 300) {
+      throw new Error('Webhook timestamp too old or in future');
+    }
+
+    // Parse signatures
+    const signatures = webhookSignature.split(',').map(sig => {
+      const parts = sig.split('=');
+      const version = parts[0];
+      const signature = parts.slice(1).join('='); // Rejoin in case signature contains '='
+      return { version, signature };
+    });
+
+    // Create signed payload
+    const signedPayload = `${webhookTimestamp}.${payload}`;
+
+    // Compute expected signature
+    const expectedSignature = crypto
+      .createHmac('sha256', this.secret)
+      .update(signedPayload)
+      .digest('base64');
+
+    // Check if any signature matches
+    const isValid = signatures.some(sig => {
+      return sig.version === 'v1' && sig.signature === expectedSignature;
+    });
+
+    if (!isValid) {
+      throw new Error('Invalid webhook signature');
+    }
+
+    return true;
+  }
+
+  /**
+   * Process webhook event
+   */
+  process(payload, headers) {
+    try {
+      // Verify signature
+      this.verifySignature(payload, headers);
+
+      // Parse payload
+      const event = typeof payload === 'string' ? JSON.parse(payload) : payload;
+
+      // Validate event structure
+      if (!event.type || !event.data) {
+        throw new Error('Invalid event structure');
+      }
+
+      return {
+        success: true,
+        event: {
+          type: event.type,
+          data: event.data
+        }
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: error.message
+      };
+    }
+  }
+
+  /**
+   * Get event category
+   */
+  static getEventCategory(eventType) {
+    const categories = {
+      'checkout.': 'checkout',
+      'order.': 'order',
+      'subscription.': 'subscription',
+      'customer.': 'customer',
+      'benefit_grant.': 'benefit',
+      'refund.': 'refund',
+      'product.': 'product'
+    };
+
+    for (const [prefix, category] of Object.entries(categories)) {
+      if (eventType.startsWith(prefix)) {
+        return category;
+      }
+    }
+
+    return 'unknown';
+  }
+
+  /**
+   * Check if event is a payment
+   */
+  static isPaymentEvent(eventType) {
+    return ['order.paid', 'order.created'].includes(eventType);
+  }
+
+  /**
+   * Check if event is a subscription change
+   */
+  static isSubscriptionEvent(eventType) {
+    return eventType.startsWith('subscription.');
+  }
+}
+
+// CLI Usage
+if (require.main === module) {
+  const args = process.argv.slice(2);
+
+  if (args.length < 1) {
+    console.log('Usage: node polar-webhook-verify.js <webhook-payload-json> [webhook-secret]');
+    console.log('\nWebhook secret can also be provided via POLAR_WEBHOOK_SECRET environment variable');
+    console.log('\nExample:');
+    console.log('  node polar-webhook-verify.js \'{"type":"order.paid","data":{...}}\' base64secret');
+    process.exit(1);
+  }
+
+  try {
+    const payload = args[0];
+    const secret = args[1] || process.env.POLAR_WEBHOOK_SECRET;
+
+    if (!secret) {
+      console.error('✗ Error: Webhook secret is required');
+      console.error('Provide it as second argument or set POLAR_WEBHOOK_SECRET environment variable');
+      process.exit(1);
+    }
+
+    // Mock headers for CLI testing
+    const timestamp = Math.floor(Date.now() / 1000);
+    const signedPayload = `${timestamp}.${payload}`;
+    const signature = crypto
+      .createHmac('sha256', Buffer.from(secret, 'base64'))
+      .update(signedPayload)
+      .digest('base64');
+
+    const headers = {
+      'webhook-id': 'msg_test_' + Date.now(),
+      'webhook-timestamp': timestamp.toString(),
+      'webhook-signature': `v1=${signature}`
+    };
+
+    const verifier = new PolarWebhookVerifier(secret);
+    const result = verifier.process(payload, headers);
+
+    if (result.success) {
+      console.log('✓ Webhook verified successfully\n');
+      console.log('Event Details:');
+      console.log(`  Type: ${result.event.type}`);
+      console.log(`  Category: ${PolarWebhookVerifier.getEventCategory(result.event.type)}`);
+      console.log(`  Is Payment: ${PolarWebhookVerifier.isPaymentEvent(result.event.type) ? 'Yes' : 'No'}`);
+      console.log(`  Is Subscription: ${PolarWebhookVerifier.isSubscriptionEvent(result.event.type) ? 'Yes' : 'No'}`);
+      console.log('\nEvent Data:');
+      console.log(JSON.stringify(result.event.data, null, 2));
+    } else {
+      console.error('✗ Verification failed:', result.error);
+      process.exit(1);
+    }
+  } catch (error) {
+    console.error('✗ Error:', error.message);
+    process.exit(1);
+  }
+}
+
+module.exports = PolarWebhookVerifier;

package/skills/ck-payment-integration/scripts/sepay-webhook-verify.js

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+
+/**
+ * SePay Webhook Verification Script
+ *
+ * Verifies SePay webhook authenticity and processes transaction data.
