Skip to content

Commit 7f29697

Browse files
jbransvisajbransvisa
authored
Merge pull request #32 from jbransvisa/mle
Implemented Message Level Encryption Added a new custom field to track the order count.
2 parents 0cfd4c7 + 47aadd3 commit 7f29697

176 files changed

Lines changed: 13504 additions & 9410 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.env‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,17 +34,23 @@ PAYMENT_GATEWAY_NETWORK_TOKEN_MULTI_MID =
3434

3535
PAYMENT_GATEWAY_UC_ALLOWED_PAYMENTS =
3636
PAYMENT_GATEWAY_UC_BILLING_TYPE =
37-
PAYMENT_GATEWAY_UC_ENABLE_PHONE =
38-
PAYMENT_GATEWAY_UC_ENABLE_EMAIL =
37+
PAYMENT_GATEWAY_UC_ENABLE_PHONE =
38+
PAYMENT_GATEWAY_UC_ENABLE_EMAIL =
3939
PAYMENT_GATEWAY_UC_ENABLE_NETWORK_ICONS =
4040
PAYMENT_GATEWAY_UC_ENABLE_SHIPPING =
4141
PAYMENT_GATEWAY_UC_ALLOWED_SHIP_TO_COUNTRIES =
4242

4343
PAYMENT_GATEWAY_SERVERLESS_DEPLOYMENT =
4444
FUNCTIONS_HTTPWORKER_PORT =
4545

46+
PAYMENT_GATEWAY_USE_MLE =
47+
PAYMENT_GATEWAY_KEY_FILE_NAME =
48+
PAYMENT_GATEWAY_KEY_PASS =
49+
PAYMENT_GATEWAY_KEY_ALIAS =
50+
PAYMENT_GATEWAY_KEY_FILE_URL =
51+
4652
CT_PROJECT_KEY =
4753
CT_CLIENT_ID =
4854
CT_CLIENT_SECRET =
4955
CT_AUTH_HOST =
50-
CT_API_HOST =
56+
CT_API_HOST =

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@ src/**.js
88
coverage
99
*.log
1010
yarn.lock
11+
.DS_Store

‎docs/API-Extension-Setup.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ Variables that begin with 'CT' prefix are Commercetools project specific propert
2424
| PAYMENT_GATEWAY_MERCHANT_SECRET_KEY | Value of a Cybersource shared secret key to be used for HTTP Signature authentication | Created in [key-Creation\#Cybersource](key-Creation.md#Cybersource). |
2525
| PAYMENT_GATEWAY_TARGET_ORIGINS | Base URLs where your frontend will be accessible | Used for Card payment method. Comma separated value without any spaces |
2626
| PAYMENT_GATEWAY_VERIFICATION_KEY | Used to check Flex tokens for tampering | Use <b>Openssl -rand64 32 </b>command to generate verification key |
27-
| PAYMENT_GATEWAY_CC_ALLOWED_CARD_NETWORKS | csv(comma separated value) of the card networks | If not specified extension will support all the card networks(VISA, MASTERCARD, AMEX, DISCOVER, MAESTRO, CUP, JCB, CARTESBANCAIRES & DINERSCLUB) by default. In case of Unified Checkout it will support(VISA, MASTERCARD, AMEX) by default. Case sensitive. Accepts block letters only without any spaces – eg: VISA,AMEX |
27+
| PAYMENT_GATEWAY_CC_ALLOWED_CARD_NETWORKS | csv(comma separated value) of the card networks | If not specified extension will support only (VISA) by default. Case sensitive. Accepts block letters only without any spaces – eg: VISA,AMEX |
2828
| PAYMENT_GATEWAY_3DS_RETURN_URL | URL that the issuing bank will redirect to the customer for Payer Authentication | Required if payment.paymentMethodInfo.method is creditCardWithPayerAuthentication |
2929
| PAYMENT_GATEWAY_SCA_CHALLENGE | Boolean value - true or false | Flag to force Strong consumer authentication challenge while saving a card using Payer Authentication. Case sensitive |
3030
| PAYMENT_GATEWAY_ORDER_RECONCILIATION | Boolean value - true or false | Flag for enabling or disabling Order reconciliation to indicate whether reconciliation Id to be passed in sale, capture and refund transactions. Case sensitive. The Cybersource-Commercetools Extension will consider order number as the reconciliation id if available. The order number from Commercetools should be numeric/alpha-numeric string to reflect in Cybersource |

