RazCrypto Payment Gateway

// Webhook Payload Field Explanation
{
  "event": "payment.completed",           // Event type
  "timestamp_iso": "ISO-8601 timestamp",  // Recommended timestamp format
  "timestamp": "Legacy timestamp",        // Backward compatibility
  
  "status": "success",                    // Payment status
  "amount": 0.20000448,                   // Final amount (with random decimal)
  "tx_hash": "0x...",                     // Blockchain transaction hash
  "gateway_id": "UID...",                 // Internal gateway ID
  
  "payment_id": "payid_...",              // Your payment ID
  "invoice_url": "https://...",           // Invoice download URL
  
  // Customer Information
  "mobile_number": "91...",               // Customer mobile
  "email_id": "email@...",                // Customer email
  "username": "username",                 // Customer username (if provided)
  
  // Product Information
  "product_id": "product_id",             // Your product ID
  "subscription_id": "sub_id",            // Your subscription ID
  
  // Custom Data (echoed back from payment creation)
  "custom_data": {
    "order_id": "your_order_id",          // Your order tracking
    "user_id": "your_user_id",            // Your user ID
    // Any additional data you sent
  }
}

// Test Webhook Payload (for development)
{
  "event": "payment.completed",
  "timestamp_iso": "2024-01-15T14:30:00+05:30",
  "status": "success",
  "amount": 1.00012345,
  "tx_hash": "0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
  "gateway_id": "UID12345678",
  "payment_id": "payid_test_123456",
  "timestamp": "2024-01-15T14:30:00+05:30",
  "invoice_url": "https://razcryptogateway.com/invoice/payid_test_123456",
  "redirect_url": "https://yourstore.com/thank-you",
  "mobile_number": "919876543210",
  "email_id": "[email protected]",
  "username": "test_user",
  "product_id": "TEST_PROD_001",
  "subscription_id": "TEST_SUB_001",
  "custom_data": {
    "order_id": "TEST_ORD_001",
    "user_id": "TEST_USER_001",
    "test_mode": true,
    "notes": "This is a test webhook payload"
  }
}

// Use this payload to test your webhook endpoint locally

// webhook.js - Complete Node.js Webhook Handler
const express = require('express');
const crypto = require('crypto');
require('dotenv').config();

const app = express();
const PORT = process.env.PORT || 3000;

// Database connection (using mysql2 as example)
const mysql = require('mysql2/promise');
const pool = mysql.createPool({
    host: process.env.DB_HOST,
    user: process.env.DB_USER,
    password: process.env.DB_PASSWORD,
    database: process.env.DB_NAME,
    waitForConnections: true,
    connectionLimit: 10,
    queueLimit: 0
});

// Use raw body for signature verification
app.post('/webhook/razcrypto',
    express.raw({ type: 'application/json' }),
    async (req, res) => {
        try {
            // 1) Get raw payload and signature
            const payload = req.body.toString('utf8');
            const signature = req.headers['x-razcrypto-signature'] || '';
            
            if (!payload || !signature) {
                return res.status(400).json({
                    error: 'Missing payload or signature'
                });
            }

            // 2) Verify signature
            const expected = crypto
                .createHmac('sha256', process.env.RAZ_WEBHOOK_SECRET)
                .update(payload)
                .digest('hex');

            if (!crypto.timingSafeEqual(
                Buffer.from(expected, 'utf8'),
                Buffer.from(signature, 'utf8')
            )) {
                return res.status(401).json({
                    error: 'Invalid signature',
                    received: signature,
                    expected: expected
                });
            }

            // 3) Parse JSON
            let data;
            try {
                data = JSON.parse(payload);
            } catch (parseError) {
                return res.status(400).json({
                    error: 'Invalid JSON',
                    details: parseError.message
                });
            }

            // 4) Process based on event
            const event = data.event;
            switch (event) {
                case 'payment.completed':
                    await handlePaymentCompleted(data);
                    break;
                    
                case 'payment.failed':
                    await handlePaymentFailed(data);
                    break;
                    
                case 'payment.pending':
                    await handlePaymentPending(data);
                    break;
                    
                default:
                    console.warn(`Unknown event received: ${event}`);
                    // Still return 200 to avoid retries
            }

            // 5) Success response
            res.status(200).json({
                status: 'success',
                message: 'Webhook processed',
                timestamp: new Date().toISOString()
            });

