Tài liệu tích hợp

POST /api/v1/events/ingest
Authorization: Bearer sp_live_...
Content-Type: application/json

{
  "bank_id": "MB",
  "account_number": "9981468491",
  "external_id": "txn-unique-id",
  "amount_vnd": 50000,
  "transfer_content": "NAP STABCDEF1234"
}

POST /api/v1/events/batch
Authorization: Bearer sp_live_...
Content-Type: application/json

{
  "events": [
    {
      "bank_id": "MB",
      "account_number": "9981468491",
      "external_id": "txn-1",
      "amount_vnd": 50000,
      "transfer_content": "STCODE123"
    }
  ]
}

POST {url_thong_bao_shop}
X-StaliPay-Event: payment.matched
X-StaliPay-Timestamp: 1710000000
X-StaliPay-Signature: sha256=...
X-StaliPay-Delivery: {uuid}

{
  "event": "payment.matched",
  "id": "...",
  "data": {
    "amount_vnd": 50000,
    "order_code": "STCODE123",
    "transfer_content": "...",
    "bank_id": "MB",
    "bank_account": "9981468491",
    "reference": "txn-1"
  }
}

GET /api/v1/connector/direct/health

→ {
  "service": "StaliPay Direct",
  "status": "connected",
  "health": { "adapter": "mbbank_unofficial", ... }
}

// functions.php — xác minh chữ ký StaliPay
add_action('rest_api_init', function () {
  register_rest_route('stalipay/v1', '/webhook', [
    'methods' => 'POST',
    'callback' => 'stalipay_handle_webhook',
    'permission_callback' => '__return_true',
  ]);
});

function stalipay_handle_webhook(WP_REST_Request $req) {
  $secret = getenv('STALIPAY_WEBHOOK_SECRET');
  $sig = $req->get_header('x-stalipay-signature');
  $ts = $req->get_header('x-stalipay-timestamp');
  $body = $req->get_body();
  $expected = 'sha256=' . hash_hmac('sha256', $ts . '.' . $body, $secret);
  if (!hash_equals($expected, $sig)) {
    return new WP_Error('invalid_signature', 'Bad signature', ['status' => 401]);
  }
  $data = json_decode($body, true);
  if (($data['event'] ?? '') === 'payment.matched') {
    $order_code = $data['data']['order_code'] ?? '';
    // wc_get_orders / update status → processing
  }
  return ['ok' => true];
}

// Node.js — endpoint webhook Haravan + StaliPay
import crypto from "node:crypto";

export async function POST(req) {
  const secret = process.env.STALIPAY_WEBHOOK_SECRET;
  const body = await req.text();
  const sig = req.headers.get("x-stalipay-signature");
  const ts = req.headers.get("x-stalipay-timestamp");
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(ts + "." + body).digest("hex");
  if (sig !== expected) return new Response("unauthorized", { status: 401 });

  const event = JSON.parse(body);
  if (event.event !== "payment.matched") return Response.json({ ok: true });

  const orderCode = event.data?.order_code;
  // TODO: Haravan API — tìm đơn theo order_code, mark paid
  return Response.json({ ok: true, order_code: orderCode });
}

// Cloudflare Worker — StaliPay → Shopify
export default {
  async fetch(request, env) {
    if (request.method !== "POST") return new Response("method", { status: 405 });
    const body = await request.text();
    const sig = request.headers.get("x-stalipay-signature");
    const ts = request.headers.get("x-stalipay-timestamp");
    const key = await crypto.subtle.importKey(
      "raw",
      new TextEncoder().encode(env.STALIPAY_WEBHOOK_SECRET),
      { name: "HMAC", hash: "SHA-256" },
      false,
      ["sign"],
    );
    const mac = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(ts + "." + body));
    const expected = "sha256=" + [...new Uint8Array(mac)].map(b => b.toString(16).padStart(2, "0")).join("");
    if (sig !== expected) return new Response("unauthorized", { status: 401 });

    const event = JSON.parse(body);
    if (event.event !== "payment.matched") return Response.json({ ok: true });

    const orderCode = event.data?.order_code;
    // Shopify Admin GraphQL: orders search by name/metafield → transactionsCreate
    return Response.json({ ok: true, order_code: orderCode });
  },
};

GET /api/v1/payments/lookup?order_code=STCODE123
Authorization: Bearer sp_live_...