‎docs/Commercetools-Setup.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,6 @@ Fields
148148
| isv_accountType | String | false ||
149149
| isv_routingNumber | String | false ||
150150
| isv_merchantId | String | false ||
151-
| isv_securityCode | Number | false ||
152151
| isv_screenWidth | String | false ||
153152
| isv_screenHeight | String | false ||
154153
| isv_responseDateAndTime | String | false ||
@@ -161,6 +160,7 @@ Fields
161160
| isv_dmpaFlag | Boolean | false ||
162161
| isv_shippingMethod | String | false ||
163162
| isv_metadata | String | false ||
163+
| isv_accountPurchaseCount | Number | false ||
164164

165165
### Payer Authentication enrolment check
166166

‎docs/Docker-Container-in-Azure.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ Once `deploy-aci.yaml` is ready with all the values, navigate to the directory w
132132

133133
## Loggers
134134

135-
- In order to see the extension logs, add a console.log statement inside the `logData` function in PaymentUtils.ts file before you could create the image. Logs generated by extension can be found under Properties --> Logs
135+
- In order to see the extension logs, add a console.log statement inside the `logData` function in PaymentUtils.ts file before you could create the image. Logs generated by extension can be found under Monitoring --> Logs
136136

137137
## Troubleshooting
138138

‎docs/Message-Level-Encryption.md‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Message Level Encryption
2+
3+
## Overview
4+
5+
Message Level Encryption (MLE) allows you to store information or to communicate with other parties while helping to prevent uninvolved parties from understanding the stored information or understanding the communication. MLE can help address the threat of relying on TLS for message security. SSL is designed to provide point-to-point security, which falls short for web/restful services because of a need for end-to-end security. Where multiple intermediary nodes could exist between the two endpoints, MLE would provide that the message remains encrypted, even during these intermediate "hops" where the traffic itself is decrypted before it arrives at Visa servers. Both processes involve a mathematical formula (algorithm) and secret data (key).
6+
7+
MLE is required for APIs that primarily deal with sensitive transaction data (financial/non-financial) which could fall into one or several of the following categories:
8+
9+
- PII (Personal Identification Information)
10+
- PAN (Personal Account Number)
11+
- PAI (Personal Account Information)
12+
13+
## Implementation
14+
15+
### Step 1: Generate a .p12 File
16+
17+
Go to the Business Center and generate a .p12 file. Follow the provided link to [Create a p12 File](https://developer.cybersource.com/docs/cybs/en-us/platform/developer/all/rest/rest-getting-started/restgs-jwt-message-intro/restgs-security-p12-intro/restgs-security-P12.html).
18+
19+
### Step 2: File Location
20+
21+
If you're storing the `.p12` file locally , make sure it's placed in the `src/certificates` folder within your project directory, so the plugin can access it.
22+
23+
### Step 3: Enable MLE in Your Configuration
24+
25+
Set the following environment variables to enable Message-Level Encryption (MLE):
26+
27+
- `PAYMENT_GATEWAY_USE_MLE` - Set to `True` to enable MLE.
28+
- `PAYMENT_GATEWAY_KEY_FILE_NAME` - The name of your .p12 file (required if you are hosting the certificate locally).
29+
- `PAYMENT_GATEWAY_KEY_FILE_URL` - The path to where the .p12 certificate is stored (required if you are hosting in the cloud).
30+
- `PAYMENT_GATEWAY_KEY_PASS` - Password of the `.p12` file
31+
- `PAYMENT_GATEWAY_KEY_ALIAS` - Key alias (optional – use if overriding the default CyberSource alias).
32+
33+
## Step 4: Support for Multi-Mid
34+
35+
In this section, mid refers to Cybersource Merchant Id.
36+
37+
The new mid configurations should be added in the .env file of the extension in the following format
38+
39+
XXXX_KEY_FILE_NAME = <The name of your .p12 file>
40+
XXXX_KEY_FILE_URL = <The path to where the .p12 certificate is stored>
41+
XXXX_KEY_PASS = <Password of your `.p12` file>
42+
XXXX_KEY_ALIAS = <Value of a Overrided name>
43+
44+
Likewise you can configure, as many mids you want to support.
45+
46+
The value added for `PAYMENT_GATEWAY_KEY_FILE_NAME` and respective fields should be the default value in which transactions will be processed when Multi-Mid is not enabled.
47+
48+
Following are the constraints to be followed when you want to support multiple mids in your extension instance.
49+
50+
1. It is mandatory to provide the env variables for Multi-Mid in recommended format only.
51+
2. All env variables should be in block letters
52+
3. First part of the variable (XXXX) should be your Cybersource merchant Id in block letters
53+
4. Second part of the variable to store key file name should be _KEY_FILE_NAME
54+
5. Second part of the variable to store key file url should be _KEY_FILE_URL
55+
6. Second part of the variable to store key file password should be _KEY_PASS
56+
7. Second part of the variable to store key alias should be _KEY_ALIAS
57+
58+
Example :
59+
60+
Below is the env variables for the mid which has merchant Id as `merchantid123`
61+
62+
MERCHANTID123_KEY_FILE_NAME = <The name of your .p12 file>
63+
MERCHANTID123_KEY_FILE_URL = <The path to where the .p12 certificate is stored>
64+
MERCHANTID123_KEY_PASS = <Password of your `.p12` file>
65+
MERCHANTID123_KEY_ALIAS = <Value of a Overrided name>

