AlliedPay_API.i

<?php
/*
 * 08-19 Copyright HomeCU LLC
 * SSO API to Allied Payments
 * Some documentation:
 * https://docs.alliedpayment.com
 * Critical to connection is a valid routing number, even a fake one
 * https://developer.wepay.com/docs/articles/testing
 *
 */

/**
 * @param array $parms by ref
 * @throws Exception
 */
function apn_config(&$parms) {

  $parms['devMode'] = (! HCU_array_key_value('devMode', $parms) ? 0 : HCU_array_key_value('devMode', $parms));
  if ($parms['devMode']) {
    // External Services / User Management
    $parms['apnDomain'] = HCU_array_key_value('devDomain', $parms);
    // HomeCU login
    $parms['apnPubkey'] = HCU_array_key_value('devPubkey', $parms);
    // HomeCU password
    $parms['apnPrivkey'] = HCU_array_key_value('devPrivkey', $parms);
    // Mobile Services / Deposits & History
    $parms['apnURL'] = HCU_array_key_value('devURL', $parms);

  } else {
    // External Services / User Management
    $parms['apnDomain'] = HCU_array_key_value('prdDomain', $parms);
    // HomeCU login
    $parms['apnPubkey'] = HCU_array_key_value('prdPubkey', $parms);
    // HomeCU password
    $parms['apnPrivkey'] = HCU_array_key_value('prdPrivkey', $parms);
    // Mobile Services / Deposits & History
    $parms['apnURL'] = HCU_array_key_value('prdURL', $parms);
  }

  if (
    empty($parms['apnDomain']) ||
    empty($parms['apnPubkey']) ||
    empty($parms['apnPrivkey']) ||
    empty($parms['apnURL'])
  ) {
    throw new Exception("Missing Parameters", 100);
  }
}

/**
 * @param string $apnDomain
 * @param string $mbrAccount
 * @param array $mir
 * @param array $accounts
 * @return array
 */
function apn_buildSSOPayload($apnDomain, $mbrAccount, $mir, $accounts) {

  try {
    $return['status']['response'] = true;
    $return['status']['message'] = 'Success';
    $req_arr = [
      'Application' => 'BILLPAY',
      'UserName' => $mbrAccount,
      'FinancialInstitutionId' => $apnDomain
    ];

    if ($mir['class'] == 'B') {
      $req_arr['PrimaryCompanyName'] = $mir['lastname'];

    } else {
      $req_arr['FirstName'] = $mir['firstname'];
      $req_arr['LastName'] = $mir['lastname'];
    }

    $req_arr['Email']     = $mir['email'];
    $req_arr['Accounts']  = [];
    $req_arr['Address1']  = $mir['address1'];
    $req_arr['City']      = $mir['city'];
    $req_arr['State']     = $mir['state'];
    $req_arr['Zip']       = $mir['zip'];

    if (HCU_array_key_exists('phonenumbers',$mir)) {
      $req_arr['PhoneNumbers'] = $mir['phonenumbers'];
    }

    $mirtype = (HCU_array_key_value('class', $mir) == 'B') ? 'Business' : 'Personal';

    if (!is_array($accounts) || !count($accounts)) {
      throw new Exception('No Eligible Payment Accounts Found');
    }

    // Was an else here - if you throw and exception you never get to the else
    foreach ($accounts as $acctID => $account) {

      // insert $account info into $req_arr['Accounts'] array
      // 08-19 Not sure why this was commented out so leaving it as is
      // $account['AccountCIF'] = $mbrAccount;

      $a = [
        'AccountNumber' => $account['AccountNumber'],
        'AccountName' => $account['AccountName'],
        // force treat as numeric
        'AvailableAccountBalance' => $account['AvailableAccountBalance'] * 1,
        'RoutingNumber' => $account['RoutingNumber'],
        'AccountOwnerType' => $mirtype,
        'AccountType' => $account['AccountType']
      ];

      $account['AccountOwnerType'] = $mirtype;
      // '$values' <- This is the key required by Allied. It is not an error.
      $req_arr['Accounts']['$values'][] = $a;
    }

    $return['data'] = json_encode($req_arr);