        } catch (error) {
            console.error('Webhook processing error:', error);
            res.status(500).json({
                error: 'Internal server error',
                message: error.message
            });
        }
    }
);

// Payment completed handler
async function handlePaymentCompleted(data) {
    const {
        payment_id,
        amount,
        tx_hash,
        email_id,
        custom_data = {}
    } = data;

    const orderId = custom_data.order_id || payment_id;
    
    try {
        // Update order in database
        const [result] = await pool.execute(`
            UPDATE orders 
            SET status = 'paid',
                payment_id = ?,
                tx_hash = ?,
                paid_amount = ?,
                paid_at = NOW(),
                custom_data = ?
            WHERE order_id = ? OR payment_id = ?
        `, [
            payment_id,
            tx_hash,
            amount,
            JSON.stringify(custom_data),
            orderId,
            payment_id
        ]);

        console.log(`Payment ${payment_id} completed for order ${orderId}`);

        // Send email notification
        if (email_id) {
            await sendPaymentEmail(
                email_id,
                payment_id,
                amount,
                orderId
            );
        }

        // Additional business logic
        await processOrderCompletion(orderId, custom_data);

    } catch (dbError) {
        console.error('Database error:', dbError);
        throw dbError;
    }
}

// Payment failed handler
async function handlePaymentFailed(data) {
    const { payment_id, custom_data = {} } = data;
    
    await pool.execute(`
        UPDATE orders 
        SET status = 'failed',
            failed_at = NOW()
        WHERE payment_id = ?
    `, [payment_id]);
    
    console.log(`Payment ${payment_id} marked as failed`);
}

// Payment pending handler
async function handlePaymentPending(data) {
    const { payment_id, amount } = data;
    console.log(`Payment ${payment_id} is pending: ${amount} USDT`);
    // You might want to update order status to 'pending_payment'
}

// Email sending function
async function sendPaymentEmail(email, paymentId, amount, orderId) {
    // Implement your email sending logic
    // Using nodemailer or your preferred service
    console.log(`Would send email to ${email} for payment ${paymentId}`);
}

// Additional order processing
async function processOrderCompletion(orderId, customData) {
    // Implement your business logic
    // e.g., generate download links, update inventory, etc.
    console.log(`Processing order completion for ${orderId}`);
}

// Start server
app.listen(PORT, () => {
    console.log(`Webhook server listening on port ${PORT}`);
    console.log(`Webhook endpoint: http://localhost:${PORT}/webhook/razcrypto`);
});

module.exports = app;

# webhook.py - Complete Python Webhook Handler
from flask import Flask, request, jsonify
import hmac
import hashlib
import json
import os
from datetime import datetime
import mysql.connector
from mysql.connector import Error
import logging

app = Flask(__name__)
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

# Load configuration
WEBHOOK_SECRET = os.getenv('RAZ_WEBHOOK_SECRET', '')
DB_CONFIG = {
    'host': os.getenv('DB_HOST', 'localhost'),
    'user': os.getenv('DB_USER', 'root'),
    'password': os.getenv('DB_PASSWORD', ''),
    'database': os.getenv('DB_NAME', 'your_database')
}

def get_db_connection():
    """Create database connection"""
    try:
        connection = mysql.connector.connect(**DB_CONFIG)
        return connection
    except Error as e:
        logger.error(f"Database connection error: {e}")
        return None

def verify_signature(payload, signature):
    """Verify HMAC-SHA256 signature"""
    if not WEBHOOK_SECRET:
        logger.error("WEBHOOK_SECRET not configured")
        return False
    
    expected = hmac.new(
        WEBHOOK_SECRET.encode('utf-8'),
        payload.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()
    
    return hmac.compare_digest(expected, signature)

@app.route('/webhook/razcrypto', methods=['POST'])
def handle_webhook():
    """Main webhook handler"""
    try:
        # Get raw payload
        payload = request.get_data(as_text=True)
        if not payload:
            return jsonify({'error': 'Empty payload'}), 400
        
        # Get signature header
        signature = request.headers.get('X-Razcrypto-Signature', '')
        if not signature:
            return jsonify({'error': 'Missing signature'}), 400
        
