Merge pull request #31 from Midtrans/snap-bi-webhook-vefirication

uziwuzzy · web-flow · commit 1144bed1efea · 2024-10-15T07:04:34.000+07:00
diff --git a/README.md b/README.md
@@ -902,6 +902,8 @@ SnapBiConfig.setSnapBiPartnerId("YOUR PARTNER ID");
 SnapBiConfig.setSnapBiChannelId("YOUR CHANNEL ID");
 // Enable logging to see details of the request/response make sure to disable this on production, the default is disabled.
 SnapBiConfig.setEnableLogging(true);
+// Set your public key here if you want to verify your webhook notification, make sure to add \n on the public key, you can refer to the examples
+SnapBiConfig.setSnapBiPublicKey("YOUR PUBLIC KEY");
 ```
 
 ### 3.2 Create Payment
@@ -1447,7 +1449,31 @@ JSONObject snapBiResponse2 = SnapBi.va()
 
 ### 3.9 Payment Notification
 To implement Snap-Bi Payment Notification you can refer to this [docs](https://docs.midtrans.com/reference/payment-notification-api)
+To verify the webhook notification that you recieve you can use this method below
+```java
+ 
+//the request body/ payload sent by the webhook
+String notificationPayload = "{\"originalPartnerReferenceNo\":\"GP24043015193402809\",\"originalReferenceNo\":\"A120240430081940S9vu8gSjaRID\",\"merchantId\":\"G099333790\",\"amount\":{\"value\":\"102800.00\",\"currency\":\"IDR\"},\"latestTransactionStatus\":\"00\",\"transactionStatusDesc\":\"SUCCESS\",\"additionalInfo\":{\"refundHistory\":[]}}"; // Sample notification body, replace with actual data you receive from Midtrans
+
+
+// to get the signature value, you need to retrieve it from the webhook header called X-Signature
+String signature = "CgjmAyC9OZ3pB2JhBRDihL939kS86LjP1VLD1R7LgI4JkvYvskUQrPXgjhrZqU2SFkfPmLtSbcEUw21pg2nItQ0KoX582Y6Tqg4Mn45BQbxo4LTPzkZwclD4WI+aCYePQtUrXpJSTM8D32lSJQQndlloJfzoD6Rh24lNb+zjUpc+YEi4vMM6MBmS26PpCm/7FZ7/OgsVh9rlSNUsuQ/1QFpldA0F8bBNWSW4trwv9bE1NFDzliHrRAnQXrT/J3chOg5qqH0+s3E6v/W21hIrBYZVDTppyJPtTOoCWeuT1Tk9XI2HhSDiSuI3pevzLL8FLEWY/G4M5zkjm/9056LTDw==";
+
+// to get the timeStamp value, you need to retrieve it from the webhook header called X-Timestamp
+String timeStamp = "2024-10-07T15:45:22+07:00";
 
+// the url path is based on the webhook url of the payment method for example for direct debit is `/v1.0/debit/notify`
+String notificationUrlPath = "/v1.0/debit/notify";
+/**
+ * Example verifying the webhook notification
+ */
+Boolean isVerified = SnapBi.notification()
+        .withNotificationPayload(notificationPayload)
+        .withSignature(signature)
+        .withTimeStamp(timeStamp)
+        .withNotificationUrlPath(notificationUrlPath)
+        .isWebhookNotificationVerified();
+```
 
 
 ## 4. Examples
diff --git a/example/src/main/java/com/midtrans/snapbi/SnapBiWebhookServer.java b/example/src/main/java/com/midtrans/snapbi/SnapBiWebhookServer.java
@@ -0,0 +1,70 @@
+package com.midtrans.snapbi;
+
+import com.sun.net.httpserver.HttpExchange;
+import com.sun.net.httpserver.HttpHandler;
+import com.sun.net.httpserver.HttpServer;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.util.*;
+
+public class SnapBiWebhookServer {
+    public static void main(String[] args) throws IOException {
+        int port = 3000;
+        HttpServer server = HttpServer.create(new InetSocketAddress(port), 0);
+        server.createContext("/webhook", new WebhookHandler());
+        server.setExecutor(null);
+        server.start();
+        System.out.println("Server started on port " + port);
+    }
+
+    static class WebhookHandler implements HttpHandler {
+        @Override
+        public void handle(HttpExchange exchange) throws IOException {
+            if ("POST".equals(exchange.getRequestMethod())) {
+                // Read the request body
+                InputStream requestBody = exchange.getRequestBody();
+                String body = new Scanner(requestBody, StandardCharsets.UTF_8.name()).useDelimiter("\\A").next();
+                Map<String, List<String>> headers = exchange.getRequestHeaders();
+
+                // Get specific header values (x-signature and x-timestamp)
+                String signature = headers.getOrDefault("X-Signature", java.util.Collections.emptyList()).stream().findFirst().orElse(null);
+                String timestamp =  headers.getOrDefault("X-Timestamp", java.util.Collections.emptyList()).stream().findFirst().orElse(null);
+
+                String publicKey = "-----BEGIN PUBLIC KEY-----"
+                        +"ACBDefghijkklmn/fboOoctcthr8aJ5AOEpCFLrsCSgAtmtcHxBHq9miZyHFf4juNBpvvRrVlCLzyhNOkjKDNj9PO/MZabcdefGHIJKLMN"
