Merge pull request 'refactored incoming signature validator to use form fields instead of httprequest' (#111) from payments into master

Reviewed-on: #111

LiteCharms.Features.MidrandBooks/Customers/CustomerService.cs

@@ -334,6 +334,28 @@ public sealed class CustomerService(IDbContextFactory<MidrandBooksDbContext> con
         }
     }
 
+    public async ValueTask<Result<Customer>> GetCustomerAsync(string email, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+            var customer = await context.Customers
+                .AsNoTracking()
+                .Include(c => c.Contacts)
+                .Include(c => c.Addresses)
+                .FirstOrDefaultAsync(c => c.Email == email, cancellationToken);
+
+            return customer is not null
+                ? Result.Ok(customer.ToModel())
+                : Result.Fail<Customer>(new Error($"Customer with email '{email}' does not exist."));
+        }
+        catch (Exception ex)
+        {
+            return Result.Fail<Customer>(new Error(ex.Message).CausedBy(ex));
+        }
+    }
+
     public async ValueTask<Result<Customer>> GetCustomerAsync(long customerId, CancellationToken cancellationToken = default)
     {
         try

LiteCharms.Features.MidrandBooks/Customers/Entities/CustomerConfiguration.cs

@@ -12,8 +12,8 @@ public sealed class CustomerConfiguration : IEntityTypeConfiguration<Customer>
         builder.Property(c => c.Company).IsRequired(false);
         builder.Property(c => c.VatNumber).IsRequired(false);
         builder.Property(c => c.Email).IsRequired();
-        builder.Property(c => c.Phone).IsRequired();
+        builder.Property(c => c.Phone).IsRequired(false);
-        builder.Property(c => c.Website).IsRequired();
+        builder.Property(c => c.Website).IsRequired(false);
         builder.Property(c => c.Enabled).HasDefaultValue(true);
 
         builder.OwnsMany(f => f.SocialMedia, b => { b.ToJson(); });

LiteCharms.Features.MidrandBooks/Extensions/Shop.cs

@@ -1,11 +1,12 @@
 using LiteCharms.Features.Abstractions;
+using LiteCharms.Features.Browser;
 using LiteCharms.Features.MidrandBooks.Abstractions;
 
 namespace LiteCharms.Features.MidrandBooks.Extensions;
 
 public static class Shop
 {
-    public static IServiceCollection AddShopServices(this IServiceCollection services)
+    public static IServiceCollection AddShopServices(this IServiceCollection services, bool includeLocalStorage = false)
     {
         var serviceType = typeof(IService);
 
@@ -19,6 +20,9 @@ public static class Shop
 
         foreach (var coreImplementation in coreImplementations) services.AddScoped(coreImplementation);
 
+        if (includeLocalStorage)
+            services.AddScoped<LocalStorageService>();
+
         return services;
     }
 }

LiteCharms.Features.MidrandBooks/LiteCharms.Features.MidrandBooks.csproj

@@ -148,6 +148,7 @@
 
   <!-- Shared Usings -->
   <ItemGroup>
+    <Using Include="Microsoft.AspNetCore.Http" />
     <Using Include="System.Net.Sockets" />
     <Using Include="System.Text.RegularExpressions" />
     <Using Include="System.Web" />

LiteCharms.Features.MidrandBooks/Orders/OrderService.cs

@@ -164,6 +164,27 @@ public sealed class OrderService(IDbContextFactory<MidrandBooksDbContext> contex
     public async ValueTask<Result> CancelOrderAsync(long orderId, CancellationToken cancellationToken = default) =>
         await UpdateOrderStatusAsync(orderId, OrderStatus.Cancelled, cancellationToken);
 
+    public async ValueTask<Result<Order>> GetPendingOrderAsync(long customerId, CancellationToken cancellationToken = default)
+    {
+        try
+        {
+            await using var context = await contextFactory.CreateDbContextAsync(cancellationToken);
+
+            var order = await context.Orders.AsNoTracking()
+                .Where(o => o.Status == OrderStatus.Pending && o.CustomerId == customerId)
+                .OrderByDescending(o => o.Id)
+                .FirstOrDefaultAsync(cancellationToken);
+
+            return order is not null
+                ? Result.Ok(order.ToModel())
+                : Result.Fail<Order>("Order not found.");
+        }
+        catch (Exception ex)
+        {
+            return Result.Fail<Order>(new Error(ex.Message).CausedBy(ex));
+        }
+    }
+
     public async ValueTask<Result<Order>> GetOrderAsync(long orderId, CancellationToken cancellationToken = default)
     {
         try

