Kod örnekleri

import express from "express";
import crypto from "node:crypto";

const app = express();
const API = "https://odecik.com/api/v1";
const KEY = process.env.ODECIK_API_KEY;
const WEBHOOK_SECRET = process.env.ODECIK_WEBHOOK_SECRET;

// 1) Satın al butonu → ödeme oturumu aç → alıcıyı yönlendir
app.post("/satin-al", express.urlencoded({ extended: false }), async (req, res) => {
  const r = await fetch(`${API}/checkout/sessions`, {
    method: "POST",
    headers: { Authorization: `Bearer ${KEY}`, "Content-Type": "application/json" },
    body: JSON.stringify({
      product: req.body.product,
      successUrl: "https://siteadresin.com/tesekkurler",
      buyer: { name: req.body.name, email: req.body.email, ip: req.ip },
    }),
  });
  const session = await r.json();
  if (!r.ok) return res.status(400).send(session.error.message);
  res.redirect(303, session.paymentUrl);
});

// 2) Webhook — ham gövde gerekli, express.json() KULLANMA
app.post("/odecik-webhook", express.raw({ type: "application/json" }), (req, res) => {
  const header = req.get("x-odecik-signature") ?? "";
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const expected = crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(`${parts.t}.${req.body}`)
    .digest("hex");

  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  const valid =
    fresh && parts.v1 && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(parts.v1));
  if (!valid) return res.sendStatus(400);

  const evt = JSON.parse(req.body.toString("utf8"));
  if (evt.event === "order.paid") {
    // evt.id ile tekrarları ele, siparişi teslim et
    console.log("Ödendi:", evt.data.orderNo, evt.data.totalKurus);
  }
  res.sendStatus(200);
});

app.listen(3000);