+ * Supports API Key and OAuth2 authentication.
+ *
+ * Usage:
+ *   node sepay-webhook-verify.js <webhook-payload-json>
+ *
+ * Environment Variables:
+ *   SEPAY_WEBHOOK_AUTH_TYPE - Authentication type (api_key or oauth2 or none)
+ *   SEPAY_WEBHOOK_API_KEY - API key for verification (if using api_key)
+ */
+
+const crypto = require('crypto');
+
+class SePayWebhookVerifier {
+  constructor(authType = 'none', apiKey = null) {
+    this.authType = authType;
+    this.apiKey = apiKey;
+  }
+
+  /**
+   * Verify webhook authenticity
+   */
+  verifyAuthentication(headers) {
+    if (this.authType === 'none') {
+      console.log('⚠️  Warning: No authentication configured');
+      return true;
+    }
+
+    if (this.authType === 'api_key') {
+      const authHeader = headers['authorization'] || headers['Authorization'];
+
+      if (!authHeader) {
+        throw new Error('Missing Authorization header');
+      }
+
+      const expectedAuth = `Apikey ${this.apiKey}`;
+      if (authHeader !== expectedAuth) {
+        throw new Error('Invalid API key');
+      }
+
+      return true;
+    }
+
+    if (this.authType === 'oauth2') {
+      const authHeader = headers['authorization'] || headers['Authorization'];
+
+      if (!authHeader || !authHeader.startsWith('Bearer ')) {
+        throw new Error('Missing or invalid OAuth2 Bearer token');
+      }
+
+      // In production, verify token with OAuth2 provider
+      console.log('✓ OAuth2 token present (full verification needed in production)');
+      return true;
+    }
+
+    throw new Error(`Unknown auth type: ${this.authType}`);
+  }
+
+  /**
+   * Check for duplicate transactions
+   */
+  isDuplicate(transactionId, processedIds = new Set()) {
+    return processedIds.has(transactionId);
+  }
+
+  /**
+   * Validate webhook payload structure
+   */
+  validatePayload(payload) {
+    const required = [
+      'id',
+      'gateway',
+      'transactionDate',
+      'accountNumber',
+      'transferType',
+      'transferAmount',
+      'referenceCode'
+    ];
+
+    for (const field of required) {
+      if (!(field in payload)) {
+        throw new Error(`Missing required field: ${field}`);
+      }
+    }
+
+    // Validate transfer type
+    if (!['in', 'out'].includes(payload.transferType)) {
+      throw new Error(`Invalid transferType: ${payload.transferType}`);
+    }
+
+    // Validate amount
+    if (typeof payload.transferAmount !== 'number' || payload.transferAmount <= 0) {
+      throw new Error('Invalid transferAmount');
+    }
+
+    return true;
+  }
+
+  /**
+   * Process webhook payload
+   */
+  process(payload, headers = {}) {
+    try {
+      // 1. Verify authentication
+      this.verifyAuthentication(headers);
+
+      // 2. Validate payload structure
+      this.validatePayload(payload);
+
+      // 3. Extract transaction data
+      const transaction = {
+        id: payload.id,
+        gateway: payload.gateway,
+        transactionDate: new Date(payload.transactionDate),
+        accountNumber: payload.accountNumber,
+        code: payload.code || null,
+        content: payload.content || '',
+        transferType: payload.transferType,
+        transferAmount: payload.transferAmount,
+        accumulated: payload.accumulated || 0,
+        subAccount: payload.subAccount || null,
+        referenceCode: payload.referenceCode
+      };
+
+      return {
