[nb-camelot]

Fixes #3

Change

NexiProvider.handle_redirect (awesome_python_checkout/providers/nexi.py) now requires the outcome MAC and compares it in constant time:

• missing or empty mac → status="failed", payment_id=codTrans, raw={"error": "MAC missing"};
• wrong mac → status="failed", raw={"error": "MAC verification failed"};
• the check is hmac.compare_digest(received.lower().encode(), expected.encode()). It compares bytes, so a non-ASCII mac fails cleanly instead of raising TypeError. nexi.py has no != on MAC values left.
• esito is read only after the MAC checks.

CheckoutConfigurator.handle_redirect is unchanged; it now emits payment.failed for these outcomes, never payment.completed.

Compatibility: esito=OK without a valid MAC goes from completed to failed. Non-OK outcomes stay failed; only raw changes. Whether every genuine Nexi return, including url_back, carries mac still has to be confirmed against the Nexi XPay documentation, as the issue notes.

Tests (per acceptance criteria)

• tests/test_providers.py, all using a MAC built with hashlib through the new _nexi_signed_outcome helper:
  • test_nexi_handle_redirect_missing_mac_rejected and test_nexi_handle_redirect_empty_mac_rejected: failed, payment_id == "ORD-1", raw == {"error": "MAC missing"}.
  • test_nexi_handle_redirect_non_ascii_mac_rejected: a 40-char "é" MAC gives MAC verification failed, with no exception.
  • test_nexi_handle_redirect_uppercase_mac_accepted: an uppercase hex MAC with esito=OK gives completed.
  • test_nexi_handle_redirect_failed_esito now sends a valid MAC, so it covers the esito path. It asserts failed, payment_id and raw["esito"] == "KO".
  • test_nexi_handle_redirect_bad_mac also asserts raw == {"error": "MAC verification failed"}.
• tests/test_configurator.py: test_handle_redirect_nexi_missing_mac_fires_failed_event uses a real NexiProvider. It asserts no payment.completed and exactly one payment.failed with {"provider": "nexi", "error": {"error": "MAC missing"}}.

Docs and release

• README ### NexiConfig: the redirect MAC is required and checked in constant time.
• CHANGELOG ## [0.1.1] - 2026-09-29, ### Security.
• pyproject.toml version is 0.1.1. PyPI publishing (publish.yml) runs when a GitHub release is published, so merging alone publishes nothing.

Mirror on awesome-node-checkout

The criteria ask for a mirror issue. It isn't needed: NexiProvider.executePayment on node-checkout main (aae0277, 1.3.0) already rejects a missing MAC (if (!mac) → 'MAC missing', src/providers/nexi/nexi.provider.ts:189) and uses crypto.timingSafeEqual.

Out of scope

The response-MAC field list differs between the ports: 7 fields in _compute_response_mac here, 4 in Node. Which one Nexi uses has to be confirmed on the Nexi XPay documentation, so it is left unchanged.

Commands run (Python 3.11 venv, pip install -e ".[dev]")

• Baseline on main: 43 passed, 1 warning.
• After the change: python -m pytest tests/ -q gives 48 passed, 1 warning. The warning is the pre-existing Starlette httpx deprecation from fastapi.testclient.
• Red check with awesome_python_checkout/ from main and the new tests kept: 3 failed, 45 passed. The failing tests are missing_mac, empty_mac and the configurator event test.
• python -m build: Successfully built awesome_python_checkout-0.1.1.tar.gz and awesome_python_checkout-0.1.1-py3-none-any.whl.
• CI also runs Python 3.12, which I did not run locally.

🤖 Generated with Claude Code