One post tagged with "authorization"

package main

import (
	"crypto/hmac"
	"crypto/sha512"
	"encoding/hex"
	"encoding/json"
	"github.com/kataras/iris/v12"
)

var AllaweeWebhookSigningKey = "XXXXXXXXXXX"

type AllaweeEventBody struct {
	Event    string                   `json:"event"`
	Data     AllaweeAuthorizationData `json:"data"`
	Metadata AllaweeEventBodyMetadata `json:"metadata"`
}

type AllaweeAuthorizationData struct {
	Card          string                          `json:"card"`
	Type          string                          `json:"type"`
	Id            string                          `json:"id"`
	Amount        int64                           `json:"amount"`
	Fees          int64                           `json:"fees"`
	Channel       string                          `json:"channel"`
	Reserved      bool                            `json:"reserved"`
	NetworkData   AllaweeEventBodyDataNetworkData `json:"networkData"`
	CreatedAt     time.Time                       `json:"createdAt"`
	Status        string                          `json:"status"`
	DeclineReason string                          `json:"declineReason"`
	DecisionType  string                          `json:"decisionType"`
	Currency      string                          `json:"currency"`
}

type AllaweeEventBodyDataNetworkData struct {
	Rrn                      string `json:"rrn"`
	Stan                     string `json:"stan"`
	Network                  string `json:"network"`
	TxnReference             string `json:"txnReference"`
	CardAcceptorNameLocation string `json:"cardAcceptorNameLocation"`
}

type AllaweeEventBodyMetadata struct {
	CreatedAt time.Time `json:"createdAt"`
	Event     string    `json:"event"`
}

// Verify the request by comparing HMAC Hex of the webhook signing key
func verifyRequest(c iris.Context) *AllaweeEventBody {
	signature := c.Request().Header.Get("Allawee-Signature")
	reqBody, _ := c.GetBody()

	hash := hmacHashHex(AllaweeWebhookSigningKey, string(reqBody))

	if hash != signature {
		c.StopWithJSON(iris.StatusBadRequest, iris.Map{"error": "Invalid Signature"})
		return nil
	}

	// Get TransferEventBody
	var body AllaweeEventBody
	err := json.Unmarshal(reqBody, &body)
	if err != nil {
		c.StopWithJSON(iris.StatusBadRequest, iris.Map{"error": "Invalid Request"})
		return nil
	}

	return &body
}


func hmacHashHex(key string, secret string) string {
	h := hmac.New(sha512.New, []byte(key))
	h.Write([]byte(secret))
	return hex.EncodeToString(h.Sum(nil))
}

func main(c iris.Context) {
	body := verifyRequest(c)
	if body == nil {
		return
	}

	if body.Event == "card.authorization.request" {
		response := processRequest(body)
		c.JSON(response)
		return
	}

	if body.Event == "card.authorization.closed" {
		response := processClosed(body)
		c.JSON(response)
		return
	}

	if body.Event == "card.authorization.update" {
		response := processUpdate(body)
		c.JSON(response)
		return
	}

	if body.Event == "card.transaction.created" {
		response := iris.Map{"code": "success"}
		c.JSON(response)
		return
	}

	c.StopWithJSON(iris.StatusBadRequest, iris.Map{"error": "Invalid Request"})
	return
}

func processRequest(body *AllaweeEventBody) iris.Map {
	if body.Data.Type == "check" {
		return processCheck(body)
	}

	if body.Data.Type == "capture" {
		return processCapture(body)
	}

	return iris.Map{"action": "decline", "metadata": iris.Map{"reason": "Invalid Request"}}
}

func processCheck(body *AllaweeEventBody) iris.Map {
	// Get the card's wallet
	wallet := getCardWallet(body.Data.Card)
	if wallet == nil {
		return iris.Map{"action": "decline", "code": "account-not-found"}
	}

	if !wallet.Active {
		return iris.Map{"action": "decline", "code": "account-inactive"}
	}

	return iris.Map{
		"action":         "approve",
		"cardBalance":    wallet.AvailableBalance,
		"cardHolderName": wallet.Name,
	}
}

func processCapture(body *AllaweeEventBody) iris.Map {
	// Get the card's wallet
	wallet := getCardWallet(body.Data.Card)

	// if the wallet is not active, decline
	if wallet == nil {
		return iris.Map{"action": "decline", "code": "account-not-found"}
	}

	// if the wallet is not active, decline
	if !wallet.Active {
		return iris.Map{"action": "decline", "code": "account-inactive"}
	}

	// Check if transaction already exists, using authorization id as reference
	transaction := getTransaction(body.Data.Id)
	if transaction != nil {
		return iris.Map{"action": "decline", "code": "duplicate-transaction"}
	}

	// Get transaction fees, in-case you are adding a fee (optional)
	transactionFee, err := calculateTransactionFee(body.Data.Amount)
	if err != nil {
		return iris.Map{"action": "decline"}
	}

	if wallet.AvailableBalance < (body.Data.AmountAndFees() + *transactionFee) {
		return iris.Map{"action": "decline", "code": "insufficient-funds"}
	}

	// Add a step to verify your internal spending controls (optional)
	if err := checkSpendingControl(body, wallet, *transactionFee); err != nil {
		return iris.Map{"action": "decline", "code": "spending-control"}
	}