+        success: true,
+        transaction,
+        isIncoming: transaction.transferType === 'in',
+        isOutgoing: transaction.transferType === 'out'
+      };
+    } catch (error) {
+      return {
+        success: false,
+        error: error.message
+      };
+    }
+  }
+}
+
+// CLI Usage
+if (require.main === module) {
+  const args = process.argv.slice(2);
+
+  if (args.length === 0) {
+    console.log('Usage: node sepay-webhook-verify.js <webhook-payload-json>');
+    console.log('\nEnvironment Variables:');
+    console.log('  SEPAY_WEBHOOK_AUTH_TYPE - Authentication type (api_key, oauth2, none)');
+    console.log('  SEPAY_WEBHOOK_API_KEY - API key for verification');
+    process.exit(1);
+  }
+
+  try {
+    const payload = JSON.parse(args[0]);
+    const authType = process.env.SEPAY_WEBHOOK_AUTH_TYPE || 'none';
+    const apiKey = process.env.SEPAY_WEBHOOK_API_KEY || null;
+
+    const verifier = new SePayWebhookVerifier(authType, apiKey);
+
+    // Mock headers for CLI testing
+    const headers = {};
+    if (authType === 'api_key' && apiKey) {
+      headers['Authorization'] = `Apikey ${apiKey}`;
+    }
+
+    const result = verifier.process(payload, headers);
+
+    if (result.success) {
+      console.log('✓ Webhook verified successfully\n');
+      console.log('Transaction Details:');
+      console.log(`  ID: ${result.transaction.id}`);
+      console.log(`  Gateway: ${result.transaction.gateway}`);
+      console.log(`  Type: ${result.transaction.transferType}`);
+      console.log(`  Amount: ${result.transaction.transferAmount.toLocaleString('vi-VN')} VND`);
+      console.log(`  Reference: ${result.transaction.referenceCode}`);
+      console.log(`  Content: ${result.transaction.content || 'N/A'}`);
+      console.log(`\n  Incoming: ${result.isIncoming ? 'Yes' : 'No'}`);
+      console.log(`  Outgoing: ${result.isOutgoing ? 'Yes' : 'No'}`);
+    } else {
+      console.error('✗ Verification failed:', result.error);
+      process.exit(1);
+    }
+  } catch (error) {
+    console.error('✗ Error:', error.message);
+    process.exit(1);
+  }
+}
+
+module.exports = SePayWebhookVerifier;

package/skills/ck-payment-integration/scripts/test-scripts.js

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+
+/**
+ * Test suite for payment integration scripts
+ */
+
+const SePayWebhookVerifier = require('./sepay-webhook-verify');
+const PolarWebhookVerifier = require('./polar-webhook-verify');
+const CheckoutHelper = require('./checkout-helper');
+
+class TestRunner {
+  constructor() {
+    this.passed = 0;
+    this.failed = 0;
+  }
+
+  test(name, fn) {
+    try {
+      fn();
+      console.log(`✓ ${name}`);
+      this.passed++;
+    } catch (error) {
+      console.error(`✗ ${name}`);
+      console.error(`  Error: ${error.message}`);
+      this.failed++;
+    }
+  }
+
+  assert(condition, message) {
+    if (!condition) {
+      throw new Error(message || 'Assertion failed');
+    }
+  }
+
+  assertEqual(actual, expected, message) {
+    if (actual !== expected) {
+      throw new Error(message || `Expected ${expected}, got ${actual}`);
+    }
+  }
+
+  summary() {
+    console.log(`\nTest Summary: ${this.passed} passed, ${this.failed} failed`);
+    return this.failed === 0;
+  }
+}
+
+// Run tests
+console.log('Running Payment Integration Script Tests\n');
+const runner = new TestRunner();
