Linux Certif

Toute la documentation sur la certification Linux LPI

Vend::Payment::CyberSource.3pm

Interchange CyberSource Support

Vend::Payment::CyberSource Revision: 1.0

SYNOPSIS

     &charge=cybersource
  
         or
  
     [charge gateway=cybersource param1=value1 param2=value2]
 
        or, with a route named foo with gateway => cybersource
 
     [charge route=foo]
 
 

While you have free will, please use a route. See below.

PREREQUISITES

  SOAP::Lite
  XML::Pastor::Schema::Parser
  LWP::Simple
  OpenSSL
 
 

DESCRIPTION

The Vend::Payment::CyberSource module implements the cybersource() routine for use with Interchange. It is compatible on a call level with the other Interchange payment modules.

To enable this module, place this directive in "interchange.cfg":

     Require module Vend::Payment::CyberSource
 
 

This must be in interchange.cfg or a file included from it.

Make sure CreditCardAuto is off (default in Interchange demos).

This module supersedes Vend::Payment::ICS. With only minor adjustments to the payment route and some changes to the keys in $Session->{payment_result}, Vend::Payment::CyberSource should function as a drop-in replacement for Vend::Payment::ICS. If you have legacy support for the SCMP API and don't need any of the new features supported in this module, you do not need to change. However, all new CyberSource clients will have to use this module as they do not allow new clients to use SCMP.

If you do choose to replace the current use of Vend::Payment::ICS, you will have to abandon the merchant keys generated by ecert() (I know, it's a devastating blow) and instead generate a transaction key from within the online merchant account. That new transaction key will be added to your payment route.

Whenever possible, please set your payment parameters using a payment route or passed as arguments to [charge] directly. No special effort has been made to consistently fall back on the charge_param() function, which plucks values out of the MV_PAYMENT_* variable space. It is not possible to isolate variables to a specific charge routine using charge_param() and, as such, it should be viewed with suspicion, rather than being used as a crutch. In particular, this module makes the assumption that certain critical route parameters will be present in $opt, and the best way to ensure they are in there is to use a payment route.

Simple made Simple

You may treat this gateway module as though it were the Simple API. The construction of the requests and responses within the Vend::Payment namespace will correspond either virtually (in the case of SOAP errors, it's probably different) or exactly (in the case of successful requests, even if the transaction itself is not successful) to the request/response name/value pairs documented for the Simple API.

Unlike its name may imply, the Simple API is in fact not simple to install. Difficult becomes Impossible if you have a 64-bit OS. CyberSource as of this module's writing has not seen fit to port either of their client APIs (SCMP or Simple) to a 64-bit version. However, because this is actually the SOAP clientless toolkit wrapped to impersonate Simple, you get to by-pass the pain you'd otherwise have to feel to install Simple into your environment.

What this means: do NOT install the Simple API! It will likely be a big pain and it is useless for the purposes of this module. You only need to ensure the modules/software indicated in PREREQUISITES are installed.

You can find the documentation for the Simple API at the following URL:

http://apps.cybersource.com/library/documentation/sbc/api_guide/html/

Again, do NOT install the Simple API; just use the docs as though it is already installed.

Options

merchant_id

ID obtained from CyberSource. Likely the same value you use to log in to the online merchant interface for your account.

transaction_key

Key generated from the CyberSource online merchant interface.

api_version

Which version of Simple to use. When setting up, just pick the current one, and updates are likely unneeded unless new features come out that you need.

You can see the full list of versions, and what features they each support (if you like reading XSD) here:

https://ics2ws.ic3.com/commerce/1.x/transactionProcessor/

The opt should be just the number, something like 1.44

live

Calls go to production environment when value is 'true' (as in, the string true, and not just perly true, to give those already familiar with the actual Simple API warm fuzzy feelings). Any other value (or no value) is assumed to go to the test environment.

xsd_cache_dir

Directory relative to catroot for caching the XSD files for each API version and from each environment (live or test). If not set, no caching will occur, but this is not recommended.

The module makes an initial request to CyberSource to get the XSD for whatever version of the API you're using, so that it knows what request values to look for and are valid. Ideally, you don't want every single request repeating this process.