‎docs/Process-a-Card-Payment-With-Payer-Authentication.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ After authentication is complete, authorization of the payment can then be tri
6868
| custom.fields.isv_tokenAlias | Alias for saved token | No | custom.fields.isv_tokens's "alias" value from Customer object |
6969
| custom.fields.isv_saleEnabled | false | Yes | Set the value to true if sale is enabled |
7070
| custom.fields.isv_merchantId | Merchant Id used for the transaction | No | Required when you want to support Multi-Mid functionality. Populate this field with the value of Merchant Id in which the transaction should happen. When this field is empty, default mid configuration will be considered for the transaction. |
71-
| custom.fields.isv_securityCode | Security code for card payment | No | Required when you want to send the card security code (CVV) during a saved card transaction |
71+
7272

7373
4. Add the payment to the cart
7474

@@ -92,6 +92,7 @@ After authentication is complete, authorization of the payment can then be tri
9292
| custom.fields.isv_saleEnabled | false | Yes | Set the value to true if sale is enabled |
9393
| custom.fields.isv_shippingMethod | Shipping method for the order | No | Possible values: <ul> <li> `lowcost`: Lowest-cost service </li> <li>`sameday`: Courier or same-day service </li> <li>`oneday`: Next-day or overnight service </li> <li>`twoday`: Two-day service </li> <li>`threeday`: Three-day service.</li> <li> `pickup`: Store pick-up </li> <li> `other`: Other shipping method </li> <li> `none`: No shipping method because product is a service or subscription </li> |
9494
| custom.fields.isv_metadata | Metadata for the order | No | This field can be used to send additional custom data as part of the authorization request. The data should be serialized into a string format (e.g., JSON string) before passing it in the request.<br>**Example:**"isv_metadata": "{\"1\":\"value1\", \"2\":\"value2\"}" |
95+
| custom.fields.isv_accountPurchaseCount | Required to determine account creation history and purchase activity | No | Provide the user's purchase count for the last six months. This value will be used to determine account creation history and populate the riskInformation section of the authorization request |
9596

