MattssonandClaude Fable 5.1
6ea92f3152
Community PR #2416 by @olofpinzke, adopted and finished by maintainers (rebased so every commit is signed). Why the problem occurred: no Zettle integration; POS sales only reached the books as bank descriptors while Woo/Shopify already had order underlag via webshop_orders. The contributor's version also failed at the database (platform CHECKs listed only woocommerce/shopify), which the mocked unit tests never saw. What was simplified: reused the Orders/book/invoice path instead of a new inbox; Finance API payouts/fees deferred. Sales the one-account, revenue-per-rate model cannot book (split tender, gift cards, tips) import unbookable with a "bokför manuellt" title instead of guessing accounts. Reset parity uses the rename-and-wrap pattern instead of re-issuing the reset body. Why this solution: per-purchase rows give the radunderlag BFL verifikat need and the bulk-book path exists; daily kassarapport aggregation and Finance API fees/payouts are the follow-up (DECISIONS.md). Skeptic-refuted paths fixed before merge: concurrent refresh-token rotation (sync claim), cron offset paging (candidate snapshot), platform CHECKs, writer-role gate, migration-reset parity, white-label return origin re-validated at callback, VAT net from product rows. Not live until ZETTLE_CLIENT_ID / ZETTLE_CLIENT_SECRET / ZETTLE_CREDENTIALS_ENCRYPTION_KEY are set on Vercel and a Zettle developer app is registered with the callback redirect URI. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WtYqzKPoTSRHskYYdf7MwB
59 lines
2.1 KiB
TypeScript
59 lines
2.1 KiB
TypeScript
import crypto from 'crypto'
|
|
|
|
/**
|
|
* At-rest encryption for Zettle OAuth refresh tokens.
|
|
*
|
|
* AES-256-GCM with a dedicated env key, mirroring the Shopify/WooCommerce
|
|
* credential stores: 12-byte IV, 16-byte auth tag, layout iv|tag|ciphertext,
|
|
* base64url encoded. The key is deployment-wide; what makes rows useless
|
|
* off-server is that ZETTLE_CREDENTIALS_ENCRYPTION_KEY never leaves the
|
|
* environment.
|
|
*/
|
|
|
|
const ALGORITHM = 'aes-256-gcm'
|
|
|
|
/** Whether the integration is configured on this deployment. */
|
|
export function isZettleConfigured(): boolean {
|
|
return Boolean(
|
|
process.env.ZETTLE_CLIENT_ID &&
|
|
process.env.ZETTLE_CLIENT_SECRET &&
|
|
process.env.ZETTLE_CREDENTIALS_ENCRYPTION_KEY,
|
|
)
|
|
}
|
|
|
|
function getEncryptionKey(): Buffer {
|
|
const key = process.env.ZETTLE_CREDENTIALS_ENCRYPTION_KEY
|
|
if (!key) throw new Error('ZETTLE_CREDENTIALS_ENCRYPTION_KEY is required')
|
|
return crypto.createHash('sha256').update(key).digest()
|
|
}
|
|
|
|
export function encryptCredential(plaintext: string): string {
|
|
const key = getEncryptionKey()
|
|
const iv = crypto.randomBytes(12)
|
|
const cipher = crypto.createCipheriv(ALGORITHM, key, iv)
|
|
const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])
|
|
const tag = cipher.getAuthTag()
|
|
return Buffer.concat([iv, tag, encrypted]).toString('base64url')
|
|
}
|
|
|
|
export function decryptCredential(ciphertext: string): string {
|
|
const key = getEncryptionKey()
|
|
const combined = Buffer.from(ciphertext, 'base64url')
|
|
const iv = combined.subarray(0, 12)
|
|
const tag = combined.subarray(12, 28)
|
|
const encrypted = combined.subarray(28)
|
|
const decipher = crypto.createDecipheriv(ALGORITHM, key, iv)
|
|
decipher.setAuthTag(tag)
|
|
return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString('utf8')
|
|
}
|
|
|
|
/** Decrypted refresh token for an active connection. */
|
|
export function refreshTokenOf(connection: {
|
|
refresh_token_encrypted: string | null
|
|
}): string {
|
|
if (!connection.refresh_token_encrypted) {
|
|
throw new Error('Connection has no stored refresh token')
|
|
}
|
|
return decryptCredential(connection.refresh_token_encrypted)
|
|
}
|