cybersource-rest-client 0.0.78 → 0.0.80

package/src/api/OrdersApi.js

@@ -89,8 +89,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2CreateOrderPost201Response;
 
       //check isMLE for an api method 'this.createOrder'
@@ -162,8 +162,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2UpdateOrderPatch201Response;
 
       //check isMLE for an api method 'this.updateOrder'

package/src/api/PaymentLinksApi.js

@@ -94,7 +94,7 @@
       var returnType = PblPaymentLinksPost201Response;
 
       //check isMLE for an api method 'this.createPaymentLink'
-      var inboundMLEStatus = 'false';
+      var inboundMLEStatus = 'optional';
       var isMLEForApi = MLEUtility.checkIsMLEForAPI(this.apiClient.merchantConfig, inboundMLEStatus, 'createPaymentLink');
       const isResponseMLEForApi = MLEUtility.checkIsResponseMLEForAPI(this.apiClient.merchantConfig, ['createPaymentLink']);
 
@@ -171,7 +171,7 @@
       var returnType = PblPaymentLinksAllGet200Response;
 
       //check isMLE for an api method 'this.getAllPaymentLinks'
-      var inboundMLEStatus = 'false';
+      var inboundMLEStatus = 'optional';
       var isMLEForApi = MLEUtility.checkIsMLEForAPI(this.apiClient.merchantConfig, inboundMLEStatus, 'getAllPaymentLinks');
       const isResponseMLEForApi = MLEUtility.checkIsResponseMLEForAPI(this.apiClient.merchantConfig, ['getAllPaymentLinks']);
 
@@ -237,7 +237,7 @@
       var returnType = PblPaymentLinksGet200Response;
 
       //check isMLE for an api method 'this.getPaymentLink'
-      var inboundMLEStatus = 'false';
+      var inboundMLEStatus = 'optional';
       var isMLEForApi = MLEUtility.checkIsMLEForAPI(this.apiClient.merchantConfig, inboundMLEStatus, 'getPaymentLink');
       const isResponseMLEForApi = MLEUtility.checkIsResponseMLEForAPI(this.apiClient.merchantConfig, ['getPaymentLink']);
 
@@ -310,7 +310,7 @@
       var returnType = PblPaymentLinksPost201Response;
 
       //check isMLE for an api method 'this.updatePaymentLink'
-      var inboundMLEStatus = 'false';
+      var inboundMLEStatus = 'optional';
       var isMLEForApi = MLEUtility.checkIsMLEForAPI(this.apiClient.merchantConfig, inboundMLEStatus, 'updatePaymentLink');
       const isResponseMLEForApi = MLEUtility.checkIsResponseMLEForAPI(this.apiClient.merchantConfig, ['updatePaymentLink']);
 

package/src/api/PaymentTokensApi.js

@@ -89,8 +89,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = InlineResponse201;
 
       //check isMLE for an api method 'this.retrieveOrDeletePaymentToken'

package/src/api/PaymentsApi.js

@@ -96,8 +96,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsOrderPost201Response;
 
       //check isMLE for an api method 'this.createOrderRequest'
@@ -162,8 +162,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsPost201Response;
 
       //check isMLE for an api method 'this.createPayment'
@@ -228,8 +228,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsPost201Response2;
 
       //check isMLE for an api method 'this.createSessionRequest'
@@ -301,8 +301,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2IncrementalAuthorizationPatch201Response;
 
       //check isMLE for an api method 'this.incrementAuth'
@@ -374,8 +374,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsPost201Response1;
 
       //check isMLE for an api method 'this.refreshPaymentStatus'
@@ -401,8 +401,8 @@
     }
 