+
+// SePay Webhook Verifier Tests
+console.log('SePay Webhook Verifier Tests:');
+
+runner.test('should verify valid SePay webhook', () => {
+  const verifier = new SePayWebhookVerifier('none');
+  const payload = {
+    id: 12345,
+    gateway: 'Vietcombank',
+    transactionDate: '2025-01-13 10:00:00',
+    accountNumber: '0123456789',
+    transferType: 'in',
+    transferAmount: 100000,
+    referenceCode: 'REF123',
+    content: 'Order payment'
+  };
+
+  const result = verifier.process(payload);
+  runner.assert(result.success === true, 'Should verify successfully');
+  runner.assert(result.transaction.id === 12345, 'Should parse transaction ID');
+  runner.assert(result.isIncoming === true, 'Should detect incoming transfer');
+});
+
+runner.test('should reject invalid SePay transfer type', () => {
+  const verifier = new SePayWebhookVerifier('none');
+  const payload = {
+    id: 12345,
+    gateway: 'Vietcombank',
+    transactionDate: '2025-01-13 10:00:00',
+    accountNumber: '0123456789',
+    transferType: 'invalid',
+    transferAmount: 100000,
+    referenceCode: 'REF123'
+  };
+
+  const result = verifier.process(payload);
+  runner.assert(result.success === false, 'Should fail validation');
+  runner.assert(result.error.includes('Invalid transferType'), 'Should report invalid transfer type');
+});
+
+runner.test('should verify SePay webhook with API key', () => {
+  const verifier = new SePayWebhookVerifier('api_key', 'test_key_123');
+  const payload = {
+    id: 12345,
+    gateway: 'Vietcombank',
+    transactionDate: '2025-01-13 10:00:00',
+    accountNumber: '0123456789',
+    transferType: 'in',
+    transferAmount: 100000,
+    referenceCode: 'REF123'
+  };
+
+  const headers = { Authorization: 'Apikey test_key_123' };
+  const result = verifier.process(payload, headers);
+  runner.assert(result.success === true, 'Should verify with valid API key');
+});
+
+runner.test('should reject SePay webhook with invalid API key', () => {
+  const verifier = new SePayWebhookVerifier('api_key', 'test_key_123');
+  const payload = {
+    id: 12345,
+    gateway: 'Vietcombank',
+    transactionDate: '2025-01-13 10:00:00',
+    accountNumber: '0123456789',
+    transferType: 'in',
+    transferAmount: 100000,
+    referenceCode: 'REF123'
+  };
+
+  const headers = { Authorization: 'Apikey wrong_key' };
+  const result = verifier.process(payload, headers);
+  runner.assert(result.success === false, 'Should reject invalid API key');
+});
+
+// Polar Webhook Verifier Tests
+console.log('\nPolar Webhook Verifier Tests:');
+
+runner.test('should verify valid Polar webhook', () => {
+  const crypto = require('crypto');
+  const secret = Buffer.from('test_secret_key').toString('base64');
+  const verifier = new PolarWebhookVerifier(secret);
+
+  const payload = JSON.stringify({
+    type: 'order.paid',
+    data: { id: 'order_123', amount: 2000 }
+  });
+
+  const timestamp = Math.floor(Date.now() / 1000);
+  const signedPayload = `${timestamp}.${payload}`;
+  const signature = crypto
+    .createHmac('sha256', Buffer.from(secret, 'base64'))
+    .update(signedPayload)
+    .digest('base64');
+
+  const headers = {
+    'webhook-id': 'msg_123',
+    'webhook-timestamp': timestamp.toString(),
+    'webhook-signature': `v1=${signature}`
+  };
+
+  const result = verifier.process(payload, headers);
+  if (!result.success) {