        # Verify signature
        if not verify_signature(payload, signature):
            return jsonify({'error': 'Invalid signature'}), 401
        
        # Parse JSON
        try:
            data = json.loads(payload)
        except json.JSONDecodeError as e:
            return jsonify({'error': f'Invalid JSON: {str(e)}'}), 400
        
        # Process event
        event = data.get('event', '')
        
        if event == 'payment.completed':
            handle_payment_completed(data)
        elif event == 'payment.failed':
            handle_payment_failed(data)
        elif event == 'payment.pending':
            handle_payment_pending(data)
        else:
            logger.warning(f"Unknown event received: {event}")
            # Still return 200 to prevent retries
        
        # Success response
        return jsonify({
            'status': 'success',
            'message': 'Webhook processed',
            'timestamp': datetime.utcnow().isoformat() + 'Z'
        }), 200
        
    except Exception as e:
        logger.error(f"Webhook processing error: {e}")
        return jsonify({
            'error': 'Internal server error',
            'message': str(e)
        }), 500

def handle_payment_completed(data):
    """Handle payment.completed event"""
    payment_id = data.get('payment_id', '')
    amount = data.get('amount', 0)
    tx_hash = data.get('tx_hash', '')
    email = data.get('email_id', '')
    custom_data = data.get('custom_data', {})
    
    order_id = custom_data.get('order_id', payment_id)
    
    logger.info(f"Payment {payment_id} completed for order {order_id}")
    
    # Update database
    connection = get_db_connection()
    if connection:
        try:
            cursor = connection.cursor()
            cursor.execute("""
                UPDATE orders 
                SET status = 'paid',
                    payment_id = %s,
                    tx_hash = %s,
                    paid_amount = %s,
                    paid_at = NOW(),
                    custom_data = %s
                WHERE order_id = %s OR payment_id = %s
            """, (
                payment_id,
                tx_hash,
                amount,
                json.dumps(custom_data),
                order_id,
                payment_id
            ))
            connection.commit()
            cursor.close()
            
            # Send email notification
            if email:
                send_payment_email(email, payment_id, amount, order_id)
                
            # Additional processing
            process_order_completion(order_id, custom_data)
            
        except Error as e:
            logger.error(f"Database error: {e}")
        finally:
            connection.close()

def handle_payment_failed(data):
    """Handle payment.failed event"""
    payment_id = data.get('payment_id', '')
    
    connection = get_db_connection()
    if connection:
        try:
            cursor = connection.cursor()
            cursor.execute("""
                UPDATE orders 
                SET status = 'failed',
                    failed_at = NOW()
                WHERE payment_id = %s
            """, (payment_id,))
            connection.commit()
            cursor.close()
            logger.info(f"Payment {payment_id} marked as failed")
        except Error as e:
            logger.error(f"Database error: {e}")
        finally:
            connection.close()

def handle_payment_pending(data):
    """Handle payment.pending event"""
    payment_id = data.get('payment_id', '')
    amount = data.get('amount', 0)
    logger.info(f"Payment {payment_id} pending: {amount} USDT")

def send_payment_email(email, payment_id, amount, order_id):
    """Send payment confirmation email"""
    # Implement email sending logic
    # Using smtplib or your preferred email service
    logger.info(f"Would send confirmation email to {email}")

def process_order_completion(order_id, custom_data):
    """Process order completion logic"""
    # Implement your business logic
    logger.info(f"Processing order completion for {order_id}")

if __name__ == '__main__':
    # Start Flask development server
    # In production, use gunicorn or uWSGI
    app.run(
        host='0.0.0.0',
        port=5000,
        debug=os.getenv('FLASK_DEBUG', 'False').lower() == 'true'
    )

// WebhookController.java - Complete Java Webhook Handler
package com.yourcompany.razcrypto;

import org.springframework.web.bind.annotation.*;
import org.springframework.http.*;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;
import java.util.Map;
import org.springframework.beans.factory.annotation.Value;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

@RestController
@RequestMapping("/webhook")
public class WebhookController {
    
    private static final Logger logger = LoggerFactory.getLogger(WebhookController.class);
    
    @Value("${razcrypto.webhook.secret}")
    private String webhookSecret;
    
