// Node 18+  (npm i express)
const crypto = require('crypto');
const express = require('express');
const GATEWAY = 'https://pay.yourdomain.com', API_KEY = 'PASTE_API_KEY', API_SECRET = 'PASTE_API_SECRET';

async function createInvoice(orderId, amount, network) {
  const f = { api_key: API_KEY, order_id: orderId, amount, callback_url: 'https://yourshop.com/gateway/callback' };
  if (network) f.network = network;
  f.sign = crypto.createHmac('sha256', API_SECRET).update(`${API_KEY}|${orderId}|${amount}`).digest('hex');
  const r = await fetch(`${GATEWAY}/api/create.php`, { method: 'POST', body: new URLSearchParams(f) });
  const j = await r.json();
  if (!j.success) throw new Error(j.error);
  return j; // j.pay_url पर customer को भेजें
}

const app = express();
app.post('/gateway/callback', express.raw({ type: '*/*' }), (req, res) => {
  const ts = req.header('X-Gateway-Timestamp') || '', sig = req.header('X-Gateway-Signature') || '';
  const body = req.body.toString('utf8');   // RAW body पर ही signature check करें
  const exp = crypto.createHmac('sha256', API_SECRET).update(`${ts}.${body}`).digest('hex');
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 600 ||
      sig.length !== exp.length || !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(exp))) return res.sendStatus(403);
  const d = JSON.parse(body);
  if (d.event === 'invoice.paid') { /* order paid mark करें (idempotent) */ }
  res.send('OK');
});
app.listen(3000);