Feature/DEV-23903 Changes getHeadersV2 parameter to path instead of u…

…rl (#155) * DEV-23903 Transition from header V1 to header V2 * DEV-23903 remove unused import * DEV-23903 Changes getHeadersV2 parameter to path instead of uri * DEV-23903 Changes parameter name uri to path * DEV-23903 Adds response checksum signature * DEV-23903 Changes response field checksum to signature --------- Co-authored-by: Abdurrahman Basgoynuk <[email protected]>
iyzico · Sep 17, 2024 · 60a73df · 60a73df
1 parent a47ebd2
commit 60a73df
Show file tree

Hide file tree

Showing 84 changed files with 624 additions and 204 deletions.
diff --git a/src/main/java/com/iyzipay/HashValidator.java b/src/main/java/com/iyzipay/HashValidator.java
@@ -0,0 +1,13 @@
+package com.iyzipay;
+
+
+import org.apache.commons.lang3.StringUtils;
+
+public class HashValidator {
+    private HashValidator() {
+    }
+
+    public static boolean hashValid(String calculatedHash, String hash) {
+        return StringUtils.equals(calculatedHash, hash);
+    }
+}
diff --git a/src/main/java/com/iyzipay/IyziAuthV2Generator.java b/src/main/java/com/iyzipay/IyziAuthV2Generator.java
@@ -15,18 +15,18 @@ public final class IyziAuthV2Generator {
     private IyziAuthV2Generator() {
     }
 
-    public static String generateAuthContent(String uri, String apiKey, String secretKey, String randomString, Object request) {
+    public static String generateAuthContent(String path, String apiKey, String secretKey, String randomString, Object request) {
         try {
-            String input = "apiKey:" + apiKey + "&randomKey:" + randomString + "&signature:" + getHmacSHA256Signature(uri, secretKey, randomString, request);
+            String input = "apiKey:" + apiKey + "&randomKey:" + randomString + "&signature:" + getHmacSHA256Signature(path, secretKey, randomString, request);
             return DatatypeConverter.printBase64Binary(input.getBytes("UTF-8"));
         } catch (UnsupportedEncodingException e) {
             throw new HttpClientException("Authentication content couldn't be generated", e);
         }
     }
 
-    private static String getHmacSHA256Signature(String uri, String secretKey, String randomString, Object request) {
+    private static String getHmacSHA256Signature(String path, String secretKey, String randomString, Object request) {
         try {
-            String dataToSign = randomString + getPayload(uri, request);
+            String dataToSign = randomString + getPayload(path, request);
             Mac mac = Mac.getInstance("HmacSHA256");
             mac.init(new SecretKeySpec(secretKey.getBytes("UTF-8"), "HmacSHA256"));
             return DatatypeConverter.printHexBinary(mac.doFinal(dataToSign.getBytes("UTF-8"))).toLowerCase();
@@ -39,10 +39,7 @@ private static String getHmacSHA256Signature(String uri, String secretKey, Strin
         }
     }
 
-    private static String getPayload(String uri, Object request) {
-        int startIndex = uri.indexOf("/v2");
-        int endIndex = uri.indexOf("?");
-        String uriPath = endIndex == -1 ? uri.substring(startIndex) : uri.substring(startIndex, endIndex);
-        return request == null ? uriPath : uriPath + new Gson().toJson(request);
+    private static String getPayload(String path, Object request) {
+        return request == null ? path : path + new Gson().toJson(request);
     }
 }
diff --git a/src/main/java/com/iyzipay/IyzipayResource.java b/src/main/java/com/iyzipay/IyzipayResource.java
@@ -20,6 +20,7 @@ public class IyzipayResource {
     private static final String CLIENT_VERSION_HEADER_NAME = "x-iyzi-client-version";
     private static final String IYZIWS_HEADER_NAME = "IYZWS ";
     private static final String IYZIWS_V2_HEADER_NAME = "IYZWSv2 ";
+    private static final String AUTHORIZATION_FALLBACK_HEADER = "Authorization_Fallback";
     private static final String CLIENT_VERSION = IyzipayResource.class.getPackage().getImplementationVersion();
     private static final String CLIENT_TITLE = IyzipayResource.class.getPackage().getImplementationTitle();
     private static final String COLON = ":";
@@ -36,6 +37,7 @@ public class IyzipayResource {
     public IyzipayResource() {
     }
 
+    @Deprecated
     protected static Map<String, String> getHttpHeaders(Request request, Options options) {
         Map<String, String> headers = new HashMap<String, String>();
 