9697

9798
c. For saved token, when the payment is being updated, the extension will do a Payer Auth Setup call to get reference_id for Digital Wallets to use in place of BIN number in Cardinal.
@@ -105,6 +106,7 @@ After authentication is complete, authorization of the payment can then be tri
105106
| custom.fields.isv_deviceFingerprintId | Customer device fingerprint Id | Yes | Refer [Device Fingerprinting](./Decision-Manager.md#device-fingerprinting) to generate this value |
106107
| custom.fields.isv_shippingMethod | Shipping method for the order | No | Possible values: <ul> <li> `lowcost`: Lowest-cost service </li> <li>`sameday`: Courier or same-day service </li> <li>`oneday`: Next-day or overnight service </li> <li>`twoday`: Two-day service </li> <li>`threeday`: Three-day service.</li> <li> `pickup`: Store pick-up </li> <li> `other`: Other shipping method </li> <li> `none`: No shipping method because product is a service or subscription </li> |
107108
| custom.fields.isv_metadata | Metadata for the order | No | This field can be used to send additional custom data as part of the authorization request. The data should be serialized into a string format (e.g., JSON string) before passing it in the request.<br>**Example:**"isv_metadata": "{\"1\":\"value1\", \"2\":\"value2\"}" |
109+
| custom.fields.isv_accountPurchaseCount | Required to determine account creation history and purchase activity | No | Provide the user's purchase count for the last six months. This value will be used to determine account creation history and populate the riskInformation section of the authorization request |
108110

109111

110112
6. Wait for the event to return back the following fields, verify them from update response. If the data exists for below fields, submit the device data collection form using below data, else throw error to the user. See [Device Data Collection](https://developer.cybersource.com/docs/cybs/en-us/payer-authentication/developer/all/rest/payer-auth/pa2-ccdc-ddc-intro.html) to get more details about device data collection Iframe

‎docs/Process-a-Card-Payment-Without-Payer-Authentication.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,6 @@ Processing of a payment is triggered by adding an initial transaction to a Comme
6868
| custom.fields.isv_deviceFingerprintId | Customer device fingerprint Id | Yes | Refer [Device Fingerprinting](./Decision-Manager.md#device-fingerprinting) to generate this value |
6969
| custom.fields.isv_saleEnabled | false | Yes | Set the value to true if sale is enabled |
7070
| custom.fields.isv_merchantId | Merchant Id used for the transaction | No | Required when you want to support Multi-Mid functionality. Populate this field with the value of merchant Id in which the transaction should happen. When this field is empty, default mid configuration will be considered for the transaction. |
71-
| custom.fields.isv_securityCode | Security code for Card payment | No | Required when you want to send the Card security code (CVV) during a saved card transaction |
7271

7372
Also see [Decision Manager](Decision-Manager.md) for additional fields to be populated if you are using Decision Manager
7473

@@ -91,6 +90,7 @@ Processing of a payment is triggered by adding an initial transaction to a Comme
9190
| custom.fields.isv_saleEnabled | false | Yes | Set the value to true if sale is enabled |
9291
| custom.fields.isv_shippingMethod | Shipping method for the order | No | Possible values: <ul> <li> `lowcost`: Lowest-cost service </li> <li>`sameday`: Courier or same-day service </li> <li>`oneday`: Next-day or overnight service </li> <li>`twoday`: Two-day service </li> <li>`threeday`: Three-day service.</li> <li> `pickup`: Store pick-up </li> <li> `other`: Other shipping method </li> <li> `none`: No shipping method because product is a service or subscription </li> |
9392
| custom.fields.isv_metadata | Metadata for the order | No | This field can be used to send additional custom data as part of the authorization request. The data should be serialized into a string format (e.g., JSON string) before passing it in the request.<br>**Example:**"isv_metadata": "{\"1\":\"value1\", \"2\":\"value2\"}" |
93+
| custom.fields.isv_accountPurchaseCount | Required to determine account creation history and purchase activity | No | Provide the user's purchase count for the last six months. This value will be used to determine account creation history and populate the riskInformation section of the authorization request |
9494

9595

9696
6. Add a transaction to the payment with the following values populated

0 commit comments

Comments
 (0)