QRIS Payment API

<?php
/**
 * ==============================================
 * LapakinAja - Webhook Callback Handler (PHP)
 * ==============================================
 *
 * Letakkan file ini di server Anda, lalu daftarkan URL-nya
 * sebagai callbackUrl di Dashboard > Merchant > Settings.
 * Contoh: https://domain-anda.com/callback.php
 */

// 1. KONFIGURASI
$apiKey = 'YOUR_API_KEY_HERE';  // Ganti dengan API Key Anda
$maxTimestampAge = 300;          // Toleransi 5 menit

// 2. TERIMA DATA DARI LAPAKINAJA
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    exit(json_encode(['error' => 'Method Not Allowed']));
}

$signature = $_SERVER['HTTP_X_SIGNATURE'] ?? '';
$timestamp = $_SERVER['HTTP_X_TIMESTAMP'] ?? '';
$rawBody   = file_get_contents('php://input');

// 3. VALIDASI TIMESTAMP (Cegah Replay Attack)
if (empty($timestamp) || abs(time() - intval($timestamp)) > $maxTimestampAge) {
    http_response_code(401);
    exit(json_encode(['error' => 'Request expired']));
}

// 4. VERIFIKASI SIGNATURE (HMAC-SHA256)
// Rumus: HMAC_SHA256(API_KEY, JSON_BODY + TIMESTAMP)
$expected = hash_hmac('sha256', $rawBody . $timestamp, $apiKey);
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit(json_encode(['error' => 'Signature tidak valid']));
}

// 5. PARSING & PROSES DATA
$data = json_decode($rawBody, true);

/**
 * Data yang diterima:
 * transaction_id => "uuid-xxxx"
 * order_id       => "INV-001"
 * nominal        => 10230
 * status         => "SUCCESS" atau "EXPIRED"
 */

if ($data['status'] === 'SUCCESS') {
    updateOrder($data['order_id'], 'PAID', $data['nominal']);
} elseif ($data['status'] === 'EXPIRED') {
    updateOrder($data['order_id'], 'EXPIRED', $data['nominal']);
}

// 6. RESPON 200 OK (WAJIB!)
// Jika tidak 200, LapakinAja akan retry hingga 5x
http_response_code(200);
echo json_encode(['success' => true, 'message' => 'Callback diterima']);

// ============================================
// FUNGSI HELPER (sesuaikan dengan database Anda)
// ============================================
function updateOrder($orderId, $status, $nominal) {
    try {
        $pdo = new PDO('mysql:host=localhost;dbname=db_anda', 'user', 'pass');
        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        $stmt = $pdo->prepare("
            UPDATE orders
            SET status = :status, paid_amount = :nominal, updated_at = NOW()
            WHERE order_id = :order_id
        ");
        $stmt->execute([
            ':status'   => $status,
            ':nominal'  => $nominal,
            ':order_id' => $orderId,
        ]);
    } catch (PDOException $e) {
        error_log('Callback DB Error: ' . $e->getMessage());
    }
}

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;
use App\Models\Order;

class LapakinAjaController extends Controller
{
    /**
     * Handle callback dari LapakinAja
     * Route: POST /api/lapakinaja/callback
     */
    public function handleCallback(Request $request)
    {
        $apiKey = config('services.lapakinaja.api_key');
        $signature = $request->header('X-Signature', '');
        $timestamp = $request->header('X-Timestamp', '');

        // Penting: Gunakan raw body, bukan $request->all()
        $rawBody = $request->getContent();

        // 1. Validasi timestamp (maks 5 menit)
        if (empty($timestamp) || abs(time() - intval($timestamp)) > 300) {
            Log::warning('LapakinAja: timestamp expired');
            return response()->json(['error' => 'Request expired'], 401);
        }

        // 2. Verifikasi signature HMAC-SHA256
        $expected = hash_hmac('sha256', $rawBody . $timestamp, $apiKey);
        if (!hash_equals($expected, $signature)) {
            Log::warning('LapakinAja: invalid signature');
            return response()->json(['error' => 'Invalid signature'], 401);
        }

        // 3. Proses data
        $data = json_decode($rawBody, true);
        Log::info('LapakinAja callback:', $data);

        $order = Order::where('order_id', $data['order_id'])->first();

        if (!$order) {
            return response()->json(['error' => 'Order not found'], 404);
        }

        // Hindari proses duplikat
        if ($order->status === 'PAID') {
            return response()->json(['success' => true, 'message' => 'Already processed']);
        }

        if ($data['status'] === 'SUCCESS') {
            $order->update([
                'status'      => 'PAID',
                'paid_amount' => $data['nominal'],
                'paid_at'     => now(),
            ]);
            // event(new PaymentReceived($order));
        } elseif ($data['status'] === 'EXPIRED') {
            $order->update(['status' => 'EXPIRED']);
        }

        // Wajib return 200 OK
        return response()->json(['success' => true, 'message' => 'Callback processed']);
    }
}

// ==============================================
// SETUP YANG DIPERLUKAN:
// ==============================================
// 1. Route → routes/api.php:
//    Route::post('/lapakinaja/callback', [LapakinAjaController::class, 'handleCallback']);
//
// 2. Config → config/services.php:
//    'lapakinaja' => ['api_key' => env('LAPAKINAJA_API_KEY')],
//
// 3. Environment → .env:
//    LAPAKINAJA_API_KEY=your_api_key_here
//
// 4. PENTING: Kecualikan dari CSRF middleware!
//    Di VerifyCsrfToken.php:
//    protected \$except = ['api/lapakinaja/callback'];

<?php
/**
 * Contoh: Buat transaksi QRIS via LapakinAja API
 * Parameter custom_name bersifat opsional (khusus QRIS Mandiri)
 */

$apiId  = 'YOUR_API_ID';
$apiKey = 'YOUR_API_KEY';
$baseUrl = 'https://api.lapakinaja.net';

$payload = json_encode([
    'amount'      => 10000,
    'order_id'    => 'INV-' . time(),
    'custom_name' => 'Toko Saya',  // Opsional, hanya untuk QRIS Mandiri (maks 25 karakter)
]);

$ch = curl_init($baseUrl . '/api/transaction/create');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $payload,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'X-API-ID: ' . $apiId,
        'X-API-KEY: ' . $apiKey,
    ],
    CURLOPT_TIMEOUT => 30,
]);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

$result = json_decode($response, true);

if ($httpCode === 200 || $httpCode === 201) {
    echo "Transaksi berhasil dibuat!\n";
    echo "Transaction ID : " . $result['transaction_id'] . "\n";
    echo "Total Bayar    : Rp " . number_format($result['total_amount']) . "\n";
    echo "QRIS URL       : " . $result['qris_url'] . "\n";
    echo "Expired        : " . $result['expired_at'] . "\n";
} else {
    echo "Error: " . ($result['message'] ?? 'Unknown error') . "\n";
}