  } catch (Exception $e) {
    $return['status']['response'] = false;
    $return['status']['message'] = $e->getMessage() . " (" . $e->getLine() . ")";
    $return['data'] = [];
  }

  return $return;
}

/**
 * Use $parms configuration settings to build list of accounts
 * @param resource object $dbh
 * @param string $Cu
 * @param string $Cn
 * @param array $parms
 * @return array
 */
function apn_selectAccounts($dbh, $Cu, $Cn, $parms) {

  try {
    $return['status']['response'] = true;
    $return['status']['message'] = "Success";
    // list of accounts goes here
    $return['data'] = [];

    if (!HCU_array_key_value('rtn', $parms)) {
      throw new Exception('Missing Routing Number');
    }

    // In other SSO's we have made MICR optional, here it is confirmed as required for Allied
    $rtn = HCU_array_key_value('rtn', $parms);
    $acctsql = (HCU_array_key_value('acctsql', $parms) ? $parms['acctsql'] : "trim(micraccount)");
    $balwhere = (HCU_array_key_value('balwhere', $parms) ? $parms['balwhere'] : "and deposittype = 'Y' and trim(micraccount) <> ''");
    $sendjoint = (HCU_array_key_value('sendjoint', $parms) ? $parms['sendjoint'] : 0);

    $sql = "select {$acctsql} as account, trim(description) as name, available,
            case when deposittype = 'Y' then 'checking' else 'savings' end as atype
            from {$Cu}accountbalance where accountnumber='$Cn'
            and deposittype in ('Y','S','N') $balwhere";

    if (!$sendjoint) {
      $sql .= " and accounttype not like '%@%' ";
    }
    $sql .= " order by accounttype;";

    $sth = db_query($sql, $dbh);

    if (! ($sth) || (db_num_rows($sth) == 0)) {
      throw new Exception('No Eligible Payment Accounts Found');
    }

    for ($row = 0; $drow = db_fetch_array($sth, $row); $row++) {

      $return['data'][] = [
        'AccountNumber' => HCU_array_key_value('account', $drow),
        'AccountName' => HCU_array_key_value('name', $drow),
        'AvailableAccountBalance' => HCU_array_key_value('available', $drow),
        'RoutingNumber' => $rtn,
        'AccountType' => HCU_array_key_value('atype', $drow)
      ];
    }

  } catch (Exception $e) {
    $return['status']['response'] = false;
    $return['status']['message'] = $e->getMessage() . " (" . $e->getLine() . ")";
    $return['data'] = [];
  }

  return $return;
}

/**
 * @param string $apnURL
 * @param string $apnDomain
 * @param string $apnPubkey
 * @param string $apnPrivkey
 * @param $mbrAccount
 * @return array
 */
function apn_buildAuthHdr($apnURL, $apnDomain, $apnPubkey, $apnPrivkey, $mbrAccount) {

  try {
    $return['status']['response'] = true;
    $return['status']['message'] = 'Success';

    if (empty($apnURL) || empty($apnDomain) || empty($apnPubkey) || empty($apnPrivkey) || empty($mbrAccount)) {
      throw new Exception('Missing Parameters');
    }

    $authdate = apn_timestamp();
    $sigstring = "{$apnURL}\r\n{$authdate}\r\n";
    $signature = hash_hmac('SHA1', $sigstring, $apnPrivkey, TRUE);
    $signature = base64_encode($signature);
    $authstring = "Authorization: TIMESTAMP username={$mbrAccount};domain={$apnDomain};"
                  . "timestamp={$authdate};signature={$signature};publicKey={$apnPubkey}";
    $return['data'] = $authstring;

  } catch (Exception $e) {
    $return['status']['response'] = false;
    $return['status']['message'] = $e->getMessage() . " (" . $e->getLine() . ")";
    $return['data'] = [];
  }

  return $return;
}

/**
 * php date always gives 000000 for microtime - nd 'c' format gets +00:00 for GMT dates.
 * Looking for format as 2018-08-02T20:05:43.273Z so we improvise to insert the microseconds.
 * @return string
 */
function apn_timestamp() {

