1. Customer fills card form in browser/app
encryptCard() ← runs in browser using DGS Encryption Key
          ↓
2. Browser sends encrypted payload to YOUR server
          ↓
3. Your server forwards encrypted payload to DGS-Pay /charges
          ↓
4. DGS-Pay decrypts with private key and processes payment

// Load your encryption key from the merchant dashboard
const ENC_KEY = "YOUR_ENCRYPTION_KEY_FROM_DASHBOARD";

async function importKey(b64) {
  const raw = Uint8Array.from(atob(b64), c => c.charCodeAt(0));
  return crypto.subtle.importKey(
    'raw', raw, { name: 'AES-GCM' }, false, ['encrypt']
  );
}

function hexNonce() {
  // Produces a 12-byte (24 hex char) nonce — required by DGS-Pay
  const bytes = crypto.getRandomValues(new Uint8Array(6));
  return Array.from(bytes).map(b => b.toString(16).padStart(2, '0')).join('');
}

async function encryptField(plaintext, key, nonce) {
  const iv  = new TextEncoder().encode(nonce);
  const enc = await crypto.subtle.encrypt(
    { name: 'AES-GCM', iv, tagLength: 128 },
    key,
    new TextEncoder().encode(plaintext)
  );
  return btoa(String.fromCharCode(...new Uint8Array(enc)));
}

async function encryptCard(cardNumber, month, year, cvv) {
  const key   = await importKey(ENC_KEY);
  const nonce = hexNonce(); // all four fields share one nonce

  const [encCard, encMon, encYr, encCvv] = await Promise.all([
    encryptField(cardNumber, key, nonce),
    encryptField(month,      key, nonce),
    encryptField(year,       key, nonce),
    encryptField(cvv,        key, nonce),
  ]);

  return {
    card_encrypted_number:       encCard,
    card_encrypted_expiry_month: encMon,
    card_encrypted_expiry_year:  encYr,
    card_encrypted_cvv:          encCvv,
    card_nonce:                  nonce,
  };
}

// Usage example
const payload = await encryptCard("4532123456789010", "12", "2028", "123");
// payload now contains card_encrypted_* fields + card_nonce