const express = require('express');
const crypto = require('crypto');

const app = express();
app.use(express.json({ verify: (req, res, buf) => { req.rawBody = buf; } }));

const WEBHOOK_SECRET = 'SEU_CLIENT_SECRET'; // Mesmo client_secret da API Key

// Middleware para verificar assinatura
function verificarAssinatura(req, res, next) {
    const signature = req.headers['x-webhook-signature'] || '';
    const expectedSignature = crypto
        .createHmac('sha256', WEBHOOK_SECRET)
        .update(req.rawBody)
        .digest('hex');

    if (!crypto.timingSafeEqual(
        Buffer.from(signature, 'hex'),
        Buffer.from(expectedSignature, 'hex')
    )) {
        return res.status(401).json({ error: 'Assinatura invalida' });
    }
    next();
}

app.post('/webhook/pagamentos', verificarAssinatura, async (req, res) => {
    const { event, transaction } = req.body;

    switch (event) {
        case 'transaction.paid':
            console.log(`Pagamento confirmado: ${transaction.id}`);
            // Atualizar pedido no banco de dados
            await atualizarPedido(transaction.external_id, 'pago');
            break;

        case 'transaction.cancelled':
            console.log(`Transacao cancelada: ${transaction.id}`);
            await atualizarPedido(transaction.external_id, 'cancelado');
            break;

        case 'transaction.reversed':
            console.log(`Pagamento estornado: ${transaction.id}`);
            await atualizarPedido(transaction.external_id, 'estornado');
            break;

        case 'transaction.expired':
            console.log(`Transacao expirada: ${transaction.id}`);
            await atualizarPedido(transaction.external_id, 'expirado');
            break;

        default:
            console.log(`Evento desconhecido: ${event}`);
    }

    // Confirmar recebimento
    res.status(200).json({ received: true });
});

app.listen(3000, () => console.log('Webhook server rodando na porta 3000'));

import hmac
import hashlib
import json
from flask import Flask, request, jsonify

app = Flask(__name__)

WEBHOOK_SECRET = 'SEU_CLIENT_SECRET'  # Mesmo client_secret da API Key


def verificar_assinatura(payload: bytes, signature: str) -> bool:
    """Verifica a assinatura HMAC-SHA256 do webhook."""
    expected = hmac.new(
        WEBHOOK_SECRET.encode('utf-8'),
        payload,
        hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, signature)


@app.route('/webhook/pagamentos', methods=['POST'])
def webhook():
    # 1. Verificar assinatura
    payload = request.get_data()
    signature = request.headers.get('X-Webhook-Signature', '')

    if not verificar_assinatura(payload, signature):
        return jsonify({'error': 'Assinatura invalida'}), 401

    # 2. Decodificar payload
    data = json.loads(payload)
    event = data['event']
    transaction = data['transaction']

    # 3. Processar evento
    if event == 'transaction.paid':
        print(f"Pagamento confirmado: {transaction['id']}")
        atualizar_pedido(transaction['external_id'], 'pago')

    elif event == 'transaction.cancelled':
        print(f"Transacao cancelada: {transaction['id']}")
        atualizar_pedido(transaction['external_id'], 'cancelado')

    elif event == 'transaction.reversed':
        print(f"Pagamento estornado: {transaction['id']}")
        atualizar_pedido(transaction['external_id'], 'estornado')

    elif event == 'transaction.expired':
        print(f"Transacao expirada: {transaction['id']}")
        atualizar_pedido(transaction['external_id'], 'expirado')

    # 4. Confirmar recebimento
    return jsonify({'received': True}), 200


if __name__ == '__main__':
    app.run(port=3000, debug=True)