Intégration du Paiement en Ligne CMI au Maroc : Le Guide Développeur Complet (2026)

# Configuration Passerelle CMI Maroc
CMI_CLIENT_ID=600001234
CMI_STORE_KEY=votreCleSecreteFournieParLeCMI123456
NODE_ENV=development # Basculer en 'production' pour les vrais paiements
NEXT_PUBLIC_APP_URL=https://votre-boutique.ma

import { CMIGateway } from 'triplew-cmi-morocco';

export const cmiClient = new CMIGateway({
  clientId: process.env.CMI_CLIENT_ID || '600001234',
  storeKey: process.env.CMI_STORE_KEY || 'TEST_STORE_KEY',
  isProduction: process.env.NODE_ENV === 'production',
  okUrl: `${process.env.NEXT_PUBLIC_APP_URL}/checkout/success`,
  failUrl: `${process.env.NEXT_PUBLIC_APP_URL}/checkout/failed`,
  callbackUrl: `${process.env.NEXT_PUBLIC_APP_URL}/api/cmi/ipn`, // Notification IPN serveur
  shopUrl: `${process.env.NEXT_PUBLIC_APP_URL}/boutique`,
  currency: '504', // 504 = MAD (Dirham Marocain)
  lang: 'fr'
});

import { NextRequest, NextResponse } from 'next/server';
import { cmiClient } from '@/lib/cmi';

export async function POST(req: NextRequest) {
  try {
    const { orderId, totalAmount, customer } = await req.json();

    if (!orderId || !totalAmount) {
      return NextResponse.json({ error: 'Paramètres de commande incomplets' }, { status: 400 });
    }

    // 1. Génération des paramètres signés SHA-512
    const paymentParams = cmiClient.createPaymentParams({
      orderId: String(orderId),
      amount: Number(totalAmount),
      email: customer?.email,
      billToName: customer?.fullName,
      tel: customer?.phone
    });

    // 2. Génération du formulaire HTML auto-soumis pour redirection CMI
    const autoSubmitHtml = cmiClient.createAutoSubmitHtml(paymentParams);

    return new NextResponse(autoSubmitHtml, {
      status: 200,
      headers: { 'Content-Type': 'text/html; charset=utf-8' }
    });
  } catch (error) {
    console.error('[CMI Checkout] Erreur initiation:', error);
    return NextResponse.json({ error: 'Erreur passerelle CMI' }, { status: 500 });
  }
}

import { NextRequest, NextResponse } from 'next/server';
import { cmiClient } from '@/lib/cmi';

export async function POST(req: NextRequest) {
  try {
    const formData = await req.formData();
    const payload: Record<string, string> = {};
    formData.forEach((value, key) => { payload[key] = value.toString(); });

    // Validation cryptographique timing-safe du hash de réponse
    const validation = cmiClient.handleCallback(payload);

    if (!validation.isValid) {
      console.error('[CMI IPN] Alerte : Signature HASH CMI invalide ou falsifiée !');
      return new NextResponse('FAILURE', { status: 400 });
    }

    if (validation.isApproved) {
      const { orderId, amount, transactionId, authCode } = validation;

      // TODO: Mettre à jour votre commande en BDD (ex: Prisma, Drizzle, Supabase)
      // await db.orders.update({
      //   where: { id: orderId },
      //   data: { status: 'PAID', cmiTransId: transactionId, authCode }
      // });

      console.log(`[CMI IPN] Commande #${orderId} payée (${amount} MAD). TransID: ${transactionId}`);

      // ⚠️ RÉPONSE IMPÉRATIVE EXIGÉE PAR LE CMI :
      return new NextResponse('ACTION=POSTAUTH', {
        status: 200,
        headers: { 'Content-Type': 'text/plain' }
      });
    } else {
      console.warn(`[CMI IPN] Paiement refusé pour commande #${validation.orderId}. Code: ${validation.errorCode}`);
      return new NextResponse('APPROVED', { status: 200 });
    }
  } catch (err) {
    console.error('[CMI IPN] Erreur interne:', err);
    return new NextResponse('FAILURE', { status: 500 });
  }
}