Integre pagamentos
sem adivinhação.

import crypto from "node:crypto";

export async function criarPix({ orderId, amount, customer }) {
  const response = await fetch("https://trust7.dev/v1/payments", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.TRUST7_API_KEY}`,
      "Content-Type": "application/json",
      "Accept": "application/json",
      "Idempotency-Key": `order-${orderId}-pix-v1`
    },
    body: JSON.stringify({
      amount,
      currency: "BRL",
      payment_method: { type: "pix", expires_in_seconds: 1800 },
      customer,
      metadata: { order_id: String(orderId) }
    }),
    signal: AbortSignal.timeout(10_000)
  });

  const payload = await response.json();
  if (!response.ok) {
    const error = new Error(payload.error?.message ?? "Trust7 request failed");
    error.status = response.status;
    error.code = payload.error?.code;
    throw error;
  }
  return {
    paymentId: payload.id,
    status: payload.status,
    copyPaste: payload.next_action?.qr_code,
    expiresAt: payload.next_action?.expires_at
  };
}

import os
import requests

def criar_pix(order_id: str, amount: int, customer: dict) -> dict:
    response = requests.post(
        "https://trust7.dev/v1/payments",
        headers={
            "Authorization": f"Bearer {os.environ['TRUST7_API_KEY']}",
            "Idempotency-Key": f"order-{order_id}-pix-v1",
            "Accept": "application/json",
        },
        json={
            "amount": amount,
            "currency": "BRL",
            "payment_method": {"type": "pix", "expires_in_seconds": 1800},
            "customer": customer,
            "metadata": {"order_id": order_id},
        },
        timeout=10,
    )
    payload = response.json()
    response.raise_for_status()
    return {
        "payment_id": payload["id"],
        "status": payload["status"],
        "copy_paste": payload["next_action"]["qr_code"],
        "expires_at": payload["next_action"]["expires_at"],
    }

<?php
function criarPix(string $orderId, int $amount, array $customer): array {
    $curl = curl_init('https://trust7.dev/v1/payments');
    curl_setopt_array($curl, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 10,
        CURLOPT_HTTPHEADER => [
            'Authorization: Bearer ' . getenv('TRUST7_API_KEY'),
            'Content-Type: application/json',
            'Accept: application/json',
            'Idempotency-Key: order-' . $orderId . '-pix-v1',
        ],
        CURLOPT_POSTFIELDS => json_encode([
            'amount' => $amount,
            'currency' => 'BRL',
            'payment_method' => ['type' => 'pix', 'expires_in_seconds' => 1800],
            'customer' => $customer,
            'metadata' => ['order_id' => $orderId],
        ], JSON_THROW_ON_ERROR),
    ]);
    $raw = curl_exec($curl);
    $status = curl_getinfo($curl, CURLINFO_RESPONSE_CODE);
    $payload = json_decode($raw, true, flags: JSON_THROW_ON_ERROR);
    if ($status < 200 || $status >= 300) {
        throw new RuntimeException($payload['error']['message'] ?? 'Trust7 request failed');
    }
    return $payload;
}

import crypto from "node:crypto";
import express from "express";

const app = express();
app.post("/webhooks/trust7", express.raw({ type: "application/json" }), (req, res) => {
  const signature = req.get("Trust7-Signature") ?? "";
  const parts = Object.fromEntries(signature.split(",").map(part => part.split("=", 2)));
  const timestamp = Number(parts.t);
  if (!Number.isFinite(timestamp) || Math.abs(Date.now() / 1000 - timestamp) > 300) {
    return res.sendStatus(400);
  }

  const expected = crypto.createHmac("sha256", process.env.TRUST7_WEBHOOK_SECRET)
    .update(`${timestamp}.`)
    .update(req.body)
    .digest("hex");
  const received = Buffer.from(parts.v1 ?? "", "hex");
  const valid = received.length === expected.length / 2 &&
    crypto.timingSafeEqual(received, Buffer.from(expected, "hex"));
  if (!valid) return res.sendStatus(401);

  const event = JSON.parse(req.body.toString("utf8"));
  // 1) insira event.id com UNIQUE; duplicado significa que já foi processado
  // 2) aplique somente sequence maior que a última do mesmo pagamento
  // 3) confirme o pedido apenas em payment.captured
  res.sendStatus(204);
});

import hashlib
import hmac
import json
import os
import time
from flask import Flask, request

app = Flask(__name__)

@app.post("/webhooks/trust7")
def trust7_webhook():
    raw = request.get_data(cache=False)
    parts = dict(item.split("=", 1) for item in request.headers.get("Trust7-Signature", "").split(",") if "=" in item)
    timestamp = int(parts.get("t", "0"))
    if abs(int(time.time()) - timestamp) > 300:
        return "stale", 400
    signed = str(timestamp).encode() + b"." + raw
    expected = hmac.new(os.environ["TRUST7_WEBHOOK_SECRET"].encode(), signed, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, parts.get("v1", "")):
        return "invalid signature", 401
    event = json.loads(raw)
    # deduplicar event["id"] e respeitar event["sequence"]
    return "", 204