مستندات ریختم

// routes/api.php
Route::post('/rikhtam', [RikhtamController::class, 'callback']);   // مسیر api است؛ CSRF ندارد

// app/Http/Controllers/RikhtamController.php
class RikhtamController extends Controller
{
    public function callback(Request $r)
    {
        $invoice = trim((string) $r->input('invoice', ''));
        if (!hash_equals(config('services.rikhtam.secret'), (string) $r->input('key'))) {
            return response()->json(['ok' => false, 'error' => 'bad key'], 403);
        }
        if ($dup = Invoice::where('paid_uid', $r->input('uid'))->first()) {
            return ['ok' => true, 'duplicate' => true, 'invoice' => (string) $dup->id];
        }
        $inv = $invoice !== ''
            ? Invoice::find($invoice)
            : Invoice::where('amount', (int) $r->input('amount'))->where('status', 'unpaid')->where('created_at', '>', now()->subDay())->latest('id')->first();
        if (!$inv) return response()->json(['ok' => false, 'error' => 'invoice not found'], 404);
        if ($inv->status === 'cancelled') return response()->json(['ok' => false, 'error' => 'invoice cancelled'], 410);

        $updated = Invoice::whereKey($inv->id)->where('status', '!=', 'paid')
            ->update(['status' => 'paid', 'paid_uid' => $r->input('uid'), 'paid_at' => now()]);
        if (!$updated) return response()->json(['ok' => false, 'error' => 'invoice already paid'], 409);

        dispatch(new ActivateOrder($inv->id));   // کار سنگین در صف
        return ['ok' => true, 'invoice' => (string) $inv->id];
    }
}

// Express
const express = require('express'), crypto = require('crypto');
const app = express();
const SECRET = process.env.RIKHTAM_SECRET;

app.post('/rikhtam', express.urlencoded({ extended: false }), async (req, res) => {
  const b = req.body, invoice = (b.invoice || '').trim();
  const given = String(b.key || '');
  const ok = given.length === SECRET.length && crypto.timingSafeEqual(Buffer.from(SECRET), Buffer.from(given));
  if (!ok) return res.status(403).json({ ok: false, error: 'bad key' });

  const dup = await db.invoice.findFirst({ where: { paidUid: b.uid } });
  if (dup) return res.json({ ok: true, duplicate: true, invoice: String(dup.id) });

  const inv = invoice
    ? await db.invoice.findUnique({ where: { id: Number(invoice) } })
    : await db.invoice.findFirst({ where: { amount: Number(b.amount), status: 'unpaid', createdAt: { gt: new Date(Date.now() - 864e5) } }, orderBy: { id: 'desc' } });
  if (!inv) return res.status(404).json({ ok: false, error: 'invoice not found' });
  if (inv.status === 'cancelled') return res.status(410).json({ ok: false, error: 'invoice cancelled' });

  const r = await db.invoice.updateMany({ where: { id: inv.id, status: { not: 'paid' } }, data: { status: 'paid', paidUid: b.uid, paidAt: new Date() } });
  if (!r.count) return res.status(409).json({ ok: false, error: 'invoice already paid' });
  res.json({ ok: true, invoice: String(inv.id) });
});

# Flask
import hmac
from flask import Flask, request
app = Flask(__name__)
SECRET = b'project secret'

@app.post('/rikhtam')
def rikhtam():
    f = request.form
    invoice = f.get('invoice', '').strip()
    if not hmac.compare_digest(SECRET, f.get('key', '').encode()):
        return {'ok': False, 'error': 'bad key'}, 403

    dup = db.one('SELECT id FROM invoices WHERE paid_uid = %s', f['uid'])
    if dup:
        return {'ok': True, 'duplicate': True, 'invoice': str(dup.id)}
    inv = (db.one('SELECT id, status FROM invoices WHERE id = %s', invoice) if invoice else
           db.one("SELECT id, status FROM invoices WHERE amount = %s AND status = 'unpaid' AND created_at > NOW() - INTERVAL '1 day' ORDER BY id DESC LIMIT 1", int(f['amount'])))
    if not inv:
        return {'ok': False, 'error': 'invoice not found'}, 404
    if inv.status == 'cancelled':
        return {'ok': False, 'error': 'invoice cancelled'}, 410
    if not db.execute("UPDATE invoices SET status = 'paid', paid_uid = %s, paid_at = NOW() WHERE id = %s AND status <> 'paid'", f['uid'], inv.id):
        return {'ok': False, 'error': 'invoice already paid'}, 409
    return {'ok': True, 'invoice': str(inv.id)}