     /**
-     * Callback function to receive the result of the updateSessionReq operation.
-     * @callback module:api/PaymentsApi~updateSessionReqCallback
+     * Callback function to receive the result of the updateSessionRequest operation.
+     * @callback module:api/PaymentsApi~updateSessionRequestCallback
      * @param {String} error Error message, if any.
      * @param {module:model/PtsV2PaymentsPost201Response2} data The data returned by the service call.
      * @param {String} response The complete HTTP response.
@@ -413,20 +413,20 @@
      * Update Alternative Payments Sessions Request
      * @param {module:model/CreateSessionRequest} createSessionRequest 
      * @param {String} id The payment ID. This ID is returned from a previous payment request.
-     * @param {module:api/PaymentsApi~updateSessionReqCallback} callback The callback function, accepting three arguments: error, data, response
+     * @param {module:api/PaymentsApi~updateSessionRequestCallback} callback The callback function, accepting three arguments: error, data, response
      * data is of type: {@link module:model/PtsV2PaymentsPost201Response2}
      */
-    this.updateSessionReq = function(createSessionRequest, id, callback) {
+    this.updateSessionRequest = function(createSessionRequest, id, callback) {
       var postBody = createSessionRequest;
 
       // verify the required parameter 'createSessionRequest' is set
       if (createSessionRequest === undefined || createSessionRequest === null) {
-        throw new Error("Missing the required parameter 'createSessionRequest' when calling updateSessionReq");
+        throw new Error("Missing the required parameter 'createSessionRequest' when calling updateSessionRequest");
       }
 
       // verify the required parameter 'id' is set
       if (id === undefined || id === null) {
-        throw new Error("Missing the required parameter 'id' when calling updateSessionReq");
+        throw new Error("Missing the required parameter 'id' when calling updateSessionRequest");
       }
 
       var SdkTracker = require('../utilities/tracking/SdkTracker');
@@ -447,14 +447,14 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsPost201Response2;
 
-      //check isMLE for an api method 'this.updateSessionReq'
+      //check isMLE for an api method 'this.updateSessionRequest'
       var inboundMLEStatus = 'optional';
-      var isMLEForApi = MLEUtility.checkIsMLEForAPI(this.apiClient.merchantConfig, inboundMLEStatus, 'updateSessionReq');
-      const isResponseMLEForApi = MLEUtility.checkIsResponseMLEForAPI(this.apiClient.merchantConfig, ['updateSessionReq']);
+      var isMLEForApi = MLEUtility.checkIsMLEForAPI(this.apiClient.merchantConfig, inboundMLEStatus, 'updateSessionRequest');
+      const isResponseMLEForApi = MLEUtility.checkIsResponseMLEForAPI(this.apiClient.merchantConfig, ['updateSessionRequest']);
 
       if (isMLEForApi === true) {
         MLEUtility.encryptRequestPayload(this.apiClient.merchantConfig, postBody).then(postBody => {

package/src/api/RefundApi.js

@@ -96,8 +96,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsRefundPost201Response;
 
       //check isMLE for an api method 'this.refundCapture'
@@ -169,8 +169,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsRefundPost201Response;
 
       //check isMLE for an api method 'this.refundPayment'

package/src/api/ReversalApi.js

@@ -96,8 +96,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsReversalsPost201Response;
 
       //check isMLE for an api method 'this.authReversal'
@@ -162,8 +162,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsReversalsPost201Response;
 
       //check isMLE for an api method 'this.mitReversal'