+                        +"-----END PUBLIC KEY-----";
+
+                SnapBiConfig.setSnapBiPublicKey(publicKey);
+                // get the url path that comes after `/webhook`
+                String requestURI = exchange.getRequestURI().toString();
+                String basePath = "/webhook";
+                String remainingPath = requestURI.substring(basePath.length());
+
+                Boolean isVerified = false;
+                try {
+                    isVerified =
+                            SnapBi.notification()
+                            .withNotificationPayload(body)
+                            .withSignature(signature)
+                            .withTimeStamp(timestamp)
+                            .withNotificationUrlPath(remainingPath)
+                            .isWebhookNotificationVerified();
+                } catch (Exception e) {
+                    throw new RuntimeException(e.getMessage());
+                }
+                String response = "Webhook received successfully, its verified = " + isVerified;
+                exchange.sendResponseHeaders(200, response.length());
+                try (OutputStream os = exchange.getResponseBody()) {
+                    os.write(response.getBytes());
+                }
+            } else {
+                // Method not allowed
+                exchange.sendResponseHeaders(405, -1);
+            }
+        }
+    }
+}
diff --git a/library/src/main/java/com/midtrans/snapbi/SnapBi.java b/library/src/main/java/com/midtrans/snapbi/SnapBi.java
@@ -2,13 +2,12 @@
 
 import java.nio.charset.StandardCharsets;
 import java.security.*;
+import java.security.spec.X509EncodedKeySpec;
 import java.time.Instant;
 import java.util.Base64;
 import java.util.HashMap;
 import java.util.Map;
 import java.security.spec.PKCS8EncodedKeySpec;
-import javax.crypto.Mac;
-import javax.crypto.spec.SecretKeySpec;
 
 import org.json.JSONObject;
 
@@ -41,6 +40,10 @@ public class SnapBi {
     private String deviceId;
     private String debugId;
     private String timeStamp;
+    private String signature;
+    private String notificationUrlPath;
+    private String notificationPayload;
+
 
     public SnapBi(String paymentMethod) {
         this.paymentMethod = paymentMethod;
@@ -59,6 +62,10 @@ public static SnapBi qris() {
         return new SnapBi("qris");
     }
 
+    public static SnapBi notification() {
+        return new SnapBi("");
+    }
+    
     public SnapBi withAccessTokenHeader(Map<String, String> headers) {
         this.accessTokenHeader.putAll(headers);
         return this;
@@ -114,6 +121,26 @@ public SnapBi withDebugId(String debugId) {
         return this;
     }
 
+    public SnapBi withSignature(String signature) {
+        this.signature = signature;
+        return this;
+    }
+
+    public SnapBi withTimeStamp(String timeStamp) {
+        this.timeStamp = timeStamp;
+        return this;
+    }
+
+    public SnapBi withNotificationUrlPath(String notificationUrlPath) {
+        this.notificationUrlPath = notificationUrlPath;
+        return this;
+    }
+
+    public SnapBi withNotificationPayload(String notificationPayload) {
+        this.notificationPayload = notificationPayload;
+        return this;
+    }
+
     public JSONObject createPayment(String externalId) throws Exception {
         this.apiPath = setupCreatePaymentApiPath(this.paymentMethod);
         return createConnection(externalId);
@@ -134,6 +161,43 @@ public JSONObject getStatus(String externalId) throws Exception {
         return createConnection(externalId);
     }
 
+    public Boolean isWebhookNotificationVerified() throws Exception {
+        if (SnapBiConfig.getSnapBiPublicKey() == null || SnapBiConfig.getSnapBiPublicKey().trim().isEmpty()) {
+            throw new IllegalStateException
+                    ("The public key is null, You need to set the public key from SnapBiConfig.' .\n" +
+                    "For more details contact support at support@midtrans.com if you have any questions.");
+        }
+        String minifiedBody = minifyJson(this.notificationPayload);
+        MessageDigest digest = MessageDigest.getInstance("SHA-256");
+        byte[] hashedNotificationBodyJsonString = digest.digest(minifiedBody.getBytes());
+        String hashedNotificationBodyJsonStringHex = bytesToHex(hashedNotificationBodyJsonString)
+                .toLowerCase();
+        String rawStringDataToVerifyAgainstSignature = "POST" +
+                ":" +
