Makosa ya serikali

Lia inatellana na server yako wakati kuzalisha kwa kuzalisha au kuzalisha mali na wakati kuzalisha mali, kwa kuchangia kwenye webhook yako. Kile kinatuma, jinsi kucheza kuchangia, na jinsi kuzalisha kama kifanyi.

#Kuhakikisha kwa kwanza

Tumia mwenyekiti wa Lia kwa mstari wako, na kusimamia siriti la kushiriki kwa kawaida (whsec_…) ambayo ilikuwa na kificho chako. Lia kisha inatuma POST kwenye wakati wote ambapo kitu kimekuja katika app yako.

Kumbukumbu kina kuzungumza, sikuwezi kama ujumbe wa kutosha: tazama API kabla ya kufanya (kwa kifedha, GET /charges/:id). Na sio'kukutana na webhooks tu; mzunguko wako pia inaweza kusema kwenye serikali yako (tazama Kuwasiliana na kitu).

#Nini'kikosi cha asili kimefanywa

POST /lia/webhook
Content-Type: application/json
Lia-Signature: t=1761998400,v1=5f2c8a…

{
  "type": "charge.paid",
  "app": "your-app",
  "at": 1761998400123,
  "data": {
    "id": "ch_9b1f4c2e7a0d5b8f3e6a1c4d",
    "playerId": "p_3f9c0a6d1b2e4f5a6b7c",
    "productId": "extra-lives",
    "amount": 5,
    "status": "paid",
    "mode": "live",
    "createdAt": 1761998400000,
    "deliveredAt": null,
    "refundedAt": null
  }
}

#Aina

Tathmini data.mode (au malipo's mode) kwa sababu matokeo ya kutosha hajapokea yoyote ya kutosha. Kuna matumizi mengine ambayo zinaweza kuongezwa: wasiliana na matumizi ambayo sio't kujua na kujibu 200.

#Kutafuta kichaguzi

Kila webhook ina Lia-Signature header, t=<seconds>,v1=<signature>. Kifupi kimekamilika HMAC SHA-256, katika hex, ya saa, mmoja, na maelekezo ya kawaida, kwa kifupi cha kawaida yako (kwa kawaida whsec_):

v1 = hex(HMAC_SHA256(key = "whsec_…", message = t + "." + rawBody))

Tafuta kwa jinsi iliyotumika kwa kawaida kama ilivyo, kabla ya kuchapisha, na kushangaa kwa kumbukumbu zilizopita kwa dakika kadhaa.

import { createHmac, timingSafeEqual } from "node:crypto";

export function liaWebhook(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries((header ?? "").split(",").map((part) => part.split("=")));
  const t = Number(parts.t);
  if (!t || !parts.v1) return null;
  if (Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return null;
  const expected = Buffer.from(createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex"));
  const given = Buffer.from(parts.v1);
  if (expected.length !== given.length || !timingSafeEqual(expected, given)) return null;
  return JSON.parse(rawBody);
}

export async function liaWebhook(request, secret, toleranceSeconds = 300) {
  const rawBody = await request.text();
  const parts = Object.fromEntries((request.headers.get("Lia-Signature") ?? "").split(",").map((part) => part.split("=")));
  const t = Number(parts.t);
  if (!t || !parts.v1 || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return null;
  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
  const signature = new Uint8Array(parts.v1.match(/../g).map((byte) => parseInt(byte, 16)));
  const ok = await crypto.subtle.verify("HMAC", key, signature, new TextEncoder().encode(`${t}.${rawBody}`));
  return ok ? JSON.parse(rawBody) : null;
}

Kusikiliza webhooks ana mchakato wote.

#Kujibu na kujaribu tena

• Jibu kwa yoyote 2xx hali, kwa siri. Kazi ya kutosha kisha kusoma.
• Kama serikali yako si't kusikia 2xx (au anaweza't be reached), Lia tries once more straight away. After that, the webhook isn'kukabili kwenye tena.
• Kwa sababu kumbukumbu za webhooks zinaweza kuzichukuliwa, na kuzipita mara mbili. Kumbuka kuwa mchango wako unapaswa kusafisha kuzipita mara mbili (kutokana na ID ya kifundisha au kifuniko cha matokeo), na njia nyingine ya kuzungumza, kama Lia.charges() wakati mshirika akifungua app yako.

#Siri yako

Siri ya webhook yako inchanginga wakati wako wamefanywa kwa mengine. Kumbusha kwenye serikali yako, kama mengine yako.

Kutafsiri kwa kawaida. Kiingereza kina maana ya kawaida. Kusoma kwa Kiingereza