API Paiement Direct (Headless) — TROLOOPAY

<?php
// ── 1) Initier le paiement ──────────────────────────────────
$clientId     = getenv('TROLOOPAY_CLIENT_ID');
$clientSecret = getenv('TROLOOPAY_CLIENT_SECRET');

$payload = json_encode([
    'client_id'     => $clientId,
    'client_secret' => $clientSecret,
    'amount'        => 5000,
    'currency'      => 'XOF',
    'method'        => 'MTNMOMO',
    'payer_phone'   => '2290154000000',
    'reference_id'  => 'ORDER-' . uniqid(),
    'ipn_url'       => 'https://votre-site.com/webhook/payment',
    'description'   => 'Commande #12345',
]);

$ch = curl_init('https://troloo.com/api/payment/direct');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $payload,
    CURLOPT_TIMEOUT        => 30,
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        'Accept: application/json',
    ],
]);
$response       = json_decode(curl_exec($ch), true);
$transactionUuid = $response['transaction_uuid'] ?? null;
curl_close($ch);

if ($response['code'] !== 200) {
    // Gérer l'erreur
    throw new \Exception($response['message'] ?? 'Erreur inconnue');
}

// ── 2) Vérifier le statut (polling) ────────────────────────
function checkPaymentStatus(string $uuid, string $clientId, string $clientSecret): array {
    $url = "https://troloo.com/api/payment/direct/status/{$uuid}"
         . "?client_id={$clientId}&client_secret={$clientSecret}";
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 10,
        CURLOPT_HTTPHEADER     => ['Accept: application/json'],
    ]);
    $result = json_decode(curl_exec($ch), true);
    curl_close($ch);
    return $result;
}

// ── 3) Recevoir & vérifier l'IPN ───────────────────────────
// Dans votre endpoint IPN (ex: /webhook/payment) :
$clientSecret = getenv('TROLOOPAY_CLIENT_SECRET');
$rawBody      = file_get_contents('php://input');
$signature    = $_SERVER['HTTP_X_TROLOOPAY_SIGNATURE'] ?? '';

$receivedHash = str_starts_with($signature, 'sha256=') ? substr($signature, 7) : $signature;
$expectedHash = hash_hmac('sha256', json_encode(json_decode($rawBody, true)), $clientSecret);

if (!hash_equals($expectedHash, $receivedHash)) {
    http_response_code(401);
    exit('Signature invalide');
}

$ipn = json_decode($rawBody, true);

if ($ipn['status'] === 'SUCCESSFUL') {
    // Créditer la commande dans votre base de données
    $orderId   = $ipn['reference_id'];   // "ORDER-12345"
    $netAmount = $ipn['paid_amount'];    // montant net après frais
}

http_response_code(200);
echo json_encode(['received' => true]);

import crypto from "crypto";

const BASE = "https://troloo.com";
const CLIENT_ID     = process.env.TROLOOPAY_CLIENT_ID;
const CLIENT_SECRET = process.env.TROLOOPAY_CLIENT_SECRET;

// ── 1) Initier le paiement ──────────────────────────────────
async function initiateDirectPayment(amount, phone, orderId) {
  const res = await fetch(`${BASE}/api/payment/direct`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "Accept":       "application/json",
    },
    body: JSON.stringify({
      client_id:     CLIENT_ID,
      client_secret: CLIENT_SECRET,
      amount,
      currency:     "XOF",
      method:       "MTNMOMO",
      payer_phone:  phone,
      reference_id: `ORDER-${orderId}`,
      ipn_url:      "https://votre-site.com/webhook/payment",
      description:  `Commande #${orderId}`,
    }),
  });

  const data = await res.json();

  if (data.code !== 200) throw new Error(data.message);
  return data.transaction_uuid;
}

// ── 2) Vérifier le statut ───────────────────────────────────
async function getPaymentStatus(transactionUuid) {
  const url = `${BASE}/api/payment/direct/status/${transactionUuid}`
    + `?client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}`;
  const res  = await fetch(url, { headers: { Accept: "application/json" } });
  return res.json();
}

// ── 3) Recevoir l'IPN (Express) ─────────────────────────────
import express from "express";
const app = express();
app.use(express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }));

app.post("/webhook/payment", (req, res) => {
  const signature    = req.headers["x-troloopay-signature"] ?? "";
  const receivedHash = signature.startsWith("sha256=") ? signature.slice(7) : signature;
  const expectedHash = crypto
    .createHmac("sha256", CLIENT_SECRET)
    .update(JSON.stringify(req.body))
    .digest("hex");

  if (!crypto.timingSafeEqual(Buffer.from(expectedHash), Buffer.from(receivedHash))) {
    return res.status(401).json({ error: "Invalid signature" });
  }

  const { status, reference_id, paid_amount } = req.body;

  if (status === "SUCCESSFUL") {
    // Créditer la commande : reference_id = votre ORDER-xxx
    console.log(`Commande ${reference_id} payée — net: ${paid_amount} XOF`);
  }

  res.json({ received: true });
});

