Payments integration guide

// Express + raw body capture. Ed25519 + JWKS — no shared secret.
import express from "express";
import { createPublicKey, verify } from "node:crypto";

const JWKS_URL = "https://sunrift-hub.com/api/public/jwks.json";
let jwksCache: { fetchedAt: number; keys: Map<string, ReturnType<typeof createPublicKey>> } | null = null;
async function getKey(kid: string) {
  if (!jwksCache || Date.now() - jwksCache.fetchedAt > 5 * 60_000) {
    const jwks = await (await fetch(JWKS_URL)).json();
    const keys = new Map();
    for (const jwk of jwks.keys) keys.set(jwk.kid, createPublicKey({ key: jwk, format: "jwk" }));
    jwksCache = { fetchedAt: Date.now(), keys };
  }
  return jwksCache.keys.get(kid);
}

const app = express();
app.post("/hub/webhook",
  express.raw({ type: "application/json", limit: "1mb" }),
  async (req, res) => {
    const sig = req.header("x-hub-signature") ?? "";
    const kid = req.header("x-hub-signature-kid") ?? "";
    const ts  = req.header("x-hub-signature-timestamp") ?? "";
    if (!sig || !kid || !ts) return res.status(401).end();
    if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return res.status(401).end();
    const key = await getKey(kid);
    if (!key) return res.status(401).end();
    const sigBuf = Buffer.from(sig.replace(/-/g, "+").replace(/_/g, "/"), "base64");
    const msg = Buffer.concat([Buffer.from(`${ts}.`), req.body]); // raw Buffer
    if (!verify(null, msg, key, sigBuf)) return res.status(401).end("invalid signature");

    const { event_type, delivery_id, payload } = JSON.parse(req.body.toString());
    if (event_type === "payment.succeeded") {
      // Идемпотентность по payment_record_id, под FOR UPDATE
      await db.tx(async (tx) => {
        const dep = await tx.one(
          "SELECT id, status FROM deposits WHERE hub_payment_id = $1 FOR UPDATE",
          [payload.payment_record_id],
        );
        if (dep.status === "credited") return;
        await creditDeposit(tx, dep.id, payload.amount_minor, payload.currency);
        await tx.none("UPDATE deposits SET status = 'credited' WHERE id = $1", [dep.id]);
      });
    }
    res.status(200).end("ok");
  },
);