Webhooklar

POST /webhooks/milliysavdo HTTP/1.1
Content-Type: application/json
webhook-id: evt_3f9a2c7d1e5b8a0c4d6e2f1a
webhook-timestamp: 1792116832
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4=

{
  "id": "evt_3f9a2c7d1e5b8a0c4d6e2f1a",
  "object": "event",
  "type": "order.sms_received",
  "mode": "test",
  "api_version": "2026-10-16",
  "created_at": "2026-10-16T02:13:52.502316+00:00",
  "data": {
    "order": {
      "id": "ord_test_14",
      "object": "order",
      "mode": "test",
      "status": "sms_received",
      "phone": "+1888582997",
      "sms_code": "636841",
      "country": {
        "id": 6,
        "name": "United States",
        "iso_code": null
      },
      "service": {
        "code": "907",
        "title": "Telegram"
      },
      "price": {
        "amount": "3842.44",
        "amount_cents": 384244,
        "retail_amount": "4269.38",
        "retail_amount_cents": 426938,
        "discount_percent": "10.00",
        "currency": "UZS"
      },
      "created_at": "2026-10-16T02:13:52.251868Z",
      "expires_at": "2026-10-16T02:33:52.251868Z",
      "completed_at": "2026-10-16T02:13:52.301158Z"
    }
  }
}

import base64
import hashlib
import hmac
import json
import time

TOLERANCE_SECONDS = 300


def verify_webhook(secret: str, headers: dict, raw_body: bytes, now: int | None = None) -> dict:
    """secret: "whsec_..." ; headers: kichik harfli kalitlar ; raw_body: xom bayt."""
    msg_id = headers.get("webhook-id")
    timestamp = headers.get("webhook-timestamp")
    signature_header = headers.get("webhook-signature")
    if not msg_id or not timestamp or not signature_header:
        raise ValueError("Imzo headerlari yo'q")

    now = int(time.time()) if now is None else now
    if abs(now - int(timestamp)) > TOLERANCE_SECONDS:
        raise ValueError("Timestamp juda eski yoki kelajakda")

    key = base64.b64decode(secret.removeprefix("whsec_"))
    signed = f"{msg_id}.{timestamp}.".encode() + raw_body
    expected = hmac.new(key, signed, hashlib.sha256).digest()

    for part in signature_header.split(" "):
        version, _, sig = part.partition(",")
        if version == "v1" and hmac.compare_digest(base64.b64decode(sig), expected):
            return json.loads(raw_body)
    raise ValueError("Imzo mos emas")


# Flask misoli:
# @app.post("/webhooks/milliysavdo")
# def milliysavdo_webhook():
#     headers = {k.lower(): v for k, v in request.headers.items()}
#     event = verify_webhook(os.environ["MILLIYSAVDO_WEBHOOK_SECRET"], headers, request.get_data())
#     ...
#     return "", 200

const express = require("express");
const { verifyWebhook } = require("./verify-webhook");

const app = express();
const seen = new Set(); // ishlab chiqarishda: Redis / DB (webhook-id bo'yicha dedup)

// MUHIM: express.raw — imzo xom body ustida hisoblanadi
app.post("/webhooks/milliysavdo", express.raw({ type: "application/json" }), (req, res) => {
  let event;
  try {
    event = verifyWebhook(process.env.MILLIYSAVDO_WEBHOOK_SECRET, req.headers, req.body);
  } catch (err) {
    return res.status(400).send(err.message);
  }
  if (seen.has(req.headers["webhook-id"])) return res.sendStatus(200); // takror
  seen.add(req.headers["webhook-id"]);

  if (event.type === "order.sms_received") {
    console.log("SMS kod:", event.data.order.sms_code);
  }
  res.sendStatus(200); // 10 soniya ichida 2xx qaytaring
});

app.listen(3000);