    @PostMapping("/razcrypto")
    public ResponseEntity> handleWebhook(
            @RequestHeader("X-Razcrypto-Signature") String signature,
            @RequestBody String rawBody) {
        
        try {
            // 1) Verify signature
            if (!verifySignature(rawBody, signature)) {
                logger.error("Invalid signature received");
                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                    .body(Map.of("error", "Invalid signature"));
            }
            
            // 2) Parse JSON
            Map payload;
            try {
                payload = parseJson(rawBody);
            } catch (Exception e) {
                logger.error("Failed to parse JSON", e);
                return ResponseEntity.badRequest()
                    .body(Map.of("error", "Invalid JSON"));
            }
            
            // 3) Process event
            String event = (String) payload.get("event");
            switch (event) {
                case "payment.completed":
                    handlePaymentCompleted(payload);
                    break;
                case "payment.failed":
                    handlePaymentFailed(payload);
                    break;
                case "payment.pending":
                    handlePaymentPending(payload);
                    break;
                default:
                    logger.warn("Unknown event type: {}", event);
            }
            
            // 4) Return success response
            return ResponseEntity.ok(Map.of(
                "status", "success",
                "message", "Webhook processed",
                "timestamp", java.time.Instant.now().toString()
            ));
            
        } catch (Exception e) {
            logger.error("Webhook processing error", e);
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
                .body(Map.of("error", "Internal server error"));
        }
    }
    
    private boolean verifySignature(String payload, String signature) 
            throws NoSuchAlgorithmException, InvalidKeyException {
        
        if (webhookSecret == null || webhookSecret.isEmpty()) {
            throw new IllegalArgumentException("Webhook secret not configured");
        }
        
        Mac sha256Hmac = Mac.getInstance("HmacSHA256");
        SecretKeySpec secretKey = new SecretKeySpec(
            webhookSecret.getBytes(StandardCharsets.UTF_8), 
            "HmacSHA256"
        );
        sha256Hmac.init(secretKey);
        
        byte[] hash = sha256Hmac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
        String expectedSignature = bytesToHex(hash);
        
        return constantTimeCompare(expectedSignature, signature);
    }
    
    private String bytesToHex(byte[] bytes) {
        StringBuilder hexString = new StringBuilder();
        for (byte b : bytes) {
            String hex = Integer.toHexString(0xff & b);
            if (hex.length() == 1) {
                hexString.append('0');
            }
            hexString.append(hex);
        }
        return hexString.toString();
    }
    
    private boolean constantTimeCompare(String a, String b) {
        if (a.length() != b.length()) {
            return false;
        }
        int result = 0;
        for (int i = 0; i < a.length(); i++) {
            result |= a.charAt(i) ^ b.charAt(i);
        }
        return result == 0;
    }
    
    @SuppressWarnings("unchecked")
    private Map parseJson(String json) throws Exception {
        // Use your preferred JSON library (Jackson, Gson, etc.)
        ObjectMapper mapper = new ObjectMapper();
        return mapper.readValue(json, Map.class);
    }
    
    private void handlePaymentCompleted(Map payload) {
        String paymentId = (String) payload.get("payment_id");
        Double amount = (Double) payload.get("amount");
        String txHash = (String) payload.get("tx_hash");
        
        @SuppressWarnings("unchecked")
        Map customData = (Map) payload.get("custom_data");
        String orderId = customData != null ? 
            (String) customData.get("order_id") : paymentId;
        
        // Update database
        updateOrderStatus(orderId, "paid", paymentId, txHash, amount, customData);
        
        // Send email
        String email = (String) payload.get("email_id");
        if (email != null && !email.isEmpty()) {
            sendPaymentEmail(email, paymentId, amount, orderId);
        }
        
        logger.info("Payment {} completed for order {}", paymentId, orderId);
    }
    
    private void handlePaymentFailed(Map payload) {
        String paymentId = (String) payload.get("payment_id");
        updateOrderStatus(paymentId, "failed", null, null, null, null);
        logger.info("Payment {} failed", paymentId);
    }
    
    private void handlePaymentPending(Map payload) {
        String paymentId = (String) payload.get("payment_id");
        Double amount = (Double) payload.get("amount");
        logger.info("Payment {} pending: {} USDT", paymentId, amount);
    }
    
    private void updateOrderStatus(String orderId, String status, 
                                   String paymentId, String txHash, 
                                   Double amount, Map customData) {
        // Implement your database update logic
        // Using JPA, JDBC, or your preferred ORM
        logger.info("Updating order {} to status {}", orderId, status);
    }
    
    private void sendPaymentEmail(String email, String paymentId, 
                                  Double amount, String orderId) {
        // Implement email sending logic
        logger.info("Sending payment email to {} for order {}", email, orderId);
    }
}

