/*
  <dependency>
     <groupId>commons-codec</groupId>
     <artifactId>commons-codec</artifactId>
     <version>1.11</version>
  </dependency>
  */
                    
  // WebhooksResource.java
  // https://micomercio/webhook_validation
  // https://micomercio/webhook_confirm
  // https://micomercio/webhook_reject
  
  package resources;
                    
  import org.springframework.http.*;
  import org.springframework.web.bind.annotation.*;
  import java.util.Map;
  import org.apache.commons.codec.digest.DigestUtils;
                    
  @RestController
  @RequestMapping("/")
  public class WebhooksResource {
                    
  private boolean validateApikey(String headerApikey, Map<String, Object> order) {
   String ecommerceReferenceId = String.valueOf(order.get("reference_id"));
   String klapOrderId = String.valueOf(order.get("order_id"));
   System.out.println("ecommerceReferenceId: " + ecommerceReferenceId);
   System.out.println("klapOrderId: " + klapOrderId);
                        
  //es tu apikey privada otorgada por Klap:
   String apikey = "SKSJKFH84JKDFNGDFGNDFGNN284895060"; 
   String key = ecommerceReferenceId + klapOrderId + apikey;
                        
  //este hash es el que debes comparar con el que te llegará en el 
  //header "Apikey" mediante el request a tus webhooks:
   String hashApiKey = DigestUtils.sha256Hex(key);
   return hashApiKey.equals(headerApikey);
  }
                    
  @RequestMapping(path  = "/webhook_validation", method = RequestMethod.POST,
   consumes = "application/json", produces = "application/json")
  public ResponseEntity<?> webhookValidation(@RequestBody(required=true) Map<String, Object> order) {
   try {
     String ecommerceReferenceId = String.valueOf(order.get("reference_id"));
     System.out.println("ecommerceReferenceId: " + ecommerceReferenceId);
                    
    // hacer algo...
                    
     return new ResponseEntity<>(order, HttpStatus.OK);
   } catch(Exception ex) {
     return new ResponseEntity<>("error", HttpStatus.INTERNAL_SERVER_ERROR);
   }
  }
                    
  @RequestMapping(path = "/webhook_confirm", method = RequestMethod.POST,
   consumes = "application/json", produces = "application/json")
  public ResponseEntity<?> webhookConfirm(@RequestBody(required=true) Map<String, Object> order,
   @RequestHeader(value="Apikey", required = true) String headerApikey) {
    try {     
                    
      if (!validateApikey(headerApikey, order)) {
       throw new Exception("Error en autenticación");
      }
                    
      // hacer algo...
                    
      return new ResponseEntity<>(order, HttpStatus.OK);
    } catch(Exception ex) {
      return new ResponseEntity<>("error", HttpStatus.INTERNAL_SERVER_ERROR);
    }
  }
                    
  @RequestMapping(path = "/webhook_reject", method = RequestMethod.POST,
   consumes = "application/json", produces = "application/json")
  public ResponseEntity<?> webhookReject(@RequestBody(required=true) Map<String, Object> order,
   @RequestHeader(value="Apikey", required = true) String headerApikey) {
    try {     
                    
      if (!validateApikey(headerApikey, order)) {
       throw new Exception("Error en autenticación");
      }
                    
      // hacer algo...
                    
      return new ResponseEntity<>(order, HttpStatus.OK);
    } catch(Exception ex) {
      return new ResponseEntity<>("error", HttpStatus.INTERNAL_SERVER_ERROR);
    }
  }

 }
  

  
  <?php 
  // webhooks.php
  // https://micomercio/webhwebhook=validation
  // https://micomercio/webhwebhook=confirm
  // https://micomercio/webhwebhook=reject
                
  function getHeader($headers, $name) {
    foreach ($headers as $hname => $hvalue) {
      if (strtolower($hname) == strtolower($name)){
        return $hvalue;
      }
    }
    return null;
  }
  
  function validateApikey($headerApikey, $decoded) {

    $ecommerceReferenceId = $decoded['reference_id'];  
    $klapOrderId = $decoded['order_id'];
    error_log(print_r('ecommerceReferenceId: ' . $ecommerceReferenceId, true));
    error_log(print_r('klapOrderId: ' . $klapOrderId, true));

