Stripe không mở cho Việt Nam: dev thu tiền khách Việt bằng gì cho nhanh

curl -X POST https://api.monapay.vn/api/v1/checkouts \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Client-Secret: $CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 50000,
    "order_code": "ORDER-123",
    "description": "Thanh toan don hang ORDER-123",
    "return_url": "https://your-site.com/success",
    "cancel_url": "https://your-site.com/cancel"
  }'

const express = require('express');
const crypto = require('crypto');
const app = express();

// Chú ý: Phải dùng express.raw() để giữ nguyên raw body cho HMAC
app.post('/api/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-mona-signature']; // header gốc gửi lên là X-Mona-Signature (Node tự lowercase key)
  const timestamp = req.headers['x-mona-timestamp'];
  const webhookSecret = 'YOUR_WEBHOOK_SECRET';
  
  if (!signature || !timestamp) {
    return res.status(400).send('Missing headers');
  }
  
  // Kiểm tra thời gian lệch (không quá 300s)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return res.status(400).send('Timestamp expired');
  }
  
  // Tính chữ ký HMAC-SHA256
  const payload = timestamp + '.' + req.body.toString('utf8');
  const expectedSig = 'sha256=' + crypto.createHmac('sha256', webhookSecret).update(payload).digest('hex');
  
  if (crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSig))) {
    const data = JSON.parse(req.body.toString('utf8'));
    // data là payload phẳng: amount, description, transfer_date, transaction_code, account_number, bank_name, type
    console.log('Nhận tiền thành công:', data.amount, data.transaction_code);
    return res.status(200).json({ status: 'ok' });
  }
  return res.status(400).send('Invalid signature');
});