@@ -47,11 +49,13 @@ protected static Map<String, String> getHttpHeaders(Request request, Options opt
         return headers;
     }
 
-    protected static Map<String, String> getHttpHeadersV2(String uri, Request request, Options options) {
+    protected static Map<String, String> getHttpHeadersV2(String path, Request request, Options options) {
         Map<String, String> headers = new HashMap<String, String>();
 
         String randomString = UUID.randomUUID().toString();
-        headers.put(AUTHORIZATION, prepareAuthorizationStringV2(uri, request, randomString, options));
+        headers.put(AUTHORIZATION, prepareAuthorizationStringV2(path, request, randomString, options));
+        headers.put(RANDOM_HEADER_NAME, randomString);
+        headers.put(AUTHORIZATION_FALLBACK_HEADER,  prepareAuthorizationString(request, randomString, options));
 
         putClientVersionHeader(headers);
         return headers;
@@ -75,8 +79,8 @@ private static String prepareAuthorizationString(Request request, String randomS
         return IYZIWS_HEADER_NAME + options.getApiKey() + COLON + hash;
     }
 
-    private static String prepareAuthorizationStringV2(String uri, Request request, String randomString, Options options) {
-        String authContent = IyziAuthV2Generator.generateAuthContent(uri, options.getApiKey(), options.getSecretKey(), randomString, request);
+    private static String prepareAuthorizationStringV2(String path, Request request, String randomString, Options options) {
+        String authContent = IyziAuthV2Generator.generateAuthContent(path, options.getApiKey(), options.getSecretKey(), randomString, request);
         return IYZIWS_V2_HEADER_NAME + authContent;
     }
 

diff --git a/src/main/java/com/iyzipay/ResponseSignatureGenerator.java b/src/main/java/com/iyzipay/ResponseSignatureGenerator.java
@@ -0,0 +1,50 @@
+package com.iyzipay;
+
+import com.iyzipay.exception.HttpClientException;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import javax.xml.bind.DatatypeConverter;
+import java.math.BigDecimal;
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.util.List;
+import java.util.Locale;
+import java.util.Objects;
+import java.util.stream.Collectors;
+
+public interface ResponseSignatureGenerator {
+    String SEPARATOR = ":";
+    String HMAC_SHA_256 = "HmacSHA256";
+    String EMPTY_PARAM = "";
+
+    default String generateSignature(String secretKey, List<Object> params) {
+        try {
+            String dataToSign = appendSignatureParams(params);
+            Mac mac = Mac.getInstance(HMAC_SHA_256);
+            mac.init(new SecretKeySpec(secretKey.getBytes(StandardCharsets.UTF_8), HMAC_SHA_256));
+            return DatatypeConverter.printHexBinary(mac.doFinal(dataToSign.getBytes(StandardCharsets.UTF_8))).toLowerCase(Locale.ENGLISH);
+        } catch (NoSuchAlgorithmException e) {
+            throw new HttpClientException("HMAC couldn't be generated", e);
+        } catch (InvalidKeyException e) {
+            throw new HttpClientException("Authentication content couldn't be generated", e);
+        }
+    }
+
+    default String appendSignatureParams(List<Object> signatureParameters) {
+        return signatureParameters.stream()
+                .map(this::convertParamToString)
+                .collect(Collectors.joining(SEPARATOR));
+    }
+
+    default String convertParamToString(Object parameter) {
+        if (Objects.isNull(parameter)) {
+            return EMPTY_PARAM;
+        } else if (parameter instanceof BigDecimal) {
+            return ((BigDecimal) parameter).stripTrailingZeros().toPlainString();
+        } else {
+            return parameter.toString();
+        }
+    }
+}
diff --git a/src/main/java/com/iyzipay/model/Apm.java b/src/main/java/com/iyzipay/model/Apm.java
@@ -1,24 +1,43 @@
 package com.iyzipay.model;
 
+import com.iyzipay.HashValidator;
 import com.iyzipay.HttpClient;
 import com.iyzipay.Options;
+import com.iyzipay.ResponseSignatureGenerator;
 import com.iyzipay.request.CreateApmInitializeRequest;
 import com.iyzipay.request.RetrieveApmRequest;
 
-public class Apm extends ApmResource {
+import java.util.Arrays;
+
+public class Apm extends ApmResource implements ResponseSignatureGenerator {
+
+    public boolean verifySignatureForCreate(String secretKey) {
+        String calculated = generateSignature(secretKey, Arrays.asList(getPaymentId(), getRedirectUrl()));
+        return HashValidator.hashValid(getSignature(), calculated);
+    }
 
     public static Apm create(CreateApmInitializeRequest request, Options options) {
-        return HttpClient.create().post(options.getBaseUrl() + "/payment/apm/initialize",
+        String path = "/payment/apm/initialize";
+        return HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 Apm.class);
     }
 