// webhook.go - Complete Go Webhook Handler
package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io/ioutil"
    "log"
    "net/http"
    "os"
    "strings"
    "time"
    
    "github.com/gin-gonic/gin"
    "gorm.io/driver/mysql"
    "gorm.io/gorm"
)

// WebhookSecret from environment
var webhookSecret = os.Getenv("RAZ_WEBHOOK_SECRET")

// Database connection
var db *gorm.DB

// WebhookPayload represents the incoming webhook data
type WebhookPayload struct {
    Event       string                 `json:"event"`
    PaymentID   string                 `json:"payment_id"`
    Amount      float64                `json:"amount"`
    TxHash      string                 `json:"tx_hash"`
    Email       string                 `json:"email_id"`
    Mobile      string                 `json:"mobile_number"`
    Timestamp   string                 `json:"timestamp_iso"`
    CustomData  map[string]interface{} `json:"custom_data"`
}

// Order represents your order table
type Order struct {
    gorm.Model
    OrderID     string                 `gorm:"uniqueIndex"`
    PaymentID   string                 `gorm:"index"`
    Status      string                 `gorm:"index"`
    Amount      float64
    TxHash      string
    PaidAt      *time.Time
    FailedAt    *time.Time
    CustomData  string                 `gorm:"type:JSON"`
}

func init() {
    // Initialize database
    dsn := fmt.Sprintf("%s:%s@tcp(%s:%s)/%s?charset=utf8mb4&parseTime=True&loc=Local",
        os.Getenv("DB_USER"),
        os.Getenv("DB_PASSWORD"),
        os.Getenv("DB_HOST"),
        os.Getenv("DB_PORT"),
        os.Getenv("DB_NAME"),
    )
    
    var err error
    db, err = gorm.Open(mysql.Open(dsn), &gorm.Config{})
    if err != nil {
        log.Fatal("Failed to connect to database:", err)
    }
    
    // Auto migrate
    db.AutoMigrate(&Order{})
}

func main() {
    // Set Gin mode
    if os.Getenv("GIN_MODE") == "release" {
        gin.SetMode(gin.ReleaseMode)
    }
    
    router := gin.Default()
    
    // Webhook endpoint
    router.POST("/webhook/razcrypto", handleWebhook)
    
    // Health check
    router.GET("/health", func(c *gin.Context) {
        c.JSON(http.StatusOK, gin.H{
            "status": "healthy",
            "time":   time.Now().UTC(),
        })
    })
    
    port := os.Getenv("PORT")
    if port == "" {
        port = "8080"
    }
    
    log.Printf("Starting webhook server on port %s", port)
    if err := router.Run(":" + port); err != nil {
        log.Fatal("Failed to start server:", err)
    }
}

func handleWebhook(c *gin.Context) {
    // 1) Get signature header
    signature := c.GetHeader("X-Razcrypto-Signature")
    if signature == "" {
        c.JSON(http.StatusBadRequest, gin.H{
            "error": "Missing signature header",
        })
        return
    }
    
    // 2) Read raw body
    body, err := ioutil.ReadAll(c.Request.Body)
    if err != nil {
        c.JSON(http.StatusBadRequest, gin.H{
            "error": "Failed to read request body",
        })
        return
    }
    
    // 3) Verify signature
    if !verifySignature(body, signature) {
        c.JSON(http.StatusUnauthorized, gin.H{
            "error": "Invalid signature",
        })
        return
    }
    
    // 4) Parse JSON
    var payload WebhookPayload
    if err := json.Unmarshal(body, &payload); err != nil {
        c.JSON(http.StatusBadRequest, gin.H{
            "error": "Invalid JSON format",
            "details": err.Error(),
        })
        return
    }
    
