Merge pull request 'Updated nuget packages' (#28) from payments into master

Reviewed-on: #28

MidrandBooksApi/MidrandBooksApi.csproj

@@ -54,13 +54,13 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="LiteCharms.Features" Version="1.115.0" />
+    <PackageReference Include="LiteCharms.Features" Version="1.123.0" />
   </ItemGroup>
 
   <!-- UI -->
   <ItemGroup>
     <PackageReference Include="ANM.Blazored.Toast" Version="0.1.1" />
-    <PackageReference Include="LiteCharms.Features.MidrandBooks" Version="1.115.0" />
+    <PackageReference Include="LiteCharms.Features.MidrandBooks" Version="1.123.0" />
 
     <!-- Global Usings -->
     <Using Include="Blazored.Toast.Services" />

MidrandBooksApi/Payments/Payfast/PayfastConfirmationEndpoint.cs

@@ -24,8 +24,6 @@ public sealed class PayfastConfirmationEndpoint : IEndpoint
             activity?.SetTag("messaging.system", "payfast");
             activity?.SetTag("messaging.destination.name", "payments/payfast/confirm");
 
-            string? remoteIp = request.HttpContext.Connection.RemoteIpAddress?.ToString();
-
             var formCollection = await request.ReadFormAsync(cancellationToken);
 
             if (!formCollection.TryGetValue("signature", out var signatureValues) || string.IsNullOrWhiteSpace(signatureValues.ToString()))
@@ -34,29 +32,28 @@ public sealed class PayfastConfirmationEndpoint : IEndpoint
             string incomingSignature = signatureValues.ToString().Trim();
             var payload = ParseForm(formCollection, incomingSignature);
 
-            var paramDictionary = payload.ToParamDictionary();
+            string? passphrase = configuration["PayfastSettings:Passphrase"];
-            string? passphrase = configuration["HasherSettings:PayfastPassphrase"];
 
-            var signatureCheck = PayfastService.GenerateSignature(paramDictionary, passphrase);
+            if (!PayfastService.VerifyIncomingSignatureFromForm(formCollection, passphrase!))
-
-            if (signatureCheck.IsFailed || !string.Equals(signatureCheck.Value, incomingSignature, StringComparison.OrdinalIgnoreCase))
             {
-                logger.LogCritical("Incoming sugnature failed validation: {signature}, {errors}", incomingSignature, signatureCheck.Errors.Select(e => e.Message).ToList());
+                logger.LogCritical($"Incoming signature failed validation: {incomingSignature}");
 
                 return Results.Unauthorized();
             }
 
-            var formPairs = formCollection.Select(kvp => $"{kvp.Key}={HttpUtility.UrlEncode(kvp.Value.ToString())}");
+            var sortedPairs = formCollection
+                .Where(kvp => !kvp.Key.Equals("signature", StringComparison.OrdinalIgnoreCase))
+                .OrderBy(kvp => kvp.Key, StringComparer.Ordinal)
+                .Select(kvp => $"{kvp.Key}={HttpUtility.UrlEncode(kvp.Value.ToString().Trim())}");
 
-            string rawQueryParamString = string.Join("&", formPairs);
+            string rawQueryParamString = string.Join("&", sortedPairs);
 
             bool isSandbox = !hostEnvironment.IsProduction();
-
             var serverConfirmation = await payfastService.ValidateServerConfirmationAsync(rawQueryParamString, isSandbox, cancellationToken);
 
             if (serverConfirmation.IsFailed || !serverConfirmation.Value)
             {
-                logger.LogCritical("Server confirmation failed: {rawstring}, {errors}", rawQueryParamString, serverConfirmation.Errors.Select(e => e.Message).ToList());
+                logger.LogCritical($"Payfast server validation ping rejected the request data: {rawQueryParamString}");
 
                 return Results.Unauthorized();
             }
@@ -67,7 +64,6 @@ public sealed class PayfastConfirmationEndpoint : IEndpoint
             await jobOrchestrator.SendAsync(notification, cancellationToken);
 
             activity?.SetStatus(ActivityStatusCode.Ok);
-
             return Results.Ok();
         })
         .WithDescription("Securely confirm and process an incoming Payfast merchant payment callback.")