+    public boolean verifySignatureForRetrieve(String secretKey) {
+        String calculated = generateSignature(secretKey,
+                Arrays.asList(getCurrency(), getBasketId(),
+                        getConversationId(), getPaidPrice(),
+                        getPrice(), getPaymentId(), getRedirectUrl()));
+        return HashValidator.hashValid(getSignature(), calculated);
+    }
+
     public static Apm retrieve(RetrieveApmRequest request, Options options) {
-        return HttpClient.create().post(options.getBaseUrl() + "/payment/apm/retrieve",
+        String path = "/payment/apm/retrieve";
+        return HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 Apm.class);
     }

diff --git a/src/main/java/com/iyzipay/model/ApmResource.java b/src/main/java/com/iyzipay/model/ApmResource.java
@@ -34,6 +34,7 @@ public class ApmResource extends IyzipayResource {
     private String apm;
     private String mobilePhone;
     private String paymentStatus;
+    private String signature;
 
     public String getRedirectUrl() {
         return redirectUrl;
@@ -219,6 +220,14 @@ public void setPaymentStatus(String paymentStatus) {
         this.paymentStatus = paymentStatus;
     }
 
+    public String getSignature() {
+        return signature;
+    }
+
+    public void setSignature(String signature) {
+        this.signature = signature;
+    }
+
     @Override
     public String toString() {
         return ToStringBuilder.reflectionToString(this, ToStringStyle.MULTI_LINE_STYLE);

diff --git a/src/main/java/com/iyzipay/model/Approval.java b/src/main/java/com/iyzipay/model/Approval.java
@@ -10,9 +10,10 @@ public class Approval extends IyzipayResource {
     private String paymentTransactionId;
 
     public static Approval create(CreateApprovalRequest request, Options options) {
-        return HttpClient.create().post(options.getBaseUrl() + "/payment/iyzipos/item/approve",
+        String path = "/payment/iyzipos/item/approve";
+        return HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 Approval.class);
     }

diff --git a/src/main/java/com/iyzipay/model/BasicBkm.java b/src/main/java/com/iyzipay/model/BasicBkm.java
@@ -11,9 +11,10 @@ public class BasicBkm extends BasicPaymentResource {
     private String paymentStatus;
 
     public static BasicBkm retrieve(RetrieveBkmRequest request, Options options) {
-        return HttpClient.create().post(options.getBaseUrl() + "/payment/bkm/auth/detail/basic",
+        String path = "/payment/bkm/auth/detail/basic";
+        return HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 BasicBkm.class);
     }

diff --git a/src/main/java/com/iyzipay/model/BasicBkmInitialize.java b/src/main/java/com/iyzipay/model/BasicBkmInitialize.java
@@ -12,9 +12,10 @@ public class BasicBkmInitialize extends IyzipayResource {
     private String token;
 
     public static BasicBkmInitialize create(CreateBasicBkmInitializeRequest request, Options options) {
-        BasicBkmInitialize response = HttpClient.create().post(options.getBaseUrl() + "/payment/bkm/initialize/basic",
+        String path = "/payment/bkm/initialize/basic";
+        BasicBkmInitialize response = HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 BasicBkmInitialize.class);
         if (response != null) {

diff --git a/src/main/java/com/iyzipay/model/BasicPayment.java b/src/main/java/com/iyzipay/model/BasicPayment.java
@@ -7,9 +7,10 @@
 public class BasicPayment extends BasicPaymentResource {
 
     public static BasicPayment create(CreateBasicPaymentRequest request, Options options) {
-        return HttpClient.create().post(options.getBaseUrl() + "/payment/auth/basic",
+        String path = "/payment/auth/basic";
+        return HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 BasicPayment.class);
     }

diff --git a/src/main/java/com/iyzipay/model/BasicPaymentPostAuth.java b/src/main/java/com/iyzipay/model/BasicPaymentPostAuth.java
@@ -7,9 +7,10 @@
 public class BasicPaymentPostAuth extends BasicPaymentResource {
 
     public static BasicPaymentPostAuth create(CreatePaymentPostAuthRequest request, Options options) {
-        return HttpClient.create().post(options.getBaseUrl() + "/payment/postauth/basic",
+        String path = "/payment/postauth/basic";
+        return HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 BasicPaymentPostAuth.class);
     }

