חשבונית אוטומטית מטרנזילה: מדף התשלום למסמך

https://your-server.example.com/hooks/tranzila?key=LONG_RANDOM_SECRET

// The notify POST carries no signature. Two things stand in for one:
// 1. The notify address is yours to choose, so it carries a secret only you and the terminal
//    know: https://shop.example.com/hooks/tranzila?key=<TRANZILA_WEBHOOK_SECRET>
// 2. The transaction is read back from Tranzila by its index before anything is issued
//    (confirm(), below), when the API keys are set.
export async function verify({ query, rawBody, secret }) {
  if (!sameSecret(query.get('key'), secret)) return false
  const { TRANZILA_APP_KEY: appKey, TRANZILA_SECRET: apiSecret, TRANZILA_TERMINAL: terminal } = process.env
  if (!appKey) return true
  const f = formFields(rawBody)
  return confirm({ terminal: terminal || f.supplier, index: f.index, amount: toMinor(f.sum), appKey, apiSecret })
}

// POST https://api.tranzila.com/v1/transactions answers the transaction as Tranzila holds it.
// It is approved when it carries this index, response code 000 and the amount that was notified.
export async function confirm({ terminal, index, amount, appKey, apiSecret, baseUrl = process.env.TRANZILA_API_URL || 'https://api.tranzila.com' }) {
  const time = String(Math.floor(Date.now() / 1000))
  const nonce = crypto.randomBytes(20).toString('hex')
  const res = await fetch(`${baseUrl}/v1/transactions`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-tranzila-api-app-key': appKey,
      'X-tranzila-api-request-time': time,
      'X-tranzila-api-nonce': nonce,
      'X-tranzila-api-access-token': crypto.createHmac('sha256', apiSecret + time + nonce).update(appKey).digest('hex'),
    },
    body: JSON.stringify({ terminal_name: terminal, transaction_index: Number(index) }),
  })
  if (!res.ok) return false
  const tx = find(await res.json(), String(index))
  if (!tx) return false
  const code = String(tx.processor_response_code ?? tx.Response ?? tx.response_code ?? '')
  // The report states the amount in agorot ("12900"), the notify in shekels ("129.00").
  return code === '000' && Number(tx.amount) === amount
}
// The shape of this answer is not published, so the transaction is found wherever it sits.
function find(node, index, depth = 0) {
  if (!node || typeof node !== 'object' || depth > 6) return null
  const own = node.index ?? node.transaction_index ?? node.transaction_id
  if (own != null && String(own) === index) return node
  for (const v of Object.values(node)) {
    const hit = find(v, index, depth + 1)
    if (hit) return hit
  }
  return null
}

// The body is application/x-www-form-urlencoded. `sum` is a decimal amount in the
// transaction's currency, and Response "000" is an approved transaction.
const CURRENCIES = { 1: 'ILS', 2: 'USD', 978: 'EUR', 826: 'GBP' }

export function parse({ rawBody }) {
  const f = formFields(rawBody)
  if (f.Response !== '000' || !f.index) return null
  return {
    payment: {
      source: name,
      id: `${f.supplier || 'terminal'}-${f.index}`, // an index counts per terminal
      amount: toMinor(f.sum),
      currency: CURRENCIES[f.currency] || 'ILS',
      method: 'card',
      description: f.pdesc || `עסקה ${f.index}`,
      // Only what your own page sent in: Tranzila echoes the fields it was given.
      customer: { name: f.company || f.contact, email: f.email, phone: f.phone },
      items: [],
    },
  }
}

export async function issueForPayment(payment, { apiKey, businessId }) {
  const { business } = await call('GET', `/businesses/${businessId}`, { apiKey })
  // The money is already in, so the document carries the sale and its payment together:
  // a tax invoice/receipt (320). An exempt dealer (osek patur) may not issue a tax invoice,
  // and gives a receipt (400) instead.
  const docType = business.dealerType === 'patur' ? 400 : 320

  // The items are printed only when they add up to what was charged. Shipping, a coupon or a
  // rounding rule on the shop's side would otherwise make a document that disagrees with the
  // payment, and the payment is the fact.
  const itemsTotal = payment.items.reduce((sum, i) => sum + Math.round(i.quantity * i.unitAmount), 0)
  const lines = payment.items.length && itemsTotal === payment.amount
    ? payment.items.map((i) => ({ description: i.description, quantity: i.quantity, unitPriceExVat: i.unitAmount }))
    : [{ description: payment.description, quantity: 1, unitPriceExVat: payment.amount }]

  const { name, email, phone, taxId } = payment.customer
  const { document } = await call('POST', `/businesses/${businessId}/documents`, {
    apiKey,
    // The source's own payment id. A notification delivered twice lands on the same document.
    idempotencyKey: `${payment.source}:${payment.id}`,
    body: {
      docType,
      // The customer was charged a VAT-inclusive price. In gross mode unitPriceExVat carries
      // that price, the total is exactly what was paid, and the VAT is derived from it.
      priceMode: 'gross',
      ...(payment.currency === 'ILS' ? {} : { currency: payment.currency }),
      party: { name: name || email || 'לקוח', ...(email ? { email } : {}), ...(phone ? { phone } : {}), ...(taxId ? { taxId } : {}) },
      lines,
      payments: [{ method: payment.method, amount: payment.amount }],
    },
  })
  // A retry of a notification that was already handled: the document exists and is final.
  if (document.status === 'issued') return document
  // Issuing gives the document its number and signs the PDF. From here it never changes.
  const issued = await call('POST', `/businesses/${businessId}/documents/${document.id}/issue`, { apiKey })
  return issued.document
}