    $t = microtime(true);
    $t = substr($t, strpos($t, '.'), 4);
    $d = gmdate('c');
    $d = str_replace('+00:00', "{$t}Z", $d);
    return $d;
}

/**
 * Curl the response from Allied.
 * @param array $parms
 * @param string $reqURL
 * @param string $reqMethod
 * @param array $reqHeaders
 * @param string $reqData JSON
 * @return array
 */
function apn_embcurl($parms, $reqURL, $reqMethod, $reqHeaders, $reqData = '') {

  $curlopts = [
    CURLOPT_RETURNTRANSFER => 1,
    CURLOPT_SSL_VERIFYPEER => 0,
    CURLOPT_SSL_VERIFYHOST => 0,
    CURLOPT_HEADER => FALSE,
    CURLOPT_URL => $reqURL
  ];

  $ch = curl_init();
  curl_setopt_array($ch, $curlopts);

  if ($reqMethod != 'GET') {
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $reqMethod);
  }
  if (strlen($reqData) > 0) {
    curl_setopt($ch, CURLOPT_POSTFIELDS, $reqData);
  }

  curl_setopt($ch, CURLOPT_HTTPHEADER, $reqHeaders);
  $response = curl_exec($ch);

  if ($parms["logging"] == "enabled") {
    $log = [
      'env'       => ($parms['environment']) ?? 'No Environment in params',
      'ch'        => print_r($ch, true),
      'headers'   => $reqHeaders,
      'method'    => $reqMethod,
      'data'      => $reqData,
      'url'       => $reqURL,
      'response'  => $response,
      'curlinfo'  => print_r(curl_getinfo($ch),true)
    ];
    LogSSOActivity(AlliedLogParams($log));
  }

  $respHTTP = curl_getinfo($ch, CURLINFO_HTTP_CODE);

  if ($respHTTP >= 400 && $respHTTP < 600) {
    // HTTP Response 4xx client error or 5xx server error
    $respArr = [
      "error" => [
        "status" => "hcuH" . $respHTTP,
        "message" => "Connection Failed HTTP Error"
      ]
    ];
  } elseif (curl_errno($ch)) {
    $respArr =[
      "error" =>[
        "status" => "hcuC" . curl_errno($ch),
        "message" => "Curl Error"
      ]
    ];
  } elseif (!isset($response) || $response == '') {
    $respArr = [
      "error" => [
        "status" => "hcuE" . curl_errno($ch),
        "message" => "Empty Response"
      ]
    ];
  } else {
    $respArr = json_decode($response, TRUE);
  }

  curl_close($ch);

  return $respArr;
}

/**
 * Helper for apn_embcurl, when there are too many params pass the param as an array.
 * @param array $log_params
 * @return array
 */
function AlliedLogParams($log_params) {

    // get the environment info passed in
    $logParms = $log_params['env'];
    // the id used across all communications in session
    $logParms["token"] = '';
    // setting logPoint here makes all the log entries look alike
    // not very helpful for support when vendor uses multiple calls.
    // set logPoint before curl call, allow clarity for possibly multiple calls
    // $logParms["logPoint"] = "ALLIED SSO apn_embcurl";
    // the id for this transaction
    $logParms["txnId"] = time();
    // the request
    $logParms["request"] = "curl ";

    if ($log_params['method'] != 'GET') {
      $logParms["request"] .= "-X {$log_params['method']} ";
    }

    if (is_array($log_params['headers'])) {
      foreach ($log_params['headers'] as $hdr) {
        $logParms['request'] .= "-H '$hdr' ";
      }
    }

    // the request
    if (strlen($log_params['data']) > 0) {
      $logParms['request'] .= "-d '{$log_params['data']}' ";
    }
    // Request URL
    $logParms['request'] .= "'{$log_params['url']}' ";
    $logParms["reply"] = $log_params['curlinfo'];
    $logParms["reply"] .= "\n{$log_params['response']}";

