Integratsiya misoli: do'kon Telegram-boti

Xaridor ─▶ bot: /buy 500 → @durov
bot ─▶ iFragment: GET /v1/recipients/lookup       → ism va avatar, "Topildi"
Xaridor ─▶ sizning to'lovingiz (Payme, Click, Stars, …) → to'landi
bot ─▶ iFragment: POST /v1/orders { externalId: "<bot buyurtmasi id'si>" } → 201 QUEUED
iFragment ─▶ bot: order.succeeded vebxuki           → "Tayyor! 500 ⭐ @durov da"

const API = 'https://api.ifragment.com/v1';

async function call<T>(path: string, init: RequestInit = {}): Promise<T> {
  const res = await fetch(`${API}${path}`, {
    ...init,
    headers: {
      'X-API-Key': process.env.IFRAGMENT_KEY!,
      'Content-Type': 'application/json',
      'Accept-Language': 'uz',
      ...init.headers,
    },
  });
  const body = await res.json();
  if (!body.success) {
    throw Object.assign(new Error(body.error.message), { status: res.status, code: body.error.code });
  }
  return body.data as T;
}

export const ifragment = {
  lookup: (username: string) =>
    call<{ found: boolean; name?: string }>(`/recipients/lookup?username=${encodeURIComponent(username)}&product=STARS`),

  // externalId = botdagi buyurtma id'si: taymautdan keyingi takror ikkinchi buyurtma yaratmaydi.
  createStarsOrder: (shopOrderId: string, username: string, quantity: number) =>
    call<{ id: string; status: string }>('/orders', {
      method: 'POST',
      headers: { 'Idempotency-Key': `shop-order-${shopOrderId}` },
      body: JSON.stringify({ product: 'STARS', quantity, username, externalId: shopOrderId }),
    }),
};

import { ifragment } from './ifragment';

export async function onShopOrderPaid(order: { id: string; username: string; quantity: number; chatId: number }) {
  try {
    await ifragment.createStarsOrder(order.id, order.username, order.quantity);
    await db.shopOrders.update(order.id, { status: 'FULFILLING' });
    await bot.api.sendMessage(order.chatId, "To'lov qabul qilindi, yulduzlarni yuboryapmiz…");
  } catch (error) {
    // 422: qabul qiluvchi tekshiruv va to'lov orasida yo'qolgan, pulni xaridorga qaytaring.
    // 5xx/tarmoq: keyinroq xuddi shu chaqiruvni takrorlang: externalId va Idempotency-Key dublikatdan himoya qiladi.
    await retryQueue.add('create-order', order, { delay: 30_000 });
  }
}

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(raw: string, header: string, secret: string): boolean {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=', 2)));
  if (!parts.t || !parts.v1 || Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) {
    return false;
  }
  const expected = createHmac('sha256', secret).update(`${parts.t}.${raw}`).digest();
  const received = Buffer.from(parts.v1, 'hex');
  return received.length === expected.length && timingSafeEqual(expected, received);
}

export async function handleWebhook(request: Request): Promise<Response> {
  const raw = await request.text(); // xom tana, JSON.parse'dan oldin
  if (!verify(raw, request.headers.get('X-IFragment-Signature') ?? '', process.env.IFRAGMENT_WEBHOOK_SECRET!)) {
    return new Response('bad signature', { status: 401 });
  }
  const event = JSON.parse(raw) as { id: string; type: string; data: { externalId: string; quantity: number } };
  if (await db.processedEvents.exists(event.id)) {
    return new Response('ok'); // qayta yetkazish
  }

  const order = await db.shopOrders.find(event.data.externalId);
  if (event.type === 'order.succeeded') {
    await db.shopOrders.update(order.id, { status: 'COMPLETED' });
    await bot.api.sendMessage(order.chatId, `Tayyor! ${event.data.quantity} ⭐ allaqachon @${order.username} da`);
  } else if (event.type === 'order.failed') {
    await db.shopOrders.update(order.id, { status: 'FAILED' });
    await bot.api.sendMessage(order.chatId, "Buyurtmani bajarib bo'lmadi, pulingizni bir kun ichida qaytaramiz.");
  }
  await db.processedEvents.add(event.id);
  return new Response('ok');
}