    // 5) Process based on event
    switch payload.Event {
    case "payment.completed":
        if err := handlePaymentCompleted(payload); err != nil {
            log.Printf("Error handling payment.completed: %v", err)
            c.JSON(http.StatusInternalServerError, gin.H{
                "error": "Failed to process payment",
            })
            return
        }
        
    case "payment.failed":
        if err := handlePaymentFailed(payload); err != nil {
            log.Printf("Error handling payment.failed: %v", err)
        }
        
    case "payment.pending":
        log.Printf("Payment pending: %s - %f", payload.PaymentID, payload.Amount)
        
    default:
        log.Printf("Unknown event received: %s", payload.Event)
    }
    
    // 6) Success response
    c.JSON(http.StatusOK, gin.H{
        "status":  "success",
        "message": "Webhook processed successfully",
        "time":    time.Now().UTC(),
    })
}

func verifySignature(body []byte, signature string) bool {
    if webhookSecret == "" {
        log.Println("Webhook secret not configured")
        return false
    }
    
    h := hmac.New(sha256.New, []byte(webhookSecret))
    h.Write(body)
    expected := hex.EncodeToString(h.Sum(nil))
    
    return hmac.Equal([]byte(expected), []byte(signature))
}

func handlePaymentCompleted(payload WebhookPayload) error {
    // Get order ID from custom data or use payment ID
    orderID := payload.PaymentID
    if payload.CustomData != nil {
        if id, ok := payload.CustomData["order_id"].(string); ok {
            orderID = id
        }
    }
    
    // Convert custom data to JSON string
    customDataJSON, _ := json.Marshal(payload.CustomData)
    
    // Update or create order
    var order Order
    result := db.Where("order_id = ?", orderID).First(&order)
    
    now := time.Now()
    if result.Error == gorm.ErrRecordNotFound {
        // Create new order
        order = Order{
            OrderID:    orderID,
            PaymentID:  payload.PaymentID,
            Status:     "paid",
            Amount:     payload.Amount,
            TxHash:     payload.TxHash,
            PaidAt:     &now,
            CustomData: string(customDataJSON),
        }
        if err := db.Create(&order).Error; err != nil {
            return fmt.Errorf("failed to create order: %v", err)
        }
    } else {
        // Update existing order
        order.Status = "paid"
        order.PaymentID = payload.PaymentID
        order.Amount = payload.Amount
        order.TxHash = payload.TxHash
        order.PaidAt = &now
        order.CustomData = string(customDataJSON)
        if err := db.Save(&order).Error; err != nil {
            return fmt.Errorf("failed to update order: %v", err)
        }
    }
    
    log.Printf("Payment %s completed for order %s", payload.PaymentID, orderID)
    
    // Send email notification
    if payload.Email != "" {
        go sendPaymentEmail(payload.Email, payload.PaymentID, payload.Amount, orderID)
    }
    
    return nil
}

func handlePaymentFailed(payload WebhookPayload) error {
    now := time.Now()
    result := db.Model(&Order{}).
        Where("payment_id = ?", payload.PaymentID).
        Updates(map[string]interface{}{
            "status":    "failed",
            "failed_at": &now,
        })
    
    if result.Error != nil {
        return fmt.Errorf("failed to update order: %v", result.Error)
    }
    
    log.Printf("Payment %s marked as failed", payload.PaymentID)
    return nil
}

func sendPaymentEmail(email, paymentID string, amount float64, orderID string) {
    // Implement email sending using your preferred service
    log.Printf("Sending payment confirmation to %s for order %s", email, orderID)
}

# webhook.rb - Complete Ruby Webhook Handler
require 'sinatra'
require 'json'
require 'openssl'
require 'mysql2'
require 'dotenv/load'

# Configuration
WEBHOOK_SECRET = ENV['RAZ_WEBHOOK_SECRET']
DB_CONFIG = {
  host: ENV['DB_HOST'] || 'localhost',
  username: ENV['DB_USER'],
  password: ENV['DB_PASSWORD'],
  database: ENV['DB_NAME']
}

# Database connection
def db_connection
  @db ||= Mysql2::Client.new(DB_CONFIG)
end

# Sinatra application
class WebhookApp < Sinatra::Base
  set :port, ENV['PORT'] || 4567
  set :environment, ENV['RACK_ENV'] || 'development'
  
  # Webhook endpoint
  post '/webhook/razcrypto' do
    content_type :json
    
    begin
      # 1) Get signature header
      signature = request.env['HTTP_X_RAZCRYPTO_SIGNATURE']
      unless signature
        status 400
        return { error: 'Missing signature header' }.to_json
      end
      