    return $logParms;
}

/**
 * Populate MIR data, some special keys used so can't use populateMIR()
 * @param array $MIR mir packet info from core or local load
 * @param string $Ml homebanking email to use if mir.email is empty
 * @param array $reqMIR required items can't be empty in mir
 * @param string $datefmt format to use for DOB
 * @param string $phones 'flat' or 'split'
 *  'flat' = fill ['PHONE'] with first non-null of HomePhone, CellPhone, WorkPhone
 *  'split' = split each phone # into sub-array of optional [Area], required [Pre] & [Num]
 *  'named' = array of number (string), name (string), and isTextCapable (boolean).
 *                  note that we don't know isTextCapable so it will be false
 *                  08/19: per the code below, true for cell false for other phones
 * @param boolean $noEmpty  unset empty mir values
 * @return array
 * @throws Exception
 */
function apn_populateMIR($MIR, $Ml, $reqMIR, $datefmt = 'Y-m-d', $phones = 'flat', $noEmpty = false) {

  try {
    /* strip slashes and dashes and non-digits from phone numbers
     * and zip code and tax id; rearrange DOB into mmddyyyy
     * then check to see if we have enough valid data to
     * satisfy the request
     */
    if ($phones == 'flat') {

      $MIR['data']['phone'] = preg_replace('/\D/', '', $MIR['data']['homephone']);
      if (trim($MIR['data']['phone']) == '') {
        $MIR['data']['phone'] = preg_replace('/\D/', '', $MIR['data']['cellphone']);
      }
      if (trim($MIR['data']['phone']) == '') {
        $MIR['data']['phone'] = preg_replace('/\D/', '', $MIR['data']['workphone']);
      }

    } elseif ($phones == 'split') {

      $MIR['data']['homephone'] = preg_replace('/\D/', '', $MIR['data']['homephone']);
      switch (strlen($MIR['data']['homephone'])) {
        case 10:
          $MIR['data']['homephone'] = [
            'area' => substr($MIR['data']['homephone'], 0, 3),
            'pre' => substr($MIR['data']['homephone'], 3, 3),
            'num' => substr($MIR['data']['homephone'], 6, 4)
          ];
          break;
        case 7:
          $MIR['data']['homephone'] = [
           'pre' => substr($MIR['data']['homephone'], 3, 3),
           'num' => substr($MIR['data']['homephone'], 6, 4)
          ];
          break;
        default:
          unset($MIR['data']['homephone']);
          break;
      }

      $MIR['data']['cellphone'] = preg_replace('/\D/', '', $MIR['data']['cellphone']);

      switch (strlen($MIR['data']['cellphone'])) {
        case 10:
          $MIR['data']['cellphone'] = [
            'area' => substr($MIR['data']['cellphone'], 0, 3),
            'pre' => substr($MIR['data']['cellphone'], 3, 3),
            'num' => substr($MIR['data']['cellphone'], 6, 4)
          ];
          break;
        case 7:
          $MIR['data']['cellphone'] = [
            'pre' => substr($MIR['data']['cellphone'], 3, 3),
            'num' => substr($MIR['data']['cellphone'], 6, 4)
          ];
          break;
        default:
          unset($MIR['data']['cellphone']);
          break;
      }

      $MIR['data']['workphone'] = preg_replace('/\D/', '', $MIR['data']['workphone']);

      switch (strlen($MIR['data']['workphone'])) {
        case 10:
          $MIR['data']['workphone'] = [
            'area' => substr($MIR['data']['workphone'], 0, 3),
            'pre' => substr($MIR['data']['workphone'], 3, 3),
            'num' => substr($MIR['data']['workphone'], 6, 4)
          ];
          break;
        case 7:
          $MIR['data']['workphone'] = [
            'pre' => substr($MIR['data']['workphone'], 3, 3),
            'num' => substr($MIR['data']['workphone'], 6, 4)
          ];
          break;
        default:
          unset($MIR['data']['workphone']);
          break;
      }

    } elseif ($phones == 'named') {

      $MIR['data']['phonenumbers'] = [];
      $MIR['data']['homephone'] = preg_replace('/\D/', '', $MIR['data']['homephone']);

      switch (strlen($MIR['data']['homephone'])) {
        case 10:
        case 7:
          $MIR['data']['phonenumbers'][] = [
            'number' => $MIR['data']['homephone'],
            'name' => 'Home',
            'isTextCapable' => FALSE
          ];
          break;
        default:
          unset($MIR['data']['homephone']);
          break;
      }