LiteCharms.Features.MidrandBooks/Payments/CartService.cs

@@ -1,5 +1,4 @@
-using LiteCharms.Features.Abstractions;
+using LiteCharms.Features.Browser;
-using LiteCharms.Features.Browser;
 using LiteCharms.Features.Hasher;
 using LiteCharms.Features.MidrandBooks.Authors.Models;
 using LiteCharms.Features.MidrandBooks.Payments.Models;
@@ -7,7 +6,7 @@ using LiteCharms.Features.MidrandBooks.Products.Models;
 
 namespace LiteCharms.Features.MidrandBooks.Payments;
 
-public sealed class CartService(LocalStorageService localStorage) : IService
+public sealed class CartService(LocalStorageService localStorage)
 {
     private readonly string CartStorageKey = HashService.ToMd5Hash(nameof(Cart)).Value;
 

LiteCharms.Features.MidrandBooks/Payments/PayfastService.cs

@@ -48,6 +48,36 @@ public sealed partial class PayfastService(IDbContextFactory<MidrandBooksDbConte
         }
     }
 
+    public static bool VerifyIncomingSignature(IDictionary<string, string> formFields, string passphrase)
+    {
+        if (!formFields.TryGetValue("signature", out string? incomingSignature))
+            return false;
+
+        var stringBuilder = new StringBuilder();
+
+        foreach (var key in formFields.Keys)
+        {
+            if (key.Equals("signature", StringComparison.OrdinalIgnoreCase))
+                continue;
+
+            string rawValue = formFields[key] ?? string.Empty;
+
+            string encodedVal = HttpUtility.UrlEncode(rawValue.Trim());
+            string cleanVal = PercentEncodingRegex.Replace(encodedVal, m => m.Value.ToUpperInvariant());
+
+            stringBuilder.Append($"{key}={cleanVal}&");
+        }
+
+        string encodedPassphrase = HttpUtility.UrlEncode(passphrase.Trim());
+        string safePassphrase = PercentEncodingRegex.Replace(encodedPassphrase, m => m.Value.ToUpperInvariant());
+
+        stringBuilder.Append($"passphrase={safePassphrase}");
+
+        string generatedSignature = HashService.ToMd5Hash(stringBuilder.ToString()).Value;
+
+        return incomingSignature.Equals(generatedSignature, StringComparison.OrdinalIgnoreCase);
+    }
+
     public async ValueTask<Result<bool>> ValidateReferrerIpAsync(string remoteIpAddress, bool allowLoopback = false, CancellationToken cancellationToken = default)
     {
         if(payfastOptions.Value?.ValidHosts?.Length == 0)
@@ -147,33 +177,66 @@ public sealed partial class PayfastService(IDbContextFactory<MidrandBooksDbConte
     {
         var pfOutput = new StringBuilder();
 
-        foreach (var kvp in data)
+        var mandatorySequence = GetPayfastMandatoryFieldSequence();
+
+        foreach (string key in mandatorySequence)
         {
-            if (string.IsNullOrEmpty(kvp.Value))
+            if (data.TryGetValue(key, out string? rawValue) && !string.IsNullOrEmpty(rawValue))
-                continue;
+            {
+                string encodedVal = HttpUtility.UrlEncode(rawValue.Trim());
+                string val = PercentEncodingRegex.Replace(encodedVal, m => m.Value.ToUpperInvariant());
 
-            string key = kvp.Key;
+                pfOutput.Append($"{key}={val}&");
-
+            }
-            string encodedVal = HttpUtility.UrlEncode(kvp.Value.Trim());
-
-            string val = PercentEncodingRegex.Replace(encodedVal, m => m.Value.ToLowerInvariant());
-
-            pfOutput.Append($"{key}={val}&");
         }
 
-        string getString = pfOutput.Length > 0
+        var getString = pfOutput.Length > 0
             ? pfOutput.ToString()[..^1]
             : string.Empty;
 
         if (!string.IsNullOrWhiteSpace(passPhrase))
         {
             string encodedPassphrase = HttpUtility.UrlEncode(passPhrase.Trim());
-
+            string safePassphrase = PercentEncodingRegex.Replace(encodedPassphrase, m => m.Value.ToUpperInvariant());
-            string safePassphrase = PercentEncodingRegex.Replace(encodedPassphrase, m => m.Value.ToLowerInvariant());
 
             getString += $"&passphrase={safePassphrase}";
         }
 
         return HashService.ToMd5Hash(getString);
     }
+
+    private static string[] GetPayfastMandatoryFieldSequence() =>
+        [
+            "merchant_id",
+            "merchant_key",
+            "return_url",
+            "cancel_url",
+            "notify_url",
+            "name_first",
+            "name_last",
+            "email_address",
+            "cell_number",
+            "m_payment_id",
+            "amount",
+            "item_name",
+            "item_description",
+            "custom_int1",
+            "custom_int2",
+            "custom_int3",
+            "custom_int4",
+            "custom_int5",
+            "custom_str1",
+            "custom_str2",
+            "custom_str3",
+            "custom_str4",
+            "custom_str5",
+            "email_confirmation",
+            "confirmation_address",
+            "payment_method",
+            "subscription_type",
+            "billing_date",
+            "recurring_amount",
+            "frequency",
+            "cycles"
+        ];
 }

