App có ví: user nạp bằng QR ngân hàng, tiền vào cộng số dư tự động

curl -X POST https://api.monapay.vn/api/v1/checkouts \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Client-Secret: $CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 500000,
    "description": "Nap tien vao vi user 123",
    "order_code": "NAP-123",
    "return_url": "https://app.com/vi",
    "cancel_url": "https://app.com/vi"
  }'

const express = require('express');
const crypto = require('crypto');
const app = express();
const SECRET = process.env.MONA_WEBHOOK_SECRET; // Secret HMAC cấu hình webhook

app.post('/api/webhooks/monapay', express.raw({ type: 'application/json' }), async (req, res) => {
  const timestamp = req.header('X-Mona-Timestamp') || '';
  const signature = req.header('X-Mona-Signature') || '';
  const rawBody = req.body.toString('utf8');

  // Chặn replay attack lệch quá 300 giây
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return res.status(400).send('timestamp qua han');
  }

  // Verify chữ ký
  const expected = 'sha256=' + crypto.createHmac('sha256', SECRET).update(timestamp + '.' + rawBody).digest('hex');
  if (signature.length !== expected.length || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return res.status(401).send('sai chu ky');
  }

  // Trả 200/201/202 ngay trong 10 giây
  res.status(200).send('OK');

  const payload = JSON.parse(rawBody);
  
  try {
    // Chống trùng bằng transaction_code
    // const inserted = await db.insertIgnore('transactions', { code: payload.transaction_code, amount: payload.amount });
    // if (!inserted) return;
    
    // Cộng credit cho user
    // await db.query('UPDATE users SET credit = credit + ? WHERE id = ?', [payload.amount, user_id]);
  } catch (err) {
    console.error(err);
  }
});

curl -X POST https://api.monapay.vn/api/v1/sandbox/transactions \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Client-Secret: $CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 500000,
    "description": "Nap tien vao vi user 123",
    "account_number": "1234567890"
  }'