    # es tu apikey privada otorgada por Klap:
    $apikey = "SKSJKFH84JKDFNGDFGNDFGNN284895060"; 
    $key = $ecommerceReferenceId . $klapOrderId . $apikey;
    
    // este hash es el que debes comparar con el que te llegará 
    // en el header "Apikey" el request a tus webhooks:
    $hashApiKey = hash('sha256', $key);
    return $hashApiKey == $headerApikey;
  }
  
  try {
  
    if(strcasecmp($_SERVER['REQUEST_METHOD'], 'POST') != 0){
       throw new NotFoundException('Request method must be POST!');
    }
  
    $contentType = isset($_SERVER["CONTENT_TYPE"]) ? trim($_SERVER["CONTENT_TYPE"]) : ';
    if(strcasecmp($contentType, 'application/json') != 0){
      throw new NotFoundException('Content type must be:application/json');
    }
  
    //Recibe los datos post raw
    $json = trim(file_get_contents("php://input"));
  
    //decodifica el json
    $decoded = json_decode($json, true);
  
    //si json_decode falla, el json es inválido
    if(!is_array($decoded)){
      throw new BadRequestException('Received content contained invalid JSON!');
    }
  
    $webhook = $_GET['webhook'];
    error_log(print_r('webhook: ' . $webhook, true));
                    
  
    if(strcasecmp($webhook, 'validation') == 0) {

    // hacer algo...
  
    } else {
        $headerApikey = $this->getHeader(apache_request_headers(), 'Apikey');
        if (!$this->validateApikey($headerApikey, $decoded)) {
          throw new UnauthorizedException('Error en autenticación');
        }
        if(strcasecmp($webhook, 'confirm') == 0) {     
  
            // hacer algo confirm...
  
        } else if(strcasecmp($webhook, 'reject') == 0) {
      
  
            // hacer algo para reject...
        }

    }

    //retorna el json
    http_response_code(200);
    echo $json;

  } catch (Exception $e) {
    error_log(print_r('Excepción capturada: ',  $e->getMessage()));
    http_response_code(500);
    echo "error";
  }
                

  # webhooks.rb
  # https://micomercio/webhook_validation
  # https://micomercio/webhook_confirm
  # https://micomercio/webhook_reject

  require 'sinatra'
  require 'json'
  require 'digest'

  set :port, 7000
  set :bind, '0.0.0.0'

  def validateApikey(headerApikey, order)
    ecommerceReferenceId = order['reference_id']
    klapOrderId = order['order_id']
    puts "ecommerceReferenceId: #{ecommerceReferenceId}"
    puts "klapOrderId: #{klapOrderId}"
    
    #es tu apikey privada otorgada por Klap:
    apikey = "SKSJKFH84JKDFNGDFGNDFGNN284895060" 
    key = ecommerceReferenceId + klapOrderId + apikey
    
    #este hash es el que debes comparar con el que te llegará en el 
    #header "Apikey" mediante el request a tus webhooks:
    hashApiKey = Digest::SHA256.hexdigest(key)
    return hashApiKey ==  headerApikey
  end

  post '/webhook_validation' do
    begin
      request.body.rewind
      order = JSON.parse request.body.read
      ecommerceReferenceId = order['reference_id']
      puts "ecommerceReferenceId: #{ecommerceReferenceId}"

      # hacer algo...

      content_type :json
      halt 200, order.to_json
    rescue StandardError => error
      halt 500, 'error'
    end
  end

  post '/webhook_confirm' do
    begin
      request.body.rewind
      order = JSON.parse request.body.read

      headerApikey = request.env["Apikey"]

      if (!validateApikey(headerApikey, order))
       raise "Error en autenticación"
      end

      # hacer algo...

      content_type :json
      halt 200, order.to_json
    rescue StandardError => error
      halt 500, 'error'
    end
  end

  post '/webhook_reject' do
    begin
      equest.body.rewind
      order = JSON.parse request.body.read
      headerApikey = request.env["Apikey"]

      if (!validateApikey(headerApikey, order))
      raise "Error en autenticación"
      end

      # hacer algo...

      content_type :json
      halt 200, order.to_json
    rescue StandardError => error
      halt 500, 'error'
    end
  end