strapi-plugin-payone-provider 5.6.10 → 5.6.12

package/server/services/transactionService.js

@@ -1,139 +1,172 @@
 "use strict";
 
-const { getPluginStore } = require("./settingsService");
+const { sanitizeSensitive } = require("../utils/sanitize");
 
-const logTransaction = async (strapi, transactionData) => {
-  const pluginStore = getPluginStore(strapi);
-  let transactionHistory =
-    (await pluginStore.get({ key: "transactionHistory" })) || [];
-
-  const logEntry = {
-    id: Date.now().toString(),
-    timestamp: new Date().toISOString(),
-    txid: transactionData.txid || null,
-    reference: transactionData.reference || null,
-    invoiceid: transactionData.invoiceid || null,
-    request_type:
-      transactionData.request_type || transactionData.request || "unknown",
-    amount: transactionData.amount || null,
-    currency: transactionData.currency || "EUR",
-    status: transactionData.status || transactionData.Status || "unknown",
-    error_code:
-      transactionData.error_code || transactionData.Error?.ErrorCode || null,
-    error_message:
-      transactionData.error_message ||
-      transactionData.Error?.ErrorMessage ||
-      null,
-    customer_message:
-      transactionData.customer_message ||
-      transactionData.Error?.CustomerMessage ||
-      null,
-    body: transactionData || null,
-    created_at: new Date().toISOString(),
-    updated_at: new Date().toISOString()
-  };
+const TRANSACTION_UID = "plugin::strapi-plugin-payone-provider.transaction";
 
-  transactionHistory.unshift(logEntry);
+const logTransaction = async (strapi, transactionData) => {
+  try {
+    const data = {
+      txid: transactionData.txid || 'NO TXID',
+      reference: transactionData.reference || 'NO REFERENCE',
+      invoiceid: transactionData.raw_request.invoiceid || 'NO INVOICE ID',
+      request_type: transactionData.request_type || "unknown",
+      amount: transactionData.amount || "0",
+      currency: transactionData.currency || "EUR",
+      status: transactionData.status || transactionData.raw_response.Status || "unknown",
+      error_code: transactionData.error_code || "NO ERROR CODE",
+      error_message: transactionData.error_message || "NO ERROR MESSAGE",
+      customer_message: transactionData.customer_message || "NO CUSTOMER MESSAGE",
+      body: transactionData ? { ...transactionData, raw_request: sanitizeSensitive(transactionData.raw_request), raw_response: sanitizeSensitive(transactionData.raw_response) } : {},
+      raw_request: sanitizeSensitive(transactionData.raw_request || {}),
+      raw_response: sanitizeSensitive(transactionData.raw_response || {}),
+    };
+
+    const entry = await strapi.db.query(TRANSACTION_UID).create({ data });
+    console.info("Transaction logged to DB:", {
+      id: entry.id,
+      txid: entry.txid,
+      status: entry.status
+    });
 
-  if (transactionHistory.length > 1000) {
-    transactionHistory = transactionHistory.slice(0, 1000);
+    return entry;
+  } catch (error) {
+    console.error("Failed to log transaction:", error);
   }
+};
 
-  await pluginStore.set({
-    key: "transactionHistory",
-    value: transactionHistory
-  });
 
-  console.log(`Transaction logged: ${logEntry}`);
-};
+const hasFilterValue = (v) =>
+  typeof v === "string" && v.trim() !== "" && v.trim().toLowerCase() !== "all";
 
+const buildWhereFromFilters = (filters = {}) => {
+  const conditions = [];
 
-const applyFilters = (transactions, filters = {}) => {
-  let result = [...transactions];
-  if (filters.search && typeof filters.search === 'string' && filters.search.trim() !== '') {
-    const search = filters.search.toLowerCase().trim();
-    result = result.filter((t) => {
-      const txid = (t.txid || "").toString().toLowerCase();
-      const reference = (t.reference || "").toString().toLowerCase();
-      return txid.includes(search) || reference.includes(search);
+  if (hasFilterValue(filters.search)) {
+    const search = String(filters.search).trim();
+    conditions.push({
+      $or: [
+        { txid: { $containsi: search } },
+        { reference: { $containsi: search } },
+      ],
     });
   }
 
-  if (filters.status) {
-    result = result.filter(
-      (t) => (t.status || "").toUpperCase() === filters.status.toUpperCase()
-    );
-  }
-
-  if (filters.request_type) {
-    result = result.filter((t) => t.request_type === filters.request_type);
+  if (hasFilterValue(filters.status)) {
+    conditions.push({ status: { $eqi: String(filters.status).trim() } });
   }
 
