إشعارات Webhook

WATADCASH-Signature: t=UNIX_SECONDS,v1=HMAC_SHA256
WATADCASH-Event-Id: evt_...
WATADCASH-Delivery-Id: dlv_...

<?php
// Verification example. Add durable idempotent processing before returning 2xx.
$raw = file_get_contents('php://input');
$signature = $_SERVER['HTTP_WATADCASH_SIGNATURE'] ?? '';
$secret = getenv('WATADCASH_WEBHOOK_SECRET');
if (!is_string($secret) || !preg_match('/^[a-f0-9]{64}$/D', $secret)
    || !preg_match('/^t=([1-9][0-9]*),v1=([a-f0-9]{64})$/D', $signature, $m)
    || abs(time() - (int) $m[1]) > 300
    || !hash_equals(hash_hmac('sha256', $m[1].'.'.$raw, $secret), $m[2])) {
    http_response_code(401);
    exit;
}
try {
    $event = json_decode($raw, true, 16, JSON_THROW_ON_ERROR);
} catch (JsonException $e) {
    http_response_code(400);
    exit;
}
if (!is_array($event) || !is_string($event['id'] ?? null)
    || $event['id'] !== ($_SERVER['HTTP_WATADCASH_EVENT_ID'] ?? null)) {
    http_response_code(400);
    exit;
}
// In ONE database transaction:
// 1. Insert event.id with a UNIQUE constraint.
// 2. If already processed, return 2xx without applying it again.
// 3. Verify the owned resource, amount and currency; apply the effect once.
// 4. Commit, then return 2xx.
// This example intentionally does not acknowledge unpersisted events.
http_response_code(501); // Replace after implementing the transaction above.