import time, requests

def wait_for_payment(payment_id, timeout=1200):
    """Poll every 10s until confirmed or expired."""
    start = time.time()
    while time.time() - start < timeout:
        r = requests.get(
            f"{GATEWAY_URL}/api/payments/{payment_id}",
            headers={"X-API-Key": API_KEY},
        )
        data = r.json()
        status = data["status"]

        if status == "confirmed":
            print(f"✅ Paid! TX: {data['txid']}")
            return data
        elif status == "expired":
            print("❌ Payment expired")
            return None

        print(f"Status: {status} ({data.get('confirmations',0)} confs)")
        time.sleep(10)

    return None

# Flask webhook handler with HMAC-SHA256 verification
from flask import Flask, request, jsonify
import hmac, hashlib, json, time

app = Flask(__name__)
WEBHOOK_SECRET = "your_webhook_secret_from_dashboard"

@app.route("/webhook/firo", methods=["POST"])
def firo_webhook():
    data = request.json
    sig  = request.headers.get("X-FiroGate-Signature", "")

    # 1. Verify HMAC-SHA256 (sort_keys + compact separators)
    canonical = json.dumps(data, sort_keys=True, separators=(",", ":")).encode()
    expected  = hmac.new(WEBHOOK_SECRET.encode(), canonical, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig):
        return jsonify({"error": "Invalid signature"}), 401

    # 2. Verify timestamp (reject if older than 5 min)
    ts = data.get("timestamp", 0)
    if abs(time.time() - ts) > 300:
        return jsonify({"error": "Stale webhook"}), 400

    # 3. Check nonce (store in DB/Redis to prevent replays)
    nonce = data.get("nonce")
    # if is_nonce_used(nonce): return jsonify({"error": "Replay"}), 409
    # mark_nonce_used(nonce)

    # 4. Process event
    event = data.get("event")
    if event == "payment.confirmed":
        activate_order(data["order_id"], data["merchant_net"], data["txid"])

    return jsonify({"ok": True})

// Express.js webhook handler with HMAC-SHA256 verification
const express = require('express');
const crypto  = require('crypto');

const app    = express();
const SECRET = 'your_webhook_secret';

app.post('/webhook/firo', express.json(), (req, res) => {
  const data = req.body;
  const sig  = req.headers['x-firogate-signature'] || '';

  // 1. Compute HMAC-SHA256 over sorted, compact JSON
  const keys    = Object.keys(data).sort();
  const sorted  = {};
  keys.forEach(k => sorted[k] = data[k]);
  const canonical = JSON.stringify(sorted);
  const expected  = crypto
    .createHmac('sha256', SECRET)
    .update(canonical)
    .digest('hex');

  if (!crypto.timingSafeEqual(
    Buffer.from(expected), Buffer.from(sig)
  )) {
    return res.status(401).json({ error: 'Bad signature' });
  }

  // 2. Verify timestamp (reject if older than 5 min)
  const ts = data.timestamp || 0;
  if (Math.abs(Date.now() / 1000 - ts) > 300) {
    return res.status(400).json({ error: 'Stale webhook' });
  }

  // 3. Process event
  const { event, order_id, merchant_net, txid } = data;
  if (event === 'payment.confirmed') {
    activateOrder(order_id, merchant_net, txid);
  }
  res.json({ ok: true });
});

// Poll payment status until confirmed
async function waitForPayment(paymentId, intervalMs = 10000) {
  return new Promise((resolve, reject) => {
    const iv = setInterval(async () => {
      const res = await fetch(
        `${GATEWAY_URL}/api/payments/${paymentId}`,
        { headers: { 'X-API-Key': API_KEY } }
      );
      const data = await res.json();

      if (data.status === 'confirmed') {
        clearInterval(iv);
        resolve(data);
      } else if (data.status === 'expired') {
        clearInterval(iv);
        reject(new Error('Payment expired'));
      }
    }, intervalMs);
  });
}

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.util.*;
import com.google.gson.*;

public class WebhookVerifier {
    static final String SECRET = "your_webhook_secret";

    public static boolean verify(String jsonBody, String signature)
            throws Exception {
        // Parse + sort keys for canonical JSON
        JsonObject obj = JsonParser.parseString(jsonBody).getAsJsonObject();
        TreeMap<String, JsonElement> sorted = new TreeMap<>();
        obj.entrySet().forEach(e -> sorted.put(e.getKey(), e.getValue()));
        String canonical = new Gson().toJson(sorted);