+                this.notificationUrlPath +
+                ":" +
+                hashedNotificationBodyJsonStringHex +
+                ":" +
+                this.timeStamp;
+        Signature verifier = Signature.getInstance("SHA256withRSA");
+        verifier.initVerify(getPublicKey(SnapBiConfig.getSnapBiPublicKey()));
+        verifier.update(rawStringDataToVerifyAgainstSignature.getBytes(StandardCharsets.UTF_8));
+        boolean isSignatureVerified = verifier.verify(Base64.getDecoder().decode(this.signature));
+
+        return isSignatureVerified;
+    }
+
+    private static PublicKey getPublicKey(String publicKeyString) throws Exception {
+        String publicKeyPEM = publicKeyString
+                .replace("-----BEGIN PUBLIC KEY-----", "")
+                .replace("-----END PUBLIC KEY-----", "")
+                .replaceAll("\\s", "");
+        byte[] keyBytes = Base64.getDecoder().decode(publicKeyPEM);
+        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(keyBytes);
+        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
+        return keyFactory.generatePublic(keySpec);
+    }
+
     public JSONObject getAccessToken() throws Exception {
         Map<String, String> snapBiAccessTokenHeader = buildAccessTokenHeader(this.timeStamp);
         Map<String, String> openApiPayload = new HashMap<>();
@@ -172,9 +236,9 @@ private Map<String, String> buildSnapBiTransactionHeader(String externalId, Stri
         snapBiTransactionHeader.put("Accept", "application/json");
         snapBiTransactionHeader.put("X-PARTNER-ID", SnapBiConfig.getSnapBiPartnerId());
         snapBiTransactionHeader.put("X-EXTERNAL-ID", externalId);
-        snapBiTransactionHeader.put("X-DEVICE-ID", this.deviceId != null ? this.deviceId : "" );
+        snapBiTransactionHeader.put("X-DEVICE-ID", this.deviceId != null ? this.deviceId : "");
         snapBiTransactionHeader.put("CHANNEL-ID", SnapBiConfig.getSnapBiChannelId());
-        snapBiTransactionHeader.put("debug-id", this.debugId != null ? this.debugId : "" );
+        snapBiTransactionHeader.put("debug-id", this.debugId != null ? this.debugId : "");
         snapBiTransactionHeader.put("Authorization", "Bearer " + this.accessToken);
         snapBiTransactionHeader.put("X-TIMESTAMP", timeStamp);
         snapBiTransactionHeader.put("X-SIGNATURE", SnapBi.getSymmetricSignatureHmacSh512(
@@ -229,6 +293,7 @@ public static String getSymmetricSignatureHmacSh512(String accessToken, Map<Stri
             throw new RuntimeException("Error generating symmetric signature", e);
         }
     }
+
     private static String minifyJson(String json) {
         // Minify JSON by removing whitespace
         return json.replaceAll("\\s+", "");
@@ -245,13 +310,15 @@ private static byte[] hmacSha512(String payload, String key) throws NoSuchAlgori
         mac.init(secretKeySpec);
         return mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
     }
+
     private static String bytesToHex(byte[] bytes) {
         StringBuilder sb = new StringBuilder();
         for (byte b : bytes) {
             sb.append(String.format("%02x", b));
         }
         return sb.toString();
     }
+
     public static String getAsymmetricSignatureSha256WithRsa(String clientId, String timeStamp, String privateKey) throws Exception {
         String stringToSign = clientId + "|" + timeStamp;
 
diff --git a/library/src/main/java/com/midtrans/snapbi/SnapBiConfig.java b/library/src/main/java/com/midtrans/snapbi/SnapBiConfig.java
@@ -12,7 +12,7 @@ public class SnapBiConfig {
     private static String snapBiPartnerId;
     private static String snapBiChannelId;
     private static boolean enableLogging = false;
-
+    private static String snapBiPublicKey;
     public static final String SNAP_BI_SANDBOX_BASE_URL = "https://merchants.sbx.midtrans.com";
     public static final String SNAP_BI_PRODUCTION_BASE_URL = "https://merchants.midtrans.com";
 
@@ -65,6 +65,13 @@ public static boolean isEnableLogging() {
     public static void setEnableLogging(boolean enableLogging) {
         SnapBiConfig.enableLogging = enableLogging;
     }
+    public static String getSnapBiPublicKey() {
+        return snapBiPublicKey;
+    }
+
+    public static void setSnapBiPublicKey(String snapBiPublicKey) {
+        SnapBiConfig.snapBiPublicKey = snapBiPublicKey;
+    }
     public static String getSnapBiTransactionBaseUrl() {
         return isProduction ? SNAP_BI_PRODUCTION_BASE_URL : SNAP_BI_SANDBOX_BASE_URL;
     }
