درگاه پرداخت اعتباری آمیوا

  فروشگاه                      آمیوا                        مشتری
     │                          │                            │
     │ 1) POST /checkout-sessions                            │
     ├─────────────────────────▶│                            │
     │◀─── checkoutUrl ─────────┤                            │
     │                          │                            │
     │ 2) redirect به checkoutUrl                            │
     ├───────────────────────────────────────────────────────▶
     │                          │◀── 3) تأیید پرداخت قسطی ───┤
     │                          │                            │
     │◀── 4) redirect به returnUrl (+sign) ───────────────────┤
     │                          │                            │
     │ 5) POST /:id/verify      │                            │
     ├─────────────────────────▶│                            │
     │◀─── verified: true ──────┤                            │
     │                          │                            │
     │◀══ webhook (مسیر پشتیبان، مستقل از مرورگر) ═══════════│

Authorization: Bearer sk_live_XXXXXXXXXXXXXXXXXXXXXXXX
Content-Type: application/json

{
  "code": "10231",
  "slug": "digikala-sample",
  "name": "فروشگاه نمونه",
  "status": "ACTIVE",
  "allowedTenures": [3, 6, 12],
  "minAmount": "500000",
  "maxAmount": "80000000",
  "webhookUrl": "https://shop.example.com/?wc-api=noqte_credit_webhook",
  "webhookConfigured": true,
  "scopes": ["checkout:create", "checkout:read"],
  "checkoutBaseUrl": "https://87.107.12.84/pay",
  "apiVersion": "v1"
}

curl -X POST https://87.107.12.84/api/v1/checkout-sessions \
  -H "Authorization: Bearer sk_live_XXXX" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 12500000,
    "tenureMonths": 6,
    "returnUrl": "https://shop.example.com/checkout/noqte-return",
    "metadata": { "orderId": "WC-10432" }
  }'

{
  "id": "cksess_9f2c1ab4e7",
  "token": "0b5f3a…",
  "checkoutUrl": "https://87.107.12.84/pay/0b5f3a…",
  "expiresAt": "2026-09-19T12:34:56.000Z"
}

{
  "id": "cksess_9f2c1ab4e7",
  "status": "COMPLETED",
  "amount": "12500000",
  "tenureMonths": 6,
  "transactionId": "txn_77c1…",
  "expiresAt": "2026-09-19T12:34:56.000Z",
  "completedAt": "2026-09-19T12:11:02.000Z"
}

curl -X POST https://87.107.12.84/api/v1/checkout-sessions/cksess_9f2c1ab4e7/verify \
  -H "Authorization: Bearer sk_live_XXXX" \
  -H "Content-Type: application/json" \
  -d '{ "amount": 12500000 }'

{
  "id": "cksess_9f2c1ab4e7",
  "verified": true,
  "status": "COMPLETED",
  "amount": "12500000",
  "tenureMonths": 6,
  "transactionId": "txn_77c1…",
  "metadata": { "orderId": "WC-10432" },
  "completedAt": "2026-09-19T12:11:02.000Z"
}

{
  "id": "cksess_9f2c1ab4e7",
  "verified": false,
  "status": "EXPIRED",
  "amount": "12500000",
  "tenureMonths": 6,
  "transactionId": null,
  "metadata": null,
  "completedAt": null
}

{ "id": "cksess_9f2c1ab4e7", "status": "CANCELLED" }

payload = session_id + "." + status + "." + transaction_id
sign    = HMAC_SHA256(signing_secret, payload)  →  hex

<?php
$secret  = getenv('NOQTE_SIGNING_SECRET');
$payload = $_GET['session_id'] . '.' . $_GET['status'] . '.' . $_GET['transaction_id'];
$expected = hash_hmac('sha256', $payload, $secret);

if (!hash_equals($expected, $_GET['sign'] ?? '')) {
    http_response_code(400);
    exit('امضای بازگشت معتبر نیست');
}

