# .env — your server only; never commit this file
# Replace every REPLACE_ME value with your test configuration.
HAMRO_MERCHANT_ID=REPLACE_ME
HAMRO_CLIENT_ID=REPLACE_ME
HAMRO_API_KEY=REPLACE_ME
HAMRO_CLIENT_SECRET=REPLACE_ME
HAMRO_USER_SECRET=REPLACE_ME

# Obtain full URLs from Hamro Pay during test onboarding.
HAMRO_CREATE_SESSION_URL=REPLACE_ME
HAMRO_GET_TRANSACTION_URL=REPLACE_ME
HAMRO_GATEWAY_URL=REPLACE_ME

# Set these to pages in your application.
CHECKOUT_SUCCESS_URL=https://your-domain.example/payment/success
CHECKOUT_FAILURE_URL=https://your-domain.example/payment/failure

{
  "merchantTxnId": "ORDER-1001",
  "merchantId": "YOUR_TEST_MERCHANT_ID",
  "transactionAmount": "12550",
  "failedRedirectionUrl": "https://your-domain.example/payment/failure",
  "successRedirectionUrl": "https://your-domain.example/payment/success",
  "remarks": "Order ORDER-1001"
}

import { createHmac } from 'node:crypto';

export function signSession(request, clientId, clientApiKey, clientSecret) {
  const message = [
    request.merchantTxnId,
    request.transactionAmount,
    request.merchantId,
    clientId,
    clientApiKey,
  ].join(',');

  return createHmac('sha512', clientSecret)
    .update(message, 'utf8')
    .digest('base64');
}

// request is the exact JSON object you send to Create Session.
// Read the client id, api key and secret from your server environment.

Signature: YOUR_GENERATED_BASE64_SIGNATURE
Client-Id: YOUR_TEST_CLIENT_ID
Client-API-Key: YOUR_TEST_API_KEY
Content-Type: application/json

import { createHmac } from 'node:crypto';

// Run on your server after a successful Create Session call.
// session is the parsed response from Hamro Pay.
export function checkoutFields(session, clientId, clientApiKey, clientSecret) {
  const tokenMessage = [
    session.merchantId,
    session.merchantTxnId,
    session.sessionId,
    session.transactionAmount,
    clientId,
    clientApiKey,
  ].join(',');

  const token = createHmac('sha512', clientSecret)
    .update(tokenMessage, 'utf8')
    .digest('base64');

  const fields = {
    merchant_id: session.merchantId,
    session_id: session.sessionId,
    token,
    merchant_transaction_id: session.merchantTxnId,
  };
  for (const [name, value] of Object.entries(fields)) {
    if (typeof value !== 'string' || value.length === 0) {
      throw new Error('Missing checkout field: ' + name);
    }
  }
  return fields;
}

// Render only these fields in the checkout form.
// Never serialize the full session response into the page.

<!-- Template: replace these values on your server.
     HTML-escape every value before inserting it.
     Use only the checkout URL confirmed by Hamro Pay. -->
<form method="POST"
      action="{{ HAMRO_GATEWAY_URL }}"
      enctype="application/x-www-form-urlencoded">
  <input type="hidden" name="merchant_id"
         value="{{ merchant_id }}">
  <input type="hidden" name="session_id"
         value="{{ session_id }}">
  <input type="hidden" name="token"
         value="{{ token }}">
  <input type="hidden" name="merchant_transaction_id"
         value="{{ merchant_transaction_id }}">
  <button type="submit">Pay with Hamro Pay</button>
</form>

{
  "merchantId": "YOUR_TEST_MERCHANT_ID",
  "merchantTxnId": "ORDER-1001"
}

// Run on your server after calling Get Transaction.
// payment = Hamro Pay's response, not the browser's data.
// order = your saved order, loaded using its transaction ID.
export function isPaid(payment, order) {
  if (!payment || !order || typeof order.merchantTxnId !== 'string'
      || !order.merchantTxnId) return false;
  if (!['number', 'string'].includes(typeof payment.amount)
      || !['number', 'string'].includes(typeof order.amount)) return false;
  const amount = Number(payment.amount);
  const expected = Number(order.amount);
  return payment.status === 'COMPLETED'
    && payment.merchantTransactionId === order.merchantTxnId
    && Number.isFinite(amount)
    && amount > 0
    && Number.isFinite(expected)
    && amount === expected;
}

// Fulfill only after isPaid returns true, and save the paid state
// atomically so repeated checks or webhooks cannot fulfill twice.