package/src/api/UnifiedCheckoutV1CaptureContextApi.js

@@ -16,18 +16,18 @@
 (function(root, factory) {
   if (typeof define === 'function' && define.amd) {
     // AMD. Register as an anonymous module.
-    define(['Authentication/MLEUtility', 'ApiClient', 'model/GenerateUnifiedCheckoutV1CaptureContextRequest', 'model/InlineResponse4001'], factory);
+    define(['Authentication/MLEUtility', 'ApiClient', 'model/GenerateUnifiedCheckoutV1CaptureContextRequest', 'model/InlineResponse40011'], factory);
   } else if (typeof module === 'object' && module.exports) {
     // CommonJS-like environments that support module.exports, like Node.
-    module.exports = factory(require('../authentication/util/MLEUtility'), require('../ApiClient'), require('../model/GenerateUnifiedCheckoutV1CaptureContextRequest'), require('../model/InlineResponse4001'));
+    module.exports = factory(require('../authentication/util/MLEUtility'), require('../ApiClient'), require('../model/GenerateUnifiedCheckoutV1CaptureContextRequest'), require('../model/InlineResponse40011'));
   } else {
     // Browser globals (root is window)
     if (!root.CyberSource) {
       root.CyberSource = {};
     }
-    root.CyberSource.UnifiedCheckoutV1CaptureContextApi = factory(root.Authentication.MLEUtility, root.CyberSource.ApiClient, root.CyberSource.GenerateUnifiedCheckoutV1CaptureContextRequest, root.CyberSource.InlineResponse4001);
+    root.CyberSource.UnifiedCheckoutV1CaptureContextApi = factory(root.Authentication.MLEUtility, root.CyberSource.ApiClient, root.CyberSource.GenerateUnifiedCheckoutV1CaptureContextRequest, root.CyberSource.InlineResponse40011);
   }
-}(this, function(MLEUtility, ApiClient, GenerateUnifiedCheckoutV1CaptureContextRequest, InlineResponse4001) {
+}(this, function(MLEUtility, ApiClient, GenerateUnifiedCheckoutV1CaptureContextRequest, InlineResponse40011) {
   'use strict';
 
   /**

package/src/api/VoidApi.js

@@ -89,8 +89,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsVoidsPost201Response;
 
       //check isMLE for an api method 'this.mitVoid'
@@ -162,8 +162,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsVoidsPost201Response;
 
       //check isMLE for an api method 'this.voidCapture'
@@ -235,8 +235,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsVoidsPost201Response;
 
       //check isMLE for an api method 'this.voidCredit'
@@ -308,8 +308,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsVoidsPost201Response;
 
       //check isMLE for an api method 'this.voidPayment'
@@ -381,8 +381,8 @@
 
 
       var authNames = [];
-      var contentTypes = ['application/json;charset=utf-8'];
-      var accepts = ['application/hal+json;charset=utf-8'];
+      var contentTypes = ['application/json', 'application/json; charset=utf-8'];
+      var accepts = ['application/hal+json'];
       var returnType = PtsV2PaymentsVoidsPost201Response;
 
       //check isMLE for an api method 'this.voidRefund'

package/src/authentication/http/HTTPSigToken.js

@@ -3,6 +3,7 @@
 var Constants = require('../util/Constants');
 var SignatureParameterGenerator = require('./SignatureParameterGenerator');
 var ApiException = require('../util/ApiException');
+var LoggingUtilities = require('../logging/LoggingUtilities');
 
 /* HttpSigToken return SignatureHeader Value that contains following paramters
  * keyid     -- Merchant ID obtained from EBC portal
@@ -47,7 +48,7 @@ exports.getToken = function (merchantConfig, logger) {
         /* Get Value for paramter 'Signature' to be passed to Signature Header */
         signatureValue = SignatureParameterGenerator.getSignatureParameter(merchantConfig, logger);
         signatureHeader += ", signature=\"" + signatureValue + "\"";
-        logger.info("signatureHeader : " + signatureHeader);
+        logger.info("signatureHeader : " + LoggingUtilities.redactSignature(signatureHeader));
         return signatureHeader;
     } catch (err) {
         logger.error(err.stack);

package/src/authentication/jwt/JWTSigToken.js

@@ -53,17 +53,9 @@ function getPayloadClaimSet(merchantConfig, isResponseMLEForApi, logger) {
     payloadClaimSet["iat"] = nowEpochSeconds;
     payloadClaimSet["exp"] = nowEpochSeconds + 120; // +2 minutes
 