If this option is set, the module will first look for the appropriate XSD associated with the correct version and environment in the cache dir. If it's not found, only then will it request the XSD from CyberSource. Once it's obtained from from CyberSource, it will cache it in the same location it initially looked, so all subsequent requests using the same API version in the same environment can use the cached XSD instead.

There should be no reason to expire the cache, but if you wish to you'll have to do so manually. There's no built-in expiration mechanism. Because a published API will be static, the only reason you would need to expire the cached version is if it somehow became corrupted.

Also, don't manually replace files in the cache. The XSD retrieved from CyberSource must be slightly tweaked to work with the XSD parsing module. That tweak is frozen into the cache. If you wish to refresh the cache, just remove the cache files and let the module itself pull down the correct version and cache it for you.

acct_type

The type of the account for the customer's payment instrument. Currently supported:

     * cc (standard credit card, the default)
     * bml (Bill Me Later)
     * pp (Paypal Express Checkout)
     * ec (Electronic Check)
 
 

transaction

Type of transaction to run.

acct_type cc or bml:

     * auth (or authorize, A)
     * settle (or capture, D)
     * sale (or S) - auth and settle in same request
     * credit (or C)
     * auth_reversal (or R) (not widely supported; use with caution)
     * void (or V)
 
 

For additional information on acct_type 'bml' transactions, see full Bill Me Later section below.

acct_type pp:

     * pp_set (Exp. checkout set service)
     * pp_get (Exp. checkout get service)
     * pp_dopmt (Exp. Checkout do payment)
     * pp_ord_setup (Exp. Checkout order setup)
     * pp_auth (auth service)
     * pp_bill (capture service)
     * pp_sale (auth and capture together)
     * pp_authrev (reverse auth)
     * pp_refund (refund service)
 
 

See Paypal section below for full details

acct_type ec:

     * ec_debit
     * ec_credit
 
 

See Electronic Check section below for full details

origid

Original transaction ID referenced for follow-on transactions. E.g., the requestID of an auth that is to be captured.

order_id or order_number

Passed over as merchantReferenceCode with request. Also very likely needed for any use of items_sub (see below).

apps

The list of allowable applications, space- or comma-separated, for this request. Added as a security measure to restrict use on any applications that aren't needed and might be a risk (such as credits if they'll never be issued through Interchange). All ics_* apps apply to cc and bml account types. pp_* and ec_* apply to account types pp and ec, respectively:

     * ics_auth (needed for auth, sale)
     * ics_auth_reversal (needed for auth_reversal)
     * ics_bill (needed for settle, sale)
     * ics_credit (needed for credit)
     * ics_void (needed for void)
     * pp_ec_set (needed for pp_set)
     * pp_ec_get (needed for pp_get)
     * pp_ec_dopmt (needed for pp_dopmt, pp_sale)
     * pp_ec_ord_setup (needed for pp_ord_setup)
     * pp_auth (needed for pp_auth)
     * pp_capture (needed for pp_bill, pp_sale)
     * pp_authrev (needed for pp_authrev)
     * pp_refund (needed for pp_refund)
     * ec_debit (needed for ec_debit)
     * ec_credit (needed for ec_credit)
 
 

It is recommended to exclude any apps you will not use from the list.

ship_map

List of mv_shipmode values to map to the various allowable values in shipTo_shippingMethod. List is optional and defaults to 'lowcost'.

The list should be in a form that is appropriate for perl's qw() to put the list into a hash. E.g.,:

     GNDRES  lowcost
     2DAY    twoday
     ...
 
 

List of possible CyberSource values:

     * sameday
     * oneday
     * twoday
     * threeday
     * lowcost
     * pickup
     * other
     * none
 
 

mv_credit_card_number

Unlike many (if not the rest) of the gateway modules, you can pass in the card number as an option. However, the code prefers the value from the traditional source from $CGI via the actual opt. This option will mostly be unneeded.

any Simple request keys

The code will take any of the Simple key names directly through $opt. However, it will prefer any defined values associated with actual() over $opt, which may not be what you expect.

items_sub

Custom subroutine that can be used to construct the order sent over to CyberSource. By default, module uses $Vend::Items. Routine will be essential for any processing of payments that are not directly associated with the immediate session. E.g., any payment interface developed for the admin to process transactions after the order already exists.

