xytara 2.5.0 → 2.6.0

package/lib/stripe_mpp_payment_front.js

@@ -0,0 +1,158 @@
+"use strict";
+
+const crypto = require("crypto");
+
+function normalizeString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function safeEqualHex(left, right) {
+  const a = Buffer.from(String(left || ""), "hex");
+  const b = Buffer.from(String(right || ""), "hex");
+  if (a.length === 0 || b.length === 0 || a.length !== b.length) return false;
+  return crypto.timingSafeEqual(a, b);
+}
+
+function decodeBase64UrlJson(value) {
+  try {
+    return JSON.parse(Buffer.from(String(value || ""), "base64url").toString("utf8"));
+  } catch (_) {
+    return null;
+  }
+}
+
+function loadStripeMppFrontConfig() {
+  const sharedSecret = normalizeString(process.env.XYTARA_MPP_SHARED_SECRET);
+  return {
+    enabled: String(process.env.XYTARA_MPP_ENABLED || (sharedSecret ? "true" : "false")).trim().toLowerCase() !== "false",
+    shared_secret: sharedSecret || null,
+    provider: normalizeString(process.env.XYTARA_MPP_PROVIDER) || "stripe_tempo_compatible",
+    settlement_family: normalizeString(process.env.XYTARA_MPP_SETTLEMENT_FAMILY) || "cards_or_stablecoin_or_lightning",
+    max_age_seconds: Math.max(30, Number(process.env.XYTARA_MPP_MAX_AGE_SECONDS || 300) || 300),
+    required_headers: ["authorization"],
+    auth_scheme: "SPT",
+    token_shape: "base64url_json_with_shared_payment_token_and_hmac_signed_payload"
+  };
+}
+
+function parseStripeMppAuthorization(headers) {
+  const authorization = headers && typeof headers.authorization === "string"
+    ? headers.authorization.trim()
+    : "";
+  const match = authorization.match(/^SPT\s+(.+)$/i);
+  if (!match) return null;
+  const decoded = decodeBase64UrlJson(match[1]);
+  if (!decoded || typeof decoded !== "object") return null;
+  return {
+    wallet_id: decoded.wallet_id || decoded.gateway_id || decoded.customer_id || "mpp_gateway",
+    encoded: decoded.payload || null,
+    signature: decoded.signature || null,
+    token_id: decoded.token_id || decoded.spt_id || null,
+    payment_method_type: decoded.payment_method_type || null,
+    provider_reference: decoded.provider_reference || null,
+    settlement_asset: decoded.settlement_asset || null,
+    scheme: "mpp"
+  };
+}
+
+function verifyStripeMppPayload(paymentPayload, quote, walletId, maxAgeSeconds) {
+  if (!paymentPayload || typeof paymentPayload !== "object") return { ok: false, reason: "mpp_payload_invalid" };
+  if (!paymentPayload.quote_id || paymentPayload.quote_id !== quote.quote_id) return { ok: false, reason: "mpp_quote_mismatch" };
+  if (paymentPayload.amount_minor !== quote.amount_minor) return { ok: false, reason: "mpp_amount_mismatch" };
+  if (paymentPayload.currency !== quote.currency) return { ok: false, reason: "mpp_currency_mismatch" };
+  if (paymentPayload.account_id && paymentPayload.account_id !== quote.account_id) return { ok: false, reason: "mpp_account_mismatch" };
+  if (walletId && paymentPayload.wallet_id && paymentPayload.wallet_id !== walletId) return { ok: false, reason: "mpp_wallet_mismatch" };
+  if (!paymentPayload.nonce || typeof paymentPayload.nonce !== "string") return { ok: false, reason: "mpp_nonce_missing" };
+  if (!paymentPayload.issued_at_iso || Number.isNaN(Date.parse(paymentPayload.issued_at_iso))) return { ok: false, reason: "mpp_issued_at_invalid" };
+  const ageSeconds = Math.max(0, Math.floor((Date.now() - Date.parse(paymentPayload.issued_at_iso)) / 1000));
+  if (ageSeconds > maxAgeSeconds) return { ok: false, reason: "mpp_token_expired" };
