App đặt lịch thu cọc: cọc vào là lịch tự giữ

curl -s -X POST https://api.monapay.vn/api/v1/checkouts \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Client-Secret: $CLIENT_SECRET" \
  -H "Idempotency-Key: checkout-LICH-123" \
  -H 'Content-Type: application/json' \
  -d '{"amount":100000,"order_code":"LICH-123","description":"Dat coc lich 123","return_url":"https://app.vn/return","expires_in":900}'

curl -X POST https://api.monapay.vn/api/v1/checkouts/{id}/expire-now \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Client-Secret: $CLIENT_SECRET"

const express = require('express');
const crypto = require('crypto');
const app = express();

const SECRET = process.env.MONA_WEBHOOK_SECRET;

// Phải lấy rawBody bằng express.raw để tính chuẩn chữ ký
app.post('/webhook/monapay', express.raw({ type: 'application/json' }), async (req, res) => {
  const timestamp = req.header('X-Mona-Timestamp') || '';
  const signature = req.header('X-Mona-Signature') || '';
  const rawBody = req.body.toString('utf8');

  // Chặn replay
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(400).send('timestamp qua han');
  }

  // Xác minh chữ ký
  const expected = 'sha256=' + crypto.createHmac('sha256', SECRET).update(timestamp + '.' + rawBody).digest('hex');
  const hopLe = signature.length === expected.length && crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  if (!hopLe) return res.status(401).send('sai chu ky');

  // Trả kết quả sớm
  res.status(200).send('OK');

  const payload = JSON.parse(rawBody);
  const event = payload.event || payload.event_type;
  
  if (event === 'CHECKOUT_PAID') {
    // TODO: Chống trùng bằng transaction_code (dùng INSERT IGNORE hoặc ON CONFLICT DO NOTHING)
    // await updateBooking(payload.order_code, { status: 'confirmed' });
  }
});

app.listen(3000, () => console.log('Webhook dang chay o cong 3000'));

curl -X POST https://api.monapay.vn/api/v1/sandbox/transactions \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Client-Secret: $CLIENT_SECRET" \
  -H 'Content-Type: application/json' \
  -d '{"amount":100000,"description":"Dat coc lich 123"}'