Routine should return an array that matches the basics of an Interchange cart. Most likely use would be to construct a cart out of an order already in the database, but as long as the routine returns a cart-style array, it doesn't matter how it's constructed.

Each line item needs the following attributes:

     * code
     * quantity
 
 

To determine cost, each line-item hash is passed to Vend::Data::item_price(). So, if your pricing demands more line-item attributes to calculate correctly, you'll need to ensure they are present.

Routine can be either a catalog or global sub, with the code preferring the catalog sub. Args:

     * Reference to copy of request hash
     * $opt
 
 

check_sub

Post-reply routine that can be used to alter the status and/or response hash returned from cybersource(). Examples of usage:

•

Auth succeeds, but we want it treat as a failure because of AVS response.

•

Auth fails, but error is a communication failure, so we want to treat it as success and follow up manually with customer to resolve.

•

Decision Manager result raises concerns, so we add a response parameter that indicates the order should not be fulfilled automatically, but rather funnel to a queue for manual review.

Routine should return 'success' or 'failed' if it is to be authoritative as to that determination. Otherwise, it should return undef and let the code calculate 'success' or 'failed' based on the value of the 'decision' key in the response hash.
It can be either a catalog or global sub, with the code preferring the catalog sub. Args:

     * Reference to response hash (so it can be modified directly)
     * Reference to a copy of the request hash
     * $opt
 
 

ip_address

IP to supply to CyberSource for the transaction. Optional and defaults to $Session->{shost} if defined, or $Session->{ohost} otherwise.

shipping

Amount to supply CyberSource for shipping costs. Defaults to [shipping].

amount

Amount to supply to CyberSource to apply to the transaction.

Note that this value supersedes all the costs provided along with the order and shipping amounts. They do not have to agree. Supplying amount means CyberSource will use that specific amount. If amount is not supplied, I believe that CyberSource will construct a transaction amount from the sum of the order and shipping, but I do not recommend this.

By default, amount will be derived from [total-cost].

timeout

Number of seconds for a request without a response before the process is killed.

merrmsg, merrmsg_bml

Override the default error messages presented to users in the event of a failed transaction attempt, for acct_type cc and bml, respectively. merrmsg will run through sprintf() and can have the reason code and reason message, in that order, embedded in message with the use of %s as a placeholder. merrmsg_bml has no such provision because the errors that come back from Paymentech for BML failures range between cryptic and useless.

The following options are valid for Paypal usage only:

returnurl

URL to which the customer's browser is returned after choosing to pay with PayPal.

cancelurl

URL to which customers are returned if they do not approve the use of PayPal for payment.

maxamount

Expected maximum total amount of the entire order, including shipping costs and tax charges.

order_desc

Description of items the customer is purchasing.

confirmshipping

Flag that indicates if you require the customer's shipping address on file with PayPal to be a confirmed address. 0 (default) not confirmed, 1 confirmed.

noshipping

Flag that indicates if the shipping address should be displayed on the PayPal Web pages. 0 (default) show shipping, 1 suppress shipping display.

addressoverride

Customer-supplied address sent in the SetExpressCheckout request rather than the address on file with PayPal for this customer.

You can use this field only with the payment method, not with the shortcut method. See Overview of PayPal Express Checkout for a description of the PayPal methods.

Possible values:

0 (default): Display the address on file with PayPal. The customer cannot edit this address.

1: Display the customer-supplied address. The customer can edit this in PayPal Express Checkout.

locale

Locale of pages displayed by PayPal during Express Checkout.

headerbackcolor

Background color for the header of the payment page. Format: HTML Hexadecimal color.

headerbordercolor

Border color around the header of the payment page. Format: HTML Hexadecimal color.

headerimg

URL for the image that will be displayed in the upper left area of the payment page.

payflowcolor

Background color for the payment page. Format: HTML Hexadecimal color.

pp_token

Timestamped token by which you identify to PayPal that you are processing this payment with Express Checkout. Corresponds with paypalToken description in CyberSource docs. Normally not needed as module will handle internally for most typical scenarios.

pp_payer_id

Unique PayPal customer account identification number that was returned in the payPalEcGetDetailsService reply message. Corresponds with paypalPayerId description in CyberSource docs. Normally not needed as module will handle internally for most typical scenarios.

return_ec_set

Boolean to indicate that an EC set call is to be issued as a return call; that is, a call to amend the user's Paypal data returned in a subsequent EC get call on the same session established by an initial EC set call.

