Payload Encryption

const crypto = require('crypto');

/**
 * Derive a 32-byte AES key from the merchant Encryption Key.
 * 64-char hex keys are decoded directly; legacy 32-char keys are UTF-8 padded.
 */
function deriveKey(encryptionKey) {
  if (/^[0-9a-fA-F]{64}$/.test(encryptionKey)) {
    return Buffer.from(encryptionKey, 'hex');
  }
  return Buffer.from(
    encryptionKey.padEnd(32, '0').substring(0, 32),
    'utf-8',
  );
}

/**
 * Encrypt a plain-text JSON string using AES-256-CBC.
 * Returns "{iv_hex}:{ciphertext_hex}".
 */
function encryptPayload(plainText, encryptionKey) {
  const keyBuffer = deriveKey(encryptionKey);
  const iv = crypto.randomBytes(16); // fresh IV per request
  const cipher = crypto.createCipheriv('aes-256-cbc', keyBuffer, iv);
  let encrypted = cipher.update(plainText, 'utf-8', 'hex');
  encrypted += cipher.final('hex');
  return `${iv.toString('hex')}:${encrypted}`;
}

/**
 * Decrypt an encrypted payload string back to plain text.
 */
function decryptPayload(encryptedPayload, encryptionKey) {
  const keyBuffer = deriveKey(encryptionKey);
  const [ivHex, encrypted] = encryptedPayload.split(':');
  if (!ivHex || !encrypted) {
    throw new Error('Invalid encrypted payload format');
  }
  const iv = Buffer.from(ivHex, 'hex');
  const decipher = crypto.createDecipheriv('aes-256-cbc', keyBuffer, iv);
  let decrypted = decipher.update(encrypted, 'hex', 'utf-8');
  decrypted += decipher.final('utf-8');
  return decrypted;
}

// 1. Load your Encryption Key from environment (Dashboard → Config)
const encryptionKey = process.env.PAYOFLUX_ENCRYPTION_KEY;

// 2. Build the request body exactly as documented on the API page
const requestBody = {
  merchantOrderId: 'ORD-12345',
  payment: { amount: 100, currency: 'USD' },
  card: {
    number: '4111111111111111',
    expiryMonth: 12,
    expiryYear: 2030,
    cvv: '123',
    holderName: 'John Doe',
  },
  customer: {
    firstName: 'John',
    lastName: 'Doe',
    email: 'john@example.com',
    ip: '185.23.44.91',
  },
  billing: {
    addressLine1: '12, Hill',
    city: 'Nevada',
    state: 'Nevada',
    country: 'US',
    postalCode: '12345',
  },
  callback: {
    webhookUrl: 'https://your-domain.com/webhook',
    returnUrl: 'https://your-domain.com/payment/callback',
  },
};

// 3. Encrypt the JSON string and wrap it in a payload field
const encrypted = encryptPayload(JSON.stringify(requestBody), encryptionKey);

// 4. Send the encrypted request to PayoFlux
const response = await fetch('https://api.payoflux.com/api/test/charge', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    Authorization: 'Bearer your_api_key_or_sandbox_api_key',
  },
  body: JSON.stringify({ payload: encrypted }),
});

// 5. Decrypt the encrypted response payload field
const { payload: encryptedResponse } = await response.json();
const decrypted = JSON.parse(decryptPayload(encryptedResponse, encryptionKey));
console.log(decrypted);