        // HMAC-SHA256
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(SECRET.getBytes(), "HmacSHA256"));
        byte[] hash = mac.doFinal(canonical.getBytes());
        StringBuilder hex = new StringBuilder();
        for (byte b : hash) hex.append(String.format("%02x", b));

        return hex.toString().equals(signature);
    }
}

// Spring Boot controller:
// String sig = request.getHeader("X-FiroGate-Signature");
// if (!WebhookVerifier.verify(body, sig)) return 401;

using System.Security.Cryptography;
using System.Text;
using System.Text.Json;

static bool VerifyWebhook(
    string jsonBody, string signature, string secret)
{
    // Parse + sort keys for canonical JSON
    var dict = JsonSerializer.Deserialize
        <SortedDictionary<string, JsonElement>>(jsonBody);
    var canonical = JsonSerializer.Serialize(dict);

    // HMAC-SHA256
    using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
    var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(canonical));
    var expected = Convert.ToHexString(hash).ToLower();

    return CryptographicOperations
        .FixedTimeEquals(
            Encoding.UTF8.GetBytes(expected),
            Encoding.UTF8.GetBytes(signature));
}

// ASP.NET Core:
// var sig = Request.Headers["X-FiroGate-Signature"];
// if (!VerifyWebhook(body, sig, SECRET)) return Unauthorized();

<?php
// webhook.php — HMAC-SHA256 verification
define('WEBHOOK_SECRET', 'your_webhook_secret');

$body = file_get_contents('php://input');
$data = json_decode($body, true);
$sig  = $_SERVER['HTTP_X_FIROGATE_SIGNATURE'] ?? '';

// Sort keys + compact JSON to match server-side signing
ksort($data);
$canonical = json_encode($data, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
$expected  = hash_hmac('sha256', $canonical, WEBHOOK_SECRET);

if (!hash_equals($expected, $sig)) {
    http_response_code(401);
    exit('Bad signature');
}

// Verify timestamp
$ts = $data['timestamp'] ?? 0;
if (abs(time() - $ts) > 300) {
    http_response_code(400);
    exit('Stale webhook');
}

if ($data['event'] === 'payment.confirmed') {
    $orderId = $data['order_id'];
    $netFiro = $data['merchant_net'];
    activateOrder($orderId, $netFiro);
}

echo json_encode(['ok' => true]);

package main

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "io"
    "math"
    "net/http"
    "time"
)

const WebhookSecret = "your_webhook_secret"

func webhookHandler(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)
    sig      := r.Header.Get("X-FiroGate-Signature")

    // Parse + re-marshal (Go sorts map keys by default)
    var data map[string]interface{}
    json.Unmarshal(body, &data)
    canonical, _ := json.Marshal(data)

    // Verify HMAC-SHA256
    mac := hmac.New(sha256.New, []byte(WebhookSecret))
    mac.Write(canonical)
    expected := hex.EncodeToString(mac.Sum(nil))

    if !hmac.Equal([]byte(expected), []byte(sig)) {
        http.Error(w, "Unauthorized", 401)
        return
    }

    // Verify timestamp
    ts, _ := data["timestamp"].(float64)
    if math.Abs(float64(time.Now().Unix())-ts) > 300 {
        http.Error(w, "Stale", 400)
        return
    }

    if data["event"] == "payment.confirmed" {
        fmt.Println("Payment confirmed:", data["order_id"])
    }
    w.Header().Set("Content-Type", "application/json")
    w.Write([]byte(`{"ok":true}`))
}

require 'sinatra'
require 'openssl'
require 'json'

WEBHOOK_SECRET = 'your_webhook_secret'

post '/webhook/firo' do
  body = request.body.read
  data = JSON.parse(body)
  sig  = request.env['HTTP_X_FIROGATE_SIGNATURE']

  # Sort keys + compact JSON to match server signing
  canonical = JSON.generate(data.sort.to_h)
  expected  = OpenSSL::HMAC.hexdigest('SHA256', WEBHOOK_SECRET, canonical)

  halt 401 unless Rack::Utils.secure_compare(expected, sig.to_s)

