import { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify'; import crypto from 'crypto'; type PaymentPrototypeBody = { amount?: unknown; currency?: unknown; orderId?: unknown; storeName?: unknown; market?: unknown; cardNumber?: unknown; cardHolder?: unknown; expiry?: unknown; cvc?: unknown; email?: unknown; }; type ValidationResult = | { ok: true; value: Required> } | { ok: false; errors: Record }; export async function paymentPrototypeRoutes(app: FastifyInstance): Promise { app.get('/payment-gateway', handlePaymentPrototypePage); app.get('/payment-prototype', handlePaymentPrototypePage); app.post('/api/prototype/payments', handlePaymentPrototypeSubmit); } async function handlePaymentPrototypePage(_request: FastifyRequest, reply: FastifyReply): Promise { reply.header('content-type', 'text/html; charset=utf-8').send(renderPaymentPrototypePage()); } async function handlePaymentPrototypeSubmit( request: FastifyRequest, reply: FastifyReply, ): Promise { const parsed = validatePaymentPrototypeBody(request.body as PaymentPrototypeBody); if (!parsed.ok) { reply.status(400).send({ ok: false, errors: parsed.errors }); return; } const paymentId = `demo_${crypto.randomUUID()}`; const cardLast4 = parsed.value.cardNumber.replace(/\D/g, '').slice(-4); reply.send({ ok: true, paymentId, mode: 'local-demo-only', message: 'Prototype submission accepted locally. Raw card data was not stored or forwarded.', received: { orderId: parsed.value.orderId, amount: parsed.value.amount, currency: parsed.value.currency, market: parsed.value.market, email: parsed.value.email, card: `**** **** **** ${cardLast4}`, }, }); } function validatePaymentPrototypeBody(body: PaymentPrototypeBody | null | undefined): ValidationResult { const errors: Record = {}; const value = { amount: normalize(body?.amount), currency: normalize(body?.currency || 'PLN').toUpperCase(), orderId: normalize(body?.orderId), storeName: normalize(body?.storeName), market: normalize(body?.market), cardNumber: normalize(body?.cardNumber), cardHolder: normalize(body?.cardHolder), expiry: normalize(body?.expiry), cvc: normalize(body?.cvc), email: normalize(body?.email), }; const amount = Number(value.amount.replace(',', '.')); if (!Number.isFinite(amount) || amount <= 0 || amount > 100000) { errors.amount = 'Enter a valid positive amount.'; } if (!/^[A-Z]{3}$/.test(value.currency)) { errors.currency = 'Enter a valid three-letter currency.'; } if (value.orderId.length < 3 || value.orderId.length > 40) { errors.orderId = 'Order reference must be 3-40 characters.'; } if (value.storeName.length < 2 || value.storeName.length > 80) { errors.storeName = 'Store name must be 2-80 characters.'; } if (value.market.length < 2 || value.market.length > 30) { errors.market = 'Market must be 2-30 characters.'; } const cardDigits = value.cardNumber.replace(/\D/g, ''); if (!/^\d{13,19}$/.test(cardDigits)) { errors.cardNumber = 'Enter 13-19 card digits for demo validation.'; } if (value.cardHolder.length < 3 || value.cardHolder.length > 80) { errors.cardHolder = 'Card holder must be 3-80 characters.'; } if (!isValidExpiry(value.expiry)) { errors.expiry = 'Enter a future expiry date in MM/YY format.'; } if (!/^\d{3,4}$/.test(value.cvc)) { errors.cvc = 'Enter a 3-4 digit CVC.'; } if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.email) || value.email.length > 120) { errors.email = 'Enter a valid email address.'; } if (Object.keys(errors).length > 0) { return { ok: false, errors }; } return { ok: true, value }; } function normalize(value: unknown): string { return String(value ?? '').trim(); } function isValidExpiry(raw: string): boolean { const match = raw.match(/^(\d{2})\/(\d{2})$/); if (!match) return false; const month = Number(match[1]); const year = Number(`20${match[2]}`); if (month < 1 || month > 12) return false; const expiryEnd = new Date(year, month, 0, 23, 59, 59, 999); return expiryEnd.getTime() >= Date.now(); } function renderPaymentPrototypePage(): string { return ` Demo Payment Gateway

Bezpieczna płatność kartą

Wprowadź dane testowe, aby zobaczyć prototyp ekranu weryfikacji. Używaj wyłącznie fikcyjnych danych.

Backend zapisuje wyłącznie lokalny, zmaskowany ślad demonstracyjny i natychmiast odrzuca pełny numer karty oraz CVC.
`; }