Integrate Payment Gateway

const express = require('express')
const { nanoid } = require('nanoid')
const fetch = require('node-fetch')
const app = express()
const port = 7000

const VIVENU_URL = 'https://vivenu.dev'
const API_KEY = 'key_'
const GATEWAY_SECRET = 'pm_secret_'

const getPaymentRequest = async (paymentId) => {
  const response = await fetch(
    VIVENU_URL + '/api/payments/requests/' + paymentId,
    {
      method: 'GET',
      headers: {
        'Content-Type': 'application/json',
        Accept: 'application/json',
        Authorization: 'Bearer ' + API_KEY,
      },
    },
  )

  const json = await response.json()
  return json
}

const completePaymentRequest = async (paymentId) => {
  const response = await fetch(
    VIVENU_URL + '/api/payments/requests/' + paymentId + '/confirm',
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        Accept: 'application/json',
        Authorization: 'Bearer ' + API_KEY,
      },
      body: JSON.stringify({
        gatewaySecret: GATEWAY_SECRET,
        reference: nanoid(),
      }),
    },
  )

  const json = await response.json()
  return json
}

app.get('/payment/gateway', async (req, res) => {
  const paymentId = req.query.paymentId
  const paymentRequest = await getPaymentRequest(paymentId)

  console.log(paymentRequest)

  if (paymentRequest.status !== 'NEW') {
    console.error('payment request is already processed')
    return res.status(403).end()
  }

  const completedPaymentRequest = await completePaymentRequest(paymentId)
  res.redirect(completedPaymentRequest.successReturnUrl)
  res.end()
})

app.listen(port, () => {
  console.log(`Listening at http://localhost:${port}`)
})

const GATEWAY_SECRET = 'pm_secret_55a54...'
const signature = crypto
  .createHmac('sha256', GATEWAY_SECRET)
  .update(req.rawPayload)
  .digest('hex')

const requestSignature = req.headers['x-vivenu-signature']
const isValid = signature.toLowerCase() === requestSignature.toLowerCase()

app.post('/payment/gateway/refund', async (req, res) => {
  const payload = req.body
  if (payload.type !== 'payment.refund') {
    return res.status(400).send(JSON.stringify({ error: 'unsupported type' }))
  }

  const signature = crypto
    .createHmac('sha256', GATEWAY_SECRET)
    .update(JSON.stringify(payload))
    .digest('hex')

  const isValid =
    signature.toLowerCase() === req.headers['x-vivenu-signature'].toLowerCase()
  if (!isValid) {
    return res.status(400).send(JSON.stringify({ error: 'invalid signature' }))
  }

  // do some refund logic delegation

  res.send(JSON.stringify({ reference: '...' }))
})

{
  "reference": "refund_3470c03290dc5b0bd631ab34afc982fe"
}

const completePaymentRequest = async (paymentId, extra = {}) => {
  // ...

  body: JSON.stringify({
    gatewaySecret: GATEWAY_SECRET,
    reference: nanoid(),
    ...extra,
  })

  // ...
}

app.get('/payment/gateway', async (req, res) => {
  const customerPaymentMethodToken = req.query.customerPaymentMethodToken

  // ...

  if (customerPaymentMethodToken) {
    const stored = database.getPaymentMethod(customerPaymentMethodToken)
    if (!stored || stored.customerId !== paymentRequest.customerId) {
      return res.status(403).end()
    }

    // use previously saved payment method details associated with the token
    // do not allow the user to enter payment details
  }

  if (paymentRequest.origin === 'setup') {
    // collect payment method details (naive)
    const creditCardNumber = '123456789012'
    const paymentMethodIdentifier = creditCardNumber.slice(-4)
    const paymentMethodExpiration = '2030-12'

    const completedPaymentRequest = await completePaymentRequest(paymentId, {
      paymentMethodIdentifier,
      paymentMethodExpiration,
    })

    database.savePaymentMethod(
      completedPaymentRequest.customerPaymentMethodToken,
      creditCardNumber,
    )

    res.redirect(completedPaymentRequest.successReturnUrl)
    res.end()
    return
  }

  // ...
})

app.post('/payment/gateway/charge', async (req, res) => {
  const payload = req.body

  const signature = crypto
    .createHmac('sha256', GATEWAY_SECRET)
    .update(JSON.stringify(payload))
    .digest('hex')

  const isValid =
    signature.toLowerCase() === req.headers['x-vivenu-signature'].toLowerCase()
  if (!isValid) {
    return res.status(400).send(JSON.stringify({ error: 'invalid signature' }))
  }

  // lookup payment credentials by customerPaymentMethodToken,
  // verify they belong to the customerId on the payment request,
  // and charge the saved payment method
  const creditCardNumber = database.getPaymentMethod(
    payload.customerPaymentMethodToken,
  )

  res.send(JSON.stringify({ reference: '...' }))
})

{
  "reference": "charge_3470c03290dc5b0bd631ab34afc982fe"
}