Webhook Notifikacije

from flask import Flask, request, jsonify
import hmac
import os

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook():
    # 1. Verifikacija tajnog ključa
    expected_secret = os.getenv('WEBHOOK_SECRET')
    received_secret = request.args.get('secret', '')

    if not hmac.compare_digest(expected_secret, received_secret):
        return jsonify({'error': 'Forbidden'}), 403

    # 2. Parsiranje payload-a
    payload = request.get_json()

    if not payload:
        return jsonify({'error': 'Bad Request'}), 400

    # 3. Obrada eventa
    event = payload.get('event')
    data = payload.get('data', {})

    if event == 'invoice.fiscalized':
        # Ažuriraj narudžbinu
        update_order(data['invoice_number'], {
            'pfr_number': data['pfr_number'],
            'fiscalized_at': data['fiscalized_at'],
        })

    elif event == 'invoice.failed':
        # Logiraj grešku
        log_error(data['invoice_number'], data['error_message'])

    return jsonify({'status': 'ok'}), 200

if __name__ == '__main__':
    app.run()

const express = require('express');
const crypto = require('crypto');

const app = express();
app.use(express.json());

app.post('/webhook', (req, res) => {
    // 1. Verifikacija tajnog ključa
    const expectedSecret = process.env.WEBHOOK_SECRET;
    const receivedSecret = req.query.secret || '';

    if (!crypto.timingSafeEqual(
        Buffer.from(expectedSecret),
        Buffer.from(receivedSecret)
    )) {
        return res.status(403).json({ error: 'Forbidden' });
    }

    // 2. Parsiranje payload-a
    const { event, data } = req.body;

    if (!event || !data) {
        return res.status(400).json({ error: 'Bad Request' });
    }

    // 3. Obrada eventa
    switch (event) {
        case 'invoice.fiscalized':
            // Ažuriraj narudžbinu
            updateOrder(data.invoice_number, {
                pfrNumber: data.pfr_number,
                fiscalizedAt: data.fiscalized_at,
            });
            break;

        case 'invoice.failed':
            // Logiraj grešku
            logError(data.invoice_number, data.error_message);
            break;
    }

    res.json({ status: 'ok' });
});

app.listen(3000);

using Microsoft.AspNetCore.Mvc;
using System.Security.Cryptography;
using System.Text;

[ApiController]
[Route("webhook")]
public class WebhookController : ControllerBase
{
    private readonly IConfiguration _config;
    private readonly IOrderService _orderService;

    public WebhookController(IConfiguration config, IOrderService orderService)
    {
        _config = config;
        _orderService = orderService;
    }

    [HttpPost]
    public IActionResult HandleWebhook([FromQuery] string secret, [FromBody] WebhookPayload payload)
    {
        // 1. Verifikacija tajnog ključa
        var expectedSecret = _config["WEBHOOK_SECRET"];
        if (!CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(expectedSecret),
            Encoding.UTF8.GetBytes(secret ?? "")))
        {
            return Forbid();
        }

        // 2. Obrada eventa
        switch (payload.Event)
        {
            case "invoice.fiscalized":
                _orderService.UpdateOrder(payload.Data.InvoiceNumber, new OrderUpdate
                {
                    PfrNumber = payload.Data.PfrNumber,
                    FiscalizedAt = payload.Data.FiscalizedAt
                });
                break;

            case "invoice.failed":
                _orderService.LogError(payload.Data.InvoiceNumber, payload.Data.ErrorMessage);
                break;
        }

        return Ok(new { status = "ok" });
    }
}

public record WebhookPayload(string Event, WebhookData Data);
public record WebhookData(
    int InvoiceId, string PfrNumber, string InvoiceNumber,
    string FiscalizedAt, string ErrorMessage);