Bot Telegram/Zalo bán hàng: bot gửi QR, khách chuyển xong bot tự báo

curl -X POST https://api.monapay.vn/api/v1/qr/generate \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Client-Secret: $CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 50000,
    "description": "Thanh toan don 1234",
    "account_number": "SO_TAI_KHOAN_ACB"
  }'

const express = require('express');
const crypto = require('crypto');
const app = express();

app.post('/webhook/monapay', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-mona-signature'];
  const timestamp = req.headers['x-mona-timestamp'];
  const rawBody = req.body.toString('utf8');
  
  if (Math.abs(Date.now() / 1000 - parseInt(timestamp)) > 300) {
    return res.status(400).send('Quá hạn');
  }
  
  const webhookSecret = process.env.WEBHOOK_SECRET; // Không dùng client_secret
  const hmac = crypto.createHmac('sha256', webhookSecret);
  const expectedSignature = 'sha256=' + hmac.update(timestamp + '.' + rawBody).digest('hex');
  
  if (!crypto.timingSafeEqual(Buffer.from(signature || ''), Buffer.from(expectedSignature))) {
    return res.status(401).send('Sai chữ ký');
  }

  const data = JSON.parse(rawBody);
  // data có 7 trường: amount, description, transfer_date, transaction_code, account_number, bank_name, type
  
  console.log(`Đã nhận ${data.amount} VND, mã GD: ${data.transaction_code}`);
  
  // Lưu transaction_code để chống trùng, sau đó gọi bot API báo tin nhắn
  
  res.status(200).send('OK');
});

curl -X POST https://api.monapay.vn/api/v1/sandbox/transactions \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Client-Secret: $CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 50000,
    "description": "Thanh toan don 1234",
    "account_number": "SO_TAI_KHOAN_ACB"
  }'