مستندات کارت خودکار

// routes/api.php
Route::post('/cardauto', [CardAutoController::class, 'callback']);   // مسیر api است؛ CSRF ندارد

// app/Http/Controllers/CardAutoController.php
class CardAutoController extends Controller
{
    public function callback(Request $r)
    {
        $invoice = trim((string) $r->input('invoice', ''));
        $parts = collect(['project_id', 'uid', 'amount', 'account', 'sms_time', 'ts'])->map(fn ($k) => (string) $r->input($k, ''));
        if ($invoice !== '') $parts->push($invoice);
        $sig = hash_hmac('sha256', $parts->implode('|'), config('services.cardauto.secret'));
        if (!hash_equals($sig, (string) $r->input('signature')) || abs(time() - (int) $r->input('ts')) > 600) {
            return response()->json(['ok' => false, 'error' => 'bad signature'], 403);
        }
        if ($dup = Invoice::where('paid_uid', $r->input('uid'))->first()) {
            return ['ok' => true, 'duplicate' => true, 'invoice' => (string) $dup->id];
        }
        $inv = $invoice !== ''
            ? Invoice::find($invoice)
            : Invoice::where('amount', (int) $r->input('amount'))->where('status', 'unpaid')->where('created_at', '>', now()->subDay())->latest('id')->first();
        if (!$inv) return response()->json(['ok' => false, 'error' => 'invoice not found'], 404);
        if ($inv->status === 'cancelled') return response()->json(['ok' => false, 'error' => 'invoice cancelled'], 410);

        $updated = Invoice::whereKey($inv->id)->where('status', '!=', 'paid')
            ->update(['status' => 'paid', 'paid_uid' => $r->input('uid'), 'paid_at' => now()]);
        if (!$updated) return response()->json(['ok' => false, 'error' => 'invoice already paid'], 409);

        dispatch(new ActivateOrder($inv->id));   // کار سنگین در صف
        return ['ok' => true, 'invoice' => (string) $inv->id];
    }
}

// Express
const express = require('express'), crypto = require('crypto');
const app = express();
const SECRET = process.env.CARDAUTO_SECRET;

app.post('/cardauto', express.urlencoded({ extended: false }), async (req, res) => {
  const b = req.body, invoice = (b.invoice || '').trim();
  const parts = ['project_id', 'uid', 'amount', 'account', 'sms_time', 'ts'].map(k => b[k] ?? '');
  if (invoice) parts.push(invoice);
  const sig = crypto.createHmac('sha256', SECRET).update(parts.join('|')).digest('hex');
  const given = String(b.signature || '');
  const ok = given.length === sig.length && crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(given));
  if (!ok || Math.abs(Date.now() / 1000 - Number(b.ts)) > 600) return res.status(403).json({ ok: false, error: 'bad signature' });

  const dup = await db.invoice.findFirst({ where: { paidUid: b.uid } });
  if (dup) return res.json({ ok: true, duplicate: true, invoice: String(dup.id) });

  const inv = invoice
    ? await db.invoice.findUnique({ where: { id: Number(invoice) } })
    : await db.invoice.findFirst({ where: { amount: Number(b.amount), status: 'unpaid', createdAt: { gt: new Date(Date.now() - 864e5) } }, orderBy: { id: 'desc' } });
  if (!inv) return res.status(404).json({ ok: false, error: 'invoice not found' });
  if (inv.status === 'cancelled') return res.status(410).json({ ok: false, error: 'invoice cancelled' });

  const r = await db.invoice.updateMany({ where: { id: inv.id, status: { not: 'paid' } }, data: { status: 'paid', paidUid: b.uid, paidAt: new Date() } });
  if (!r.count) return res.status(409).json({ ok: false, error: 'invoice already paid' });
  res.json({ ok: true, invoice: String(inv.id) });
});

# Flask
import hmac, hashlib, time
from flask import Flask, request
app = Flask(__name__)
SECRET = b'project secret'

@app.post('/cardauto')
def cardauto():
    f = request.form
    invoice = f.get('invoice', '').strip()
    parts = [f.get(k, '') for k in ('project_id', 'uid', 'amount', 'account', 'sms_time', 'ts')]
    if invoice:
        parts.append(invoice)
    sig = hmac.new(SECRET, '|'.join(parts).encode(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, f.get('signature', '')) or abs(time.time() - int(f.get('ts') or 0)) > 600:
        return {'ok': False, 'error': 'bad signature'}, 403

    dup = db.one('SELECT id FROM invoices WHERE paid_uid = %s', f['uid'])
    if dup:
        return {'ok': True, 'duplicate': True, 'invoice': str(dup.id)}
    inv = (db.one('SELECT id, status FROM invoices WHERE id = %s', invoice) if invoice else
           db.one("SELECT id, status FROM invoices WHERE amount = %s AND status = 'unpaid' AND created_at > NOW() - INTERVAL '1 day' ORDER BY id DESC LIMIT 1", int(f['amount'])))
    if not inv:
        return {'ok': False, 'error': 'invoice not found'}, 404
    if inv.status == 'cancelled':
        return {'ok': False, 'error': 'invoice cancelled'}, 410
    if not db.execute("UPDATE invoices SET status = 'paid', paid_uid = %s, paid_at = NOW() WHERE id = %s AND status <> 'paid'", f['uid'], inv.id):
        return {'ok': False, 'error': 'invoice already paid'}, 409
    return {'ok': True, 'invoice': str(inv.id)}