+  if (!normalizeString(paymentPayload.token_id || paymentPayload.spt_id)) return { ok: false, reason: "mpp_token_missing" };
+  if (!normalizeString(paymentPayload.provider_reference || paymentPayload.payment_intent_id || paymentPayload.checkout_session_id)) {
+    return { ok: false, reason: "mpp_provider_reference_missing" };
+  }
+  return { ok: true, age_seconds: ageSeconds };
+}
+
+function verifyStripeMppAccessToken(headers, quote) {
+  const config = loadStripeMppFrontConfig();
+  if (!config.enabled) return { ok: false, status: 503, reason: "mpp_not_enabled" };
+  if (!config.shared_secret) return { ok: false, status: 503, reason: "mpp_shared_secret_missing" };
+  const payment = parseStripeMppAuthorization(headers || {});
+  if (!payment || !payment.encoded || !payment.signature) {
+    return { ok: false, status: 402, reason: "mpp_headers_incomplete" };
+  }
+  const expectedSignature = crypto.createHmac("sha256", config.shared_secret).update(payment.encoded).digest("hex");
+  if (!safeEqualHex(expectedSignature, payment.signature)) {
+    return { ok: false, status: 403, reason: "mpp_signature_invalid" };
+  }
+  const payload = decodeBase64UrlJson(payment.encoded);
+  const validation = verifyStripeMppPayload(payload, quote, payment.wallet_id, config.max_age_seconds);
+  if (!validation.ok) return { ok: false, status: 403, reason: validation.reason };
+  return {
+    ok: true,
+    verification_mode: "mpp_gateway_signed",
+    wallet_id: payment.wallet_id,
+    payment_payload: payload,
+    age_seconds: validation.age_seconds,
+    mpp: {
+      token_id: payment.token_id || payload.token_id || payload.spt_id || null,
+      provider_reference: payment.provider_reference || payload.provider_reference || payload.payment_intent_id || payload.checkout_session_id || null,
+      payment_method_type: payment.payment_method_type || payload.payment_method_type || null,
+      settlement_asset: payment.settlement_asset || payload.settlement_asset || null,
+      provider: config.provider,
+      settlement_family: config.settlement_family
+    }
+  };
+}
+
+function buildStripeMppSecuritySummary() {
+  const config = loadStripeMppFrontConfig();
+  const blockers = [];
+  if (config.enabled && !config.shared_secret) blockers.push("mpp_shared_secret_missing");
+  return {
+    ok: true,
+    category: "machine-commerce-stripe-mpp-security-summary",
+    summary_version: "xytara-stripe-mpp-security-summary-v1",
+    enabled: config.enabled,
+    shared_secret_configured: Boolean(config.shared_secret),
+    provider: config.provider,
+    settlement_family: config.settlement_family,
+    max_age_seconds: config.max_age_seconds,
+    auth_scheme: config.auth_scheme,
+    token_shape: config.token_shape,
+    ready: config.enabled && blockers.length === 0,
+    blockers,
+    linked_surfaces: {
+      stripe_mpp_lane_ref: "/v1/stripe-mpp",
+      commands_execute_ref: "/mpp/commands/execute",
+      mcp_invoke_ref: "/mpp/mcp/tools/invoke"
+    }
+  };
+}
+
+function buildStripeMppChallengePayload(quote) {
+  return {
+    ok: false,
+    payment_required: {
+      scheme: "mpp",
+      quote,
+      operator_requirements: {
+        auth_scheme: "SPT",
+        token_shape: "base64url_json_with_shared_payment_token_and_hmac_signed_payload",
+        security_ref: "/v1/stripe-mpp/security",
+        proof_requirements: [
+          "token_id",
+          "provider_reference"
+        ]
+      }
+    }
+  };
+}
+
+module.exports = {
+  buildStripeMppChallengePayload,
+  buildStripeMppSecuritySummary,
+  loadStripeMppFrontConfig,
+  parseStripeMppAuthorization,
+  verifyStripeMppAccessToken
+};