# .env — your server only; never commit this file
# Copy these from UAT Merchant Portal → Client Credentials:
# https://pay-sandbox.hamropatro.com/client-credentials
HAMRO_MERCHANT_ID=REPLACE_ME
HAMRO_CLIENT_ID=REPLACE_ME
HAMRO_API_KEY=REPLACE_ME
HAMRO_CLIENT_SECRET=REPLACE_ME

# Generated when you save your webhook URL in
# UAT Merchant Portal → Configuration → Webhook.
HAMRO_WEBHOOK_SECRET=REPLACE_ME

# UAT endpoints from step 1.3 above.
HAMRO_CREATE_SESSION_URL=https://uat-payclient.hamropatro.com/v1/checkout/sessionId
HAMRO_GET_TRANSACTION_URL=https://uat-payclient.hamropatro.com/v1/checkout/transaction
HAMRO_GATEWAY_URL=https://uat-checkout-pay.hamropatro.com/api/checkout

# Set these to pages in your application.
CHECKOUT_SUCCESS_URL=https://your-domain.example/payment/success
CHECKOUT_FAILURE_URL=https://your-domain.example/payment/failure

{
  "merchantTxnId": "ORDER-1001",
  "merchantId": "YOUR_TEST_MERCHANT_ID",
  "transactionAmount": "12550",
  "failedRedirectionUrl": "https://your-domain.example/payment/failure",
  "successRedirectionUrl": "https://your-domain.example/payment/success",
  "remarks": "Order ORDER-1001"
}

import { createHmac } from 'node:crypto';

export function signSession(request, clientId, clientApiKey, clientSecret) {
  const message = [
    request.merchantTxnId,
    request.transactionAmount,
    request.merchantId,
    clientId,
    clientApiKey,
  ].join(',');

  return createHmac('sha512', clientSecret)
    .update(message, 'utf8')
    .digest('base64');
}

// request is the exact JSON object you send to Create Session.
// Read the client id, api key and secret from your server environment.

Signature: YOUR_GENERATED_BASE64_SIGNATURE
Client-Id: YOUR_TEST_CLIENT_ID
Client-API-Key: YOUR_TEST_API_KEY
Content-Type: application/json

import { createHmac } from 'node:crypto';

// Run on your server after a successful Create Session call.
// request = the exact body you sent to Create Session (step 2).
// session = Hamro Pay's response. It contains only sessionId and merchantId;
//           it does not contain a token, so your server generates it here.
export function checkoutFields(request, session, clientId, clientApiKey, clientSecret) {
  const tokenMessage = [
    request.merchantId,
    request.merchantTxnId,
    session.sessionId,
    request.transactionAmount, // same paisa value you signed in step 2
    clientId,
    clientApiKey,
  ].join(',');

  const token = createHmac('sha512', clientSecret)
    .update(tokenMessage, 'utf8')
    .digest('base64');

  const fields = {
    merchant_id: request.merchantId,
    session_id: session.sessionId,
    token,
    merchant_transaction_id: request.merchantTxnId,
  };
  for (const [name, value] of Object.entries(fields)) {
    if (typeof value !== 'string' || value.length === 0) {
      throw new Error('Missing checkout field: ' + name);
    }
  }
  return fields;
}

// Render only these fields in the checkout form.
// Never serialize the full session response into the page.

<!-- Template: replace these values on your server.
     HTML-escape every value before inserting it.
     HAMRO_GATEWAY_URL is {{GATEWAY_URL}}/api/checkout
     (UAT: https://uat-checkout-pay.hamropatro.com/api/checkout). -->
<form method="POST"
      action="{{ HAMRO_GATEWAY_URL }}"
      enctype="application/x-www-form-urlencoded">
  <input type="hidden" name="merchant_id"
         value="{{ merchant_id }}">
  <input type="hidden" name="session_id"
         value="{{ session_id }}">
  <input type="hidden" name="token"
         value="{{ token }}">
  <input type="hidden" name="merchant_transaction_id"
         value="{{ merchant_transaction_id }}">
  <button type="submit">Pay with Hamro Pay</button>
</form>

{
  "merchantId": "YOUR_TEST_MERCHANT_ID",
  "merchantTxnId": "ORDER-1001"
}

// Run on your server after calling Get Transaction.
// payment = Hamro Pay's response, not the browser's data.
// order = your saved order, loaded using its transaction ID.
export function isPaid(payment, order) {
  if (!payment || !order || typeof order.merchantTxnId !== 'string'
      || !order.merchantTxnId) return false;
  // The reference names this field merchantTransactionId; the UAT API has been
  // observed returning merchantTxnId. Accept either.
  const txnId = payment.merchantTransactionId ?? payment.merchantTxnId;
  if (!['number', 'string'].includes(typeof payment.amount)
      || !['number', 'string'].includes(typeof order.amount)) return false;
  const amount = Number(payment.amount);
  const expected = Number(order.amount);
  return payment.status === 'COMPLETED'
    && txnId === order.merchantTxnId
    && Number.isFinite(amount)
    && amount > 0
    && Number.isFinite(expected)
    && amount === expected;
}

// Fulfill only after isPaid returns true, and save the paid state
// atomically so repeated checks or webhooks cannot fulfill twice.