חשבונית אוטומטית מ-Grow (משולם), כולל תשלומי Bit

https://your-server.example.com/hooks/grow?key=LONG_RANDOM_SECRET

// Grow signs nothing. The address it is given carries the secret:
//   https://shop.example.com/hooks/grow?key=<GROW_WEBHOOK_SECRET>
// Grow also publishes the addresses it sends from, for a firewall rule in front of this.
export function verify({ query, rawBody, secret }) {
  return sameSecret(query.get('key') || formFields(rawBody).webhookKey, secret)
}

// The body is form-encoded. A page's update names the transaction `transactionCode` and the
// amount `paymentSum`; a createPaymentProcess callback names them `transactionId` and `sum`,
// with statusCode 2 for a paid transaction. Amounts are decimal shekels.
const METHODS = { Bit: 'bit', 6: 'bit', PayBox: 'paybox', 5: 'paybox', 'העברה בנקאית': 'transfer', 15: 'transfer' }

export function parse({ rawBody }) {
  const f = formFields(rawBody)
  const id = f.transactionCode || f.transactionId
  const sum = f.paymentSum || f.sum
  if (!id || !sum) return null
  if (f.statusCode && f.statusCode !== '2') return null // 6 is a refund, 0 and 9 were not paid
  return {
    payment: {
      source: name,
      id,
      amount: toMinor(sum),
      currency: 'ILS',
      method: METHODS[f.transactionType] || METHODS[f.transactionTypeId] || 'card',
      description: f.paymentDesc || f.description || `עסקה ${f.asmachta || id}`,
      customer: { name: f.fullName, email: f.payerEmail, phone: f.payerPhone },
      items: [],
    },
  }
}

export async function issueForPayment(payment, { apiKey, businessId }) {
  const { business } = await call('GET', `/businesses/${businessId}`, { apiKey })
  // The money is already in, so the document carries the sale and its payment together:
  // a tax invoice/receipt (320). An exempt dealer (osek patur) may not issue a tax invoice,
  // and gives a receipt (400) instead.
  const docType = business.dealerType === 'patur' ? 400 : 320

  // The items are printed only when they add up to what was charged. Shipping, a coupon or a
  // rounding rule on the shop's side would otherwise make a document that disagrees with the
  // payment, and the payment is the fact.
  const itemsTotal = payment.items.reduce((sum, i) => sum + Math.round(i.quantity * i.unitAmount), 0)
  const lines = payment.items.length && itemsTotal === payment.amount
    ? payment.items.map((i) => ({ description: i.description, quantity: i.quantity, unitPriceExVat: i.unitAmount }))
    : [{ description: payment.description, quantity: 1, unitPriceExVat: payment.amount }]

  const { name, email, phone, taxId } = payment.customer
  const { document } = await call('POST', `/businesses/${businessId}/documents`, {
    apiKey,
    // The source's own payment id. A notification delivered twice lands on the same document.
    idempotencyKey: `${payment.source}:${payment.id}`,
    body: {
      docType,
      // The customer was charged a VAT-inclusive price. In gross mode unitPriceExVat carries
      // that price, the total is exactly what was paid, and the VAT is derived from it.
      priceMode: 'gross',
      ...(payment.currency === 'ILS' ? {} : { currency: payment.currency }),
      party: { name: name || email || 'לקוח', ...(email ? { email } : {}), ...(phone ? { phone } : {}), ...(taxId ? { taxId } : {}) },
      lines,
      payments: [{ method: payment.method, amount: payment.amount }],
    },
  })
  // A retry of a notification that was already handled: the document exists and is final.
  if (document.status === 'issued') return document
  // Issuing gives the document its number and signs the PDF. From here it never changes.
  const issued = await call('POST', `/businesses/${businessId}/documents/${document.id}/issue`, { apiKey })
  return issued.document
}