-  if (filters.payment_method) {
-    result = result.filter((t) => {
-      const clearingtype = t.raw_request?.clearingtype;
-      const wallettype = t.raw_request?.wallettype;
-
-      switch (filters.payment_method) {
-        case "credit_card":
-          return clearingtype === "cc";
-        case "paypal":
-          return clearingtype === "wlt" && wallettype === "PPE";
-        case "google_pay":
-          return clearingtype === "wlt" && ["GPY", "GOOGLEPAY"].includes(wallettype);
-        case "apple_pay":
-          return clearingtype === "wlt" && ["APL", "APPLEPAY"].includes(wallettype);
-        case "sofort":
-          return clearingtype === "sb";
-        case "sepa":
-          return clearingtype === "elv";
-        default:
-          return true;
-      }
-    });
+  if (hasFilterValue(filters.request_type)) {
+    conditions.push({ request_type: String(filters.request_type).trim() });
   }
 
-  if (filters.date_from) {
+  if (hasFilterValue(filters.date_from)) {
     const dateFrom = new Date(filters.date_from);
     dateFrom.setHours(0, 0, 0, 0);
-    result = result.filter(
-      (t) => new Date(t.timestamp) >= dateFrom
-    );
+    conditions.push({ createdAt: { $gte: dateFrom.toISOString() } });
   }
 
-  if (filters.date_to) {
+  if (hasFilterValue(filters.date_to)) {
     const dateTo = new Date(filters.date_to);
     dateTo.setHours(23, 59, 59, 999);
-    result = result.filter(
-      (t) => new Date(t.timestamp) <= dateTo
-    );
+    conditions.push({ createdAt: { $lte: dateTo.toISOString() } });
   }
 
-  return result;
-};
+  if (hasFilterValue(filters.payment_method)) {
+    switch (filters.payment_method) {
+      case "credit_card":
+        conditions.push({ raw_request: { $containsi: '"clearingtype":"cc"' } });
+        break;
+      case "paypal":
+        conditions.push({
+          $and: [
+            { raw_request: { $containsi: '"clearingtype":"wlt"' } },
+            { raw_request: { $containsi: '"wallettype":"PPE"' } },
+          ],
+        });
+        break;
+      case "google_pay":
+        conditions.push({
+          $and: [
+            { raw_request: { $containsi: '"clearingtype":"wlt"' } },
+            {
+              $or: [
+                { raw_request: { $containsi: '"wallettype":"GPY"' } },
+                { raw_request: { $containsi: '"wallettype":"GOOGLEPAY"' } },
+              ],
+            },
+          ],
+        });
+        break;
+      case "apple_pay":
+        conditions.push({
+          $and: [
+            { raw_request: { $containsi: '"clearingtype":"wlt"' } },
+            {
+              $or: [
+                { raw_request: { $containsi: '"wallettype":"APL"' } },
+                { raw_request: { $containsi: '"wallettype":"APPLEPAY"' } },
+              ],
+            },
+          ],
+        });
+        break;
+      case "sofort":
+        conditions.push({ raw_request: { $containsi: '"clearingtype":"sb"' } });
+        break;
+      case "sepa":
+        conditions.push({ raw_request: { $containsi: '"clearingtype":"elv"' } });
+        break;
+      default:
+        break;
+    }
+  }
 
-const getTransactionHistory = async (strapi, { filters = {}, pagination = {} }) => {
-  const pluginStore = getPluginStore(strapi);
+  if (conditions.length === 0) return undefined;
+  if (conditions.length === 1) return conditions[0];
+  return { $and: conditions };
+};
 
-  let transactions =
-    (await pluginStore.get({ key: "transactionHistory" })) || [];
+const ALLOWED_SORT_FIELDS = [
+  "txid",
+  "reference",
+  "amount",
+  "request_type",
+  "status",
+  "createdAt",
+  "updatedAt",
+];
+
+const getTransactionHistory = async (
+  strapi,
+  { filters = {}, pagination = {}, sort_by, sort_order }
+) => {
+  const page = Math.max(1, Number(pagination.page) || 1);
+  const pageSize = Math.min(100, Math.max(1, Number(pagination.pageSize) || 10));
+  const offset = (page - 1) * pageSize;
+
+  const where = buildWhereFromFilters(filters);
+
+  const sortField =
+    sort_by && ALLOWED_SORT_FIELDS.includes(sort_by) ? sort_by : "createdAt";
+  const order = sort_order === "asc" ? "asc" : "desc";
+
+  const queryOptions = {
+    orderBy: { [sortField]: order },
+    limit: pageSize,
+    offset,
+  };
+  if (where !== undefined) queryOptions.where = where;
 
