GressPay Integration Reference

// GressPay Node.js Server-Side Integration (Node 18+ / ESM)
// Read secret keys strictly from process.env — NEVER expose in frontend bundles.

import crypto from 'node:crypto';

const API_KEY = process.env.GRESSPAY_API_KEY; // 'gp_live_sk_...'
const BASE_URL = process.env.GRESSPAY_URL || 'https://api.yourdomain.com';
const WEBHOOK_SECRET = process.env.GRESSPAY_WEBHOOK_SECRET;

// 1. Create Checkout Session
export async function createCheckout(amount, currency, orderId, email) {
  const res = await fetch(`${BASE_URL}/api/v1/checkout/create`, {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      amount,
      currency,
      email,
      return_url: `https://yoursite.com/orders/${orderId}/complete`,
      webhook_url: 'https://yoursite.com/api/webhooks/gresspay',
      metadata: { orderId },
    }),
  });

  if (!res.ok) {
    const err = await res.json().catch(() => ({}));
    throw new Error(err.error?.message || `HTTP ${res.status}`);
  }

  const session = await res.json();
  // Redirect buyer to session.payUrl
  return session; // { sessionId: 'chs_...', payUrl: 'https://.../pay/chs_...' }
}

// 2. Webhook Handler with Constant-Time Signature Verification
export function verifyWebhook(rawBodyBuffer, signatureHeader) {
  const hmac = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(rawBodyBuffer)
    .digest('hex');

  // Prevent timing attacks using crypto.timingSafeEqual
  return crypto.timingSafeEqual(
    Buffer.from(hmac, 'utf8'),
    Buffer.from(signatureHeader || '', 'utf8')
  );
}

// 3. Server-to-Server Payment Status Check
export async function checkPaymentStatus(sessionId) {
  const res = await fetch(`${BASE_URL}/api/v1/checkout/verify-payment`, {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ sessionId }),
  });

  return res.json();
}