# Быстрый smoke-test: AES-256-GCM конверт через openssl + curl.
# openssl ниже работает с GCM на 1.1.1+; для прод-интеграции используйте
# библиотечный пример (Python / JS / Rust) — там tag и nonce обрабатываются явно.

KEY_B64="your_base64_encryption_key"
BODY='{"public_user_id":"DPPU-X9Y8Z7W6V5","qr_payload":"00020101021230740016A000000677010111011300660000000000021700000000000000000530376454031500802TH91047CBC","external_user_id":"user_456","callback_url":"https://your.domain/webhooks/payments"}'

# 1) Сгенерировать случайный 12-байтный nonce
NONCE=$(openssl rand 12 | base64)
NONCE_HEX=$(echo "$NONCE" | base64 -d | xxd -p -c 256)
KEY_HEX=$(echo "$KEY_B64" | base64 -d | xxd -p -c 256)

# 2) Зашифровать (ciphertext + GCM tag) и base64-кодировать
CIPHERTEXT=$(echo -n "$BODY" | openssl enc -aes-256-gcm -K "$KEY_HEX" -iv "$NONCE_HEX" -nopad | base64)

# 3) Завернуть в конверт и отправить
curl -X POST https://api.aggregator.stage.doverkasend.com/api/v1/payments/transactions \
  -H "Authorization: Bearer dpm_your_token_here" \
  -H "Idempotency-Key: pay-20260520-inv-0042" \
  -H "Content-Type: application/json" \
  -d "{\"data\":\"$CIPHERTEXT\",\"nonce\":\"$NONCE\"}"

import os, json, base64
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

def encrypt_envelope(key: bytes, payload: dict) -> dict:
    nonce = os.urandom(12)
    ct = AESGCM(key).encrypt(nonce, json.dumps(payload).encode(), None)
    return {
        "data": base64.b64encode(ct).decode(),
        "nonce": base64.b64encode(nonce).decode(),
    }

def decrypt_envelope(key: bytes, envelope: dict) -> dict:
    nonce = base64.b64decode(envelope["nonce"])
    ct = base64.b64decode(envelope["data"])
    return json.loads(AESGCM(key).decrypt(nonce, ct, None))

// Node 18+: WebCrypto API (crypto.subtle). For browser code it is identical.
export async function encryptEnvelope(key, payload) {
  const nonce = crypto.getRandomValues(new Uint8Array(12));
  const pt = new TextEncoder().encode(JSON.stringify(payload));
  const ct = new Uint8Array(
    await crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce }, key, pt)
  );
  const b64 = (u8) => Buffer.from(u8).toString("base64");
  return { data: b64(ct), nonce: b64(nonce) };
}

<?php
// PHP 7.2+: AES-256-GCM через openssl_encrypt с параметром tag.
// $key — это 32 сырых байта (ваш encryption_key, после base64-decode).

function encryptEnvelope(string $key, array $payload): array {
    $nonce = random_bytes(12);
    $tag = '';
    $ciphertext = openssl_encrypt(
        json_encode($payload, JSON_UNESCAPED_UNICODE),
        'aes-256-gcm',
        $key,
        OPENSSL_RAW_DATA,
        $nonce,
        $tag,
        '',
        16
    );
    return [
        'data'  => base64_encode($ciphertext . $tag),
        'nonce' => base64_encode($nonce),
    ];
}

function decryptEnvelope(string $key, array $envelope): array {
    $blob = base64_decode($envelope['data']);
    $nonce = base64_decode($envelope['nonce']);
    $tag = substr($blob, -16);
    $ciphertext = substr($blob, 0, -16);
    $plaintext = openssl_decrypt(
        $ciphertext,
        'aes-256-gcm',
        $key,
        OPENSSL_RAW_DATA,
        $nonce,
        $tag
    );
    return json_decode($plaintext, true);
}

// Cargo.toml: aes-gcm = "0.10"; rand = "0.8"; base64 = "0.22"; serde_json = "1"
use aes_gcm::{Aes256Gcm, KeyInit, Nonce, aead::Aead};
use base64::{Engine, engine::general_purpose::STANDARD};
use rand::RngCore;
use serde_json::Value;

type BoxError = Box<dyn std::error::Error + Send + Sync>;

pub fn encrypt_envelope(key: &[u8; 32], payload: &Value) -> Result<Value, BoxError> {
    let cipher = Aes256Gcm::new(key.into());
    let mut nonce_bytes = [0u8; 12];
    rand::thread_rng().fill_bytes(&mut nonce_bytes);
    let ct = cipher
        .encrypt(Nonce::from_slice(&nonce_bytes), serde_json::to_vec(payload)?.as_ref())
        .map_err(|e| format!("encrypt: {e}"))?;
    Ok(serde_json::json!({
        "data": STANDARD.encode(&ct),
        "nonce": STANDARD.encode(&nonce_bytes),
    }))
}

# Проверка X-Signature на входящем webhook.
# secret = encryption_key вашего токена (один общий секрет).

SECRET="your_encryption_key"
RAW_BODY='{"event":"payment.status_changed","payment_id":"DPP-1A2B3C4D5E","status":"COMPLETED"}'
SIG_HEADER='t=1716126000,v1=ab12cd34ef56...'