-    let requestTarget;
-
-    if (merchantConfig.requestTarget.includes("?")) {
-        requestTarget = merchantConfig.requestTarget.substring(0, merchantConfig.requestTarget.indexOf("?"));
-    } else {
-        requestTarget = merchantConfig.requestTarget;
-    }
-
     // Request metadata
     payloadClaimSet["request-host"] = merchantConfig.getRunEnvironment();
-    payloadClaimSet["request-resource-path"] = requestTarget;
+    payloadClaimSet["request-resource-path"] = merchantConfig.requestTarget;
     payloadClaimSet["request-method"] = requestVerb;
 
     // Standard JWT claims

package/src/authentication/logging/LogConfiguration.js

@@ -46,7 +46,11 @@ class LogConfiguration {
      * @param {any} enableMaskingValue
      */
     setMaskingEnabled(enableMaskingValue) {
-        this.enableMasking = enableMaskingValue;
+        if (enableMaskingValue === null || enableMaskingValue === undefined || enableMaskingValue === "") {
+            this.enableMasking = true;
+        } else {
+            this.enableMasking = enableMaskingValue;
+        }
     }
 
     setHasExternalLogger(hasExternalLogger){
@@ -140,7 +144,9 @@ class LogConfiguration {
             this.enableLog = false;
         }
 
-        if (typeof (this.enableMasking) === "boolean" && this.enableMasking === true) {
+        if (this.enableMasking === null || this.enableMasking === undefined || this.enableMasking === "") {
+            this.enableMasking = true;
+        } else if (typeof (this.enableMasking) === "boolean" && this.enableMasking === true) {
             this.enableMasking = true;
         } else {
             this.enableMasking = false;

package/src/authentication/logging/LoggingUtilities.js

@@ -0,0 +1,47 @@
+'use strict';
+
+function LoggingUtilities() { }
+
+/**
+ * Generic redactor for opaque secrets in log output.
+ * Returns "***" + last `tailLen` chars of the input.
+ * Null/empty safe. If the value is shorter than `tailLen`, the whole
+ * value is appended after "***" (no slice underflow, still prefixed).
+ *
+ * Use this for any new auth-related log statement that needs to include
+ * a token, key, secret, or signature material.
+ */
+LoggingUtilities.redact = function (value, tailLen) {
+  if (value === null || value === undefined || value === '') return '***';
+  var n = (typeof tailLen === 'number' && tailLen > 0) ? tailLen : 4;
+  var s = String(value);
+  return '***' + (s.length > n ? s.slice(-n) : s);
+};
+
+/**
+ * Redact opaque values in a JWT string.
+ * Masks the JWT to "***" + last 4 chars of the original value.
+ */
+LoggingUtilities.redactJwt = function (jwt) {
+    return LoggingUtilities.redact(jwt, 4);
+}
+
+/**
+ * Redact opaque values in an HTTP Signature header string.
+ * Keeps algorithm and headers (structural metadata) intact; masks the rest
+ * to "***" + last 4 chars of the original value.
+ */
+LoggingUtilities.redactSignature = function (signature) {
+  if (!signature) return signature;
+  var KEEP = { algorithm: true, headers: true };
+  var matched = false;
+  var result = signature.replace(/(\w+)="([^"]*)"/g, function (_, key, val) {
+    matched = true;
+    if (KEEP[key.toLowerCase()]) return key + '="' + val + '"';
+    return key + '="' + LoggingUtilities.redact(val, 4) + '"';
+  });
+  if (!matched) return LoggingUtilities.redact(signature, 4);
+  return result;
+}
+
+module.exports = LoggingUtilities;

package/src/authentication/logging/SensitiveDataMasker.js

@@ -21,6 +21,10 @@ function maskSensitiveData(message) {
         return Constants.LOG_RESPONSE_BEFORE_MLE + maskSensitiveData(message.substring(Constants.LOG_RESPONSE_BEFORE_MLE.length));
     }
 
