Webhooks

[Пассажир оплачивает на сайте авиакомпании]
        │
        ▼
[Your backend] → POST /bookings/{id}/initiate-payment → NurCore
        │
        ▼
[Freedom Pay] → платёж проходит → webhook → NurCore
        │
        ▼
[NurCore] → booking.confirmed → POST на ваш webhook URL
        │                       (HMAC-SHA256 подпись)
        ▼
[Ваш backend]
        │ Парсит payload
        │ Начисляет миль в loyalty programme
        │ Шлёт push пользователю через ваш FCM
        ▼
[Возвращает 200 OK]

curl -X POST \
  -H "Authorization: Bearer $STAFF_JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Your backend integration",
    "url": "https://api.example-airline.com/internal/nurcore-webhooks",
    "events": [
      "booking.confirmed",
      "booking.cancelled",
      "booking.refunded",
      "flight.delayed",
      "flight.cancelled",
      "passenger.checked_in"
    ],
    "max_retries": 3,
    "timeout_seconds": 10
  }' \
  "https://api.nurcore.kg/api/v1/notifications/outgoing-webhooks/"

{
  "id": "uuid",
  "name": "Your backend integration",
  "url": "https://api.example-airline.com/internal/nurcore-webhooks",
  "secret": "abc123XyZ...48-char-secret",
  "events": ["booking.confirmed", "..."],
  "is_active": true,
  "max_retries": 3,
  "timeout_seconds": 10,
  "created_at": "2026-05-12T02:00:00Z"
}

{
  "booking_id": "uuid",
  "booking_reference": "ABC123",
  "status": "confirmed",
  "total_amount": 5000.00,
  "currency": "KGS",
  "passenger_count": 2,
  "contact_email": "user@example.com",
  "flight_id": "uuid",
  "confirmed_at": "2026-05-12T10:00:00Z"
}

{
  "flight_id": "uuid",
  "flight_number": "ZM-202",
  "origin_iata": "FRU",
  "destination_iata": "IST",
  "original_departure": "2026-05-15T07:30:00Z",
  "new_departure": "2026-05-15T09:00:00Z",
  "delay_minutes": 90,
  "reason": "ATC delay",
  "affected_passengers": 78
}

POST /your/webhook/endpoint HTTP/1.1
Host: api.example-airline.com
Content-Type: application/json
User-Agent: NurCore-Webhooks/1.0
X-NurCore-Event: booking.confirmed
X-NurCore-Event-Id: 550e8400-e29b-41d4-a716-446655440000
X-NurCore-Timestamp: 1747031600
X-NurCore-Signature: sha256=abc123def456...
X-NurCore-Delivery-Id: 660e8400-e29b-41d4-a716-446655440001

{"booking_id":"uuid","booking_reference":"ABC123",...}

signed_payload = "{timestamp}.{event_id}.{request_body}"
expected = HMAC-SHA256(secret, signed_payload).hex()
expected_signature = "sha256=" + expected

# Сравните с X-NurCore-Signature (constant-time comparison!)

import hmac
import hashlib

WEBHOOK_SECRET = "abc123XyZ..."  # из POST /outgoing-webhooks/ response

@app.post("/internal/nurcore-webhooks")
async def receive_webhook(request: Request):
    body = await request.body()
    timestamp = request.headers["X-NurCore-Timestamp"]
    event_id = request.headers["X-NurCore-Event-Id"]
    signature = request.headers["X-NurCore-Signature"]

    # 1. Compute expected
    signed_payload = f"{timestamp}.{event_id}.{body.decode()}"
    expected = "sha256=" + hmac.new(
        WEBHOOK_SECRET.encode(),
        signed_payload.encode(),
        hashlib.sha256
    ).hexdigest()

    # 2. Constant-time compare
    if not hmac.compare_digest(expected, signature):
        raise HTTPException(403, "Invalid signature")

    # 3. Anti-replay: timestamp не старше 5 минут
    import time
    if abs(time.time() - int(timestamp)) > 300:
        raise HTTPException(400, "Replay attack: timestamp too old")

    # 4. Idempotency: уже обработали этот event_id?
    if await already_processed(event_id):
        return {"status": "duplicate"}

    # 5. Обработка
    event_type = request.headers["X-NurCore-Event"]
    data = await request.json()
    await handle_event(event_type, data)

    await mark_processed(event_id)
    return {"status": "ok"}

import crypto from "crypto";

const WEBHOOK_SECRET = process.env.NURCORE_WEBHOOK_SECRET!;

app.post("/internal/nurcore-webhooks", async (req, res) => {
  const body = JSON.stringify(req.body);  // или raw body
  const timestamp = req.headers["x-nurcore-timestamp"] as string;
  const eventId = req.headers["x-nurcore-event-id"] as string;
  const receivedSig = req.headers["x-nurcore-signature"] as string;

  const signedPayload = `${timestamp}.${eventId}.${body}`;
  const expected = "sha256=" + crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(signedPayload)
    .digest("hex");

  // Constant-time comparison
  const a = Buffer.from(expected);
  const b = Buffer.from(receivedSig);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(403).json({ error: "Invalid signature" });
  }

  if (Math.abs(Date.now() / 1000 - parseInt(timestamp)) > 300) {
    return res.status(400).json({ error: "Replay attack" });
  }

  // Process event...
  res.json({ status: "ok" });
});

@app.post("/internal/nurcore-webhooks")
async def receive_webhook(request: Request):
    # 1. Проверить подпись (быстро)
    verify_signature(request)

    # 2. Сохранить в очередь
    await queue.publish("nurcore_event", await request.json())

    # 3. Ответить 200 сразу
    return {"status": "queued"}

-- В вашей БД:
CREATE TABLE processed_webhook_events (
  event_id UUID PRIMARY KEY,
  processed_at TIMESTAMPTZ DEFAULT now()
);

-- В обработчике:
INSERT INTO processed_webhook_events (event_id) VALUES ($1)
ON CONFLICT DO NOTHING
RETURNING event_id;
-- Если RETURNING пустой → уже обработали, skip

{
  "name": "Astana Travel agency webhooks",
  "url": "https://crm.astana-travel.kz/nurcore",
  "events": ["booking.confirmed", "booking.cancelled"],
  "partner_id": "uuid-of-astana-travel"
}

# Localhost listener (Python)
python3 -m http.server 8080

# Tunnel через ngrok
ngrok http 8080

# Создаёте subscription на полученный URL
curl -X POST .../outgoing-webhooks/ -d '{
  "url": "https://abc123.ngrok.io/webhook",
  "events": ["booking.confirmed"],
  ...
}'

# История всех попыток для подписки
curl -H "Authorization: Bearer $JWT" \
  "https://api.nurcore.kg/api/v1/notifications/outgoing-webhooks/{sub_id}/deliveries"

# Видите failed/dead_letter deliveries для debug