<!--
  IMPORTANT : ne jamais exposer client_secret dans le frontend.
  Ce composant appelle VOTRE backend, qui lui appelle TROLOOPAY côté serveur.
-->

<script setup>
import { ref } from "vue";

const props   = defineProps({ orderId: String, amount: Number, phone: String });
const status  = ref(null); // null | "PENDING" | "SUCCESSFUL" | "CANCELLED"
const loading = ref(false);
const error   = ref(null);
let pollingTimer = null;

async function pay() {
  loading.value = true;
  error.value   = null;

  try {
    // Votre backend sécurisé initie le paiement et retourne le transaction_uuid
    const res = await fetch("/api/create-direct-payment", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        amount:    props.amount,
        currency:  "XOF",
        method:    "MTNMOMO",
        phone:     props.phone,
        order_id:  props.orderId,
      }),
    });

    const data = await res.json();
    if (!data.transaction_uuid) throw new Error(data.message ?? "Erreur");

    status.value = "PENDING";

    // Polling toutes les 5 secondes pour vérifier le statut
    pollingTimer = setInterval(async () => {
      const s = await fetch(`/api/payment-status/${data.transaction_uuid}`);
      const d = await s.json();
      if (d.status !== "PENDING") {
        clearInterval(pollingTimer);
        status.value = d.status;
      }
    }, 5000);

  } catch (e) {
    error.value = e.message || "Impossible d'initier le paiement.";
  } finally {
    loading.value = false;
  }
}
</script>

<template>
  <div>
    <button class="btn-troloo-primary" :disabled="loading || status === 'PENDING'" @click="pay">
      {{ loading ? "Envoi en cours…" : status === "PENDING" ? "En attente de confirmation…" : "Payer maintenant" }}
    </button>

    <div v-if="status === 'SUCCESSFUL'" class="mt-3 text-emerald-600 font-semibold">
      ✅ Paiement confirmé !
    </div>
    <div v-if="status === 'CANCELLED'" class="mt-3 text-red-500 font-semibold">
      ❌ Paiement annulé ou refusé.
    </div>
    <p v-if="error" class="mt-2 text-red-500 text-sm">{{ error }}</p>
  </div>
</template>

import os, hmac, hashlib, time, requests
from fastapi import FastAPI, Request, HTTPException

BASE          = "https://troloo.com"
CLIENT_ID     = os.environ["TROLOOPAY_CLIENT_ID"]
CLIENT_SECRET = os.environ["TROLOOPAY_CLIENT_SECRET"]

# ── 1) Initier le paiement ──────────────────────────────────
def initiate_payment(amount: int, phone: str, order_id: str) -> str:
    resp = requests.post(
        f"{BASE}/api/payment/direct",
        json={
            "client_id":     CLIENT_ID,
            "client_secret": CLIENT_SECRET,
            "amount":        amount,
            "currency":      "XOF",
            "method":        "MTNMOMO",
            "payer_phone":   phone,
            "reference_id":  f"ORDER-{order_id}",
            "ipn_url":       "https://votre-site.com/webhook/payment",
            "description":   f"Commande #{order_id}",
        },
        headers={"Accept": "application/json"},
        timeout=30,
    )
    data = resp.json()
    if data.get("code") != 200:
        raise ValueError(data.get("message", "Erreur inconnue"))
    return data["transaction_uuid"]

# ── 2) Polling du statut ────────────────────────────────────
def wait_for_payment(transaction_uuid: str, max_wait: int = 120) -> dict:
    url = (f"{BASE}/api/payment/direct/status/{transaction_uuid}"
           f"?client_id={CLIENT_ID}&client_secret={CLIENT_SECRET}")
    deadline = time.time() + max_wait
    while time.time() < deadline:
        r = requests.get(url, headers={"Accept": "application/json"}, timeout=10)
        d = r.json()
        if d.get("status") != "PENDING":
            return d
        time.sleep(5)
    return {"status": "PENDING", "message": "Timeout"}

# ── 3) Recevoir l'IPN (FastAPI) ─────────────────────────────
app = FastAPI()

@app.post("/webhook/payment")
async def ipn_handler(request: Request):
    body      = await request.body()
    signature = request.headers.get("x-troloopay-signature", "")
    received  = signature[7:] if signature.startswith("sha256=") else signature

    import json
    expected = hmac.new(
        CLIENT_SECRET.encode(),
        json.dumps(json.loads(body)).encode(),
        hashlib.sha256,
    ).hexdigest()

    if not hmac.compare_digest(expected, received):
        raise HTTPException(status_code=401, detail="Invalid signature")

    payload = json.loads(body)

    if payload["status"] == "SUCCESSFUL":
        order_id   = payload["reference_id"]
        paid_amount = payload["paid_amount"]
        print(f"Commande {order_id} — net: {paid_amount} XOF")

    return {"received": True}