# views.py  —  path('cardauto/', views.cardauto) در urls.py
import hmac, hashlib, time
from django.conf import settings
from django.http import JsonResponse
from django.views.decorators.csrf import csrf_exempt
from django.views.decorators.http import require_POST
from django.utils import timezone
from .models import Invoice

@csrf_exempt
@require_POST
def cardauto(request):
    f = request.POST
    invoice = f.get('invoice', '').strip()
    parts = [f.get(k, '') for k in ('project_id', 'uid', 'amount', 'account', 'sms_time', 'ts')] + ([invoice] if invoice else [])
    sig = hmac.new(settings.CARDAUTO_SECRET.encode(), '|'.join(parts).encode(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, f.get('signature', '')) or abs(time.time() - int(f.get('ts') or 0)) > 600:
        return JsonResponse({'ok': False, 'error': 'bad signature'}, status=403)
    if (dup := Invoice.objects.filter(paid_uid=f['uid']).first()):
        return JsonResponse({'ok': True, 'duplicate': True, 'invoice': str(dup.pk)})
    qs = Invoice.objects
    inv = (qs.filter(pk=invoice).first() if invoice else
           qs.filter(amount=int(f['amount']), status='unpaid', created_at__gt=timezone.now() - timezone.timedelta(days=1)).order_by('-pk').first())
    if not inv:
        return JsonResponse({'ok': False, 'error': 'invoice not found'}, status=404)
    if inv.status == 'cancelled':
        return JsonResponse({'ok': False, 'error': 'invoice cancelled'}, status=410)
    if not Invoice.objects.filter(pk=inv.pk).exclude(status='paid').update(status='paid', paid_uid=f['uid'], paid_at=timezone.now()):
        return JsonResponse({'ok': False, 'error': 'invoice already paid'}, status=409)
    return JsonResponse({'ok': True, 'invoice': str(inv.pk)})

package main

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"math"
	"net/http"
	"strconv"
	"strings"
	"time"
)

var secret = []byte("project secret")

func reply(w http.ResponseWriter, code int, body map[string]any) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(code)
	json.NewEncoder(w).Encode(body)
}

func cardauto(w http.ResponseWriter, r *http.Request) {
	r.ParseForm()
	f := r.PostForm.Get
	invoice := strings.TrimSpace(f("invoice"))
	parts := []string{f("project_id"), f("uid"), f("amount"), f("account"), f("sms_time"), f("ts")}
	if invoice != "" {
		parts = append(parts, invoice)
	}
	m := hmac.New(sha256.New, secret)
	m.Write([]byte(strings.Join(parts, "|")))
	ts, _ := strconv.ParseInt(f("ts"), 10, 64)
	if !hmac.Equal([]byte(hex.EncodeToString(m.Sum(nil))), []byte(f("signature"))) || math.Abs(float64(time.Now().Unix()-ts)) > 600 {
		reply(w, 403, map[string]any{"ok": false, "error": "bad signature"})
		return
	}
	if id, ok := findByPaidUID(f("uid")); ok {
		reply(w, 200, map[string]any{"ok": true, "duplicate": true, "invoice": id})
		return
	}
	var inv *Invoice
	if invoice != "" {
		inv = findInvoiceByID(invoice)
	} else {
		amount, _ := strconv.ParseInt(f("amount"), 10, 64)
		inv = findOpenInvoiceByAmount(amount)
	}
	switch {
	case inv == nil:
		reply(w, 404, map[string]any{"ok": false, "error": "invoice not found"})
	case inv.Status == "cancelled":
		reply(w, 410, map[string]any{"ok": false, "error": "invoice cancelled"})
	case !markPaidIfUnpaid(inv.ID, f("uid")): // UPDATE ... WHERE id = ? AND status <> 'paid'
		reply(w, 409, map[string]any{"ok": false, "error": "invoice already paid"})
	default:
		reply(w, 200, map[string]any{"ok": true, "invoice": inv.ID})
	}
}

func main() { http.HandleFunc("/cardauto", cardauto); http.ListenAndServe(":8080", nil) }