// امضا درست است؛ حالا مبلغ را سمت سرور تأیید کنید
$ch = curl_init($base . '/api/v1/checkout-sessions/' . $_GET['session_id'] . '/verify');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . getenv('NOQTE_API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => json_encode(['amount' => $orderAmountToman]),
]);
$result = json_decode(curl_exec($ch), true);

if (!empty($result['verified'])) {
    // سفارش را تکمیل کنید
}

import { createHmac, timingSafeEqual } from 'node:crypto';

function isValidReturn(query, secret) {
  const payload = `${query.session_id}.${query.status}.${query.transaction_id}`;
  const expected = createHmac('sha256', secret).update(payload).digest('hex');
  const given = String(query.sign ?? '');
  if (given.length !== expected.length) return false;
  return timingSafeEqual(Buffer.from(expected), Buffer.from(given));
}

{
  "event": "checkout_session.completed",
  "checkoutSessionId": "cksess_9f2c1ab4e7",
  "transactionId": "txn_77c1…",
  "status": "COMPLETED",
  "amount": "12500000",
  "tenureMonths": 6,
  "metadata": { "orderId": "WC-10432" },
  "returnUrl": "https://shop.example.com/checkout/noqte-return",
  "occurredAt": "2026-09-19T12:11:02.000Z"
}

<?php
$raw       = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_NOQTE_SIGNATURE'] ?? '';
$expected  = hash_hmac('sha256', $raw, getenv('NOQTE_SIGNING_SECRET'));

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

$event = json_decode($raw, true);
$orderId = $event['metadata']['orderId'] ?? null;
// سفارش را پیدا کنید، اگر قبلاً تکمیل نشده آن را تکمیل کنید (idempotent)

http_response_code(200);  // هر پاسخ غیر ۲xx به معنای شکست تحویل است

import express from 'express';
import { createHmac, timingSafeEqual } from 'node:crypto';

const app = express();
const BASE = 'https://87.107.12.84';
const API_KEY = process.env.NOQTE_API_KEY;
const SECRET = process.env.NOQTE_SIGNING_SECRET;

// ۱) شروع پرداخت
app.post('/pay/noqte/:orderId', async (req, res) => {
  const order = await loadOrder(req.params.orderId);

  const response = await fetch(`${BASE}/api/v1/checkout-sessions`, {
    method: 'POST',
    headers: {
      authorization: `Bearer ${API_KEY}`,
      'content-type': 'application/json',
    },
    body: JSON.stringify({
      amount: order.totalToman,
      tenureMonths: 6,
      returnUrl: 'https://shop.example.com/pay/noqte/return',
      metadata: { orderId: order.id },
    }),
  });

  if (!response.ok) return res.status(502).send('ساخت نشست پرداخت ناموفق بود');

  const session = await response.json();
  await saveSessionId(order.id, session.id);
  res.redirect(session.checkoutUrl);
});

// ۲) بازگشت مشتری
app.get('/pay/noqte/return', async (req, res) => {
  const { session_id, status, transaction_id, sign } = req.query;

  const payload = `${session_id}.${status}.${transaction_id}`;
  const expected = createHmac('sha256', SECRET).update(payload).digest('hex');
  if (String(sign).length !== expected.length ||
      !timingSafeEqual(Buffer.from(expected), Buffer.from(String(sign)))) {
    return res.status(400).send('امضای بازگشت معتبر نیست');
  }

  if (status !== 'completed') return res.redirect('/cart?canceled=1');

  const order = await findOrderBySession(session_id);

  // ۳) تأیید نهایی سمت سرور — تنها مبنای معتبر
  const verify = await fetch(
    `${BASE}/api/v1/checkout-sessions/${session_id}/verify`,
    {
      method: 'POST',
      headers: {
        authorization: `Bearer ${API_KEY}`,
        'content-type': 'application/json',
      },
      body: JSON.stringify({ amount: order.totalToman }),
    },
  );
  const result = await verify.json();

  if (!result.verified) return res.status(402).send('پرداخت تأیید نشد');

  await markOrderPaid(order.id, result.transactionId);  // ایدمپوتنت
  res.redirect(`/orders/${order.id}?paid=1`);
});