# views.py  —  path('rikhtam/', views.rikhtam) در urls.py
import hmac
from django.conf import settings
from django.http import JsonResponse
from django.views.decorators.csrf import csrf_exempt
from django.views.decorators.http import require_POST
from django.utils import timezone
from .models import Invoice

@csrf_exempt
@require_POST
def rikhtam(request):
    f = request.POST
    invoice = f.get('invoice', '').strip()
    if not hmac.compare_digest(settings.RIKHTAM_SECRET.encode(), f.get('key', '').encode()):
        return JsonResponse({'ok': False, 'error': 'bad key'}, status=403)
    if (dup := Invoice.objects.filter(paid_uid=f['uid']).first()):
        return JsonResponse({'ok': True, 'duplicate': True, 'invoice': str(dup.pk)})
    qs = Invoice.objects
    inv = (qs.filter(pk=invoice).first() if invoice else
           qs.filter(amount=int(f['amount']), status='unpaid', created_at__gt=timezone.now() - timezone.timedelta(days=1)).order_by('-pk').first())
    if not inv:
        return JsonResponse({'ok': False, 'error': 'invoice not found'}, status=404)
    if inv.status == 'cancelled':
        return JsonResponse({'ok': False, 'error': 'invoice cancelled'}, status=410)
    if not Invoice.objects.filter(pk=inv.pk).exclude(status='paid').update(status='paid', paid_uid=f['uid'], paid_at=timezone.now()):
        return JsonResponse({'ok': False, 'error': 'invoice already paid'}, status=409)
    return JsonResponse({'ok': True, 'invoice': str(inv.pk)})

package main

import (
	"crypto/subtle"
	"encoding/json"
	"net/http"
	"strconv"
	"strings"
)

var secret = []byte("project secret")

func reply(w http.ResponseWriter, code int, body map[string]any) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(code)
	json.NewEncoder(w).Encode(body)
}

func rikhtam(w http.ResponseWriter, r *http.Request) {
	r.ParseForm()
	f := r.PostForm.Get
	invoice := strings.TrimSpace(f("invoice"))
	if subtle.ConstantTimeCompare(secret, []byte(f("key"))) != 1 {
		reply(w, 403, map[string]any{"ok": false, "error": "bad key"})
		return
	}
	if id, ok := findByPaidUID(f("uid")); ok {
		reply(w, 200, map[string]any{"ok": true, "duplicate": true, "invoice": id})
		return
	}
	var inv *Invoice
	if invoice != "" {
		inv = findInvoiceByID(invoice)
	} else {
		amount, _ := strconv.ParseInt(f("amount"), 10, 64)
		inv = findOpenInvoiceByAmount(amount)
	}
	switch {
	case inv == nil:
		reply(w, 404, map[string]any{"ok": false, "error": "invoice not found"})
	case inv.Status == "cancelled":
		reply(w, 410, map[string]any{"ok": false, "error": "invoice cancelled"})
	case !markPaidIfUnpaid(inv.ID, f("uid")): // UPDATE ... WHERE id = ? AND status <> 'paid'
		reply(w, 409, map[string]any{"ok": false, "error": "invoice already paid"})
	default:
		reply(w, 200, map[string]any{"ok": true, "invoice": inv.ID})
	}
}

func main() { http.HandleFunc("/rikhtam", rikhtam); http.ListenAndServe(":8080", nil) }