	// Place a lien on the account, note the transaction is not yet final until closed,
	// so you want to only reserve the money, optionally pass in the transactionFee to reserve also
	if err := placeLien(body, wallet, *transactionFee); err != nil {
		return iris.Map{"action": "decline"}
	}

	return iris.Map{"action": "approve"}
}

// processClosed processes authorization closed event
// This is called when an authorization is closed on allawee
func processClosed(body *AllaweeEventBody) iris.Map {
	// Get Original Transaction
	originalTransaction := getTransaction(body.Data.Id)
	if originalTransaction == nil {
		return iris.Map{"action": "decline", "code": "invalid-transaction"}
	}

	// get card's wallet
	wallet := getCardWallet(body.Data.Card)
	if wallet == nil {
		return iris.Map{"action": "decline", "code": "account-not-found"}
	}

	if body.Data.Status == "approved" {
		return processAuthorizationApproved(body, wallet, originalTransaction)
	}

	if body.Data.Status == "declined" {
		return processAuthorizationDeclined(body, wallet, originalTransaction)
	}

	return iris.Map{"action": "decline", "code": "invalid-transaction"}
}

// processAuthorizationUpdate processes authorization updated event
// This is called when an authorization is updated on allawee, in case where a new amount is to be captured or it is completely reversed
func processUpdate(body *AllaweeEventBody) iris.Map {
	// Get Original Transaction
	originalTransaction := getTransaction(body.Data.Id)
	if originalTransaction == nil {
		return iris.Map{"action": "decline", "code": "invalid-transaction"}
	}

	// get card's wallet
	wallet := getCardWallet(body.Data.Card)
	if wallet == nil {
		return iris.Map{"action": "decline", "code": "account-not-found"}
	}

	if body.Data.Status == "pending" {
		return processAuthorizationPending(body, wallet, originalTransaction)
	}

	if body.Data.Status == "reversed" {
		return processAuthorizationReversed(body, wallet, originalTransaction)
	}

	return iris.Map{"action": "decline", "code": "invalid-transaction"}

}

func processAuthorizationApproved(
	body *AllaweeEventBody,
	wallet *Wallet,
	originalTransaction *Transaction) iris.Map {

	if originalTransaction.Status != "pending" {
		return iris.Map{"action": "decline", "code": "duplicate-transaction"}
	}

	// Debit the lien that was previously reserved
	if err := processDebitLien(body, wallet, originalTransaction); err != nil {
		return iris.Map{"action": "decline"}
	}

	return iris.Map{"action": "approve"}
}

func processAuthorizationPending(
	body *AllaweeEventBody,
	wallet *Wallet,
	originalTransaction *Transaction) iris.Map {

	if originalTransaction.Status != "pending" {
		return iris.Map{"action": "decline", "code": "duplicate-transaction"}
	}

	// Get transaction fees
	transactionFee, err := calculateTransactionFee(body.Data.Amount)
	if err != nil {
		return iris.Map{"action": "decline"}
	}

	// if new amount is greater than the original amount and the wallet do not have a sufficient balance for the new amount
	// then reverse the money reserved and return an insufficient-funds error
	// Note: NetworkAmountAndFees here mean the original amount and fees that was sent excluding your own additional fee if applied
	if (body.Data.AmountAndFees() > originalTransaction.NetworkAmountAndFees()) && ((wallet.AvailableBalance + originalTransaction.NetworkAmountAndFees()) < (body.Data.AmountAndFees() + *transactionFee)) {
		if err := processReverseLien(body, wallet, originalTransaction); err != nil {
			return iris.Map{"action": "decline"}
		}

		return iris.Map{"action": "decline", "code": "insufficient-funds"}
	}

	//  debit lien with new amount
	if err := processDebitLien(body, wallet, originalTransaction, *transactionFee); err != nil {
		return iris.Map{"action": "decline"}
	}

	return iris.Map{"action": "approve"}

}

// in a case where a previous pending authorization was declined, remove the reserved funds and return to the user
func processAuthorizationDeclined(
	body *AllaweeEventBody,
	wallet *Wallet,
	originalTransaction *Transaction) iris.Map {

	if originalTransaction.Status != "pending" {
		return iris.Map{"action": "decline", "code": "duplicate-transaction"}
	}

	if err := processReverseLien(body, wallet, originalTransaction); err != nil {
		return iris.Map{"action": "decline"}
	}

	return iris.Map{"action": "approve"}
}

// in a case where a previous successful authorization was reversed by the network, refund user and return the cash to the user
func processAuthorizationReversed(
	body *AllaweeEventBody,
	wallet *Wallet,
	originalTransaction *Transaction) iris.Map {

	if originalTransaction.Status != "success" {
		return iris.Map{"action": "decline", "code": "invalid-transaction"}
	}

	// Note: NetworkAmountAndFees here mean the original amount and fees that was sent excluding your own additional fee if applied
	if originalTransaction.NetworkAmountAndFees() != body.Data.AmountAndFees() {
		return iris.Map{"action": "decline", "code": "invalid-transaction"}
	}

	// Notice processReverse here is different from processReverseLien, as the money is no longer in lien
	if err := processReverse(body, wallet, originalTransaction); err != nil {
		return iris.Map{"action": "decline"}
	}

	return iris.Map{"action": "approve"}
}