Webhooks

import hmac
import hashlib
import time
import json
from flask import Flask, request

app = Flask(__name__)

def verify_webhook_signature(payload, signature, timestamp, webhook_secret):
    # Verificar que el timestamp no sea muy antiguo (5 minutos)
    current_time = int(time.time() * 1000)
    webhook_time = int(timestamp)

    if current_time - webhook_time > 5 * 60 * 1000:
        raise ValueError('Webhook timestamp too old')

    # Calcular la firma esperada
    signed_payload = f"{timestamp}.{payload}"
    expected_signature = hmac.new(
        webhook_secret.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    # Comparar firmas
    received_sig = signature.replace('sha256=', '')

    if not hmac.compare_digest(expected_signature, received_sig):
        raise ValueError('Invalid webhook signature')

    return True

@app.route('/webhook', methods=['POST'])
def webhook():
    signature = request.headers.get('X-NIIO-Signature')
    timestamp = request.headers.get('X-NIIO-Timestamp')
    payload = request.get_data(as_text=True)

    try:
        verify_webhook_signature(
            payload,
            signature,
            timestamp,
            os.environ['WEBHOOK_SECRET']
        )

        event = json.loads(payload)

        # Procesar el evento
        if event['event'] == 'payment.completed':
            # Marcar orden como pagada en tu sistema
            mark_order_as_paid(event['data']['id'], event['data']['reference'])
        elif event['event'] == 'payment.failed':
            # Manejar fallo - notificar al usuario, etc.
            handle_payment_failure(event['data']['id'], event['data']['reference'])

        return 'OK', 200
    except ValueError as e:
        return str(e), 400

function verifyWebhookSignature($payload, $signature, $timestamp, $webhookSecret) {
    // Verificar que el timestamp no sea muy antiguo (5 minutos)
    $currentTime = round(microtime(true) * 1000);
    $webhookTime = intval($timestamp);

    if ($currentTime - $webhookTime > 5 * 60 * 1000) {
        throw new Exception('Webhook timestamp too old');
    }

    // Calcular la firma esperada
    $signedPayload = $timestamp . '.' . $payload;
    $expectedSignature = hash_hmac('sha256', $signedPayload, $webhookSecret);

    // Comparar firmas
    $receivedSig = str_replace('sha256=', '', $signature);

    if (!hash_equals($expectedSignature, $receivedSig)) {
        throw new Exception('Invalid webhook signature');
    }

    return true;
}

// Uso
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_NIIO_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_NIIO_TIMESTAMP'] ?? '';

try {
    verifyWebhookSignature($payload, $signature, $timestamp, getenv('WEBHOOK_SECRET'));

    $event = json_decode($payload, true);

    // Procesar el evento
    switch ($event['event']) {
        case 'payment.completed':
            // Marcar orden como pagada en tu sistema
            markOrderAsPaid($event['data']['id'], $event['data']['reference']);
            break;
        case 'payment.failed':
            // Manejar fallo - notificar al usuario, etc.
            handlePaymentFailure($event['data']['id'], $event['data']['reference']);
            break;
    }

    http_response_code(200);
    echo 'OK';
} catch (Exception $e) {
    http_response_code(400);
    echo $e->getMessage();
}