Webhooks & Callbacks

const crypto = require('crypto');

function createCanonicalString(payload) {
  const fields = Object.keys(payload)
    .filter(key => key !== 'signature')
    .sort();

  const parts = [];
  for (const field of fields) {
    if (payload[field] !== undefined && payload[field] !== null) {
      parts.push(`${field}=${payload[field]}`);
    }
  }
  return parts.join('&');
}

function verifySignature(payload, publicKeyPEM) {
  try {
    const canonicalString = createCanonicalString(payload);
    const signature = payload.signature;
    const signatureBuffer = Buffer.from(signature, 'base64');
    const verifier = crypto.createVerify('RSA-SHA256');
    verifier.update(canonicalString);
    return verifier.verify(publicKeyPEM, signatureBuffer);
  } catch (error) {
    console.error('Signature verification failed:', error.message);
    return false;
  }
}

// Usage in your webhook handler
app.post('/webhook', (req, res) => {
  const publicKey = process.env.LAKIPAY_PUBLIC_KEY;

  if (!verifySignature(req.body, publicKey)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Process the webhook
  res.json({ success: true });
});

import java.security.KeyFactory;
import java.security.PublicKey;
import java.security.Signature;
import java.security.spec.X509EncodedKeySpec;
import java.util.*;
import java.util.stream.Collectors;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

public class WebhookVerifier {
  public static String createCanonicalString(Map<String, Object> payload) {
    return payload.keySet().stream()
      .filter(key -> !key.equals("signature"))
      .sorted()
      .map(key -> key + "=" + payload.get(key).toString())
      .collect(Collectors.joining("&"));
  }

  public static boolean verifySignature(Map<String, Object> payload, String publicKeyPEM) {
    try {
      String canonicalString = createCanonicalString(payload);
      String signatureStr = (String) payload.get("signature");
      byte[] signatureBytes = Base64.getDecoder().decode(signatureStr);

      String publicKeyContent = publicKeyPEM
        .replace("-----BEGIN PUBLIC KEY-----", "")
        .replace("-----END PUBLIC KEY-----", "")
        .replaceAll("\\s", "");
      byte[] decodedKey = Base64.getDecoder().decode(publicKeyContent);
      X509EncodedKeySpec spec = new X509EncodedKeySpec(decodedKey);
      KeyFactory kf = KeyFactory.getInstance("RSA");
      PublicKey publicKey = kf.generatePublic(spec);

      Signature sig = Signature.getInstance("SHA256withRSA");
      sig.initVerify(publicKey);
      sig.update(canonicalString.getBytes(StandardCharsets.UTF_8));
      return sig.verify(signatureBytes);
    } catch (Exception e) {
      System.err.println("Signature verification failed: " + e.getMessage());
      return false;
    }
  }
}

// Usage in your webhook controller
@PostMapping("/webhook")
public ResponseEntity<?> handleWebhook(@RequestBody Map<String, Object> payload) {
  String publicKey = System.getenv("LAKIPAY_PUBLIC_KEY");
  if (!WebhookVerifier.verifySignature(payload, publicKey)) {
    return ResponseEntity.status(401).body(Map.of("error", "Invalid signature"));
  }
  return ResponseEntity.ok(Map.of("success", true));
}

<?php

namespace App\Services;

class LakiPayWebhookVerifier
{
  public static function createCanonicalString(array $payload)
  {
    $data = array_filter(
      $payload,
      fn($key) => $key !== 'signature',
      ARRAY_FILTER_USE_KEY
    );
    ksort($data);

    $parts = [];
    foreach ($data as $key => $value) {
      if ($value !== null) {
        $parts[] = $key . '=' . $value;
      }
    }
    return implode('&', $parts);
  }

  public static function verifySignature(array $payload, string $publicKeyPath)
  {
    try {
      $canonicalString = self::createCanonicalString($payload);
      $signature = base64_decode($payload['signature'] ?? '');

      $publicKey = openssl_pkey_get_public(file_get_contents($publicKeyPath));
      if (!$publicKey) {
        throw new \Exception('Failed to load public key');
      }

      $result = openssl_verify(
        $canonicalString,
        $signature,
        $publicKey,
        OPENSSL_ALGO_SHA256
      );
      openssl_free_key($publicKey);

      return $result === 1;
    } catch (\Exception $e) {
      \Log::error('Signature verification failed: ' . $e->getMessage());
      return false;
    }
  }
}

// Usage in your webhook controller
Route::post('/webhook', function (Request $request) {
  $publicKeyPath = storage_path('app/lakipay-public.pem');

  if (!LakiPayWebhookVerifier::verifySignature($request->all(), $publicKeyPath)) {
    return response()->json(['error' => 'Invalid signature'], 401);
  }

  return response()->json(['success' => true]);
});