diff --git a/src/main/java/com/iyzipay/model/BasicPaymentPreAuth.java b/src/main/java/com/iyzipay/model/BasicPaymentPreAuth.java
@@ -7,9 +7,10 @@
 public class BasicPaymentPreAuth extends BasicPaymentResource {
 
     public static BasicPaymentPreAuth create(CreateBasicPaymentRequest request, Options options) {
-        return HttpClient.create().post(options.getBaseUrl() + "/payment/preauth/basic",
+        String path = "/payment/preauth/basic";
+        return HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 BasicPaymentPreAuth.class);
     }

diff --git a/src/main/java/com/iyzipay/model/BasicThreedsInitialize.java b/src/main/java/com/iyzipay/model/BasicThreedsInitialize.java
@@ -13,9 +13,10 @@ public class BasicThreedsInitialize extends IyzipayResource {
     private String htmlContent;
 
     public static BasicThreedsInitialize create(CreateBasicPaymentRequest request, Options options) {
-        BasicThreedsInitialize response = HttpClient.create().post(options.getBaseUrl() + "/payment/3dsecure/initialize/basic",
+        String path = "/payment/3dsecure/initialize/basic";
+        BasicThreedsInitialize response = HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 BasicThreedsInitialize.class);
         if (response != null) {

diff --git a/src/main/java/com/iyzipay/model/BasicThreedsInitializePreAuth.java b/src/main/java/com/iyzipay/model/BasicThreedsInitializePreAuth.java
@@ -13,9 +13,10 @@ public class BasicThreedsInitializePreAuth extends IyzipayResource {
     private String htmlContent;
 
     public static BasicThreedsInitializePreAuth create(CreateBasicPaymentRequest request, Options options) {
-        BasicThreedsInitializePreAuth response = HttpClient.create().post(options.getBaseUrl() + "/payment/3dsecure/initialize/preauth/basic",
+        String path = "/payment/3dsecure/initialize/preauth/basic";
+        BasicThreedsInitializePreAuth response = HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 BasicThreedsInitializePreAuth.class);
         if (response != null) {

diff --git a/src/main/java/com/iyzipay/model/BasicThreedsPayment.java b/src/main/java/com/iyzipay/model/BasicThreedsPayment.java
@@ -7,9 +7,10 @@
 public class BasicThreedsPayment extends BasicPaymentResource {
 
     public static BasicThreedsPayment create(CreateThreedsPaymentRequest request, Options options) {
-        return HttpClient.create().post(options.getBaseUrl() + "/payment/3dsecure/auth/basic",
+        String path = "/payment/3dsecure/auth/basic";
+        return HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 BasicThreedsPayment.class);
     }

diff --git a/src/main/java/com/iyzipay/model/BinNumber.java b/src/main/java/com/iyzipay/model/BinNumber.java
@@ -16,9 +16,10 @@ public class BinNumber extends IyzipayResource {
     private Integer commercial;
 
     public static BinNumber retrieve(RetrieveBinNumberRequest request, Options options) {
-        return HttpClient.create().post(options.getBaseUrl() + "/payment/bin/check",
+        String path = "/payment/bin/check";
+        return HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 BinNumber.class);
     }

diff --git a/src/main/java/com/iyzipay/model/Bkm.java b/src/main/java/com/iyzipay/model/Bkm.java
@@ -1,18 +1,31 @@
 package com.iyzipay.model;
 
+import com.iyzipay.HashValidator;
 import com.iyzipay.HttpClient;
 import com.iyzipay.Options;
+import com.iyzipay.ResponseSignatureGenerator;
 import com.iyzipay.request.RetrieveBkmRequest;
 
-public class Bkm extends PaymentResource {
+import java.util.Arrays;
+
+public class Bkm extends PaymentResource implements ResponseSignatureGenerator {
 
     private String token;
     private String callbackUrl;
 
+    public boolean verifySignature(String secretKey) {
+        String calculated = generateSignature(secretKey,
+                Arrays.asList(getPaymentId(), getPaymentStatus(),
+                        getBasketId(), getConversationId(), getCurrency(),
+                        getPaidPrice(), getPrice(), getToken()));
+        return HashValidator.hashValid(getSignature(), calculated);
+    }
+
     public static Bkm retrieve(RetrieveBkmRequest request, Options options) {
-        return HttpClient.create().post(options.getBaseUrl() + "/payment/bkm/auth/detail",
+        String path = "/payment/bkm/auth/detail";
+        return HttpClient.create().post(options.getBaseUrl() + path,
                 getHttpProxy(options),
-                getHttpHeaders(request, options),
+                getHttpHeadersV2(path, request, options),
                 request,
                 Bkm.class);
     }