LiteCharms.Features.MidrandBooks/Postgres/Migrations/20260612210020_OnlyEmailIsMandatoryOnCustomer.cs

@@ -0,0 +1,54 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace LiteCharms.Features.MidrandBooks.Postgres.Migrations
+{
+    /// <inheritdoc />
+    public partial class OnlyEmailIsMandatoryOnCustomer : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<string>(
+                name: "Website",
+                table: "Customers",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Phone",
+                table: "Customers",
+                type: "text",
+                nullable: true,
+                oldClrType: typeof(string),
+                oldType: "text");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AlterColumn<string>(
+                name: "Website",
+                table: "Customers",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+
+            migrationBuilder.AlterColumn<string>(
+                name: "Phone",
+                table: "Customers",
+                type: "text",
+                nullable: false,
+                defaultValue: "",
+                oldClrType: typeof(string),
+                oldType: "text",
+                oldNullable: true);
+        }
+    }
+}

LiteCharms.Features.MidrandBooks/Postgres/Migrations/MidrandBooksDbContextModelSnapshot.cs

@@ -17,7 +17,7 @@ namespace LiteCharms.Features.MidrandBooks.Postgres.Migrations
         {
 #pragma warning disable 612, 618
             modelBuilder
-                .HasAnnotation("ProductVersion", "10.0.8")
+                .HasAnnotation("ProductVersion", "10.0.9")
                 .HasAnnotation("Relational:MaxIdentifierLength", 63);
 
             NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
@@ -309,7 +309,6 @@ namespace LiteCharms.Features.MidrandBooks.Postgres.Migrations
                         .HasDefaultValue(true);
 
                     b.Property<string>("Phone")
-                        .IsRequired()
                         .HasColumnType("text");
 
                     b.Property<DateTime?>("UpdatedAt")
@@ -321,7 +320,6 @@ namespace LiteCharms.Features.MidrandBooks.Postgres.Migrations
                         .HasColumnType("text");
 
                     b.Property<string>("Website")
-                        .IsRequired()
                         .HasColumnType("text");
 
                     b.HasKey("Id");

LiteCharms.Features.Tests.Common/appsettings.json

@@ -4,8 +4,6 @@
     "ValidHosts": [
       "www.payfast.co.za",
       "sandbox.payfast.co.za",
-      "w1w.payfast.co.za",
-      "w2w.payfast.co.za",
       "ips.payfast.co.za",
       "api.payfast.co.za",
       "payment.payfast.io"

LiteCharms.Features/Api/TokenService.cs

@@ -1,11 +1,10 @@
-using LiteCharms.Features.Abstractions;
+using LiteCharms.Features.Api.Configuration;
-using LiteCharms.Features.Api.Configuration;
 using LiteCharms.Features.Api.Models;
 using LiteCharms.Features.Api.Sdk;
 
 namespace LiteCharms.Features.Api;
 
-public sealed class TokenService(IConnectApi connectApi, IOptions<LiteCharmsClientSettings> clientOptions) : IService
+public sealed class TokenService(IConnectApi connectApi, IOptions<LiteCharmsClientSettings> clientOptions)
 {
     private readonly LiteCharmsClientSettings clientSettings = clientOptions.Value;
 

LiteCharms.Features/Browser/LocalStorageService.cs

@@ -1,8 +1,6 @@
-using LiteCharms.Features.Abstractions;
+namespace LiteCharms.Features.Browser;
 
-namespace LiteCharms.Features.Browser;
+public sealed class LocalStorageService(ProtectedLocalStorage storage)
-
-public sealed class LocalStorageService(ProtectedLocalStorage storage) : IService
 {
     public async ValueTask<Result> DeleteAsync(string key)
     {

LiteCharms.Features/Extensions/Api.cs

@@ -46,6 +46,8 @@ public static class Api
                 options.Retry.BackoffType = Polly.DelayBackoffType.Exponential;
             });
 
+        services.AddScoped<TokenService>();
+
         return services;
     }