The same can be accomplished by calling EC set while explicitly supplying the paypal token and CyberSource request ID and token of the original call to EC set establishing that session.

transaction_id

For use in captures, refunds, and auth reversals. Maps to the paypal-specific transaction ID of the original request, and not the RequestID, which is the CyberSource transaction ID.

Specifically, it should relate in the following manner:
    Maps to Service Param                               Obtained From
    payPalDoCaptureService_paypalAuthorizationId        payPalEcDoPaymentReply_transactionId
    payPalAuthReversalService_paypalAuthorizationId     payPalAuthorizationReply_transactionId
    payPalRefundService_paypalCaptureId                 payPalDoCaptureReply_transactionId

Bill Me Later

This module provides full support for Bill Me Later (BML) transactions. Some important notes on using BML with this module:

See CyberSource's full BML documentation for details:

http://apps.cybersource.com/library/documentation/dev_guides/CC_Svcs_IG_BML_Supplement/html/

•

You'll want to add in the extra fields collected for BML. Suggested process is to use the remap feature in Vend::Payment::charge(). Thus, add to your route:

     Route foo remap <<EOV
         bml_customer_registration_date bml_customer_registration_date
         bml_customer_type_flag bml_customer_type_flag
         bml_item_category bml_item_category
         bml_product_delivery_type_indicator bml_product_delivery_type_indicator
         bml_tc_version bml_tc_version
         customer_ssn customer_ssn
         date_of_birth date_of_birth
         b_phone b_phone
     EOV
 
 

This will allow those fields to be used directly from your form and be picked up by map_actual() for you. The names listed above correspond with the values as managed through SCMP. You can just as easily use, instead, those documented with Simple.

•

Set acct_type option to 'bml'.

•

On a failed BML attempt, the module sets [value suppress_bml] to 1. It's recommended you use this session setting to disable the BML option so as to encourage your customers to try to complete their order with a credit card. Chances are extremely remote that a subsequent BML attempt will succeed after a failure. However, this is not a BML requirement; you may choose to let customers try again and again to check out with BML.

•

On a successful BML authorization, you can find the customer's BML account number (which looks like a credit card starting with the digits 5049) in $Session->{payment_result}{ccAuthReply_bmlAccountNumber}. Using this account number for repeat customers will speed up the authorization process, but it is not required. Without it, your BML customers will have to re-enter their last-four SSN and DOB each time.

Note that BML does not consider this account number sensitive. It can be freely stored unencrypted in the customer's user record.

Paypal

This module also fully implements CyberSource's integration for Express Checkout services. Note that CyberSource doesn't appear to support all Paypal services, so depending on your needs (e.g., Mass Pay), you may need another option. However, for typical Express Checkout usage, it is fully supported.

See CyberSource's full Paypal documentation for details:

http://apps.cybersource.com/library/documentation/dev_guides/PayPal_Express_IG/html/

•

Set acct_type option to 'pp'

•

Module is set up to handle most standard cases with minimal demand on the developer. Paypal requires toting around the paypal session ID and, in the case of dopayment, the payer ID. Further, CyberSource requires that the request ID and token from the EC set be passed back on each subsequent request associated with the same paypal session. Finally, using address override needs to be tracked between a set call and subsequent get call. The module will track these values in the user's IC session and most likely ``do the right thing''. You can, however, override any of these explicitly if you have the need or wish to control it explicitly.

•

The reply fields are stripped down to their canonical values for convenience. Many times, the same param merely differs in its reply field based on the application under which it was processed. E.g., the ``amount'' returned will come back in one of the following forms:

     payPalEcSetReply_amount
     payPalEcDoPaymentReply_amount
     payPalEcOrderSetupReply_amount
     payPalAuthorizationReply_amount
     payPalDoCaptureReply_amount
 
 

Any of these will be stripped down to just ``amount'' in the payment_result hash, but the fully qualified parameter is left in place, too, if needed.