+    throw new Error(`Verification failed: ${result.error}`);
+  }
+  runner.assert(result.success === true, 'Should verify successfully');
+  runner.assertEqual(result.event.type, 'order.paid', 'Should parse event type');
+});
+
+runner.test('should reject Polar webhook with invalid signature', () => {
+  const secret = Buffer.from('test_secret_key').toString('base64');
+  const verifier = new PolarWebhookVerifier(secret);
+
+  const payload = JSON.stringify({
+    type: 'order.paid',
+    data: { id: 'order_123' }
+  });
+
+  const headers = {
+    'webhook-id': 'msg_123',
+    'webhook-timestamp': Math.floor(Date.now() / 1000).toString(),
+    'webhook-signature': 'v1=invalid_signature'
+  };
+
+  const result = verifier.process(payload, headers);
+  runner.assert(result.success === false, 'Should reject invalid signature');
+});
+
+runner.test('should categorize Polar event types', () => {
+  runner.assertEqual(PolarWebhookVerifier.getEventCategory('order.paid'), 'order');
+  runner.assertEqual(PolarWebhookVerifier.getEventCategory('subscription.active'), 'subscription');
+  runner.assertEqual(PolarWebhookVerifier.getEventCategory('customer.created'), 'customer');
+  runner.assert(PolarWebhookVerifier.isPaymentEvent('order.paid') === true);
+  runner.assert(PolarWebhookVerifier.isSubscriptionEvent('subscription.active') === true);
+});
+
+// Checkout Helper Tests
+console.log('\nCheckout Helper Tests:');
+
+runner.test('should generate SePay checkout fields', () => {
+  const config = {
+    merchantId: 'SP-TEST-123',
+    secretKey: 'test_secret',
+    orderInvoiceNumber: 'ORD001',
+    orderAmount: 100000,
+    successUrl: 'https://example.com/success',
+    errorUrl: 'https://example.com/error',
+    cancelUrl: 'https://example.com/cancel',
+    env: 'sandbox'
+  };
+
+  const result = CheckoutHelper.generateSePayCheckout(config);
+  runner.assert(result.fields !== undefined, 'Should generate fields');
+  runner.assert(result.fields.signature !== undefined, 'Should generate signature');
+  runner.assertEqual(result.fields.merchant_id, 'SP-TEST-123', 'Should include merchant ID');
+  runner.assert(result.formUrl.includes('sandbox'), 'Should use sandbox URL');
+});
+
+runner.test('should generate Polar checkout config', () => {
+  const config = {
+    productPriceId: 'price_123',
+    successUrl: 'https://example.com/success',
+    externalCustomerId: 'user_123',
+    accessToken: 'test_token',
+    server: 'sandbox'
+  };
+
+  const result = CheckoutHelper.generatePolarCheckout(config);
+  runner.assert(result.config !== undefined, 'Should generate config');
+  runner.assertEqual(result.config.product_price_id, 'price_123', 'Should include price ID');
+  runner.assertEqual(result.config.external_customer_id, 'user_123', 'Should include customer ID');
+  runner.assert(result.apiEndpoint.includes('sandbox'), 'Should use sandbox endpoint');
+});
+
+runner.test('should reject Polar config with relative URL', () => {
+  try {
+    CheckoutHelper.generatePolarCheckout({
+      productPriceId: 'price_123',
+      successUrl: '/success' // Relative URL
+    });
+    runner.assert(false, 'Should throw error for relative URL');
+  } catch (error) {
+    runner.assert(error.message.includes('absolute URL'), 'Should require absolute URL');
+  }
+});
+
+// Run summary
+const success = runner.summary();
+process.exit(success ? 0 : 1);