{
  "_comment": "md5(client_key + client_secret + X + Y), lowercase hex. SALE (callbacks and return URLs): X=payme_transaction_id, Y=payme_sale_id. SUBSCRIPTION RETURN URL ONLY: X=transaction_id, Y=sub_payme_id; subscription callbacks are unsigned, so they do not appear here. A valid signature is not proof of payment: see partner-callbacks.json. Digests were computed with node:crypto, independently of the implementation. All values are fake.",
  "case_count": 17,
  "credentials": {
    "client_key": "MPL00000-EXAMPLE0-PARTNER0-KEY00000",
    "client_secret": "example-partner-secret"
  },
  "digests": [
    {
      "inputs": [
        "MPL00000-EXAMPLE0-PARTNER0-KEY00000",
        "example-partner-secret",
        "TRAN0000-EXAMPLE0-TRANSACT-SALE0001",
        "SALE0000-EXAMPLE0-SALE0000-00000001"
      ],
      "md5": "320349e9aeb4b491a063af4556ca1e14"
    },
    {
      "inputs": [
        "MPL00000-EXAMPLE0-PARTNER0-KEY00000",
        "example-partner-secret",
        "TRAN0000-EXAMPLE0-TRANSACT-SUB00001",
        "SUB00000-EXAMPLE0-SUB00000-00000001"
      ],
      "md5": "d02ac4d703b6abe6d88a06822e9c6277"
    }
  ],
  "cases": [
    {
      "name": "sale: valid",
      "verifier": "sale",
      "body": {
        "status_code": "0",
        "notify_type": "sale-complete",
        "transaction_id": "order-0001",
        "payme_sale_id": "SALE0000-EXAMPLE0-SALE0000-00000001",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SALE0001",
        "price": "5075",
        "currency": "ILS",
        "payme_signature": "320349e9aeb4b491a063af4556ca1e14"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "valid"
    },
    {
      "name": "sale: upper-case signature is accepted",
      "verifier": "sale",
      "body": {
        "status_code": "0",
        "notify_type": "sale-complete",
        "transaction_id": "order-0001",
        "payme_sale_id": "SALE0000-EXAMPLE0-SALE0000-00000001",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SALE0001",
        "price": "5075",
        "currency": "ILS",
        "payme_signature": "320349E9AEB4B491A063AF4556CA1E14"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "valid"
    },
    {
      "name": "sale: merchant transaction_id is not part of the hash",
      "verifier": "sale",
      "body": {
        "status_code": "0",
        "notify_type": "sale-complete",
        "transaction_id": "another-order",
        "payme_sale_id": "SALE0000-EXAMPLE0-SALE0000-00000001",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SALE0001",
        "price": "5075",
        "currency": "ILS",
        "payme_signature": "320349e9aeb4b491a063af4556ca1e14"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "valid"
    },
    {
      "name": "sale: tampered payme_sale_id",
      "verifier": "sale",
      "body": {
        "status_code": "0",
        "notify_type": "sale-complete",
        "transaction_id": "order-0001",
        "payme_sale_id": "SALE0000-EXAMPLE0-SALE0000-00000009",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SALE0001",
        "price": "5075",
        "currency": "ILS",
        "payme_signature": "320349e9aeb4b491a063af4556ca1e14"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "invalid"
    },
    {
      "name": "sale: tampered payme_transaction_id",
      "verifier": "sale",
      "body": {
        "status_code": "0",
        "notify_type": "sale-complete",
        "transaction_id": "order-0001",
        "payme_sale_id": "SALE0000-EXAMPLE0-SALE0000-00000001",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SALE0009",
        "price": "5075",
        "currency": "ILS",
        "payme_signature": "320349e9aeb4b491a063af4556ca1e14"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "invalid"
    },
    {
      "name": "sale: wrong secret",
      "verifier": "sale",
      "body": {
        "status_code": "0",
        "notify_type": "sale-complete",
        "transaction_id": "order-0001",
        "payme_sale_id": "SALE0000-EXAMPLE0-SALE0000-00000001",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SALE0001",
        "price": "5075",
        "currency": "ILS",
        "payme_signature": "320349e9aeb4b491a063af4556ca1e14"
      },
      "client_secret": "some-other-secret",
      "expected_status": "invalid"
    },
    {
      "name": "sale: signed with transaction_id (order id) instead of payme_transaction_id",
      "verifier": "sale",
      "body": {
        "status_code": "0",
        "notify_type": "sale-complete",
        "transaction_id": "order-0001",
        "payme_sale_id": "SALE0000-EXAMPLE0-SALE0000-00000001",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SALE0001",
        "price": "5075",
        "currency": "ILS",
        "payme_signature": "c430f41eb7408b085c751ee2b45d3a23"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "invalid"
