Supabase Edge Function nhận webhook, cập nhật bảng orders

import { serve } from "https://deno.land/[email protected]/http/server.ts"
import { createClient } from "https://esm.sh/@supabase/supabase-js@2"

const encoder = new TextEncoder()

function hexToBytes(hex: string) {
  const bytes = new Uint8Array(hex.length / 2)
  for (let i = 0; i < hex.length; i += 2) {
    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16)
  }
  return bytes
}

async function verifyHmac(secret: string, timestamp: string, rawBody: string, signature: string) {
  const key = await crypto.subtle.importKey(
    'raw',
    encoder.encode(secret),
    { name: 'HMAC', hash: 'SHA-256' },
    false,
    ['verify']
  )
  const data = encoder.encode(timestamp + '.' + rawBody)
  const sigHex = signature.replace('sha256=', '')
  const sigBytes = hexToBytes(sigHex)
  return await crypto.subtle.verify('HMAC', key, sigBytes, data)
}

serve(async (req) => {
  if (req.method !== 'POST') return new Response('Method Not Allowed', { status: 405 })

  const secret = Deno.env.get('MONA_WEBHOOK_SECRET')
  const timestamp = req.headers.get('x-mona-timestamp') || '' // Header gốc: X-Mona-Timestamp
  const signature = req.headers.get('x-mona-signature') || '' // Header gốc: X-Mona-Signature, dạng sha256=<hex>
  const rawBody = await req.text() // BẮT BUỘC dùng raw body

  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) {
    return new Response('timestamp qua han', { status: 400 })
  }

  if (!secret || !(await verifyHmac(secret, timestamp, rawBody, signature))) {
    return new Response('sai chu ky', { status: 401 })
  }

  const payload = JSON.parse(rawBody)

  // Khởi tạo Supabase Client bằng SERVICE_ROLE_KEY để vượt qua RLS
  const supabase = createClient(
    Deno.env.get('SUPABASE_URL') ?? '',
    Deno.env.get('SUPABASE_SERVICE_ROLE_KEY') ?? ''
  )

  // Lưu giao dịch để chống trùng (bảng bank_transactions với UNIQUE transaction_code)
  const { error } = await supabase
    .from('bank_transactions')
    .insert({
      transaction_code: payload.transaction_code,
      amount: payload.amount,
      description: payload.description,
      transfer_date: payload.transfer_date,
      account_number: payload.account_number,
      bank_name: payload.bank_name,
      type: payload.type
    })

  if (error && error.code !== '23505') {
    return new Response(error.message, { status: 500 })
  }

  if (!error) {
    // TODO: Khớp đơn hàng theo payload.description và cập nhật bảng orders
  }

  return new Response('OK', { status: 200 })
})