•

It is recommended that you utilize check_sub in conjunction with an EC get request for migrating response values from Paypal into the Interchange session. The following is a sample sub that works in conjunction with a typical configuration based off the standard demo:

     Sub load_values <<EOS
     sub {
         my ($resp, $req, $opt) = @_;
 
         return unless $resp->{decision} eq 'ACCEPT';
 
         my $b_pre = $Values->{pp_use_billing_address}
             ? 'b_'
             : ''
         ;
 
         $Values->{$b_pre . 'phone_day'}     = $resp->{payerPhone};
 
         $Values->{email}            = $resp->{payer};
         $Values->{payerid}          = $resp->{PayerId};
         $Values->{payerstatus}      = $resp->{payerStatus};
         $Values->{payerbusiness}    = $resp->{payerBusiness};
         $Values->{salutation}       = $resp->{payerSalutation};
         $Values->{mname}            = $resp->{payerMiddlename};
         $Values->{suffix}           = $resp->{payerSuffix};
         $Values->{address_status}   = $resp->{addressStatus};
         $Values->{countryname}      = $resp->{countryName};
 
         unless ($Session->{paypal_override}) {
             $Values->{$b_pre . 'fname'}     = $resp->{payerFirstname};
             $Values->{$b_pre . 'lname'}     = $resp->{payerLastname};
             $Values->{$b_pre . 'address1'}  = $resp->{shipToAddress1};
             $Values->{$b_pre . 'address2'}  = $resp->{shipToAddress2};
             $Values->{$b_pre . 'city'}      = $resp->{shipToCity};
             $Values->{$b_pre . 'state'}     = $resp->{shipToState};
             $Values->{$b_pre . 'zip'}       = $resp->{shipToZip};
             $Values->{$b_pre . 'country'}   = $resp->{shipToCountry};
         }
 
         return;
     }
     EOS
 
 

•

When making an EC set call through [charge], the module will return the appropriate URL to which to redirect the user's browser rather than the typical value of the transaction ID. Thus, when running an EC set, it is appropriate to capture and test the return value from [charge] to determine both if the request was successful and, if so, where to direct the user.

Example mv_click code:

     [button
         text="Checkout with Paypal"
         form=basket
     ]   
         [tmp redirect][charge route=paypal_set][/tmp]
         [if scratch redirect]
             [bounce href="[scratch redirect]"]
         [/if]
     [/button]
 
 

Electronic Checks

This module fully implements CyberSource's electronic check support. See documentation for full details:

http://apps.cybersource.com/library/documentation/dev_guides/Electronic_Checks_IG/html/

•

Set acct_type option to 'ec'

•

Includes mappings to use the standard demo's default check payment option.

Troubleshooting

Try the instructions above in test mode (live set to anything but string 'true'). A test order should complete.

Switch to production mode, then try an auth or sale with the card number "4111 1111 1111 1111" and a valid expiration date. The transaction should be denied, and the reason should be in [data session payment_error].

If nothing works:

•

Make sure you ``Require''d the module in interchange.cfg:

     Require module Vend::Payment::CyberSource
 
 

•

Make sure all the modules/applications listed in PREREQUISITES are installed and working. You can test to see whether your Perl thinks they are:

     perl -MSOAP::Lite \
     -MXML::Pastor::Schema::Parser \
     -MLWP::Simple \
     -e 'print "It works\n"'
 
 

If it prints ``It works.'' and returns to the prompt you should be OK (presuming they are in working order otherwise).

•

Check the error logs, both catalog and global. Also set debugging on in "interchange.cfg" and check the debug log!

•

Make sure you set your payment parameters properly, and of course you used a payment route, right?

•

Try an order, then put this code in a page:

     <XMP>
     [calc]
         my $string = $Tag->uneval( { ref => $Session->{payment_result} });
         $string =~ s/{/{\n/;
         $string =~ s/,/,\n/g;
         return $string;
     [/calc]
     </XMP>
 
 

That should show what happened.

•

If all else fails, consultants are available to help with integration for a fee. See http://www.icdevgroup.org/ for mailing lists and other information.

BUGS

Naturally none. OK, at least none known. Be sure to post any found to the IC user list or you can send them to the author directly.

AUTHOR

Mark Johnson <mark@endpoint.com> (Based primarily off of Vend::Payment::ICS by Sonny Cook <sonny@endpoint.com>)