Webhooks

<?php
// Get the signature from headers
$signature = $_SERVER['HTTP_X_VERIPAY_SIGNATURE'];
$payload = file_get_contents('php://input');

// Parse the signature header
list($timestamp, $signature_hash) = explode(',', $signature);
$timestamp = str_replace('t=', '', $timestamp);
$signature_hash = str_replace('v1=', '', $signature_hash);

// Verify timestamp (prevent replay attacks)
if (abs(time() - (int)$timestamp) > 300) { // 5 minutes
    http_response_code(400);
    exit('Request too old');
}

// Compute expected signature
$expected_signature = hash_hmac(
    'sha256',
    $timestamp . '.' . $payload,
    $webhook_secret
);

// Verify signature (constant time)
if (!hash_equals($expected_signature, $signature_hash)) {
    http_response_code(401);
    exit('Invalid signature');
}

// Process the webhook
$event = json_decode($payload, true);
processWebhook($event);

const crypto = require('crypto');

function verifyWebhook(req, webhookSecret) {
  const signature = req.headers['x-veripay-signature'];
  const payload = req.body instanceof Buffer ? req.body.toString('utf8') : JSON.stringify(req.body);

  // Parse signature header
  const [timestampPart, hashPart] = signature.split(',');
  const timestamp = timestampPart.replace('t=', '');
  const signatureHash = hashPart.replace('v1=', '');

  // Verify timestamp (prevent replay attacks)
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - parseInt(timestamp, 10)) > 300) {
    throw new Error('Request too old');
  }

  // Compute expected signature
  const expectedSignature = crypto
    .createHmac('sha256', webhookSecret)
    .update(`${timestamp}.${payload}`)
    .digest('hex');

  // Verify signature (constant time)
  if (!crypto.timingSafeEqual(Buffer.from(expectedSignature), Buffer.from(signatureHash))) {
    throw new Error('Invalid signature');
  }

  return true;
}

{
  "id": "evt_1234567890abcdef",
  "type": "payment.validated",
  "occurred_at": "2024-08-14T10:30:00Z",
  "data": {
    "payment_link": {
      "id": "ABC123XY",
      "status": "verified",
      "amount": 150.00,
      "currency": "TTD",
      "reference": "ORDER-12345",
      "source_reference": "order_12345"
    }
  },
  "meta": {
    "attempt": 1
  }
}

{
  "id": "evt_abcdef1234567890",
  "type": "invoice.paid",
  "occurred_at": "2024-08-14T15:45:00Z",
  "data": {
    "invoice": {
      "id": 456,
      "invoice_number": "INV-2024-001",
      "status": "paid",
      "total_cents": 568125,
      "currency": "TTD",
      "customer_id": 123,
      "paid_at": "2024-08-14T15:45:00Z"
    }
  },
  "meta": {
    "attempt": 1
  }
}

<?php
// routes/web.php
Route::post('/webhooks/veripay', [WebhookController::class, 'handle']);

// app/Http/Controllers/WebhookController.php
class WebhookController extends Controller
{
    public function handle(Request $request)
    {
        // Verify the signature (see security section)
        $this->verifySignature($request);

        $event = $request->all();

        switch ($event['type'] ?? null) {
            case 'payment.validated':
                $this->handlePaymentValidated($event['data']);
                break;

            case 'payment.rejected':
                $this->handlePaymentRejected($event['data']);
                break;

            case 'invoice.paid':
                $this->handleInvoicePaid($event['data']);
                break;

            default:
                Log::info('Unhandled webhook event: ' . ($event['type'] ?? 'unknown'));
        }

        return response()->json(['status' => 'success']);
    }

    private function handlePaymentValidated(array $data): void
    {
        $paymentLink = $data['payment_link'];

        // Update your local order status
        Order::where('veripay_invoice_id', $paymentLink['id'])
            ->update(['status' => 'paid']);

        // Optional: Send confirmation email, etc.
    }
}

const express = require('express');
const app = express();

// Use raw body for signature verification
app.use('/webhooks/veripay', express.raw({ type: 'application/json' }));

app.post('/webhooks/veripay', (req, res) => {
  try {
    verifyWebhook(req, process.env.VERIPAY_WEBHOOK_SECRET); // from earlier tab

    const event = JSON.parse(req.body);

    switch (event.type) {
      case 'payment.validated':
        handlePaymentValidated(event.data);
        break;
      case 'payment.rejected':
        handlePaymentRejected(event.data);
        break;
      case 'invoice.paid':
        handleInvoicePaid(event.data);
        break;
      default:
        console.log(`Unhandled event: ${event.type}`);
    }

    res.status(200).json({ status: 'success' });
  } catch (error) {
    console.error('Webhook error:', error);
    res.status(400).json({ error: error.message });
  }
});

function handlePaymentValidated(data) {
  const paymentLink = data.payment_link;
  // Update order status in database
  updateOrderStatus(paymentLink.id, 'paid');
  // Send confirmation email, etc.
}