Webhook Almak — Ödeme Tamamlandı Diyen Gerçekten Sağlayıcı mı?

1
@RestController
2
@RequestMapping("/webhooks/payments")
3
class PaymentWebhookController {
4

5
    private final SignatureVerifier verifier;
6
    private final ReceivedEvents receivedEvents;
7

8
    PaymentWebhookController(SignatureVerifier verifier, ReceivedEvents receivedEvents) {
9
        this.verifier = verifier;
10
        this.receivedEvents = receivedEvents;
11
    }
12

13
    @PostMapping
14
    ResponseEntity<Void> receive(@RequestHeader("Payment-Signature") String signature,
15
                                 @RequestBody byte[] rawBody) {
16
        // 1. Who sent it? Checked on the exact bytes that arrived.
17
        if (!verifier.isValid(signature, rawBody)) {
18
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
19
        }
20
        // 2. Have we seen it? Only verified events may claim an id.
21
        PaymentEvent event = PaymentEvent.parse(rawBody);
22
        receivedEvents.saveIfNew(event); // processed in the background
23
        // 3. Answer quickly, so the provider has no reason to retry.
24
        return ResponseEntity.ok().build();
25
    }
26
}

1
@Component
2
class SignatureVerifier {
3

4
    private static final Duration TOLERANCE = Duration.ofMinutes(5);
5

6
    private final byte[] secret;
7
    private final Clock clock;
8

9
    SignatureVerifier(@Value("${payments.webhook-secret}") String secret, Clock clock) {
10
        this.secret = secret.getBytes(StandardCharsets.UTF_8);
11
        this.clock = clock;
12
    }
13

14
    /** Header format: "t=1767225600,v1=5f2b...". */
15
    boolean isValid(String header, byte[] body) {
16
        Map<String, String> parts = parse(header);
17
        String t = parts.get("t");
18
        String v1 = parts.get("v1");
19
        if (t == null || v1 == null) {
20
            return false;
21
        }
22
        Instant sentAt = Instant.ofEpochSecond(Long.parseLong(t));
23
        if (Duration.between(sentAt, clock.instant()).abs().compareTo(TOLERANCE) > 0) {
24
            return false; // a replay of an old, genuine call
25
        }
26
        byte[] expected = hmacSha256(t + "." + new String(body, StandardCharsets.UTF_8));
27
        // Constant-time comparison: no timing hint about how many bytes matched.
28
        return MessageDigest.isEqual(expected, HexFormat.of().parseHex(v1));
29
    }
30

31
    private byte[] hmacSha256(String payload) {
32
        try {
33
            Mac mac = Mac.getInstance("HmacSHA256");
34
            mac.init(new SecretKeySpec(secret, "HmacSHA256"));
35
            return mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
36
        } catch (GeneralSecurityException e) {
37
            throw new IllegalStateException("HMAC unavailable", e);
38
        }
39
    }
40

41
    private static Map<String, String> parse(String header) {
42
        return Arrays.stream(header.split(","))
43
                .map(part -> part.split("=", 2))
44
                .filter(kv -> kv.length == 2)
45
                .collect(Collectors.toMap(kv -> kv[0], kv -> kv[1], (a, b) -> a));
46
    }
47
}

1
@Repository
2
class ReceivedEvents {
3

4
    private final JdbcClient jdbc;
5

6
    ReceivedEvents(JdbcClient jdbc) {
7
        this.jdbc = jdbc;
8
    }
9

10
    /** Stores the event once; a retry with the same id changes nothing. */
11
    void saveIfNew(PaymentEvent event) {
12
        jdbc.sql("""
13
                INSERT INTO received_payment_events (event_id, amount, currency, status)
14
                VALUES (:id, :amount, :currency, 'PENDING')
15
                ON CONFLICT (event_id) DO NOTHING
16
                """)
17
            .param("id", event.id())
18
            .param("amount", event.amount())
19
            .param("currency", event.currency())
20
            .update();
21
    }
22
}

1
CREATE TABLE received_payment_events (
2
    event_id    VARCHAR(64) PRIMARY KEY,  -- the provider's event id
3
    amount      NUMERIC(19, 2) NOT NULL,
4
    currency    CHAR(3)        NOT NULL,
5
    status      VARCHAR(16)    NOT NULL,  -- PENDING, CREDITED
6
    received_at TIMESTAMPTZ    NOT NULL DEFAULT now()
7
);