      $MIR['data']['cellphone'] = preg_replace('/\D/', '', $MIR['data']['cellphone']);

      switch (strlen($MIR['data']['cellphone'])) {
        case 10:
        case 7:
          // assume cell phone would be text capable
          $MIR['data']['phonenumbers'][] = [
            'number' => $MIR['data']['cellphone'],
            'name' => 'Cell',
            'isTextCapable' => TRUE
          ];
          break;
        default:
          unset($MIR['data']['cellphone']);
          break;
      }

      $MIR['data']['workphone'] = preg_replace('/\D/', '', $MIR['data']['workphone']);

      switch (strlen($MIR['data']['workphone'])) {
        case 10:
        case 7:
          $MIR['data']['phonenumbers'][] = [
            'number' => $MIR['data']['workphone'],
            'name' => 'Work',
            'isTextCapable' => FALSE
          ];
          break;
        default:
          unset($MIR['data']['workphone']);
          break;
      }

      if (!count($MIR['data']['phonenumbers'])) {
        unset($MIR['data']['phonenumbers']);
      }
    // End named
    }

    $MIR['data']['dob'] = format_date($MIR['data']['dob'], $datefmt);

    $rmlist = [' ', '-'];
    $MIR['data']['ssn'] = str_replace($rmlist, '', $MIR['data']['ssn']);
    $MIR['data']['zip'] = str_replace($rmlist, '', $MIR['data']['zip']);

    if (strlen($MIR['data']['zip']) < 5) {
      unset($MIR['data']['zip']);
    }

    $rmlist = ["#", "&", "/", "%", ",", ":", "=", "?", "'"];

    $EMAIL = (empty($MIR['data']['email']) ? $Ml : $MIR['data']['email']);
    $MIR['data']['email'] = str_replace($rmlist, "", $EMAIL);
    $MIR['data']['firstname'] = str_replace($rmlist, "", $MIR['data']['firstname']);
    $MIR['data']['middlename'] = str_replace($rmlist, "", $MIR['data']['middlename']);
    $MIR['data']['lastname'] = str_replace($rmlist, "", $MIR['data']['lastname']);
    $MIR['data']['address1'] = str_replace($rmlist, "", $MIR['data']['address1']);
    $MIR['data']['address2'] = str_replace($rmlist, "", $MIR['data']['address2']);
    $MIR['data']['city'] = str_replace($rmlist, "", $MIR['data']['city']);
    $MIR['data']['state'] = str_replace($rmlist, "", $MIR['data']['state']);
    $MIR['data']['accountnumber'] = str_replace($rmlist, "", $MIR['data']['accountnumber']);
    # default country code to US.  Assume CU will specify for other countries
    if (trim($MIR['data']['cc']) == '') {
        $MIR['data']['cc'] = 'US';
    }

    // if firstname is missing but lastname is present, treat as a business account
    if (! HCU_array_key_value('firstname', $MIR['data']) && HCU_array_key_value('lastname', $MIR['data'])) {
      $MIR['data']['class'] = 'B';
      // clear firstname from the 'required values' list
      unset($reqMIR['firstname']);
    }

    if ($noEmpty) {
      // D.R.Y. some of the redundant code
      $keys = [
        'email',
        'firstname',
        'middlename',
        'lastname',
        'address1',
        'address2',
        'city',
        'state',
        'accountnumber',
        'dob',
        'zip'
      ];

      foreach ($keys as $field) {
        if (trim($MIR['data'][$field]) == false) {
          unset($MIR['data'][$field]);
        }
      }
    }

    $missing = array_diff_key($reqMIR, $MIR['data']);
    if (sizeof($missing)) {
      throw new Exception("Incomplete Member Info (" . join(", ", array_keys($missing)) . ")");
    }

    $return['status']['response'] = true;
    $return['status']['message'] = 'Success';
    $return['data'] = $MIR['data'];

  } catch (Exception $e) {
    $return['status']['response'] = false;
    $return['status']['message'] = $e->getMessage();
    // $return['status']['message'] = "(" . $e->getline() . ") " . $e->getMessage();
    $return['data'] = [];
  }

  return $return;
}