Webhooks

# Тестовая отправка webhook на ваш endpoint (для отладки)
curl -X POST https://your-app.example.com/webhooks/finos \
  -H "Content-Type: application/json" \
  -H "X-FinOs-Signature: sha256=abc123..." \
  -d '{
    "id": "evt_5f8d7a3c-1234-4567-89ab-cdef01234567",
    "type": "wallet.deposit.confirmed",
    "created_at": "2026-05-27T14:23:00Z",
    "data": {
      "transaction_id": "tx_8e23f...",
      "amount": "100.000000",
      "currency": "USDT",
      "network": "TRC20"
    }
  }'

// Node.js / Express — обработчик webhook
import express from 'express';
import crypto from 'crypto';

const app = express();
const WEBHOOK_SECRET = process.env.FINOS_WEBHOOK_SECRET;
const processedEvents = new Set(); // в реальности — Redis/БД

app.post('/webhooks/finos', express.raw({ type: 'application/json' }), (req, res) => {
    const signature = req.header('X-FinOs-Signature') || '';
    const expected = 'sha256=' + crypto
        .createHmac('sha256', WEBHOOK_SECRET)
        .update(req.body)
        .digest('hex');

    // Constant-time compare
    if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
        return res.status(401).send('Invalid signature');
    }

    const event = JSON.parse(req.body.toString());

    // Idempotency check
    if (processedEvents.has(event.id)) return res.status(200).send('Already processed');
    processedEvents.add(event.id);

    switch (event.type) {
        case 'wallet.deposit.confirmed':
            console.log('Deposit:', event.data.amount, event.data.currency);
            break;
        case 'kyc.approved':
            // unlock user features
            break;
    }

    res.status(200).send('OK');
});

// Laravel webhook controller
use Illuminate\Http\Request;

class FinOsWebhookController extends Controller
{
    public function handle(Request $request)
    {
        $signature = $request->header('X-FinOs-Signature', '');
        $expected = 'sha256=' . hash_hmac(
            'sha256',
            $request->getContent(),
            config('services.finos.webhook_secret')
        );

        if (! hash_equals($expected, $signature)) {
            abort(401, 'Invalid signature');
        }

        $event = $request->json()->all();

        // Idempotency
        if (WebhookEvent::where('event_id', $event['id'])->exists()) {
            return response()->noContent();
        }

        WebhookEvent::create(['event_id' => $event['id'], 'type' => $event['type']]);

        match ($event['type']) {
            'wallet.deposit.confirmed' => app(DepositHandler::class)->handle($event['data']),
            'kyc.approved'             => $this->unlockUser($event['data']),
            default                    => logger()->info('Unhandled webhook', $event),
        };

        return response()->noContent();
    }
}

# Flask / Django webhook handler
import hmac, hashlib
from flask import Flask, request, abort

app = Flask(__name__)
WEBHOOK_SECRET = os.environ['FINOS_WEBHOOK_SECRET']
processed = set()  # use Redis in production

@app.route('/webhooks/finos', methods=['POST'])
def webhook():
    signature = request.headers.get('X-FinOs-Signature', '')
    expected = 'sha256=' + hmac.new(
        WEBHOOK_SECRET.encode(),
        request.data,
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(signature, expected):
        abort(401)

    event = request.json
    if event['id'] in processed:
        return '', 204
    processed.add(event['id'])

    if event['type'] == 'wallet.deposit.confirmed':
        process_deposit(event['data'])
    elif event['type'] == 'kyc.approved':
        unlock_user(event['data'])

    return '', 204