// ASP.NET Core Minimal API (Program.cs)
using System.Security.Cryptography;
using System.Text;

app.MapPost("/cardauto", async (HttpRequest req, AppDb db) =>
{
    var f = await req.ReadFormAsync();
    string F(string k) => f[k].ToString();
    var invoice = F("invoice").Trim();
    var parts = new List<string> { F("project_id"), F("uid"), F("amount"), F("account"), F("sms_time"), F("ts") };
    if (invoice != "") parts.Add(invoice);
    var sig = Convert.ToHexString(HMACSHA256.HashData(Encoding.UTF8.GetBytes(app.Configuration["CardAuto:Secret"]!),
                                                     Encoding.UTF8.GetBytes(string.Join('|', parts)))).ToLowerInvariant();
    long.TryParse(F("ts"), out var ts);
    if (!CryptographicOperations.FixedTimeEquals(Encoding.UTF8.GetBytes(sig), Encoding.UTF8.GetBytes(F("signature")))
        || Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - ts) > 600)
        return Results.Json(new { ok = false, error = "bad signature" }, statusCode: 403);

    var dup = await db.Invoices.FirstOrDefaultAsync(i => i.PaidUid == F("uid"));
    if (dup != null) return Results.Json(new { ok = true, duplicate = true, invoice = dup.Id.ToString() });

    var amount = long.Parse(F("amount"));
    var inv = invoice != ""
        ? await db.Invoices.FindAsync(long.Parse(invoice))
        : await db.Invoices.Where(i => i.Amount == amount && i.Status == "unpaid" && i.CreatedAt > DateTime.UtcNow.AddDays(-1))
                           .OrderByDescending(i => i.Id).FirstOrDefaultAsync();
    if (inv == null) return Results.Json(new { ok = false, error = "invoice not found" }, statusCode: 404);
    if (inv.Status == "cancelled") return Results.Json(new { ok = false, error = "invoice cancelled" }, statusCode: 410);

    var n = await db.Invoices.Where(i => i.Id == inv.Id && i.Status != "paid")
        .ExecuteUpdateAsync(s => s.SetProperty(i => i.Status, "paid").SetProperty(i => i.PaidUid, F("uid")).SetProperty(i => i.PaidAt, DateTime.UtcNow));
    if (n == 0) return Results.Json(new { ok = false, error = "invoice already paid" }, statusCode: 409);
    return Results.Json(new { ok = true, invoice = inv.Id.ToString() });
}).DisableAntiforgery();

// Spring Boot
@RestController
public class CardAutoController {
    @Value("${cardauto.secret}") private String secret;
    private final InvoiceRepository invoices;
    public CardAutoController(InvoiceRepository invoices) { this.invoices = invoices; }

    @PostMapping(value = "/cardauto", consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
    public ResponseEntity<Map<String, Object>> callback(@RequestParam MultiValueMap<String, String> f) throws Exception {
        Function<String, String> g = k -> Optional.ofNullable(f.getFirst(k)).orElse("");
        String invoice = g.apply("invoice").trim();
        List<String> parts = new ArrayList<>(List.of(g.apply("project_id"), g.apply("uid"), g.apply("amount"), g.apply("account"), g.apply("sms_time"), g.apply("ts")));
        if (!invoice.isEmpty()) parts.add(invoice);
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        String sig = HexFormat.of().formatHex(mac.doFinal(String.join("|", parts).getBytes(StandardCharsets.UTF_8)));
        long ts = g.apply("ts").isEmpty() ? 0 : Long.parseLong(g.apply("ts"));
        if (!MessageDigest.isEqual(sig.getBytes(), g.apply("signature").getBytes()) || Math.abs(Instant.now().getEpochSecond() - ts) > 600)
            return ResponseEntity.status(403).body(Map.of("ok", false, "error", "bad signature"));

        var dup = invoices.findByPaidUid(g.apply("uid"));
        if (dup.isPresent()) return ResponseEntity.ok(Map.of("ok", true, "duplicate", true, "invoice", dup.get().getId().toString()));

        Optional<Invoice> inv = invoice.isEmpty()
            ? invoices.findFirstByAmountAndStatusAndCreatedAtAfterOrderByIdDesc(Long.parseLong(g.apply("amount")), "unpaid", LocalDateTime.now().minusDays(1))
            : invoices.findById(Long.parseLong(invoice));
        if (inv.isEmpty()) return ResponseEntity.status(404).body(Map.of("ok", false, "error", "invoice not found"));
        if ("cancelled".equals(inv.get().getStatus())) return ResponseEntity.status(410).body(Map.of("ok", false, "error", "invoice cancelled"));
        // @Modifying @Query("update Invoice i set i.status='paid', i.paidUid=:uid where i.id=:id and i.status <> 'paid'")
        if (invoices.markPaidIfUnpaid(inv.get().getId(), g.apply("uid")) == 0)
            return ResponseEntity.status(409).body(Map.of("ok", false, "error", "invoice already paid"));
        return ResponseEntity.ok(Map.of("ok", true, "invoice", inv.get().getId().toString()));
    }
}