Overview

deltatech_payment_bti_bank is an Odoo 18 payment provider that integrates the BTI Bank eCommerce financing flow. It prepares the application payload from Sales Orders or Invoices, encrypts it with BTI’s public key, and redirects the customer to BTI. When BTI posts the decision back, the module decrypts and updates the transaction accordingly.

This module is a tailored adaptation of an internal iPay-based provider, rebuilt to follow BTI’s PHP sample and documentation.

Key features

• New payment provider: BTI Bank (code = bti_bank).
• Encrypts the order/application JSON using RSA (PKCS#1 v1.5) with BTI’s public key; chunked and base64-encoded as required by the spec.
• Posts only the required fields to BTI’s Finalize endpoint:
  • order_data (encrypted JSON)
  • providerCode (merchant/provider code, plain text)
• Computes the Finalize endpoint automatically based on provider state:
  • Live: https://ecommerce.tbibank.ro/Api/LoanApplication/Finalize
  • UAT: https://vmrouatftos01.westeurope.cloudapp.azure.com/LoanApplication/Finalize
• Supports both Sales Orders and Invoices:
  • If the transaction is linked to invoices, build items and customer data from the invoice.
  • Else use sale order lines; else fall back to a single line.
• Return processing (notification): decrypts BTI’s order_data using your private key and maps status_id to Odoo transaction states:
  • 1 → done (or authorized if configured 2‑phase)
  • 0 → canceled/rejected
  • 2 → pending
• Optional 2‑phase (manual capture) mode via provider setting.

How it works

1. At checkout or when paying an invoice, Odoo builds an order/application JSON with:
   • store_id, order_id (Odoo reference), back_ref (Odoo return URL), order_total, username, password.
   • customer: name, email, phone, billing/shipping data, and promo indicator.
   • items: product lines (name, qty formatted like 1.0000, price with 2 decimals, SKU, ImageLink).
2. The JSON is RSA-encrypted (PKCS#1 v1.5) with the BTI public key, chunked by key size, and base64-encoded into order_data.
3. Browser auto‑POSTs to the computed Finalize URL with order_data and providerCode.
4. BTI responds with a redirect for the customer to complete the process.
5. When BTI returns a status (ReturnToProvider), it posts an encrypted payload order_data to the Odoo return URL. The module decrypts it with your private key and updates the Odoo transaction.

Configuration

Go to Settings > Payments > Providers > BTI Bank and fill:

• API credentials
  • Store ID (bti_bank_store_id)
  • Provider Code (bti_bank_provider_code)
  • Username (bti_bank_user) and Password (bti_bank_pass)
• Mode and capture
  • bti_bank_mode: 1 (single phase) or 2 (two phase). Two‑phase marks approved transactions as Authorized; you can capture from Odoo.
• Cryptographic keys
  • BTI Public Key (PEM): used to encrypt the request to BTI.
  • BTI Private Key (PEM): used to decrypt BTI’s status payload.

Notes:

• Ensure the PEMs are pasted exactly (including -----BEGIN PUBLIC KEY----- / -----BEGIN PRIVATE KEY----- lines).
• providerCode must match what BTI configured for you.

Dependencies and compatibility

• Odoo 18.0 (community or enterprise).
• Python package: cryptography (used for RSA operations). Install in your Odoo virtualenv if missing.

Testing and troubleshooting

• Use the UAT environment while validating: the module automatically selects the UAT Finalize URL when the provider is not in the Enabled state.
• Typical flows:
  • Sales Order: create website order, choose BTI Bank, confirm.
  • Invoice: open customer invoice, register payment via BTI Bank, proceed.
• Check Odoo logs for detailed info if payload encryption or decryption fails. The module avoids logging sensitive plaintext, but reports high-level errors and status IDs.
• If you receive “Missing BTI Bank public/private key” or cryptography errors, verify the keys and that cryptography is installed.

Security

• Request payload contains credentials and customer details and is encrypted with BTI’s public key on your server before being auto‑posted by the browser.
• Return payload from BTI is encrypted and is decrypted server‑side using your private key.
• The module minimizes logging of sensitive content.

Limitations and notes

• order_total is currently sent as a rounded whole-number string to match the PHP sample. If BTI requires minor units or exact decimals, adjust the formatting in payment.transaction._get_specific_rendering_values.
• Category codes in items default to "8" when unavailable; map them if your catalog requires specific values.
• Capture and void endpoints in this module mirror legacy iPay semantics and may need adaptation if BTI exposes different server‑to‑server APIs for post‑authorization operations.

Module metadata

• Technical name: deltatech_payment_bti_bank
• Code: bti_bank
• Maintainer: Terrabit / Dorin Hongu
• License: OPL-1

Table of contents