Shopify

const express = require('express');
const BoomPay = require('boom-pay-sdk');

const app = express();

const boomPay = new BoomPay({
  apiKey: process.env.BOOMPAY_API_KEY,
  sandbox: process.env.NODE_ENV !== 'production',
});

app.set('boomPay', boomPay);
app.use('/shopify', require('./routes/shopify-webhook')(boomPay));
app.use('/boompay', require('./routes/boompay-return')(boomPay));

app.listen(process.env.PORT || 3000);

const express = require('express');
const crypto = require('crypto');

// Name must exactly match the manual payment method you create in
// Settings -> Payments -> Manual payment methods.
const BOOMPAY_GATEWAY_NAME = 'Pay with Boomcoin (BoomPay)';

module.exports = function (boomPay) {
  const router = express.Router();

  // Shopify's webhook HMAC needs the raw, unparsed body -- keep this
  // separate from any express.json() middleware used elsewhere in the app.
  router.post(
    '/webhooks/orders-create',
    express.raw({ type: 'application/json' }),
    async (req, res) => {
      const digest = crypto
        .createHmac('sha256', process.env.SHOPIFY_WEBHOOK_SECRET)
        .update(req.body)
        .digest('base64');

      const valid = crypto.timingSafeEqual(
        Buffer.from(digest),
        Buffer.from(req.get('X-Shopify-Hmac-Sha256') || '', 'utf8')
      );
      // NOTE: this verifies Shopify's own webhook signature -- a different
      // scheme, with a different secret, from BoomPay's return signature
      // below. Don't conflate the two.
      if (!valid) return res.status(401).end();

      const order = JSON.parse(req.body.toString('utf8'));
      if (order.gateway !== BOOMPAY_GATEWAY_NAME) {
        return res.status(200).end(); // not a BoomPay order, ignore
      }

      const intent = await boomPay.payments.createIntent({
        amount: toBmc(order.current_total_price, order.currency),
        successUrl: `${process.env.APP_URL}/boompay/return?status=success&order_id=${order.id}`,
        failureUrl: `${process.env.APP_URL}/boompay/return?status=failure&order_id=${order.id}`,
        label: `Shopify Order ${order.name}`,
        metadata: { shopifyOrderId: order.id },
      });

      // Manual payment methods finalize the order immediately, with no
      // mid-checkout redirect available -- so the link has to reach the
      // customer some other way. Emailing it is the most broadly reliable
      // option that needs no checkout-extensibility approval.
      await emailPaymentLink(order.email, intent.link, order.name);

      res.status(200).end();
    }
  );

  return router;
};

function toBmc(fiatTotal, currency) {
  // BoomPay has no FX endpoint (see API Reference > Currency) -- source your
  // own conversion rate before going live.
  return Number(fiatTotal);
}

async function emailPaymentLink(email, link, orderName) {
  // Wire up to your transactional email provider of choice.
}

const express = require('express');

module.exports = function (boomPay) {
  const router = express.Router();

  // boomPay.webhooks() validates paymentIntentId + X-Boom-Signature on the
  // query string before this handler ever runs.
  router.get('/return', boomPay.webhooks(), async (req, res) => {
    const orderId = req.query.order_id;
    const status = req.query.status;
    const payment = await boomPay.payments.getPayment(req.query.paymentIntentId);

    if (status === 'success' && payment.paidAt) {
      await markShopifyOrderPaid(orderId, payment);
      return res.redirect(`https://${process.env.SHOP_DOMAIN}/pages/payment-confirmed`);
    }
    return res.redirect(`https://${process.env.SHOP_DOMAIN}/pages/payment-failed`);
  });

  return router;
};

// Marks a manual-payment-method order as paid via the Order Transactions
// API. Requires a custom app (Settings -> Apps -> Develop apps) with
// write_orders scope, or an equivalent OAuth access token for a public app.
async function markShopifyOrderPaid(orderId, payment) {
  const url = `https://${process.env.SHOP_DOMAIN}/admin/api/2025-01/orders/${orderId}/transactions.json`;
  await fetch(url, {
    method: 'POST',
    headers: {
      'X-Shopify-Access-Token': process.env.SHOPIFY_ADMIN_TOKEN,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      transaction: {
        kind: 'capture',
        amount: payment.amount,
        gateway: 'boompay',
        source: 'external',
      },
    }),
  });
}

const express = require('express');
const router = express.Router();

// Configured as the "payment session URL" in your app's Offsite Payments
// Extension settings. Shopify POSTs here when a buyer pays with BoomPay at
// native checkout. Requires Shopify Plus / approved Partner access -- see
// the callout above before building against this.
router.post('/payment-session', async (req, res) => {
  const boomPay = req.app.get('boomPay');
  const session = req.body; // order + customer details, per Shopify's payload

  try {
    const intent = await boomPay.payments.createIntent({
      amount: Number(session.payment_method.amount),
      successUrl: `${process.env.APP_URL}/shopify/offsite-return?session=${session.id}`,
      failureUrl: `${process.env.APP_URL}/shopify/offsite-return?session=${session.id}&failed=1`,
      label: `Shopify order ${session.order_id}`,
      metadata: { shopifySessionId: session.id },
    });

    // Required, required shape: a 2xx response with redirect_url under 8192 bytes.
    // This only *starts* the Shopify payment session -- see offsite-return.js
    // below for the step that actually finalizes it.
    res.status(200).json({ redirect_url: intent.link });
  } catch (err) {
    res.status(422).json({ error: 'boompay_intent_failed' });
  }
});

module.exports = router;

// routes/offsite-return.js
// BoomPay redirects the customer's browser here after they pay. The
// redirect_url returned from payment-session.js only starts the Shopify
// payment session -- this route is what actually finalizes it, by calling
// back into Shopify's own GraphQL API.
module.exports = function (boomPay) {
  const express = require('express');
  const router = express.Router();

  const SHOPIFY_GRAPHQL = `https://${process.env.SHOP_DOMAIN}/admin/api/2025-01/graphql.json`;

  router.get('/offsite-return', boomPay.webhooks(), async (req, res) => {
    const payment = await boomPay.payments.getPayment(req.query.paymentIntentId);
    const shopifySessionId = payment.metadata && payment.metadata.shopifySessionId;

    // The exact mutation arguments and id format belong to Shopify's
    // Payments Apps GraphQL schema -- confirm those against Shopify's
    // current API reference rather than copying this verbatim. What matters
    // here is that this call is mandatory, not optional: skip it and the
    // payment session sits open on Shopify's side indefinitely, even though
    // BoomPay has already settled the payment on its own.
    const mutation = payment.paidAt
      ? `mutation { paymentSessionResolve(id: "${shopifySessionId}") { paymentSession { id } userErrors { message } } }`
      : `mutation { paymentSessionReject(id: "${shopifySessionId}", reason: PROCESSING_ERROR) { paymentSession { id } userErrors { message } } }`;

    await fetch(SHOPIFY_GRAPHQL, {
      method: 'POST',
      headers: { 'X-Shopify-Access-Token': process.env.SHOPIFY_ADMIN_TOKEN, 'Content-Type': 'application/json' },
      body: JSON.stringify({ query: mutation }),
    });

    res.redirect(payment.paidAt ? '/checkout/thank-you' : '/checkout');
  });

  return router;
};