Webhooks

export SOQ_BASE="https://api.eod-infinitee.com"
export SOQ_TOKEN="sqok_..."   # client token của bạn (lấy trong Client Portal)

curl -sS -X POST "$SOQ_BASE/v1/me/webhooks" \
  -H "Authorization: Bearer $SOQ_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.example.com/webhooks/soq",
    "topics": ["order.created", "order.status_updated", "tracking.updated"],
    "description": "Production endpoint"
  }'

{
  "id": "b2f8c0a1-3d4e-4f5a-9b6c-7d8e9f0a1b2c",
  "url": "https://your-app.example.com/webhooks/soq",
  "topics": ["order.created", "order.status_updated", "tracking.updated"],
  "is_active": true,
  "secret": "whsec_ZmFrZXNlY3JldGV4YW1wbGVvbmx5bm90cmVhbHZhbHVl"
}

export WEBHOOK_SECRET="whsec_..."   # secret vừa nhận được

curl -sS -X POST "$SOQ_BASE/v1/me/webhooks/b2f8c0a1-3d4e-4f5a-9b6c-7d8e9f0a1b2c/test" \
  -H "Authorization: Bearer $SOQ_TOKEN"

curl -sS "$SOQ_BASE/v1/me/webhooks/b2f8c0a1-3d4e-4f5a-9b6c-7d8e9f0a1b2c/deliveries?limit=5" \
  -H "Authorization: Bearer $SOQ_TOKEN"

{
  "id": "e7c1a2b3-4d5e-6f70-8192-a3b4c5d6e7f8",
  "topic": "order.created",
  "created_at": "2026-09-23T08:05:12.345Z",
  "data": { }
}

{
  "id": "e7c1a2b3-4d5e-6f70-8192-a3b4c5d6e7f8",
  "topic": "order.created",
  "created_at": "2026-09-23T08:05:12.345Z",
  "data": {
    "order": {
      "id": "0a1b2c3d-4e5f-6071-8293-a4b5c6d7e8f9",
      "reference_id": "MY-ORDER-001",
      "store_id": "9f8e7d6c-5b4a-3210-fedc-ba9876543210",
      "client_status": "processing",
      "shipment_status": null,
      "created_at": "2026-09-23T08:05:12.000Z",
      "updated_at": "2026-09-23T08:05:12.000Z"
    },
    "tracking": null
  }
}

{
  "data": {
    "order": {
      "id": "0a1b2c3d-4e5f-6071-8293-a4b5c6d7e8f9",
      "reference_id": "MY-ORDER-001",
      "store_id": "9f8e7d6c-5b4a-3210-fedc-ba9876543210",
      "client_status": "shipping",
      "shipment_status": "in_transit",
      "created_at": "2026-09-23T08:05:12.000Z",
      "updated_at": "2026-09-24T10:20:00.000Z"
    },
    "tracking": {
      "tracking_number": "9400111899223456789012",
      "carrier": "USPS",
      "tracking_url": "https://tools.usps.com/go/TrackConfirmAction?tLabels=9400111899223456789012",
      "shipment_status": "in_transit"
    }
  }
}

{
  "topic": "order.status_updated",
  "data": {
    "order": { "client_status": "shipping" },
    "tracking": null,
    "previous": { "client_status": "processing" }
  }
}

{
  "id": "11112222-3333-4444-5555-666677778888",
  "topic": "webhook.test",
  "created_at": "2026-09-23T08:10:00.000Z",
  "data": {
    "message": "This is a test event from Shopify Order Queue.",
    "webhook_id": "b2f8c0a1-3d4e-4f5a-9b6c-7d8e9f0a1b2c"
  }
}

signature = "sha256=" + HMAC_SHA256(secret, `${timestamp}.${rawBody}`).hex()

import express from 'express'
import crypto from 'crypto'

const app = express()
const SECRET = process.env.WEBHOOK_SECRET // whsec_...
const TOLERANCE_SEC = 300 // 5 phút
const seen = new Set() // production: dùng Redis/DB, không dùng Set trong RAM

function verify(headers, rawBody) {
  const timestamp = headers['x-webhook-timestamp']
  const signature = headers['x-webhook-signature']
  if (!timestamp || !signature) return false

  // Chống replay: từ chối request quá cũ.
  const age = Math.floor(Date.now() / 1000) - Number(timestamp)
  if (!Number.isFinite(age) || age > TOLERANCE_SEC) return false

  const body = Buffer.isBuffer(rawBody) ? rawBody.toString('utf8') : rawBody
  const expected =
    'sha256=' + crypto.createHmac('sha256', SECRET).update(`${timestamp}.${body}`).digest('hex')

  const a = Buffer.from(signature)
  const b = Buffer.from(expected)
  // timingSafeEqual ném lỗi nếu độ dài khác nhau — check trước.
  return a.length === b.length && crypto.timingSafeEqual(a, b)
}

// QUAN TRỌNG: express.raw() để có đúng byte thô, không phải express.json().
app.post('/webhooks/soq', express.raw({ type: '*/*' }), (req, res) => {
  if (!verify(req.headers, req.body)) {
    return res.status(401).send('invalid signature')
  }

  const eventId = req.headers['x-webhook-id']
  if (seen.has(eventId)) return res.sendStatus(200) // đã xử lý — bỏ qua
  seen.add(eventId)

  const event = JSON.parse(req.body.toString('utf8'))