      # 2) Get raw request body
      request.body.rewind
      payload = request.body.read
      
      # 3) Verify signature
      unless verify_signature(payload, signature)
        status 401
        return { error: 'Invalid signature' }.to_json
      end
      
      # 4) Parse JSON
      begin
        data = JSON.parse(payload)
      rescue JSON::ParserError => e
        status 400
        return { error: 'Invalid JSON', details: e.message }.to_json
      end
      
      # 5) Process event
      event = data['event']
      case event
      when 'payment.completed'
        handle_payment_completed(data)
      when 'payment.failed'
        handle_payment_failed(data)
      when 'payment.pending'
        handle_payment_pending(data)
      else
        puts "Unknown event received: #{event}"
      end
      
      # 6) Success response
      status 200
      {
        status: 'success',
        message: 'Webhook processed',
        timestamp: Time.now.utc.iso8601
      }.to_json
      
    rescue => e
      puts "Webhook processing error: #{e.message}"
      puts e.backtrace
      
      status 500
      { error: 'Internal server error', message: e.message }.to_json
    end
  end
  
  # Health check endpoint
  get '/health' do
    content_type :json
    { status: 'healthy', time: Time.now.utc.iso8601 }.to_json
  end
  
  private
  
  def verify_signature(payload, signature)
    return false unless WEBHOOK_SECRET
    
    expected = OpenSSL::HMAC.hexdigest(
      'sha256',
      WEBHOOK_SECRET,
      payload
    )
    
    # Constant time comparison to prevent timing attacks
    OpenSSL.fixed_length_secure_compare(expected, signature)
  end
  
  def handle_payment_completed(data)
    payment_id = data['payment_id']
    amount = data['amount'].to_f
    tx_hash = data['tx_hash']
    email = data['email_id']
    custom_data = data['custom_data'] || {}
    
    order_id = custom_data['order_id'] || payment_id
    
    puts "Payment #{payment_id} completed for order #{order_id}"
    
    # Update database
    custom_data_json = custom_data.to_json
    
    db_connection.query("
      INSERT INTO orders (
        order_id, payment_id, status, amount, 
        tx_hash, paid_at, custom_data, created_at, updated_at
      ) VALUES (
        '#{db_connection.escape(order_id)}',
        '#{db_connection.escape(payment_id)}',
        'paid',
        #{amount},
        '#{db_connection.escape(tx_hash)}',
        NOW(),
        '#{db_connection.escape(custom_data_json)}',
        NOW(),
        NOW()
      ) ON DUPLICATE KEY UPDATE
        status = 'paid',
        payment_id = '#{db_connection.escape(payment_id)}',
        amount = #{amount},
        tx_hash = '#{db_connection.escape(tx_hash)}',
        paid_at = NOW(),
        custom_data = '#{db_connection.escape(custom_data_json)}',
        updated_at = NOW()
    ")
    
    # Send email notification
    send_payment_email(email, payment_id, amount, order_id) if email
    
    # Additional processing
    process_order_completion(order_id, custom_data)
  end
  
  def handle_payment_failed(data)
    payment_id = data['payment_id']
    
    puts "Payment #{payment_id} failed"
    
    db_connection.query("
      UPDATE orders 
      SET status = 'failed',
          failed_at = NOW(),
          updated_at = NOW()
      WHERE payment_id = '#{db_connection.escape(payment_id)}'
    ")
  end
  
  def handle_payment_pending(data)
    payment_id = data['payment_id']
    amount = data['amount'].to_f
    
    puts "Payment #{payment_id} pending: #{amount} USDT"
  end
  
  def send_payment_email(email, payment_id, amount, order_id)
    # Implement email sending using your preferred gem
    # Example with Mail gem:
    # mail = Mail.new do
    #   to email
    #   subject "Payment Confirmed - Order ##{order_id}"
    #   body "Your payment of #{amount} USDT has been confirmed."
    # end
    # mail.deliver!
    
    puts "Would send payment confirmation email to #{email}"
  end
  
  def process_order_completion(order_id, custom_data)
    # Implement your business logic
    puts "Processing order completion for #{order_id}"
  end
end

# Run the application
if __FILE__ == $0
  WebhookApp.run!
end