everypay.js

var HmacSHA1 = require('crypto-js/hmac-sha1')
var _ = require('lodash')
var crypto = require('crypto')

function addHMAC(data, api_secret) {
  data['hmac_fields'] = ""
  var hmac_fields = _.keys(data).sort()
  data['hmac_fields'] = hmac_fields.join(',')
  var dataString = ''
  for (var i = 0; i < hmac_fields.length; i++) {
    dataString += hmac_fields[i] + '=' + data[hmac_fields[i]]
    if (i < hmac_fields.length - 1)
      dataString += "&"
  }
  console.log(dataString)
  data['hmac'] = HmacSHA1(dataString, api_secret).toString()
  return data
}

function addNonceAndTimestamp (data) {
  data['nonce'] = crypto.randomBytes(8).toString('hex')
  data['timestamp'] = Math.floor(Date.now() / 1000).toString()
  return data
}

function buildData() {
  var api_secret = "xxx"
  var data = {
    api_username: "yyy",
    account_id: "EUR3D1",
    callback_url: "https://example.com/",
    customer_url: "https://example.com/",
    amount: "12.34",
    order_reference: "31337",
    user_ip: "93.75.248.20",
    transaction_type: "charge"
  }
  data = addNonceAndTimestamp(data)
  data = addHMAC(data, api_secret)
  return data
}

exports.buildData = buildData

Here's a code snippet which builds data for the payment API: https://gist.github.com/killerstorm/ca4ee82536b6bfda6741

It can be executed using node after installing libraries it needs:

$ node 
> require('./everypay').buildData()
...
{ api_username: 'yyy',
  account_id: 'EUR3D1',
  ...
  hmac: '5e2e399ea3af0900850a0306ac0d5d28a9b77280' }

The task is to implement a REST service which will receive amount and order_reference from caller and return JSON data.

Parameters needed to build data (api_username, api_secret, account_id, callback_url, customer_url, transaction_type) should be taken from a separate config.json file which the service should read at start.

Service should automatically determine user_ip as IP address of the caller.

We recommend to use Express framework but it's not a hard requirement.

Bonus points for adding CORS support so this service can be called from any browser. Bonus points for curl command to test the service.