Webhooks

const crypto = require("crypto");

function verifyPay27Signature(rawBody, headers) {
  const signature = headers["x-pay27-signature"];
  const timestamp = headers["x-pay27-timestamp"];
  if (!signature || !timestamp) return false;

  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) return false; // 5 phút

  const payload = timestamp + "." + rawBody;
  const expected = crypto.createHmac("sha256", SECRET).update(payload).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

import hmac, hashlib, time

def verify_pay27_signature(raw_body: str, headers: dict) -> bool:
    signature = headers.get("X-Pay27-Signature", "")
    timestamp = headers.get("X-Pay27-Timestamp", "")
    if not signature or not timestamp:
        return False
    if abs(int(time.time()) - int(timestamp)) > 300:
        return False
    payload = timestamp + "." + raw_body
    expected = hmac.new(
        SECRET.encode(), payload.encode(), hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(signature, expected)

// Express.js — Endpoint nhận Webhook Pay27 đầy đủ
const express = require("express");
const crypto = require("crypto");

const app = express();

app.use(
  express.json({
    verify: (req, res, buf) => { req.rawBody = buf.toString(); },
  })
);

const SECRET = process.env.PAY27_WEBHOOK_SECRET;

app.post("/webhooks/pay27", (req, res) => {
  const signature = req.headers["x-pay27-signature"];
  const timestamp = req.headers["x-pay27-timestamp"];
  if (!signature || !timestamp) return res.status(401).json({ error: "Missing headers" });

  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) return res.status(401).json({ error: "Expired" });

  const expected = crypto.createHmac("sha256", SECRET).update(timestamp + "." + req.rawBody).digest("hex");
  try {
    if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected)))
      return res.status(401).json({ error: "Invalid signature" });
  } catch { return res.status(401).json({ error: "Invalid format" }); }

  const { event, transaction_id, gateway, amount, currency } = req.body;
  console.log("[Webhook] " + event + " — " + transaction_id + " (" + gateway + ")");

  switch (event) {
    case "payout.succeeded":
      console.log("Payout " + transaction_id + " OK: " + amount + " " + currency);
      break;
    case "payout.failed":
      console.error("Payout " + transaction_id + " FAILED: " + amount + " " + currency);
      break;
  }

  res.json({ received: true });
});

app.listen(process.env.PORT || 3000, () => console.log("Webhook server running"));

# Python Flask — Endpoint nhận Webhook Pay27
from flask import Flask, request, jsonify
import hmac, hashlib, os, time, logging

app = Flask(__name__)
SECRET = os.environ["PAY27_WEBHOOK_SECRET"]

def verify():
    sig = request.headers.get("X-Pay27-Signature", "")
    ts = request.headers.get("X-Pay27-Timestamp", "")
    if not sig or not ts: return False
    if abs(int(time.time()) - int(ts)) > 300: return False
    payload = ts + "." + request.get_data(as_text=True)
    expected = hmac.new(SECRET.encode(), payload.encode(), hashlib.sha256).hexdigest()
    return hmac.compare_digest(sig, expected)

@app.route("/webhooks/pay27", methods=["POST"])
def webhook():
    if not verify(): return jsonify({"error":"Invalid"}), 401
    body = request.json
    event = body.get("event")
    tx_id = body.get("transaction_id")
    if event == "payout.succeeded":
        app.logger.info(f"Payout OK: {tx_id}")
    return jsonify({"received":True}), 200

<?php
// PHP — Endpoint nhận Webhook Pay27
$secret = getenv("PAY27_WEBHOOK_SECRET");
$headers = getallheaders();
$sig = $headers["X-Pay27-Signature"] ?? "";
$ts = $headers["X-Pay27-Timestamp"] ?? "";

if (!$sig || !$ts) { http_response_code(401); exit; }
if (abs(time() - (int)$ts) > 300) { http_response_code(401); exit; }

$raw = file_get_contents("php://input");
$expected = hash_hmac("sha256", $ts . "." . $raw, $secret);
if (!hash_equals($expected, $sig)) { http_response_code(401); exit; }

$body = json_decode($raw, true);
$event = $body["event"] ?? "";
error_log("[Webhook] $event — {$body["transaction_id"]}");

switch ($event) {
  case "payout.succeeded":
    // Cập nhật đơn hàng
    break;
  case "payout.failed":
    // Thông báo thất bại
    break;
}

echo json_encode(["received" => true]);