إشعارات Webhook

POST /webhooks/bridge HTTP/1.1
Host: shop.example
Content-Type: application/json
User-Agent: AlphabetPaymentBridge-Webhooks/1.0
X-Bridge-Event: payment.paid
X-Bridge-Signature: t=1792017204,v1=17cfa378e474d1c57e8707e60fcbc369329a5bf15981d2ed81472a8d5188cfa2

{
  "id": "evt_0b8f7c52-4a51-4f0e-9a3e-2c7d1e9b6a10",
  "event": "payment.paid",
  "created_at": "2026-10-14T22:35:02+00:00",
  "data": {
    "id": "01a13c8c-8592-70f4-9ef9-d3767e74d54c",
    "status": "paid",
    "mode": "test",
    "amount": 25000,
    "refunded_amount": 0,
    "currency": "IQD",
    "method": "aps_card",
    "order_reference": "ORD-1001",
    "description": "Two coffees",
    "customer": {"name": "Ali", "phone": "+9647700000000", "email": "ali@example.com"},
    "payer": {"name": "Ali Hassan", "phone": null, "email": null, "ip": "203.0.113.10", "user_agent": "GuzzleHttp/7"},
    "locale": "en",
    "return_url": "https://shop.example/return",
    "metadata": {"cart_id": "c-42"},
    "checkout_url": "https://<your-bridge-domain>/checkout/01a13c8c-8592-70f4-9ef9-d3767e74d54c",
    "expires_at": "2026-10-14T23:03:24+00:00",
    "paid_at": "2026-10-14T22:35:02+00:00",
    "created_at": "2026-10-14T22:33:24+00:00",
    "refunds": []
  }
}

<?php

function verifyBridgeSignature(string $rawBody, string $header, string $secret, int $tolerance = 300): bool
{
    if (! preg_match('/(?:^|,)t=(\d+)/', $header, $t) || ! preg_match('/(?:^|,)v1=([0-9a-f]{64})/', $header, $v1)) {
        return false;
    }

    if (abs(time() - (int) $t[1]) > $tolerance) {
        return false;
    }

    $expected = hash_hmac('sha256', $t[1].'.'.$rawBody, $secret);

    return hash_equals($expected, $v1[1]);
}

Route::post('/webhooks/bridge', function (Illuminate\Http\Request $request) {
    $valid = verifyBridgeSignature(
        $request->getContent(),
        (string) $request->header('X-Bridge-Signature'),
        config('services.bridge.webhook_secret'),
    );

    abort_unless($valid, 400);

    $event = $request->json()->all();
    // Skip $event['id'] if you have handled it already, then queue the real work.

    return response()->noContent();
});

const crypto = require('node:crypto');

function verifyBridgeSignature(rawBody, header, secret, tolerance = 300) {
  const t = /(?:^|,)t=(\d+)/.exec(header || '')?.[1];
  const v1 = /(?:^|,)v1=([0-9a-f]{64})/.exec(header || '')?.[1];
  if (!t || !v1) return false;
  if (Math.abs(Date.now() / 1000 - Number(t)) > tolerance) return false;

  const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');

  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

app.post('/webhooks/bridge', express.raw({ type: 'application/json' }), (req, res) => {
  const ok = verifyBridgeSignature(req.body, req.get('X-Bridge-Signature'), process.env.BRIDGE_WEBHOOK_SECRET);
  if (!ok) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  // Skip event.id if you have handled it already, then queue the real work.
  res.sendStatus(204);
});