-  transactions = applyFilters(transactions, filters);
-  const page = Number(pagination.page) || 1;
-  const pageSize = Number(pagination.pageSize) || 10;
+  const [data, total] = await strapi.db
+    .query(TRANSACTION_UID)
+    .findWithCount(queryOptions);
 
-  const total = transactions.length;
   const pageCount = Math.max(1, Math.ceil(total / pageSize));
-
-  const validPage = Math.min(Math.max(1, page), pageCount);
-
-  const start = (validPage - 1) * pageSize;
-  const end = Math.min(start + pageSize, total);
-
-  const paginatedData = start < total ? transactions.slice(start, end) : [];
+  const validPage = Math.min(page, pageCount);
 
   return {
-    data: paginatedData,
+    data,
     pagination: {
       page: validPage,
       pageSize,

package/server/services/transactionStatusService.js

@@ -1,87 +1,81 @@
 "use strict";
 
-const crypto = require("crypto");
-const { getPluginStore, getSettings } = require("./settingsService");
+const { getSettings } = require("./settingsService");
+const { sanitizeSensitive } = require("../utils/sanitize");
 
-const verifyHash = (notificationData, portalKey) => {
-  const {
-    portalid = "",
-    aid = "",
-    txid = "",
-    sequencenumber = "",
-    price = "",
-    currency = "",
-    mode = "",
-  } = notificationData;
+const TRANSACTION_UID = "plugin::strapi-plugin-payone-provider.transaction";
 
-  const hashString = `${portalid}${aid}${txid}${sequencenumber}${price}${currency}${mode}${portalKey}`;
-  const expectedHash = crypto.createHash("md5").update(hashString).digest("hex");
+const genreateUpdateData = (notificationData, existing, safeNotification) => {
+  const amount = String(notificationData.clearing_amount) || String(Math.round(parseFloat(notificationData.price) * 100)) || existing.amount;
+  const raw_request = {
+    ...existing.raw_request,
+    ...notificationData,
+    mode: notificationData.mode,
+    amount,
+    clearingtype: notificationData.clearingtype || existing.clearingtype,
+  }
+
+  return {
+    status: notificationData.transaction_status || existing.status,
+    currency: notificationData.currency || existing.currency,
+    reference: notificationData.reference || existing.reference,
+    amount,
+    body: {
+      ...existing.body,
+      status: notificationData.transaction_status,
+      amount,
+      raw_request: sanitizeSensitive(raw_request),
+      payone_notification_data: safeNotification,
+    },
+  };
+}
+
+const validateData = (notificationData, settings) => {
+  const isExist = (settings.portalid && settings.aid && settings.key) && (notificationData.portalid && notificationData.aid && notificationData.key);
+  const isMatch = notificationData.portalid === settings.portalid && notificationData.aid === settings.aid && notificationData.key === settings.key;
+
+  if (!isExist) {
+    console.log("[Payone TransactionStatus] Settings not found or payone data missing");
+    return false;
+  }
 
-  return expectedHash.toLowerCase() === (notificationData.key || "").toLowerCase();
+  if (!isMatch) {
+    console.log("[Payone TransactionStatus] Payone data mismatch with settings");
+    return false;
+  }
+
+  return true;
 };
 
+
 const processTransactionStatus = async (strapi, notificationData) => {
   try {
     const settings = await getSettings(strapi);
-    const txid = notificationData.txid;
-
-    if (!settings || !settings.key) {
-      console.log("[Payone TransactionStatus] Settings not found or key missing");
+    if (!validateData(notificationData, settings)) {
       return;
     }
 
-    const isValid = verifyHash(notificationData, settings.key);
-    if (!isValid) {
-      console.log(`[Payone TransactionStatus] Hash verification failed txid: ${txid}`);
-      return;
-    }
+    const txid = notificationData.txid;
+    const existing = await strapi.db.query(TRANSACTION_UID).findOne({ where: { txid } });
 
-    if (notificationData.portalid !== settings.portalid || notificationData.aid !== settings.aid) {
-      console.log(`[Payone TransactionStatus] Portal ID or AID mismatch txid: ${txid}`);
+    if (!existing) {
+      console.log(`[Payone TransactionStatus] Transaction ${txid} not found. Notification ignored.`);
       return;
     }
 
