# LCDH × YabandPay — Shopify online payment bridge

Lets La Casa del Habano Brussels accept **Alipay / WeChat Pay online** through YabandPay,
even though Shopify Payments is unavailable (tobacco merchant). It turns the current
"order → staff sends a QR by hand" flow into an **instant, self-service** payment.

> Goal: fix the China/HK checkout drop-off (672 reached checkout → 33 paid).
> The signature algorithm is **verified** against YabandPay's own doc example
> (`npm run test:sign` → PASS).

## How it works
1. Customer checks out on Shopify and picks the manual method **"WeChat Pay / Alipay"** → order created *pending*.
2. Shopify fires `orders/create` → this middleware creates a YabandPay payment and emails the customer a **Pay now** link (`/pay/:orderId`), which shows a **WeChat QR** (or redirects to **Alipay+**).
3. Customer pays → YabandPay calls `/yaband/notify` → middleware verifies the signature and **marks the Shopify order paid**.

## Setup
1. `npm install`
2. `cp .env.example .env` and fill it in (start with the **sandbox** YabandPay creds already in the example).
3. **Shopify → Settings → Payments → Manual payment methods** → add one named exactly `WeChat Pay / Alipay` (must match `MANUAL_GATEWAY_NAME`).
4. **Shopify custom app** (Settings → Apps → Develop apps): scopes `read_orders`, `write_orders`; install; copy the **Admin API token** → `SHOPIFY_ADMIN_TOKEN`; copy the **API secret** for webhook verification → `SHOPIFY_WEBHOOK_SECRET`.
5. Create a webhook `orders/create` (JSON) pointing to `https://<your-host>/shopify/order-created`.
6. Deploy this app on a public HTTPS host (OVH VPS, Fly, Render…) and set `PUBLIC_URL`.
7. `npm start`.

## Test in sandbox
- `npm run test:sign` → must print `sign selftest: PASS`.
- Place a test order using the manual method; confirm the `/pay/:id` QR appears and that a sandbox payment flips the order to **Paid**.

## Production checklist
- Swap sandbox `YABAND_USER/SECRET` for your **live** YabandPay merchant creds.
- Replace the in-memory `PAYMENTS` map with a small DB (orders survive restarts).
- Add refund handling (YabandPay refund endpoints) if you process refunds from Shopify.
- Confirm with YabandPay that **EUR** Alipay/WeChat online is enabled on your live account.

## Notes / caveats
- Showing the QR directly on Shopify's Thank-You page depends on checkout extensibility; the **email link** path here works regardless.
- This is a reference implementation — review security (rate-limit `/pay`, secrets handling) before going live.