Move money with
one clear contract.

import crypto from "node:crypto";

const apiBase = "https://api.spqr-payments.com";
const apiKey = process.env.SPQR_API_KEY;
const apiClientSecret = Buffer.from(process.env.SPQR_API_CLIENT_SECRET, "hex");
const merchantSecret = Buffer.from(process.env.SPQR_MERCHANT_SECRET, "hex");

const body = JSON.stringify({
  merchant: "acme_my",
  amount: 12500,
  currency: "MYR",
  external_id: "order-8402",
  country: "MY",
  payment_method: "duitnowqr",
  return_url: "https://shop.example.com/orders/order-8402",
  callback_url: "https://api.shop.example.com/webhooks/spqr",
  payer: { customer_uid: "customer-184" }
});

const timestamp = Math.floor(Date.now() / 1000).toString();
const bodyHash = crypto.createHash("sha256").update(body).digest("hex");
const canonical = `POST\n/payments\n${bodyHash}\n${timestamp}\n`;
const inner = crypto.createHmac("sha256", merchantSecret).update(canonical).digest();
const signature = crypto.createHmac("sha256", apiClientSecret).update(inner).digest("hex");

const response = await fetch(`${apiBase}/payments`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-Api-Key": apiKey,
    "X-Timestamp": timestamp,
    "X-Signature": signature,
    "Idempotency-Key": crypto.randomUUID()
  },
  body
});

console.log(response.status, await response.json());

function verifySPQRWebhook({ method, originalUrl, rawBody, headers }) {
  const timestamp = headers["x-timestamp"];
  const received = headers["x-signature"];
  const bodyHash = crypto.createHash("sha256").update(rawBody).digest("hex");
  const canonical = `${method.toUpperCase()}\n${originalUrl}\n${bodyHash}\n${timestamp}\n`;
  const inner = crypto.createHmac("sha256", merchantSecret).update(canonical).digest();
  const expected = crypto.createHmac("sha256", apiClientSecret).update(inner).digest();
  const signature = Buffer.from(received, "hex");

  return signature.length === expected.length &&
    crypto.timingSafeEqual(signature, expected);
}