Merge pull request 'Updated nuget packages' (#28) from payments into master

Reviewed-on: #28

MidrandBooksApi/MidrandBooksApi.csproj

@@ -54,13 +54,13 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="LiteCharms.Features" Version="1.115.0" />
+    <PackageReference Include="LiteCharms.Features" Version="1.123.0" />
   </ItemGroup>
 
   <!-- UI -->
   <ItemGroup>
     <PackageReference Include="ANM.Blazored.Toast" Version="0.1.1" />
-    <PackageReference Include="LiteCharms.Features.MidrandBooks" Version="1.115.0" />
+    <PackageReference Include="LiteCharms.Features.MidrandBooks" Version="1.123.0" />
 
     <!-- Global Usings -->
     <Using Include="Blazored.Toast.Services" />

MidrandBooksApi/Payments/Payfast/PayfastConfirmationEndpoint.cs

@@ -16,15 +16,14 @@ public sealed class PayfastConfirmationEndpoint : IEndpoint
     public void Map(IEndpointRouteBuilder builder)
     {
         builder.MapPost("payments/payfast/confirm", async (HttpRequest request, PayfastService payfastService,
-            IJobOrchestrator jobOrchestrator, IConfiguration configuration, IHostEnvironment hostEnvironment, CancellationToken cancellationToken) =>
+            IJobOrchestrator jobOrchestrator, IConfiguration configuration, IHostEnvironment hostEnvironment,
+            ILogger<PayfastConfirmationEndpoint> logger, CancellationToken cancellationToken) =>
         {
             using Activity? activity = PaymentActivitySource.StartActivity("ReceivePayfastWebhook", ActivityKind.Server);
 
             activity?.SetTag("messaging.system", "payfast");
             activity?.SetTag("messaging.destination.name", "payments/payfast/confirm");
 
-            string? remoteIp = request.HttpContext.Connection.RemoteIpAddress?.ToString();
-
             var formCollection = await request.ReadFormAsync(cancellationToken);
 
             if (!formCollection.TryGetValue("signature", out var signatureValues) || string.IsNullOrWhiteSpace(signatureValues.ToString()))
@@ -33,24 +32,31 @@ public sealed class PayfastConfirmationEndpoint : IEndpoint
             string incomingSignature = signatureValues.ToString().Trim();
             var payload = ParseForm(formCollection, incomingSignature);
 
-            var paramDictionary = payload.ToParamDictionary();
+            string? passphrase = configuration["PayfastSettings:Passphrase"];
-            string? passphrase = configuration["HasherSettings:PayfastPassphrase"];
 
-            var signatureCheck = PayfastService.GenerateSignature(paramDictionary, passphrase);
+            if (!PayfastService.VerifyIncomingSignatureFromForm(formCollection, passphrase!))
+            {
+                logger.LogCritical($"Incoming signature failed validation: {incomingSignature}");
 
-            if (signatureCheck.IsFailed || !string.Equals(signatureCheck.Value, incomingSignature, StringComparison.OrdinalIgnoreCase))
                 return Results.Unauthorized();
+            }
 
-            var formPairs = formCollection.Select(kvp => $"{kvp.Key}={HttpUtility.UrlEncode(kvp.Value.ToString())}");
+            var sortedPairs = formCollection
+                .Where(kvp => !kvp.Key.Equals("signature", StringComparison.OrdinalIgnoreCase))
+                .OrderBy(kvp => kvp.Key, StringComparer.Ordinal)
+                .Select(kvp => $"{kvp.Key}={HttpUtility.UrlEncode(kvp.Value.ToString().Trim())}");
 
-            string rawQueryParamString = string.Join("&", formPairs);
+            string rawQueryParamString = string.Join("&", sortedPairs);
 
             bool isSandbox = !hostEnvironment.IsProduction();
-
             var serverConfirmation = await payfastService.ValidateServerConfirmationAsync(rawQueryParamString, isSandbox, cancellationToken);
 
             if (serverConfirmation.IsFailed || !serverConfirmation.Value)
+            {
+                logger.LogCritical($"Payfast server validation ping rejected the request data: {rawQueryParamString}");
+
                 return Results.Unauthorized();
+            }
 
             var notification = PayfastPaymentConfirmationReceivedEvent.Create(payload, payload.MerchantPaymentId!,
                 allowLoopback: !hostEnvironment.IsProduction(), performBackgroundChecks: false);
@@ -58,7 +64,6 @@ public sealed class PayfastConfirmationEndpoint : IEndpoint
             await jobOrchestrator.SendAsync(notification, cancellationToken);
 
             activity?.SetStatus(ActivityStatusCode.Ok);
-
             return Results.Ok();
         })
         .WithDescription("Securely confirm and process an incoming Payfast merchant payment callback.")

midrandbooksapi-uat.yml

@@ -161,8 +161,8 @@ spec:
             httpGet:
               path: /health
               port: 8080
-            initialDelaySeconds: 5
+            initialDelaySeconds: 10
-            periodSeconds: 10
+            periodSeconds: 15
           readinessProbe:
             httpGet:
               path: /health