Webhook Notifikacije

from flask import Flask, request, jsonify
import hmac
import os

app = Flask(__name__)

@app.route('/webhook', methods=['POST'])
def webhook():
    # 1. Verifikacija tajnog ključa (query parametar)
    # os.environ.get sa default '' — nikad None, nema TypeError u compare_digest
    expected_secret = os.environ.get('WEBHOOK_SECRET', '')
    received_secret = request.args.get('key', '')

    # Odbijte zahtev ako secret nije konfigurisan
    if not expected_secret:
        return jsonify({'error': 'Server misconfigured'}), 500

    if not hmac.compare_digest(expected_secret, received_secret):
        return jsonify({'error': 'Forbidden'}), 403

    # 2. Parsiranje payload-a
    payload = request.get_json()

    if not payload:
        return jsonify({'error': 'Bad Request'}), 400

    # 3. Obrada eventa
    # Svi podaci o računu nalaze se unutar payload['data']
    event = payload.get('event')
    data  = payload.get('data', {})

    if event == 'invoice.fiscalized':
        # Ažuriraj narudžbinu
        update_order(data['invoice_number'], {
            'pfr_broj':        data['pfr_broj'],
            'ukupan_iznos':    data['ukupan_iznos'],
            'datum_izdavanja': data['datum_izdavanja'],
        })

        # Email kupcu — adresa je u data['kupac']['email'] (ako postoji)
        kupac_email = data.get('kupac', {}).get('email')
        if kupac_email:
            send_fiscal_receipt_email(kupac_email, data['pfr_broj'])

    elif event == 'invoice.failed':
        # Logiraj grešku
        log_error(data.get('invoice_number'), data.get('error_message'))

    return jsonify({'status': 'ok'}), 200

if __name__ == '__main__':
    app.run()

const express = require('express');
const crypto  = require('crypto');

const app = express();
app.use(express.json());

// timingSafeEqual baca RangeError ako bufferi nisu iste dužine.
// Rešenje: hešujemo oba niza na SHA-256 pre poređenja (uvek 32 bajta).
function safeCompare(a, b) {
    const hashA = crypto.createHash('sha256').update(a).digest();
    const hashB = crypto.createHash('sha256').update(b).digest();
    return crypto.timingSafeEqual(hashA, hashB);
}

app.post('/webhook', (req, res) => {
    // 1. Verifikacija tajnog ključa (query parametar)
    const expectedSecret = process.env.WEBHOOK_SECRET || '';
    const receivedSecret = req.query.key  || '';

    // Odbijte zahtev ako secret nije konfigurisan
    if (!expectedSecret) {
        return res.status(500).json({ error: 'Server misconfigured' });
    }

    if (!safeCompare(expectedSecret, receivedSecret)) {
        return res.status(403).json({ error: 'Forbidden' });
    }

    // 2. Parsiranje payload-a
    // Svi podaci o računu nalaze se unutar req.body.data
    const { event, data } = req.body;

    if (!event || !data) {
        return res.status(400).json({ error: 'Bad Request' });
    }

    // 3. Obrada eventa
    switch (event) {
        case 'invoice.fiscalized':
            // Ažuriraj narudžbinu
            updateOrder(data.invoice_number, {
                pfrBroj:        data.pfr_broj,
                ukupanIznos:    data.ukupan_iznos,
                datumIzdavanja: data.datum_izdavanja,
            });

            // Email kupcu — adresa je u data.kupac?.email (ako postoji)
            if (data.kupac?.email) {
                sendFiscalReceiptEmail(data.kupac.email, data.pfr_broj);
            }
            break;

        case 'invoice.failed':
            // Logiraj grešku
            logError(data.invoice_number, data.error_message);
            break;
    }

    res.json({ status: 'ok' });
});

app.listen(3000);

using Microsoft.AspNetCore.Mvc;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json.Serialization;

[ApiController]
[Route("webhook")]
public class WebhookController : ControllerBase
{
    private readonly IConfiguration _config;
    private readonly IOrderService _orderService;

    public WebhookController(IConfiguration config, IOrderService orderService)
    {
        _config = config;
        _orderService = orderService;
    }

    [HttpPost]
    public IActionResult HandleWebhook([FromQuery] string key, [FromBody] WebhookPayload payload)
    {
        // 1. Verifikacija tajnog ključa (query parametar)
        var expectedSecret = _config["WEBHOOK_SECRET"] ?? "";
        if (!CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(expectedSecret),
            Encoding.UTF8.GetBytes(key ?? "")))
        {
            return Forbid();
        }

        // 2. Obrada eventa
        // Svi podaci o računu nalaze se unutar payload.Data
        switch (payload.Event)
        {
            case "invoice.fiscalized":
                _orderService.UpdateOrder(payload.Data.InvoiceNumber, new OrderUpdate
                {
                    PfrBroj        = payload.Data.PfrBroj,
                    UkupanIznos    = payload.Data.UkupanIznos,
                    DatumIzdavanja = payload.Data.DatumIzdavanja,
                });

                // Email kupcu — adresa je u Data.Kupac?.Email (ako postoji)
                if (payload.Data.Kupac?.Email != null)
                {
                    _orderService.SendFiscalReceiptEmail(payload.Data.Kupac.Email, payload.Data.PfrBroj);
                }
                break;

            case "invoice.failed":
                _orderService.LogError(payload.Data.InvoiceNumber, payload.Data.ErrorMessage);
                break;
        }

        return Ok(new { status = "ok" });
    }
}

// Modeli payload-a (sva polja su u Data objektu)
public record WebhookPayload(
    [property: JsonPropertyName("event")]     string Event,
    [property: JsonPropertyName("timestamp")] string Timestamp,
    [property: JsonPropertyName("data")]      WebhookData Data
);

public record WebhookData(
    [property: JsonPropertyName("invoice_id")]     int? InvoiceId,
    [property: JsonPropertyName("invoice_number")] string? InvoiceNumber,
    [property: JsonPropertyName("success")]        bool Success,
    [property: JsonPropertyName("pfr_broj")]       string? PfrBroj,
    [property: JsonPropertyName("ukupan_iznos")]   string? UkupanIznos,
    [property: JsonPropertyName("datum_izdavanja")]string? DatumIzdavanja,
    [property: JsonPropertyName("tip_racuna")]     string? TipRacuna,
    [property: JsonPropertyName("tip_transakcije")]string? TipTransakcije,
    [property: JsonPropertyName("nacin_placanja")] string? NacinPlacanja,
    [property: JsonPropertyName("kupac")]          WebhookKupac? Kupac,
    [property: JsonPropertyName("error_message")]  string? ErrorMessage
);

public record WebhookKupac(
    [property: JsonPropertyName("ime")]    string? Ime,
    [property: JsonPropertyName("pib")]    string? Pib,
    [property: JsonPropertyName("jmbg")]   string? Jmbg,
    [property: JsonPropertyName("adresa")] string? Adresa,
    [property: JsonPropertyName("email")]  string? Email
);