cybersource-brunei-payauth 0.1.0

package/.claude/scheduled_tasks.lock

@@ -0,0 +1 @@
+{"sessionId":"34c2077e-ca7a-48eb-a633-d43df7e24854","pid":23436,"procStart":"134308217849349133","acquiredAt":1786419693310}

package/.gitattributes

@@ -0,0 +1,2 @@
+# Auto detect text files and perform LF normalization
+* text=auto

package/README.md

@@ -0,0 +1,76 @@
+# cybersource-brunei-payauth
+
+Cybersource REST API client for card payments with EMV 3-D Secure payer authentication, including issuer step-up (OTP) redirect handling for Brunei-issued cards. Hand-rolled HTTP Signature auth — no Cybersource SDK dependency.
+
+## Install
+
+Copy this package into your project (or publish it to your own npm registry) — it has zero runtime dependencies.
+
+## Usage
+
+```js
+const { createCyberSourceClient, CyberSourceApiError } = require('cybersource-brunei-payauth');
+
+const client = createCyberSourceClient({
+  merchantId: process.env.CYBERSOURCE_MERCHANT_ID,
+  apiKeyId: process.env.CYBERSOURCE_API_KEY_ID,
+  apiKeySecret: process.env.CYBERSOURCE_API_KEY_SECRET,
+  environment: 'sandbox', // or 'production'
+});
+
+async function main() {
+  // Illustrative placeholder values — replace with real order/customer data.
+  const card = { number: '4111111111111111', type: '001', expirationMonth: '12', expirationYear: '2030' };
+  const orderAmount = { currency: 'BND', totalAmount: '50.00' };
+  const billTo = {
+    firstName: 'Jane', lastName: 'Doe',
+    address1: 'Jalan Kianggeh', locality: 'Bandar Seri Begawan',
+    administrativeArea: 'BM', postalCode: 'BS8811', country: 'BN',
+    email: 'jane@example.com', phoneNumber: '2234567',
+  };
+
+  // 1. Setup
+  const setup = await client.setupPayerAuth({ card });
+
+  // 2. Enrollment check
+  const enrollment = await client.checkEnrollment({
+    referenceId: setup.referenceId,
+    card,
+    orderAmount,
+    returnUrl: 'https://your-site.example/payer-auth-return',
+  });
+
+  // authenticationResult ends up populated either directly by checkEnrollment (frictionless
+  // pass) or, after a step-up challenge, by validateStepUp.
+  let authenticationResult = enrollment.authenticationResult;
+
+  if (enrollment.stepUpRequired) {
+    // 3. Serve this HTML — the customer is redirected to their bank's OTP page
+    const html = client.buildStepUpFormHtml(enrollment.stepUp);
+    // ... respond with `html` from your route handler here ...
+
+    // 4. Your /payer-auth-return route receives the bank's POST-back (TransactionId, MD)
+    const transactionId = /* req.body.TransactionId from your return-URL route handler */ undefined;
+    const validation = await client.validateStepUp({
+      transactionId,
+      veresEnrolled: enrollment.stepUp.veresEnrolled,
+      card,
+      orderAmount,
+    });
+
+    if (!validation.authenticationResult) {
+      // validation.failureReason explains why (e.g. wrong OTP) — ask for another payment method
+      return;
+    }
+    authenticationResult = validation.authenticationResult;
+  }
+
+  // 5. Authorize (authenticationResult comes from checkEnrollment or validateStepUp)
+  const payment = await client.authorize({ card, orderAmount, billTo, authenticationResult });
+
+  // 6. Capture
+  const captured = await client.capture(payment.id, { currency: 'BND', totalAmount: '50.00' });
+}
+```
+
+`CyberSourceApiError` is thrown only for transport/HTTP-level failures (bad signature, network error, malformed response). Business outcomes (declined payment, failed OTP) are returned normally — check `status`/`authenticationResult`/`failureReason` on the resolved value.