Integrating Paynow & EcoCash in Node.js: The Production Payment Architecture Guide

import { NextRequest, NextResponse } from 'next/server';
import crypto from 'crypto';

export async function POST(req: NextRequest) {
  const formData = await req.formData();
  const data: Record<string, string> = {};
  formData.forEach((value, key) => {
    data[key] = value.toString();
  });

  const { reference, paynowreference, amount, status, hash } = data;
  const integrationKey = process.env.PAYNOW_INTEGRATION_KEY!;

  // 1. Rebuild message string for SHA512 verification
  const hashString = Object.keys(data)
    .filter(k => k.toLowerCase() !== 'hash')
    .sort()
    .map(k => data[k])
    .join('') + integrationKey;

  const expectedHash = crypto
    .createHash('sha512')
    .update(hashString)
    .digest('hex')
    .toUpperCase();

  if (hash !== expectedHash) {
    return NextResponse.json({ error: 'Invalid hash signature' }, { status: 400 });
  }

  // 2. Idempotent Order State Update
  if (status.toLowerCase() === 'paid') {
    await db.orders.update({
      where: { orderNumber: reference },
      data: { status: 'PAID', gatewayReference: paynowreference }
    });
  }

  return NextResponse.json({ received: true });
}