Quickstart

import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";

const API = "https://api.rais.app/v1";
const SECRET_KEY = process.env.RAIS_SECRET_KEY; // rais_sk_test_...
const WEBHOOK_SECRET = process.env.RAIS_WEBHOOK_SECRET; // whsec_...

/**
 * rawBody: the request body exactly as received (Buffer or string), never re-serialised JSON.
 * header:  the value of the Rais-Signature header.
 */
export function verifySignature(rawBody, header, secret, toleranceSeconds = 300, now = Math.floor(Date.now() / 1000)) {
  const pairs = header.split(",").map((part) => part.trim().split("="));
  const timestamp = pairs.find(([key]) => key === "t")?.[1];
  const signatures = pairs.filter(([key]) => key === "v1").map(([, value]) => value);
  if (!/^\d+$/.test(timestamp ?? "") || signatures.length === 0) return false;
  if (Math.abs(now - Number(timestamp)) > toleranceSeconds) return false;

  const expected = createHmac("sha256", secret).update(`${timestamp}.`).update(rawBody).digest();
  return signatures.some((signature) => {
    const received = Buffer.from(signature, "hex");
    return received.length === expected.length && timingSafeEqual(received, expected);
  });
}

async function rais(path, init = {}) {
  const response = await fetch(`${API}${path}`, {
    ...init,
    headers: { Authorization: `Bearer ${SECRET_KEY}`, "Content-Type": "application/json", ...init.headers },
  });
  return { ok: response.ok, body: await response.json() };
}

const app = express();
const orders = new Map(); // order id -> { paymentId, amount }. Use your database in production.
const processed = new Set(); // ids of the events already handled. Use your database too.

app.get("/", (req, res) => {
  res.send('<form method="post" action="/checkout"><button>Pay 5,000.00 DA</button></form>');
});

// 1. Create the payment on your server, keep its id with the order, then send the payer to the hosted checkout.
app.post("/checkout", async (req, res) => {
  const orderId = "1042"; // your own order
  const amount = 500000; // 5,000.00 DA, in centimes
  const { ok, body: payment } = await rais("/payments", {
    method: "POST",
    headers: { "Idempotency-Key": `order-${orderId}` }, // one payment per order, even if this handler runs twice
    body: JSON.stringify({
      amount,
      description: `Order #${orderId}`,
      reference: `order-${orderId}`,
      success_url: "http://localhost:3000/thanks", // https:// is required for live payments
      cancel_url: "http://localhost:3000/",
    }),
  });
  if (!ok) return res.status(502).json(payment);
  orders.set(orderId, { paymentId: payment.id, amount });
  res.redirect(303, payment.checkout_url);
});

// 2. The payer comes back here. The address proves nothing: ask the API about the payment YOU created for this order.
app.get("/thanks", async (req, res) => {
  const order = orders.get(String(req.query.reference ?? "").replace(/^order-/, ""));
  if (!order) return res.status(404).send("Unknown order.");
  const { ok, body: payment } = await rais(`/payments/${order.paymentId}`);
  const paid = ok && payment.status === "paid" && payment.amount === order.amount;
  res.send(paid ? "Thank you, we received your payment." : "Payment not completed.");
});

// 3. Raïs calls this URL for every event. express.raw keeps the body exactly as it was signed.
app.post("/webhooks/rais", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifySignature(req.body, req.get("Rais-Signature") ?? "", WEBHOOK_SECRET)) return res.sendStatus(400);

  const event = JSON.parse(req.body.toString("utf8"));
  if (event.id.startsWith("evt_test_")) return res.sendStatus(200); // the dashboard's test event: never fulfil an order for it
  if (processed.has(event.id)) return res.sendStatus(200); // delivered twice: nothing to do
  processed.add(event.id);

  if (event.type === "payment.succeeded") {
    const payment = event.data.object;
    const orderId = [...orders].find(([, order]) => order.paymentId === payment.id)?.[0];
    if (orderId && payment.amount === orders.get(orderId).amount) console.log(`Order ${orderId} is paid (${payment.amount} centimes)`);
  }
  res.sendStatus(200); // answer quickly, do slow work afterwards
});

app.listen(3000, () => console.log("Listening on http://localhost:3000"));