  // Trả 2xx NGAY, đẩy xử lý nặng sang hàng đợi nền.
  res.sendStatus(200)
  queueMicrotask(() => handleEvent(event))
})

function handleEvent(event) {
  switch (event.topic) {
    case 'order.created':
    case 'order.status_updated':
      console.log('order', event.data.order.reference_id, event.data.order.client_status)
      break
    case 'tracking.updated':
      console.log('tracking', event.data.tracking?.tracking_number)
      break
  }
}

app.listen(3000)

import hashlib
import hmac
import json
import time

from fastapi import FastAPI, Request, Response

app = FastAPI()
SECRET = "whsec_..."           # đọc từ env trong thực tế
TOLERANCE_SEC = 300            # 5 phút
seen: set[str] = set()         # production: dùng Redis/DB

def verify(headers, raw_body: bytes) -> bool:
    timestamp = headers.get("x-webhook-timestamp")
    signature = headers.get("x-webhook-signature")
    if not timestamp or not signature:
        return False

    # Chống replay: từ chối request quá cũ.
    try:
        age = int(time.time()) - int(timestamp)
    except ValueError:
        return False
    if age > TOLERANCE_SEC:
        return False

    signed = f"{timestamp}.".encode("utf-8") + raw_body
    digest = hmac.new(SECRET.encode("utf-8"), signed, hashlib.sha256).hexdigest()
    expected = f"sha256={digest}"
    # So sánh hằng thời gian.
    return hmac.compare_digest(signature, expected)

@app.post("/webhooks/soq")
async def receive(request: Request):
    raw_body = await request.body()  # đúng byte thô, chưa parse
    if not verify(request.headers, raw_body):
        return Response(status_code=401, content="invalid signature")

    event_id = request.headers.get("x-webhook-id")
    if event_id in seen:
        return Response(status_code=200)  # đã xử lý — bỏ qua
    seen.add(event_id)

    event = json.loads(raw_body)
    # Trả 2xx nhanh; đẩy xử lý nặng sang background task / hàng đợi.
    handle_event(event)
    return Response(status_code=200)

def handle_event(event: dict) -> None:
    topic = event["topic"]
    if topic in ("order.created", "order.status_updated"):
        order = event["data"]["order"]
        print("order", order["reference_id"], order["client_status"])
    elif topic == "tracking.updated":
        tracking = event["data"].get("tracking") or {}
        print("tracking", tracking.get("tracking_number"))

<?php
// webhook.php — trỏ endpoint của bạn tới file này.
$secret        = getenv('WEBHOOK_SECRET'); // whsec_...
$toleranceSec  = 300;                      // 5 phút

$rawBody   = file_get_contents('php://input');           // đúng byte thô
$timestamp = $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$eventId   = $_SERVER['HTTP_X_WEBHOOK_ID'] ?? '';

function verify(string $secret, string $timestamp, string $signature, string $rawBody, int $tolerance): bool
{
    if ($timestamp === '' || $signature === '') {
        return false;
    }
    // Chống replay: từ chối request quá cũ.
    if (time() - (int) $timestamp > $tolerance) {
        return false;
    }
    $expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    // So sánh hằng thời gian.
    return hash_equals($expected, $signature);
}

if (!verify($secret, $timestamp, $signature, $rawBody, $toleranceSec)) {
    http_response_code(401);
    echo 'invalid signature';
    exit;
}

// Dedupe theo X-Webhook-Id (ví dụ đơn giản: file lock; production dùng Redis/DB).
$marker = sys_get_temp_dir() . '/soq_wh_' . preg_replace('/[^a-zA-Z0-9_-]/', '', $eventId);
if ($eventId !== '' && file_exists($marker)) {
    http_response_code(200); // đã xử lý — bỏ qua
    exit;
}
if ($eventId !== '') {
    touch($marker);
}

// Trả 2xx NGAY; đẩy xử lý nặng ra tiến trình nền (queue/cron).
http_response_code(200);
if (function_exists('fastcgi_finish_request')) {
    fastcgi_finish_request();
}

$event = json_decode($rawBody, true);
switch ($event['topic'] ?? '') {
    case 'order.created':
    case 'order.status_updated':
        error_log('order ' . $event['data']['order']['reference_id'] . ' ' . $event['data']['order']['client_status']);
        break;
    case 'tracking.updated':
        error_log('tracking ' . ($event['data']['tracking']['tracking_number'] ?? ''));
        break;
}

# receiver đang chạy ở localhost:3000
cloudflared tunnel --url http://localhost:3000
# → in ra một URL dạng https://<random>.trycloudflare.com

ngrok http 3000
# → Forwarding  https://<random>.ngrok-free.app -> http://localhost:3000

PATCH /v1/me/webhooks/b2f8c0a1-3d4e-4f5a-9b6c-7d8e9f0a1b2c

{
  "topics": ["order.created", "order.cancelled"],
  "is_active": true
}

GET /v1/me/webhooks/:id/deliveries?page=1&limit=20