TS=$(echo "$SIG_HEADER" | awk -F',' '{print $1}' | cut -d'=' -f2)
SIG=$(echo "$SIG_HEADER" | awk -F',' '{print $2}' | cut -d'=' -f2)

# Отбрасываем, если дрейф timestamp больше 5 минут
NOW=$(date +%s)
DRIFT=$(( NOW > TS ? NOW - TS : TS - NOW ))
if [ "$DRIFT" -gt 300 ]; then
  echo "FAIL: stale timestamp"; exit 1
fi

# Пересчитываем HMAC-SHA256 и сравниваем
EXPECTED=$(printf '%s.%s' "$TS" "$RAW_BODY" | openssl dgst -sha256 -hmac "$SECRET" -hex | awk '{print $2}')

if [ "$EXPECTED" = "$SIG" ]; then
  echo "OK"
else
  echo "FAIL: signature mismatch"
fi

// X-Signature: t=<unix>,v1=<hex(HMAC-SHA256(secret, "{t}.{body}"))>
// Отклоняйте, если |now - t| > 300 секунд (±5 минут tolerance)
import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(secret, header, rawBody) {
  const parts = new Map(header.split(",").map((p) => p.split("=", 2)));
  const ts = Number(parts.get("t"));
  const sig = parts.get("v1");
  if (!ts || !sig) return false;
  if (Math.abs(Date.now() / 1000 - ts) > 300) return false;
  const expected = createHmac("sha256", secret)
    .update(`${ts}.` + rawBody.toString("utf8"))
    .digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(sig, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

# X-Signature: t=<unix>,v1=<hex(HMAC-SHA256(secret, "{t}.{body}"))>
# Отклоняйте, если |now - t| > 300 секунд (±5 минут tolerance)
import hmac, hashlib, time

def verify(secret: str, header: str, body: bytes) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    ts, sig = parts.get("t"), parts.get("v1")
    if not ts or not sig:
        return False
    if abs(time.time() - int(ts)) > 300:
        return False
    payload = f"{ts}.".encode() + body
    expected = hmac.new(secret.encode(), payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)

<?php
// X-Signature: t=<unix>,v1=<hex(HMAC-SHA256(secret, "{t}.{body}"))>
// Отклоняйте, если |now - t| > 300 секунд (±5 минут tolerance)
function verifySignature(string $secret, string $sigHeader, string $rawBody): bool {
    $parts = [];
    foreach (explode(',', $sigHeader) as $pair) {
        [$k, $v] = explode('=', $pair, 2);
        $parts[$k] = $v;
    }
    $ts = (int)($parts['t'] ?? 0);
    $sig = $parts['v1'] ?? '';
    if (abs(time() - $ts) > 300) {
        return false;
    }
    $expected = hash_hmac('sha256', $ts . '.' . $rawBody, $secret);
    return hash_equals($expected, $sig);
}

// X-Signature: t=<unix>,v1=<hex(HMAC-SHA256(secret, "{t}.{body}"))>
// Отклоняйте, если |now - t| > 300 секунд (±5 минут tolerance)
use hmac::{Hmac, Mac};
use sha2::Sha256;
use std::time::{SystemTime, UNIX_EPOCH};

pub fn verify(secret: &[u8], header: &str, body: &[u8]) -> bool {
    let mut ts: i64 = 0;
    let mut sig_hex = "";
    for part in header.split(',') {
        if let Some((k, v)) = part.split_once('=') {
            match k {
                "t" => ts = v.parse().unwrap_or(0),
                "v1" => sig_hex = v,
                _ => {}
            }
        }
    }
    let now = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() as i64;
    if (now - ts).abs() > 300 { return false; }
    let mut mac = Hmac::<Sha256>::new_from_slice(secret).expect("hmac key");
    mac.update(format!("{}.", ts).as_bytes());
    mac.update(body);
    let expected = mac.finalize().into_bytes();
    let sig_bytes = (0..sig_hex.len() / 2)
        .map(|i| u8::from_str_radix(&sig_hex[i * 2..i * 2 + 2], 16).unwrap_or(0))
        .collect::<Vec<_>>();
    expected.as_slice() == sig_bytes.as_slice()
}