-    const pluginStore = getPluginStore(strapi);
-    let transactionHistory = (await pluginStore.get({ key: "transactionHistory" })) || [];
-
-    const transaction = transactionHistory.find((t) => t.txid === txid || t.id === txid);
-
-    if (transaction) {
-      Object.assign(transaction, {
-        ...notificationData,
-        status: notificationData?.transaction_status,
-        txaction: notificationData?.txaction,
-        txtime: notificationData?.txtime,
-        sequencenumber: notificationData?.sequencenumber,
-        balance: notificationData?.balance,
-        receivable: notificationData?.receivable,
-        price: notificationData?.price,
-        amount: notificationData?.price ? parseFloat(notificationData?.price) * 100 : transaction?.amount,
-        userid: notificationData?.userid,
-        updated_at: new Date().toISOString(),
-        body: {
-          ...transaction?.body,
-          ...notificationData,
-          status: notificationData?.transaction_status
-        }
-      });
-
-      await pluginStore.set({
-        key: "transactionHistory",
-        value: transactionHistory,
-      });
-
-      console.log(`[Payone TransactionStatus] Successfully updated transaction txid: ${txid}`);
-    } else {
-      console.log(`[Payone TransactionStatus] Transaction ${txid} not found in history. Notification ignored.`);
-    }
+    const safeNotification = sanitizeSensitive({ ...notificationData });
+    const data = genreateUpdateData(notificationData, existing, safeNotification);
+    await strapi.db.query(TRANSACTION_UID).update({
+      where: { id: existing.id },
+      data,
+    });
 
+    console.log(`[Payone TransactionStatus] Successfully updated transaction txid: ${txid}`);
   } catch (error) {
     console.log(`[Payone TransactionStatus] Error processing notification: ${error}`);
   }
 };
 
 module.exports = {
-  verifyHash,
   processTransactionStatus,
 };

package/server/utils/requestBuilder.js

@@ -2,38 +2,7 @@
 
 const crypto = require("crypto");
 const { normalizeCustomerId } = require("./normalize");
-const calculateKeyHash = (settings, params) => {
-  const portalKey = settings.portalKey || settings.key;
-  const portalid = String(settings.portalid || "");
-  const aid = String(settings.aid || "");
-  const mode = String(settings.mode || "test");
-
-  const requestType = params.request || "";
-
-  // For Capture and Refund operations
-  if (requestType === "capture" || requestType === "refund") {
-    const txid = String(params.txid || "");
-    const sequencenumber = String(params.sequencenumber || "");
-    const amount = String(params.amount || "");
-    const currency = String(params.currency || "EUR");
-
-    const hashString = `${portalid}${aid}${txid}${sequencenumber}${amount}${currency}${mode}${portalKey}`;
-    return crypto.createHash("md5").update(hashString).digest("hex");
-  }
-
-  // For Preauthorization and Authorization operations
-  if (requestType === "preauthorization" || requestType === "authorization") {
-    const amount = String(params.amount || "");
-    const currency = String(params.currency || "EUR");
-    const reference = String(params.reference || "");
 
-    const hashString = `${portalid}${aid}${amount}${currency}${reference}${mode}${portalKey}`;
-    return crypto.createHash("md5").update(hashString).digest("hex");
-  }
-
-  const hashString = `${portalid}${aid}${mode}${portalKey}`;
-  return crypto.createHash("md5").update(hashString).digest("hex");
-};
 
 const buildClientRequestParams = (settings, params, logger = null) => {
   const requestParams = {
@@ -51,7 +20,10 @@ const buildClientRequestParams = (settings, params, logger = null) => {
     logger
   );
 
-  requestParams.key = calculateKeyHash(settings, requestParams);
+  requestParams.key = crypto
+    .createHash("md5")
+    .update(settings.portalKey || settings.key)
+    .digest("hex");
 
   const isCreditCard = requestParams.clearingtype === "cc";
   const enable3DSecure = settings.enable3DSecure !== false;

package/server/utils/sanitize.js

@@ -0,0 +1,42 @@
+"use strict";
+
+const SENSITIVE_KEYS = [
+  "cardpan",
+  "cardexpiredate",
+  "cardcvc2",
+  "iban",
+  "bic",
+  "bankaccount",
+  "bankcode",
+  "bankaccountholder",
+  "key",
+  "accesscode",
+  "accessname",
+  "token",
+  "redirecturl",
+  "Identifier"
+];
+
+const maskValue = (val) => {
+  if (typeof val !== "string") return val;
+  return "*".repeat(Math.min(val.length, 20));
+};
+
+const sanitizeSensitive = (obj) => {
+  if (!obj || typeof obj !== "object") return obj;
+  if (Array.isArray(obj)) return obj.map(sanitizeSensitive);
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    const keyLower = k.toLowerCase();
+    if (SENSITIVE_KEYS.includes(keyLower) && v != null) {
+      out[k] = maskValue(String(v));
+    } else if (v != null && typeof v === "object" && !Array.isArray(v)) {
+      out[k] = sanitizeSensitive(v);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+};
+
+module.exports = { sanitizeSensitive };