+    if (typeof message === 'string' && message.startsWith(Constants.RESPONSE_DATA_MESSAGE)) {
+        return Constants.RESPONSE_DATA_MESSAGE + maskSensitiveData(message.substring(Constants.RESPONSE_DATA_MESSAGE.length));
+    }
+
     if (Utility.isJsonString(message)) {
         jsonMsg = JSON.parse(message);
     } else {
@@ -34,14 +38,38 @@ function maskSensitiveData(message) {
         for (prop in jsonMsg) {
             var isFieldSensitive = (sensitiveFields.indexOf(prop) > -1);
             if (isFieldSensitive === true) {
-                if (jsonMsg[prop] != null || jsonMsg[prop] != undefined) {
-                    if(typeof jsonMsg[prop].length === 'number'){
-                        jsonMsg[prop] = new Array(jsonMsg[prop].length + 1).join('X');
-                    }else if (jsonMsg.hasOwnProperty(prop)) {
-                        jsonMsg[prop] = JSON.parse(maskSensitiveData(jsonMsg[prop]));
+                if (jsonMsg[prop] !== null && jsonMsg[prop] !== undefined) {  // && not ||
+                    var v = jsonMsg[prop];
+                    if (typeof v === 'string') {
+                        jsonMsg[prop] = new Array(v.length + 1).join('X');
+                    } else if (typeof v === 'number' || typeof v === 'boolean') {
+                        // Mask primitive non-string values with a fixed placeholder
+                        jsonMsg[prop] = 'XXX';
+                    } else if (Array.isArray(v)) {
+                        // Recurse into each array item
+                        jsonMsg[prop] = v.map(function (item) {
+                            // Item is not valid
+                            if (item === null || item === undefined) return item;
+
+                            // Item is an array or an object — recurse
+                            if (typeof item === 'object') return JSON.parse(maskSensitiveData(item));
+
+                            // Item is a string — mask with Xs
+                            if (typeof item === 'string') return new Array(item.length + 1).join('X');
+
+                            // Item is a number / boolean / unknown — fail closed
+                            return 'XXX';
+                        });
+                    } else if (typeof v === 'object') {
+                        // Object type - recurse into children
+                        jsonMsg[prop] = JSON.parse(maskSensitiveData(v));
+                    } else {
+                        // Unknown type — fail closed
+                        jsonMsg[prop] = 'XXX';
                     }
                 }
             } else if (jsonMsg.hasOwnProperty(prop)) {
+                // Recurse into non-sensitive objects/arrays to mask any nested sensitive fields
                 jsonMsg[prop] = JSON.parse(maskSensitiveData(jsonMsg[prop]));
             }
         }

package/src/authentication/util/Cache.js

@@ -14,11 +14,11 @@ var Utility = require('./Utility');
  * Certificate will be available in the memory cache if it has initialized once.
  */
 exports.fetchCachedCertificate = function (merchantConfig, logger) {
-
-    var cachedCertificateFromP12File = cache.get("certificateFromP12File");
-    var cachedLastModifiedTimeStamp = cache.get("certificateLastModifideTimeStamp");
-
     var filePath = merchantConfig.getP12FilePath();
+    var cacheKey = path.resolve(filePath);
+    var cachedCertificateFromP12File = cache.get(cacheKey);
+    var cachedLastModifiedTimeStamp = cache.get(cacheKey + "LastModifiedTimeStamp");
+
     if (fs.existsSync(filePath)) {
         const stats = fs.statSync(filePath);
         const currentFileLastModifiedTime = stats.mtime;
@@ -48,8 +48,9 @@ exports.fetchCachedCertificate = function (merchantConfig, logger) {
 function getCertificate(keyPass, filePath, fileLastModifiedTime, logger) {
     try {
         var certificate = Utility.parseP12File(filePath, keyPass, logger);
-        cache.put("certificateFromP12File", certificate);
-        cache.put("certificateLastModifideTimeStamp", fileLastModifiedTime);
+        var cacheKey = path.resolve(filePath);
+        cache.put(cacheKey, certificate);
+        cache.put(cacheKey + "LastModifiedTimeStamp", fileLastModifiedTime);
         return certificate;
     } catch (error) {
         ApiException.AuthException(error.message + ". " + Constants.INCORRECT_KEY_PASS);