    },
    {
      "name": "sale: signature of wrong length",
      "verifier": "sale",
      "body": {
        "status_code": "0",
        "notify_type": "sale-complete",
        "transaction_id": "order-0001",
        "payme_sale_id": "SALE0000-EXAMPLE0-SALE0000-00000001",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SALE0001",
        "price": "5075",
        "currency": "ILS",
        "payme_signature": "320349e9aeb4b491a063af4556ca1e1"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "invalid"
    },
    {
      "name": "sale: signed but ids missing",
      "verifier": "sale",
      "body": {
        "status_code": "0",
        "notify_type": "sale-complete",
        "transaction_id": "order-0001",
        "payme_sale_id": "SALE0000-EXAMPLE0-SALE0000-00000001",
        "price": "5075",
        "currency": "ILS",
        "payme_signature": "320349e9aeb4b491a063af4556ca1e14"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "invalid"
    },
    {
      "name": "sale: null signature is unsigned, not forged",
      "verifier": "sale",
      "body": {
        "status_code": "0",
        "notify_type": "sale-complete",
        "transaction_id": "order-0001",
        "payme_sale_id": "SALE0000-EXAMPLE0-SALE0000-00000001",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SALE0001",
        "price": "5075",
        "currency": "ILS",
        "payme_signature": ""
      },
      "client_secret": "example-partner-secret",
      "expected_status": "unsigned"
    },
    {
      "name": "sale: no secret configured",
      "verifier": "sale",
      "body": {
        "status_code": "0",
        "notify_type": "sale-complete",
        "transaction_id": "order-0001",
        "payme_sale_id": "SALE0000-EXAMPLE0-SALE0000-00000001",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SALE0001",
        "price": "5075",
        "currency": "ILS",
        "payme_signature": "320349e9aeb4b491a063af4556ca1e14"
      },
      "client_secret": "",
      "expected_status": "unverifiable"
    },
    {
      "name": "subscription return URL: valid",
      "verifier": "subscription-return-url",
      "body": {
        "payme_status": "success",
        "sub_payme_id": "SUB00000-EXAMPLE0-SUB00000-00000001",
        "transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SUB00001",
        "payme_signature": "d02ac4d703b6abe6d88a06822e9c6277"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "valid"
    },
    {
      "name": "subscription return URL: tampered sub_payme_id",
      "verifier": "subscription-return-url",
      "body": {
        "payme_status": "success",
        "sub_payme_id": "SUB00000-EXAMPLE0-SUB00000-00000009",
        "transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SUB00001",
        "payme_signature": "d02ac4d703b6abe6d88a06822e9c6277"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "invalid"
    },
    {
      "name": "subscription return URL: wrong secret",
      "verifier": "subscription-return-url",
      "body": {
        "payme_status": "success",
        "sub_payme_id": "SUB00000-EXAMPLE0-SUB00000-00000001",
        "transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SUB00001",
        "payme_signature": "d02ac4d703b6abe6d88a06822e9c6277"
      },
      "client_secret": "some-other-secret",
      "expected_status": "invalid"
    },
    {
      "name": "subscription return URL: payme_transaction_id does not stand in for transaction_id",
      "verifier": "subscription-return-url",
      "body": {
        "payme_status": "success",
        "sub_payme_id": "SUB00000-EXAMPLE0-SUB00000-00000001",
        "payme_signature": "d02ac4d703b6abe6d88a06822e9c6277",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SUB00001"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "invalid"
    },
    {
      "name": "subscription return URL: sale-shaped payload does not verify",
      "verifier": "subscription-return-url",
      "body": {
        "payme_status": "success",
        "sub_payme_id": "SALE0000-EXAMPLE0-SALE0000-00000001",
        "transaction_id": "order-0001",
        "payme_signature": "320349e9aeb4b491a063af4556ca1e14",
        "payme_transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SALE0001"
      },
      "client_secret": "example-partner-secret",
      "expected_status": "invalid"
    },
    {
      "name": "subscription return URL: no signature",
      "verifier": "subscription-return-url",
      "body": {
        "payme_status": "success",
        "sub_payme_id": "SUB00000-EXAMPLE0-SUB00000-00000001",
        "transaction_id": "TRAN0000-EXAMPLE0-TRANSACT-SUB00001",
        "payme_signature": ""
      },
      "client_secret": "example-partner-secret",
      "expected_status": "unsigned"
    }
  ]
}