الأحداث

POST /aurmap/webhooks HTTP/1.1
Host: pos.example.com
Content-Type: application/json
X-AurMap-Delivery-Id: dlv_01JA9Y3K
X-AurMap-Timestamp: 1760445006
X-AurMap-Signature: v1=5f2c…e81a

{
  "delivery_id": "dlv_01JA9Y3K",
  "mode": "live",
  "sent_at": "2026-10-14T12:30:06Z",
  "events": [
    {
      "event_id": "evt_01JA9Y3J8Q",
      "type": "order.created",
      "seq": 18233,
      "occurred_at": "2026-10-14T12:30:05Z",
      "link_id": "lnk_2h6j4n",
      "place_id": "plc_9q3w7e",
      "entity": { "kind": "order", "id": "ord_7m1x9c", "version": 1 },
      "data": { "order": { "order_id": "ord_7m1x9c", "status": "received", "…": "…" } }
    }
  ]
}

TIMESTAMP + "." + raw_body

import crypto from 'node:crypto';
import express from 'express';

const app = express();
const SECRET = process.env.AURMAP_WEBHOOK_SECRET;

function verified(req) {
  const ts = req.get('X-AurMap-Timestamp') ?? '';
  if (!/^\d+$/.test(ts) || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const expected = crypto.createHmac('sha256', SECRET).update(ts + '.').update(req.body).digest();
  return (req.get('X-AurMap-Signature') ?? '')
    .split(',')
    .map((p) => p.trim().replace(/^v1=/, ''))
    .some((sig) => /^[0-9a-f]{64}$/.test(sig) && crypto.timingSafeEqual(Buffer.from(sig, 'hex'), expected));
}

app.post('/aurmap/webhooks', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!verified(req)) return res.status(401).end();
  const { events } = JSON.parse(req.body.toString('utf8'));
  for (const event of events) {
    if (await alreadySeen(event.event_id)) continue;   // منع التكرار
    await queue.add(event);                            // عالج لاحقا، ورد بسرعة
  }
  res.status(200).end();
});

<?php
$raw = file_get_contents('php://input');
$ts  = $_SERVER['HTTP_X_AURMAP_TIMESTAMP'] ?? '';
$hdr = $_SERVER['HTTP_X_AURMAP_SIGNATURE'] ?? '';

if (!ctype_digit($ts) || abs(time() - (int) $ts) > 300) {
    http_response_code(401);
    exit;
}
$expected = hash_hmac('sha256', $ts . '.' . $raw, getenv('AURMAP_WEBHOOK_SECRET'));
$ok = false;
foreach (explode(',', $hdr) as $part) {
    $sig = preg_replace('/^v1=/', '', trim($part));
    if (hash_equals($expected, $sig)) {
        $ok = true;
    }
}
if (!$ok) {
    http_response_code(401);
    exit;
}

$payload = json_decode($raw, true);
foreach ($payload['events'] as $event) {
    if (already_seen($event['event_id'])) {
        continue;
    }
    enqueue($event);
}
http_response_code(200);

aurmap GET '/v1/events?after_seq=18200&limit=100&types=order.created,order.cancelled'

{ "data": [ { "event_id": "evt_01JA9Y3J8Q", "type": "order.created", "seq": 18233, "…": "…" } ], "next_after_seq": 18300, "has_more": true }

{
  "event_id": "evt_01JA7Z0STAT",
  "type": "menu.changed",
  "seq": 18240,
  "occurred_at": "2026-10-14T18:00:00Z",
  "link_id": "lnk_2h6j4n",
  "place_id": "plc_9q3w7e",
  "entity": { "kind": "menu", "id": "plc_9q3w7e", "version": 43 },
  "data": { "place_id": "plc_9q3w7e", "prev_version": 42, "version": 43, "kind": "state", "hash": "a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1" }
}