package/src/authentication/util/Constants.js

@@ -48,6 +48,7 @@ module.exports = {
     LOG_REQUEST_AFTER_MLE             :  "Request after MLE: ",
     LOG_RESPONSE_BEFORE_MLE           :  "Response before MLE decryption: ",
     LOG_RESPONSE_AFTER_MLE            :  "Response after MLE decryption: ",
+    RESPONSE_DATA_MESSAGE             :  "Response Data : ",
     MERCHANTID                        :  "MERCHANTID",
     MERCHANT_KEY_ID                   :  "MERCHANT_KEY_ID",
     MERCHANT_SECERT_KEY               :  "MERCHANT_SECERT_KEY",

package/src/authentication/util/JWEUtility.js

@@ -17,6 +17,9 @@ exports.decryptUsingPEM = function(merchantConfig, encodedData) {
 
 exports.decryptJWEUsingPrivateKey = async function(privateKey, encodedData) {
     const privateKeyObject = crypto.createPrivateKey(privateKey);
-    const { plaintext } = await compactDecrypt(encodedData, privateKeyObject);
+    const { plaintext } = await compactDecrypt(encodedData, privateKeyObject, {
+        keyManagementAlgorithms: ['RSA-OAEP-256', 'RSA-OAEP'],
+        contentEncryptionAlgorithms: ['A256GCM', 'A128GCM'],
+    });
     return new TextDecoder().decode(plaintext);
 }

package/src/authentication/util/jwt/JWTUtility.js

@@ -11,6 +11,9 @@ const SUPPORTED_ALGORITHMS = {
     'RS512': 'sha512'
 };
 
+// Minimum RSA key size in bytes (2048 bits = 256 bytes)
+const MIN_RSA_KEY_SIZE_BYTES = 256;
+
 // Error messages constants
 const ERROR_MESSAGES = {
     UNSUPPORTED_ALGORITHM: (algorithm) =>
@@ -19,7 +22,8 @@ const ERROR_MESSAGES = {
     NO_PUBLIC_KEY: 'No public key found',
     INVALID_PUBLIC_KEY_FORMAT: 'Invalid public key format. Expected JWK object or JSON string.',
     INVALID_RSA_KEY: 'Public key must be an RSA key (kty: RSA)',
-    MISSING_RSA_PARAMS: 'Invalid RSA JWK: missing required parameters (n, e)'
+    MISSING_RSA_PARAMS: 'Invalid RSA JWK: missing required parameters (n, e)',
+    RSA_KEY_TOO_SMALL: `RSA key too small: minimum ${MIN_RSA_KEY_SIZE_BYTES * 8} bits required`
 };
 
 /**
@@ -92,6 +96,18 @@ function convertJwkToPem(jwkKey) {
         throw new JWTExceptions.InvalidJwkException('Invalid base64url encoding in JWK parameters', decodeErr);
     }
 
+    // Strip leading zero bytes to get the effective modulus size
+    // This prevents bypass via zero-padded small keys
+    let effectiveModulus = n;
+    while (effectiveModulus.length > 0 && effectiveModulus[0] === 0) {
+        effectiveModulus = effectiveModulus.slice(1);
+    }
+
+    // Enforce minimum RSA key size to prevent weak key attacks
+    if (effectiveModulus.length < MIN_RSA_KEY_SIZE_BYTES) {
+        throw new JWTExceptions.InvalidJwkException(ERROR_MESSAGES.RSA_KEY_TOO_SMALL);
+    }
+
     let publicKeyForge;
     try {
         publicKeyForge = forge.pki.rsa.setPublicKey(