Từ token đầu tiên đến webhook chạy thật

<?php
$secret = $_ENV['APIBANK_WEBHOOK_SECRET'];
$timestamp = $_SERVER['HTTP_X_APIBANK_TIMESTAMP'] ?? '';
$received = strtolower($_SERVER['HTTP_X_APIBANK_SIGNATURE'] ?? '');
$rawBody = file_get_contents('php://input');

if (!ctype_digit($timestamp) || abs(time() - (int) $timestamp) > 300) {
    http_response_code(401); exit('Timestamp invalid');
}

$expected = hash_hmac('sha256', $timestamp.'.'.$rawBody, $secret);
if (!hash_equals($expected, $received)) {
    http_response_code(401); exit('Signature invalid');
}

$event = json_decode($rawBody, true, 512, JSON_THROW_ON_ERROR);
// INSERT event_id với UNIQUE INDEX trước khi cập nhật đơn hàng.
http_response_code(204);

import crypto from 'node:crypto';
import express from 'express';

const app = express();
app.post('/webhooks/apibank', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.get('X-APIBank-Timestamp') || '';
  const received = req.get('X-APIBank-Signature') || '';
  if (!/^\d+$/.test(timestamp) || Math.abs(Date.now()/1000 - Number(timestamp)) > 300)
    return res.status(401).send('Timestamp invalid');

  const expected = crypto.createHmac('sha256', process.env.APIBANK_WEBHOOK_SECRET)
    .update(`${timestamp}.${req.body.toString('utf8')}`).digest('hex');
  const valid = received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
  if (!valid) return res.status(401).send('Signature invalid');

  const event = JSON.parse(req.body.toString('utf8'));
  // Lưu event.event_id bằng UNIQUE INDEX rồi xử lý trong queue.
  return res.sendStatus(204);
});