Accept card payments server-to-server

const express = require('express');
const crypto = require('crypto');
const router = express.Router();

// Every active Glomo secret key, comma-separated (store in environment variables)
const GLOMO_SECRET_KEYS = (process.env.GLOMO_SECRET_KEYS || '')
  .split(',')
  .map((k) => k.trim())
  .filter(Boolean);
if (GLOMO_SECRET_KEYS.length === 0) throw new Error('GLOMO_SECRET_KEYS is not set');

/**
 * Check the signature against each active secret key
 */
function verifySignature(orderId, paymentId, status, signature, secretKeys) {
  const data = `${orderId}|${paymentId}|${status}`;
  const received = Buffer.from(signature || '');
  return secretKeys.some((secret) => {
    if (!secret) return false; // an empty key never matches
    const expected = Buffer.from(crypto.createHmac('sha256', secret).update(data).digest('hex'));
    return expected.length === received.length && crypto.timingSafeEqual(expected, received);
  });
}

/**
 * Glomo Payment Callback Handler
 */
router.get('/payment/callback', (req, res) => {
  // Extract query parameters
  const { order_id, payment_id, status, signature } = req.query;

  // Verify signature
  if (!verifySignature(order_id, payment_id, status, signature, GLOMO_SECRET_KEYS)) {
    console.error('Signature verification failed');
    return res.redirect(`/payment/error?message=Invalid signature`);
  }

  // Signature is valid - proceed based on payment status
  console.log('Payment verified successfully');

  // Redirect based on payment status
  if (status === 'success') {
    return res.redirect(`/payment/success?order_id=${order_id}&payment_id=${payment_id}`);
  } else if (status === 'failed') {
    return res.redirect(`/payment/failed?order_id=${order_id}`);
  } else {
    return res.redirect(`/payment/error?order_id=${order_id}`);
  }
});

module.exports = router;

<?php

/**
 * Check the signature against each active secret key
 */
function verifySignature($orderId, $paymentId, $status, $signature, array $secretKeys) {
    $data = "$orderId|$paymentId|$status";
    foreach ($secretKeys as $secret) {
        if ((string) $secret === '') {
            continue; // an empty key never matches
        }
        if (hash_equals(hash_hmac('sha256', $data, $secret), (string) $signature)) {
            return true;
        }
    }
    return false;
}

// Every active Glomo secret key, comma-separated, from your config
$glomoSecretKeys = array_values(array_filter(array_map('trim', explode(',', (string) getenv('GLOMO_SECRET_KEYS')))));
if (count($glomoSecretKeys) === 0) {
    throw new RuntimeException('GLOMO_SECRET_KEYS is not set');
}

// Verify signature
if (!verifySignature($orderId, $paymentId, $status, $signature, $glomoSecretKeys)) {
    // Signature verification failed
}

require 'openssl'

# Check the signature against each active secret key
def verify_signature(order_id, payment_id, status, signature, secret_keys)
  data = "#{order_id}|#{payment_id}|#{status}"
  secret_keys.any? do |secret|
    next false if secret.to_s.empty? # an empty key never matches
    OpenSSL.secure_compare(OpenSSL::HMAC.hexdigest('SHA256', secret, data), signature.to_s)
  end
end

# Every active Glomo secret key, comma-separated, from your config
GLOMO_SECRET_KEYS = ENV.fetch('GLOMO_SECRET_KEYS', '').split(',').map(&:strip).reject(&:empty?)
raise 'GLOMO_SECRET_KEYS is not set' if GLOMO_SECRET_KEYS.empty?

# Verify signature
unless verify_signature(order_id, payment_id, status, signature, GLOMO_SECRET_KEYS)
  # Signature verification failed
end

import (
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "errors"
    "fmt"
    "log"
    "os"
    "strings"
)

// loadSecretKeys reads every active Glomo secret key from a comma-separated value
func loadSecretKeys(value string) ([]string, error) {
    var keys []string
    for _, key := range strings.Split(value, ",") {
        key = strings.TrimSpace(key)
        if key != "" {
            keys = append(keys, key)
        }
    }
    if len(keys) == 0 {
        return nil, errors.New("GLOMO_SECRET_KEYS is not set")
    }
    return keys, nil
}

// verifySignature checks the signature against each active secret key
func verifySignature(orderID, paymentID, status, signature string, secretKeys []string) bool {
    data := fmt.Sprintf("%s|%s|%s", orderID, paymentID, status)

    for _, secret := range secretKeys {
        if secret == "" {
            continue // an empty key never matches
        }
        h := hmac.New(sha256.New, []byte(secret))
        h.Write([]byte(data))
        expected := hex.EncodeToString(h.Sum(nil))

        if hmac.Equal([]byte(expected), []byte(signature)) {
            return true
        }
    }
    return false
}

// Every active Glomo secret key, comma-separated, from your config
glomoSecretKeys, err := loadSecretKeys(os.Getenv("GLOMO_SECRET_KEYS"))
if err != nil {
    log.Fatal(err)
}

// Verify signature
if !verifySignature(orderID, paymentID, status, signature, glomoSecretKeys) {
    // Signature verification failed
}

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.ArrayList;
import java.util.List;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;

// Every active Glomo secret key, comma-separated, from your config
private static final List<String> GLOMO_SECRET_KEYS = loadSecretKeys(System.getenv("GLOMO_SECRET_KEYS"));

public static List<String> loadSecretKeys(String value) {
    List<String> keys = new ArrayList<>();
    if (value != null) {
        for (String key : value.split(",")) {
            if (!key.trim().isEmpty()) keys.add(key.trim());
        }
    }
    if (keys.isEmpty()) throw new IllegalStateException("GLOMO_SECRET_KEYS is not set");
    return keys;
}

// Call as verifySignature(orderId, paymentId, status, signature, GLOMO_SECRET_KEYS)
public static boolean verifySignature(String orderId, String paymentId, String status,
                                      String signature, List<String> secretKeys) {
    if (signature == null) return false;
    try {
        byte[] data = (orderId + "|" + paymentId + "|" + status).getBytes(StandardCharsets.UTF_8);
        byte[] received = signature.getBytes(StandardCharsets.UTF_8);

        for (String secret : secretKeys) {
            if (secret == null || secret.isEmpty()) continue; // an empty key never matches

            Mac mac = Mac.getInstance("HmacSHA256");
            mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));

            StringBuilder hex = new StringBuilder();
            for (byte b : mac.doFinal(data)) hex.append(String.format("%02x", b));

            if (MessageDigest.isEqual(hex.toString().getBytes(StandardCharsets.UTF_8), received)) {
                return true;
            }
        }
        return false;
    } catch (Exception e) {
        return false;
    }
}