Webhooks

<?php

function verifyWebhook(string $secret, string $timestamp, string $signature, string $rawBody, ?int $now = null): bool
{
    $now ??= time();
    if (!ctype_digit($timestamp) || abs($now - (int) $timestamp) > 300) {
        return false;
    }
    $expected = hash_hmac('sha256', $timestamp . "\n" . $rawBody, $secret);
    return hash_equals($expected, $signature);
}

const encoder = new TextEncoder();

function fromHex(hex) {
  const pairs = hex.match(/^(?:[0-9a-f]{2})+$/) ? hex.match(/../g) : [];
  return new Uint8Array(pairs.map((b) => parseInt(b, 16)));
}

export async function verifyWebhook(secret, timestamp, signature, rawBody, now = Date.now()) {
  if (!/^\d+$/.test(timestamp ?? "") || Math.abs(now / 1000 - Number(timestamp)) > 300) return false;
  const signed = new Uint8Array([...encoder.encode(timestamp + "\n"), ...new Uint8Array(rawBody)]);
  const key = await crypto.subtle.importKey(
    "raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"],
  );
  return crypto.subtle.verify("HMAC", key, fromHex(signature ?? ""), signed);
}

import hashlib
import hmac
import time


def verify_webhook(secret, timestamp, signature, raw_body, now=None):
    now = time.time() if now is None else now
    if not (timestamp or "").isdigit() or abs(now - int(timestamp)) > 300:
        return False
    expected = hmac.new(secret.encode(), timestamp.encode() + b"\n" + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature or "")

import crypto from "node:crypto";

export function verifyWebhook(secret, timestamp, signature, rawBody, now = Date.now()) {
  if (!/^\d+$/.test(timestamp ?? "") || Math.abs(now / 1000 - Number(timestamp)) > 300) return false;
  const expected = crypto.createHmac("sha256", secret)
    .update(timestamp + "\n")
    .update(rawBody)
    .digest("hex");
  return typeof signature === "string" && signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

<?php

require __DIR__ . '/webhook.php';

$raw = file_get_contents('php://input');
$verified = verifyWebhook(
    getenv('API_KEY_SECRET'),
    $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? '',
    $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '',
    $raw,
);
if (!$verified) {
    http_response_code(401);
    exit;
}

$pdo = new PDO(getenv('DATABASE_DSN'), getenv('DATABASE_USER'), getenv('DATABASE_PASSWORD'));
$insert = $pdo->prepare(
    'INSERT INTO time2pay_webhooks (idempotency_key, body) VALUES (?, ?) ON CONFLICT (idempotency_key) DO NOTHING'
);
$insert->execute([$_SERVER['HTTP_X_IDEMPOTENCY_KEY'], $raw]);
http_response_code(204);

import { verifyWebhook } from "./webhook.js";

export default {
  async fetch(request, env) {
    const raw = new Uint8Array(await request.arrayBuffer());
    const verified = await verifyWebhook(
      env.API_KEY_SECRET,
      request.headers.get("X-Webhook-Timestamp"),
      request.headers.get("X-Webhook-Signature"),
      raw,
    );
    if (!verified) return new Response("bad signature", { status: 401 });

    await env.recordOnce(request.headers.get("X-Idempotency-Key"), new TextDecoder().decode(raw));
    return new Response(null, { status: 204 });
  },
};

import os

from flask import Flask, request

from webhook import verify_webhook

app = Flask(__name__)


@app.post("/time2pay/webhook")
def time2pay_webhook():
    raw = request.get_data()
    verified = verify_webhook(
        os.environ["API_KEY_SECRET"],
        request.headers.get("X-Webhook-Timestamp"),
        request.headers.get("X-Webhook-Signature"),
        raw,
    )
    if not verified:
        return "bad signature", 401
    record_once(request.headers["X-Idempotency-Key"], raw)
    return "", 204

import express from "express";
import { verifyWebhook } from "./webhook.mjs";

const app = express();

app.post("/time2pay/webhook", express.raw({ type: "application/json" }), async (req, res) => {
  const verified = verifyWebhook(
    process.env.API_KEY_SECRET,
    req.get("X-Webhook-Timestamp"),
    req.get("X-Webhook-Signature"),
    req.body,
  );
  if (!verified) return res.sendStatus(401);

  await recordOnce(req.get("X-Idempotency-Key"), req.body.toString("utf8"));
  res.sendStatus(204);
});

function processEvent(Ledger $ledger, string $raw): void
{
    $e = json_decode($raw, true, 512, JSON_THROW_ON_ERROR);
    match ($e['event']) {
        'payment.completed' => $ledger->creditDeposit($e['external_order_id'], $e['token'], $e['amount']),
        'payment.failed' => $ledger->failDeposit($e['external_order_id']),
        'deposit.confirmed' => $ledger->creditWalletDeposit($e['deposit_id'], $e['player_id'], $e['token'], $e['credited']),
        'payout.completed' => $ledger->completeWithdrawal($e['external_id'] ?? $e['payout_id'], $e['tx_hash']),
        'payout.failed' => $ledger->failWithdrawal($e['external_id'] ?? $e['payout_id'], $e['failure_reason'] ?? ''),
        default => null,
    };
}

export async function processEvent(ledger, raw) {
  const e = JSON.parse(raw);
  switch (e.event) {
    case "payment.completed":
      return ledger.creditDeposit(e.external_order_id, e.token, e.amount);
    case "payment.failed":
      return ledger.failDeposit(e.external_order_id);
    case "deposit.confirmed":
      return ledger.creditWalletDeposit(e.deposit_id, e.player_id, e.token, e.credited);
    case "payout.completed":
      return ledger.completeWithdrawal(e.external_id ?? e.payout_id, e.tx_hash);
    case "payout.failed":
      return ledger.failWithdrawal(e.external_id ?? e.payout_id, e.failure_reason ?? "");
  }
}

import json


def process_event(ledger, raw):
    e = json.loads(raw)
    kind = e["event"]
    if kind == "payment.completed":
        ledger.credit_deposit(e["external_order_id"], e["token"], e["amount"])
    elif kind == "payment.failed":
        ledger.fail_deposit(e["external_order_id"])
    elif kind == "deposit.confirmed":
        ledger.credit_wallet_deposit(e["deposit_id"], e["player_id"], e["token"], e["credited"])
    elif kind == "payout.completed":
        ledger.complete_withdrawal(e.get("external_id") or e["payout_id"], e["tx_hash"])
    elif kind == "payout.failed":
        ledger.fail_withdrawal(e.get("external_id") or e["payout_id"], e.get("failure_reason", ""))

export async function processEvent(ledger, raw) {
  const e = JSON.parse(raw);
  switch (e.event) {
    case "payment.completed":
      return ledger.creditDeposit(e.external_order_id, e.token, e.amount);
    case "payment.failed":
      return ledger.failDeposit(e.external_order_id);
    case "deposit.confirmed":
      return ledger.creditWalletDeposit(e.deposit_id, e.player_id, e.token, e.credited);
    case "payout.completed":
      return ledger.completeWithdrawal(e.external_id ?? e.payout_id, e.tx_hash);
    case "payout.failed":
      return ledger.failWithdrawal(e.external_id ?? e.payout_id, e.failure_reason ?? "");
  }
}