Webhooks

// Node.js 18+. npm install express
import crypto from "node:crypto";
import express from "express";

const HASH_KEY = process.env.VNSWITCH_PAYMENT_RESPONSE_HASH_KEY;

function isValidSignature(rawBody, receivedSignature) {
  const expected = Buffer.from(
    crypto.createHmac("sha512", HASH_KEY).update(rawBody).digest("hex"),
    "utf8",
  );
  const received = Buffer.from(receivedSignature ?? "", "utf8");
  return received.length === expected.length && crypto.timingSafeEqual(received, expected);
}

const app = express();

// express.raw keeps the body as a Buffer: the signature covers the exact bytes received.
app.post("/webhooks/vnswitch", express.raw({ type: "application/json" }), (req, res) => {
  if (!isValidSignature(req.body, req.get("X-Webhook-Signature-512"))) {
    return res.status(401).end();
  }
  const event = JSON.parse(req.body.toString("utf8"));
  res.status(200).end(); // acknowledge first
  handleEvent(event).catch(console.error); // then process (see below)
});

async function handleEvent(event) {
  console.log(event.event_id, event.event_type);
}

app.listen(3000);

import hashlib
import hmac
import json
import os

from flask import Flask, abort, request

app = Flask(__name__)
HASH_KEY = os.environ["VNSWITCH_PAYMENT_RESPONSE_HASH_KEY"].encode("utf-8")

def is_valid_signature(raw_body: bytes, received_signature: str) -> bool:
    expected = hmac.new(HASH_KEY, raw_body, hashlib.sha512).hexdigest()
    return hmac.compare_digest(expected.encode(), (received_signature or "").encode())

@app.post("/webhooks/vnswitch")
def vnswitch_webhook():
    raw_body = request.get_data()  # exact bytes received, before any JSON parsing
    if not is_valid_signature(raw_body, request.headers.get("X-Webhook-Signature-512")):
        abort(401)
    event = json.loads(raw_body)
    print(event["event_id"], event["event_type"])  # hand off to a queue in production
    return "", 200

// Java 17+
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

public class WebhookSignature {
    private static final String HASH_KEY = System.getenv("VNSWITCH_PAYMENT_RESPONSE_HASH_KEY");

    // rawBody: the request body bytes exactly as received.
    // receivedSignature: the X-Webhook-Signature-512 header.
    public static boolean isValidSignature(byte[] rawBody, String receivedSignature)
            throws Exception {
        if (receivedSignature == null) {
            return false;
        }
        Mac mac = Mac.getInstance("HmacSHA512");
        mac.init(new SecretKeySpec(HASH_KEY.getBytes(StandardCharsets.UTF_8), "HmacSHA512"));
        byte[] digest = mac.doFinal(rawBody);

        StringBuilder hex = new StringBuilder(digest.length * 2);
        for (byte b : digest) {
            hex.append(String.format("%02x", b));
        }
        return MessageDigest.isEqual(
            hex.toString().getBytes(StandardCharsets.UTF_8),
            receivedSignature.getBytes(StandardCharsets.UTF_8));
    }
}

// Called after the signature check. `db` stands for your own data store.
async function handleEvent(event) {
  // 1. Idempotency: record event_id first; skip if it was already processed.
  const isNew = await db.insertIfAbsent("vnswitch_events", event.event_id);
  if (!isNew) return;

  if (event.content.type !== "payment_details") return;
  const { payment_id } = event.content.object;

  // 2. Out-of-order safety: read the current state from VNSwitch.
  const res = await fetch(`https://sandbox.api.vnswitch.nivc.ai/payments/${payment_id}`, {
    headers: { "api-key": process.env.VNSWITCH_API_KEY },
  });
  const payment = await res.json();

  // 3. Update your order from the fetched status, not from the event type.
  await db.updateOrderPaymentStatus(payment_id, payment.status);
}

import os

import requests

def handle_event(event, db):
    """Called after the signature check. `db` stands for your own data store."""
    # 1. Idempotency: record event_id first; skip if it was already processed.
    if not db.insert_if_absent("vnswitch_events", event["event_id"]):
        return

    if event["content"]["type"] != "payment_details":
        return
    payment_id = event["content"]["object"]["payment_id"]

    # 2. Out-of-order safety: read the current state from VNSwitch.
    resp = requests.get(
        f"https://sandbox.api.vnswitch.nivc.ai/payments/{payment_id}",
        headers={"api-key": os.environ["VNSWITCH_API_KEY"]},
        timeout=30,
    )
    payment = resp.json()

    # 3. Update your order from the fetched status, not from the event type.
    db.update_order_payment_status(payment_id, payment["status"])

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class WebhookHandler {
    // Stands for your own data store.
    interface EventStore {
        boolean insertIfAbsent(String table, String eventId);
        void updateOrderPaymentStatus(String paymentId, String paymentJson);
    }

    // Called after the signature check, with event_id and payment_id read from the JSON body.
    static void handleEvent(String eventId, String paymentId, EventStore db) throws Exception {
        // 1. Idempotency: record event_id first; skip if it was already processed.
        if (!db.insertIfAbsent("vnswitch_events", eventId)) {
            return;
        }

        // 2. Out-of-order safety: read the current state from VNSwitch.
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://sandbox.api.vnswitch.nivc.ai/payments/" + paymentId))
            .header("api-key", System.getenv("VNSWITCH_API_KEY"))
            .GET()
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        // 3. Update your order from the fetched status (parse "status" with your JSON library).
        db.updateOrderPaymentStatus(paymentId, response.body());
    }
}