  # Verify timestamp
  ts = data['timestamp'].to_i
  halt 400 if (Time.now.to_i - ts).abs > 300

  if data['event'] == 'payment.confirmed'
    activate_order(data['order_id'], data['merchant_net'])
  end

  {ok: true}.to_json
end

use hmac::{Hmac, Mac};
use sha2::Sha256;
use serde_json::Value;
use std::collections::BTreeMap;

type HmacSha256 = Hmac<Sha256>;

fn verify_webhook(
    json_body: &str, signature: &str, secret: &str,
) -> bool {
    // Parse + BTreeMap auto-sorts keys
    let data: BTreeMap<String, Value> =
        serde_json::from_str(json_body).unwrap();
    let canonical = serde_json::to_string(&data).unwrap();

    // HMAC-SHA256
    let mut mac = HmacSha256::new_from_slice(
        secret.as_bytes()).unwrap();
    mac.update(canonical.as_bytes());
    let result = mac.finalize();
    let expected = hex::encode(result.into_bytes());

    // Constant-time compare
    expected == signature
}

// Actix-web / Axum handler:
// let sig = req.headers().get("X-FiroGate-Signature");
// if !verify_webhook(&body, sig, SECRET) { return 401; }

curl https://api.firogate.com/api/payments/PAYMENT_ID \
  -H "X-API-Key: fgate_your_api_key"

curl "https://api.firogate.com/api/payments/?limit=10&status=confirmed" \
  -H "X-API-Key: fgate_your_api_key"

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  // Sort keys + compact JSON to match server signing
  const keys   = Object.keys(payload).sort();
  const sorted = {};
  keys.forEach(k => sorted[k] = payload[k]);
  const canonical = JSON.stringify(sorted);

  const expected = crypto
    .createHmac('sha256', secret)
    .update(canonical)
    .digest('hex');
  try {
    return crypto.timingSafeEqual(
      Buffer.from(expected), Buffer.from(signature)
    );
  } catch { return false; }
}

// Usage in Express:
const sig = req.headers['x-firogate-signature'];
if (!verifyWebhook(req.body, sig, SECRET)) { ... }

function verifyWebhook($data, $signature, $secret): bool {
    // Sort keys + compact JSON
    ksort($data);
    $canonical = json_encode($data, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    $expected  = hash_hmac('sha256', $canonical, $secret);
    return hash_equals($expected, $signature);
}

// Usage
$body = file_get_contents('php://input');
$data = json_decode($body, true);
$sig  = $_SERVER['HTTP_X_FIROGATE_SIGNATURE'] ?? '';
if (!verifyWebhook($data, $sig, WEBHOOK_SECRET)) {
    http_response_code(401); exit;
}

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "sort"
)

func verifyWebhook(data map[string]interface{}, signature, secret string) bool {
    // json.Marshal sorts keys by default in Go
    canonical, _ := json.Marshal(data)
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write(canonical)
    expected := hex.EncodeToString(mac.Sum(nil))
    return hmac.Equal([]byte(expected), []byte(signature))
}

// Usage: sig = r.Header.Get("X-FiroGate-Signature")

# pip install requests[socks]
import requests

ONION_URL = "http://yourxxx.onion"
API_KEY   = "fgate_your_api_key"

proxies = {
    "http":  "socks5h://127.0.0.1:9050",
    "https": "socks5h://127.0.0.1:9050",
}

r = requests.post(
    f"{ONION_URL}/api/payments/create",
    json={
        "amount_firo":     2.5,
        "order_id":        "ORD-1234",
        "timeout_minutes": 20,
    },
    headers={"X-API-Key": API_KEY},
    proxies=proxies,
    timeout=30,
)
payment = r.json()
print(f"Checkout: {payment['checkout_url']}")

// npm install socks-proxy-agent node-fetch
const { SocksProxyAgent } = require('socks-proxy-agent');
const fetch = require('node-fetch');

const ONION_URL = 'http://yourxxx.onion';
const API_KEY   = 'fgate_your_api_key';
const agent     = new SocksProxyAgent('socks5h://127.0.0.1:9050');

const res = await fetch(`${ONION_URL}/api/payments/create`, {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
    'X-API-Key': API_KEY,
  },
  body: JSON.stringify({
    amount_firo: 2.5, order_id: 'ORD-1234', timeout_minutes: 20,
  }),
  agent,
});
const payment = await res.json();
console.log(`Checkout: ${payment.checkout_url}`);