Validate and fulfil

import crypto from "node:crypto";
import express from "express";

const app = express();

app.post("/webhooks/kwugwo", express.raw({ type: "application/json" }), async (req, res) => {
  // 1. Verify
  const expected = crypto.createHmac("sha256", process.env.KWUGWO_WEBHOOK_SECRET)
    .update(req.body).digest("hex");
  const given = req.get("X-Kwugwo-Signature") ?? "";
  if (given.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected))) {
    return res.sendStatus(401);
  }

  const event = JSON.parse(req.body);

  // 2. De-duplicate, then acknowledge
  if (!(await db.webhookEvents.insertIfNew(event.uid))) return res.sendStatus(200);
  res.sendStatus(200);

  if (event.event === "ugwo.successful") await confirmPayment(event.data.uid);
});

async function confirmPayment(ugwoUid) {
  // 3–4. Find the order and re-fetch the ugwo
  const order = await db.orders.findByUgwoUid(ugwoUid);
  if (!order) return log.warn("Unknown ugwo", ugwoUid);

  const ugwo = await fetch(`${process.env.KWUGWO_API}/v1/ugwo/${ugwoUid}`, {
    headers: { Authorization: `Bearer ${process.env.KWUGWO_SECRET_KEY}` },
  }).then(r => r.json());

  // 5. Compare
  const ok =
    ugwo.status === "ugwo_successful" &&
    ugwo.total_amount_paid >= ugwo.amount &&
    ugwo.amount === order.totalKobo &&
    ugwo.currency === order.currency &&
    ugwo.ref === order.id;

  if (!ok) return db.orders.flagForReview(order.id, ugwo);

  // 6. Fulfil once
  const changed = await db.orders.markPaidIfPending(order.id, {
    ugwoUid: ugwo.uid,
    activityUid: ugwo.lastest_ugwo_activity?.uid, // note the spelling; keep it for refunds
  });
  if (changed) await fulfil(order.id);
}

import hmac, hashlib, json, os, requests
from flask import Flask, request

app = Flask(__name__)

@app.post("/webhooks/kwugwo")
def kwugwo_webhook():
    raw = request.get_data()
    expected = hmac.new(os.environ["KWUGWO_WEBHOOK_SECRET"].encode(), raw, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-Kwugwo-Signature", "")):
        return "", 401

    event = json.loads(raw)
    if not db.webhook_events.insert_if_new(event["uid"]):
        return "", 200

    if event["event"] == "ugwo.successful":
        queue.enqueue(confirm_payment, event["data"]["uid"])
    return "", 200


def confirm_payment(ugwo_uid):
    order = db.orders.find_by_ugwo_uid(ugwo_uid)
    if order is None:
        return

    ugwo = requests.get(
        f"{os.environ['KWUGWO_API']}/v1/ugwo/{ugwo_uid}",
        headers={"Authorization": f"Bearer {os.environ['KWUGWO_SECRET_KEY']}"},
    ).json()

    ok = (
        ugwo["status"] == "ugwo_successful"
        and ugwo["total_amount_paid"] >= ugwo["amount"]
        and ugwo["amount"] == order.total_kobo
        and ugwo["currency"] == order.currency
        and ugwo["ref"] == order.id
    )
    if not ok:
        return db.orders.flag_for_review(order.id, ugwo)

    activity = ugwo.get("lastest_ugwo_activity") or {}  # note the spelling
    if db.orders.mark_paid_if_pending(order.id, ugwo["uid"], activity.get("uid")):
        fulfil(order.id)