Webhooks

const express = require('express');
const crypto = require('crypto');
const app = express();

app.use(express.json());

// Função para verificar a assinatura do webhook
function verifyWebhookSignature(payload, signature, apiKey) {
  const payloadString = JSON.stringify(payload);
  const expectedSignature = crypto
    .createHmac('sha256', apiKey)
    .update(payloadString)
    .digest('hex');
  return signature === `sha256=${expectedSignature}`;
}

app.post('/webhook/nevermiss', async (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const timestamp = req.headers['x-webhook-timestamp'];
  
  // Verifique a assinatura (recomendado)
  if (signature && !verifyWebhookSignature(req.body, signature, process.env.API_KEY)) {
    console.warn('Assinatura de webhook inválida');
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  const { event, data, timestamp: eventTimestamp } = req.body;
  
  switch (event) {
    case 'payment.created':
      console.log(`Pagamento criado: ${data.txid}`);
      await handlePaymentCreated(data);
      break;
    case 'payment.approved':
      console.log(`Pagamento aprovado: ${data.txid}`);
      await handlePaymentApproved(data);
      break;
    case 'payment.expired':
      console.log(`Pagamento expirado: ${data.txid}`);
      await handlePaymentExpired(data);
      break;
    case 'refund.created':
      console.log(`Reembolso criado: ${data.txid}`);
      await handleRefundCreated(data);
      break;
    case 'refund.completed':
      console.log(`Reembolso concluído: ${data.txid}`);
      await handleRefundCompleted(data);
      break;
    case 'refund.failed':
      console.log(`Reembolso falhou: ${data.txid}`);
      await handleRefundFailed(data);
      break;
    case 'withdrawal.created':
      console.log(`Saque criado: ${data.txid}`);
      await handleWithdrawalCreated(data);
      break;
    case 'withdrawal.completed':
      console.log(`Saque concluído: ${data.txid}`);
      await handleWithdrawalCompleted(data);
      break;
    case 'withdrawal.failed':
      console.log(`Saque falhou: ${data.txid}`);
      await handleWithdrawalFailed(data);
      break;
    case 'med.created':
      console.log(`MED criado: ${data.infractionId}`);
      await handleMedCreated(data);
      break;
    case 'med.won':
    case 'med.lost':
      console.log(`MED resolvido: ${data.infractionId} - ${data.outcome}`);
      await handleMedResolved(data);
      break;
  }
  
  // Retorne 200 para confirmar recebimento
  res.status(200).json({ received: true });
});

app.listen(3000);

from flask import Flask, request, jsonify
import requests
import hmac
import hashlib
import json
import os

app = Flask(__name__)

def verify_webhook_signature(payload, signature, api_key):
    payload_string = json.dumps(payload, separators=(',', ':'))
    expected_signature = hmac.new(
        api_key.encode(),
        payload_string.encode(),
        hashlib.sha256
    ).hexdigest()
    return signature == f'sha256={expected_signature}'

@app.route('/webhook/nevermiss', methods=['POST'])
def webhook():
    signature = request.headers.get('X-Webhook-Signature')
    timestamp = request.headers.get('X-Webhook-Timestamp')
    data = request.json
    
    # Verifique a assinatura (recomendado)
    if signature and not verify_webhook_signature(data, signature, os.getenv('API_KEY')):
        return jsonify({'error': 'Invalid signature'}), 401
    
    event = data['event']
    event_data = data['data']
    
    if event == 'payment.created':
        print(f"Pagamento criado: {event_data['txid']}")
        handle_payment_created(event_data)
    elif event == 'payment.approved':
        print(f"Pagamento aprovado: {event_data['txid']}")
        handle_payment_approved(event_data)
    elif event == 'payment.expired':
        print(f"Pagamento expirado: {event_data['txid']}")
        handle_payment_expired(event_data)
    elif event == 'refund.created':
        print(f"Reembolso criado: {event_data['txid']}")
        handle_refund_created(event_data)
    elif event == 'refund.completed':
        print(f"Reembolso concluído: {event_data['txid']}")
        handle_refund_completed(event_data)
    elif event == 'refund.failed':
        print(f"Reembolso falhou: {event_data['txid']}")
        handle_refund_failed(event_data)
    elif event == 'withdrawal.created':
        print(f"Saque criado: {event_data['txid']}")
        handle_withdrawal_created(event_data)
    elif event == 'withdrawal.completed':
        print(f"Saque concluído: {event_data['txid']}")
        handle_withdrawal_completed(event_data)
    elif event == 'withdrawal.failed':
        print(f"Saque falhou: {event_data['txid']}")
        handle_withdrawal_failed(event_data)
    elif event == 'med.created':
        print(f"MED criado: {event_data['infractionId']}")
        handle_med_created(event_data)
    elif event in ['med.won', 'med.lost']:
        print(f"MED resolvido: {event_data['infractionId']} - {event_data['outcome']}")
        handle_med_resolved(event_data)
    
    return jsonify({'received': True}), 200

if __name__ == '__main__':
    app.run(port=3000)

<?php
// webhook.php

function verifyWebhookSignature($payload, $signature, $apiKey) {
    $payloadString = json_encode($payload);
    $expectedSignature = hash_hmac('sha256', $payloadString, $apiKey);
    return $signature === "sha256=$expectedSignature";
}

// Leia o payload
$rawPayload = file_get_contents('php://input');
$payload = json_decode($rawPayload, true);

$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? null;
$timestamp = $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? null;

// Verifique a assinatura (recomendado)
if ($signature && !verifyWebhookSignature($payload, $signature, getenv('API_KEY'))) {
    http_response_code(401);
    echo json_encode(['error' => 'Invalid signature']);
    exit;
}

$event = $payload['event'];
$data = $payload['data'];

switch ($event) {
    case 'payment.created':
        error_log("Pagamento criado: " . $data['txid']);
        handlePaymentCreated($data);
        break;
    case 'payment.approved':
        error_log("Pagamento aprovado: " . $data['txid']);
        handlePaymentApproved($data);
        break;
    case 'payment.expired':
        error_log("Pagamento expirado: " . $data['txid']);
        handlePaymentExpired($data);
        break;
    case 'refund.created':
        error_log("Reembolso criado: " . $data['txid']);
        handleRefundCreated($data);
        break;
    case 'refund.completed':
        error_log("Reembolso concluído: " . $data['txid']);
        handleRefundCompleted($data);
        break;
    case 'refund.failed':
        error_log("Reembolso falhou: " . $data['txid']);
        handleRefundFailed($data);
        break;
    case 'withdrawal.created':
        error_log("Saque criado: " . $data['txid']);
        handleWithdrawalCreated($data);
        break;
    case 'withdrawal.completed':
        error_log("Saque concluído: " . $data['txid']);
        handleWithdrawalCompleted($data);
        break;
    case 'withdrawal.failed':
        error_log("Saque falhou: " . $data['txid']);
        handleWithdrawalFailed($data);
        break;
    case 'med.created':
        error_log("MED criado: " . $data['infractionId']);
        handleMedCreated($data);
        break;
    case 'med.won':
    case 'med.lost':
        error_log("MED resolvido: " . $data['infractionId'] . " - " . $data['outcome']);
        handleMedResolved($data);
        break;
}

// Retorne 200 para confirmar recebimento
http_response_code(200);
echo json_encode(['received' => true]);
?>