// ASP.NET Core Minimal API (Program.cs)
using System.Security.Cryptography;
using System.Text;

app.MapPost("/rikhtam", async (HttpRequest req, AppDb db) =>
{
    var f = await req.ReadFormAsync();
    string F(string k) => f[k].ToString();
    var invoice = F("invoice").Trim();
    var a = Encoding.UTF8.GetBytes(app.Configuration["Rikhtam:Secret"]!);
    var b = Encoding.UTF8.GetBytes(F("key"));
    if (a.Length != b.Length || !CryptographicOperations.FixedTimeEquals(a, b))
        return Results.Json(new { ok = false, error = "bad key" }, statusCode: 403);

    var dup = await db.Invoices.FirstOrDefaultAsync(i => i.PaidUid == F("uid"));
    if (dup != null) return Results.Json(new { ok = true, duplicate = true, invoice = dup.Id.ToString() });

    var amount = long.Parse(F("amount"));
    var inv = invoice != ""
        ? await db.Invoices.FindAsync(long.Parse(invoice))
        : await db.Invoices.Where(i => i.Amount == amount && i.Status == "unpaid" && i.CreatedAt > DateTime.UtcNow.AddDays(-1))
                           .OrderByDescending(i => i.Id).FirstOrDefaultAsync();
    if (inv == null) return Results.Json(new { ok = false, error = "invoice not found" }, statusCode: 404);
    if (inv.Status == "cancelled") return Results.Json(new { ok = false, error = "invoice cancelled" }, statusCode: 410);

    var n = await db.Invoices.Where(i => i.Id == inv.Id && i.Status != "paid")
        .ExecuteUpdateAsync(s => s.SetProperty(i => i.Status, "paid").SetProperty(i => i.PaidUid, F("uid")).SetProperty(i => i.PaidAt, DateTime.UtcNow));
    if (n == 0) return Results.Json(new { ok = false, error = "invoice already paid" }, statusCode: 409);
    return Results.Json(new { ok = true, invoice = inv.Id.ToString() });
}).DisableAntiforgery();

// Spring Boot
@RestController
public class RikhtamController {
    @Value("${rikhtam.secret}") private String secret;
    private final InvoiceRepository invoices;
    public RikhtamController(InvoiceRepository invoices) { this.invoices = invoices; }

    @PostMapping(value = "/rikhtam", consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
    public ResponseEntity<Map<String, Object>> callback(@RequestParam MultiValueMap<String, String> f) throws Exception {
        Function<String, String> g = k -> Optional.ofNullable(f.getFirst(k)).orElse("");
        String invoice = g.apply("invoice").trim();
        if (!MessageDigest.isEqual(secret.getBytes(StandardCharsets.UTF_8), g.apply("key").getBytes(StandardCharsets.UTF_8)))
            return ResponseEntity.status(403).body(Map.of("ok", false, "error", "bad key"));

        var dup = invoices.findByPaidUid(g.apply("uid"));
        if (dup.isPresent()) return ResponseEntity.ok(Map.of("ok", true, "duplicate", true, "invoice", dup.get().getId().toString()));

        Optional<Invoice> inv = invoice.isEmpty()
            ? invoices.findFirstByAmountAndStatusAndCreatedAtAfterOrderByIdDesc(Long.parseLong(g.apply("amount")), "unpaid", LocalDateTime.now().minusDays(1))
            : invoices.findById(Long.parseLong(invoice));
        if (inv.isEmpty()) return ResponseEntity.status(404).body(Map.of("ok", false, "error", "invoice not found"));
        if ("cancelled".equals(inv.get().getStatus())) return ResponseEntity.status(410).body(Map.of("ok", false, "error", "invoice cancelled"));
        // @Modifying @Query("update Invoice i set i.status='paid', i.paidUid=:uid where i.id=:id and i.status <> 'paid'")
        if (invoices.markPaidIfUnpaid(inv.get().getId(), g.apply("uid")) == 0)
            return ResponseEntity.status(409).body(Map.of("ok", false, "error", "invoice already paid"));
        return ResponseEntity.ok(Map.of("ok", true, "invoice", inv.get().getId().toString()));
    }
}