payment

apps/edr-freight-api/src/modules/payment/webhooks/dto/telebirr.dto.ts

@@ -0,0 +1,13 @@
+export class TelebirrDto {
+    merch_order_id!: string;
+    payment_order_id!: string;
+    trade_status!: string;
+    trans_id?: string;
+    total_amount?: string;
+    trans_currency?: string;
+    notify_time?: string;
+    trans_end_time?: string;
+    sign!: string;
+    sign_type?: string;
+    [key: string]: unknown;
+}

apps/edr-freight-api/src/modules/payment/webhooks/providers/telebirr.service.ts

@@ -0,0 +1,49 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import * as crypto from "crypto"
+import { TelebirrDto } from '../dto/telebirr.dto';
+@Injectable()
+export class TelebirrWebhookService {
+    // private readonly logger = new Logger(TelebirrWebhookService.name);
+
+    constructor(
+        private readonly config: ConfigService
+    ) { }
+
+    verifyTelebirrNotification(payload: TelebirrDto) {
+        // 1. Extract the signature provided by Telebirr
+        const { sign, ...bizContent } = payload;
+
+        if (!sign) {
+            throw new Error("Missing 'sign' field from Telebirr payload");
+        }
+
+        // 2. Sort the remaining keys alphabetically to rebuild the raw string
+        const sortedKeys = Object.keys(bizContent).sort();
+        const signString = sortedKeys
+            .map(key => `${key}=${typeof bizContent[key] === 'object' ? JSON.stringify(bizContent[key]) : bizContent[key]}`)
+            .join('&');
+
+        // 3. Convert Telebirr's public key into an object specifying RSA-PSS padding
+        const publicKey = {
+            key: this.config.get<string>("telebirr.publicKey") ?? "",
+            padding: crypto.constants.RSA_PKCS1_PSS_PADDING,
+            saltLength: 32 // Telebirr standard salt length
+        };
+
+        // 4. Verify the signature against the sorted string
+        const isVerified = crypto.verify(
+            "sha256",
+            Buffer.from(signString),
+            publicKey,
+            Buffer.from(sign, 'base64')
+        );
+
+        return isVerified;
+    }
+
+    async handle(payload: TelebirrDto): Promise<void> {
+
+    }
+
+}

apps/edr-freight-api/src/modules/payment/webhooks/webhook.controller.ts

@@ -0,0 +1,41 @@
+import { All, Body, Controller, HttpCode, HttpStatus, Logger, } from '@nestjs/common';
+import { TelebirrWebhookService } from './providers/telebirr.service';
+import { ApiOperation } from '@nestjs/swagger';
+import { TelebirrDto } from './dto/telebirr.dto';
+
+@Controller("payments/webhooks")
+export class WebhookController {
+    constructor(private readonly telebirr: TelebirrWebhookService) { }
+    private readonly logger = new Logger(WebhookController.name);
+
+    @All('telebirr')
+    @HttpCode(HttpStatus.OK)
+    @ApiOperation({
+        summary: 'Telebirr payment notification callback (Ethiopia)',
+        description: 'Webhook endpoint for Telebirr payment status updates. Used by Ethiopian passengers.'
+    })
+    async receiveTelebirr(@Body() payload: TelebirrDto) {
+        this.logger.log(
+            `Telebirr webhook Called`,
+        );
+
+        try {
+            const verified = this.telebirr.verifyTelebirrNotification(payload)
+            if (!verified) {
+                throw new Error("not valid")
+            }
+            const merchantOrderId = payload.merch_order_id;
+            if (merchantOrderId.startsWith("freight")) {
+                await this.telebirr.handle(payload);
+            } else if (merchantOrderId.startsWith("passagner")) {
+                //todo: handle else where
+            }
+
+        } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            this.logger.error(`Telebirr webhook handler threw: ${message}`);
+        }
+        return { code: '0', message: 'OK' };
+    }
+
+}