Fringg
443a826402
The old code hashed the full raw body INCLUDING the 'signature' field itself — a circular computation that can never match (you can't include the signature in the data being signed). Fix: 1. Strip 'signature' key from payload before HMAC-SHA256 computation 2. Try both sorted and unsorted keys (PayPear docs don't specify) 3. Fallback to IP allowlist check (158.160.85.101 per PayPear docs) 4. Pass client_ip from request headers to the verification function
266 lines
9.2 KiB
Python
266 lines
9.2 KiB
Python
"""Сервис для работы с API PayPear (paypear.ru)."""
|
|
|
|
import hashlib
|
|
import hmac
|
|
import uuid
|
|
from base64 import b64encode
|
|
from typing import Any
|
|
|
|
import aiohttp
|
|
import structlog
|
|
|
|
from app.config import settings
|
|
|
|
|
|
logger = structlog.get_logger(__name__)
|
|
|
|
API_BASE_URL = 'https://api.paypear.ru/v1'
|
|
|
|
|
|
class PayPearAPIError(Exception):
|
|
"""Ошибка API PayPear."""
|
|
|
|
def __init__(self, status_code: int, message: str):
|
|
self.status_code = status_code
|
|
self.message = message
|
|
super().__init__(f'PayPear API error ({status_code}): {message}')
|
|
|
|
|
|
class PayPearService:
|
|
"""Сервис для работы с API PayPear."""
|
|
|
|
def __init__(self):
|
|
self._session: aiohttp.ClientSession | None = None
|
|
|
|
@property
|
|
def shop_id(self) -> str:
|
|
return settings.PAYPEAR_SHOP_ID or ''
|
|
|
|
@property
|
|
def secret_key(self) -> str:
|
|
return settings.PAYPEAR_SECRET_KEY or ''
|
|
|
|
def _basic_auth_header(self) -> str:
|
|
"""Генерирует HTTP Basic Auth заголовок."""
|
|
credentials = f'{self.shop_id}:{self.secret_key}'
|
|
encoded = b64encode(credentials.encode('utf-8')).decode('utf-8')
|
|
return f'Basic {encoded}'
|
|
|
|
async def _get_session(self) -> aiohttp.ClientSession:
|
|
"""Возвращает переиспользуемую HTTP-сессию."""
|
|
if self._session is None or self._session.closed:
|
|
self._session = aiohttp.ClientSession(
|
|
timeout=aiohttp.ClientTimeout(total=30),
|
|
)
|
|
return self._session
|
|
|
|
async def close(self) -> None:
|
|
"""Закрывает HTTP-сессию."""
|
|
if self._session and not self._session.closed:
|
|
await self._session.close()
|
|
self._session = None
|
|
|
|
async def create_payment(
|
|
self,
|
|
*,
|
|
order_id: str,
|
|
amount_rubles: float,
|
|
currency: str = 'RUB',
|
|
payment_method_type: str = 'sbp',
|
|
description: str = '',
|
|
return_url: str | None = None,
|
|
webhook_url: str | None = None,
|
|
metadata: dict[str, Any] | None = None,
|
|
) -> dict[str, Any]:
|
|
"""
|
|
Создает платеж через API PayPear.
|
|
POST /v1/payment/
|
|
"""
|
|
idempotence_key = str(uuid.uuid4())
|
|
|
|
payload: dict[str, Any] = {
|
|
'amount': {
|
|
'value': f'{amount_rubles:.2f}',
|
|
'currency': currency,
|
|
},
|
|
'order_id': order_id,
|
|
'payment_method_data': {
|
|
'type': payment_method_type,
|
|
},
|
|
}
|
|
|
|
if description:
|
|
payload['description'] = description
|
|
if return_url:
|
|
payload['confirmation'] = {
|
|
'type': 'redirect',
|
|
'return_url': return_url,
|
|
}
|
|
if webhook_url:
|
|
payload['webhook_url'] = webhook_url
|
|
if metadata:
|
|
payload['metadata'] = metadata
|
|
|
|
logger.info(
|
|
'PayPear API create_payment',
|
|
order_id=order_id,
|
|
amount_rubles=amount_rubles,
|
|
currency=currency,
|
|
payment_method_type=payment_method_type,
|
|
)
|
|
|
|
try:
|
|
session = await self._get_session()
|
|
async with session.post(
|
|
f'{API_BASE_URL}/payment/',
|
|
json=payload,
|
|
headers={
|
|
'Content-Type': 'application/json',
|
|
'Authorization': self._basic_auth_header(),
|
|
'Idempotence-Key': idempotence_key,
|
|
},
|
|
) as response:
|
|
data = await response.json(content_type=None)
|
|
|
|
if response.status == 200 and data.get('success') is True:
|
|
result = data.get('result', {})
|
|
logger.info(
|
|
'PayPear API payment created',
|
|
order_id=order_id,
|
|
paypear_id=result.get('id'),
|
|
)
|
|
return result
|
|
|
|
error_msg = data.get('message') or data.get('error') or str(data)
|
|
logger.error(
|
|
'PayPear create_payment error',
|
|
status_code=response.status,
|
|
error_msg=error_msg,
|
|
response_data=data,
|
|
)
|
|
raise PayPearAPIError(response.status, error_msg)
|
|
|
|
except aiohttp.ClientError as e:
|
|
logger.exception('PayPear API connection error', error=e)
|
|
raise
|
|
|
|
async def get_payment(self, payment_id: str) -> dict[str, Any]:
|
|
"""
|
|
Получает информацию о платеже по ID.
|
|
GET /v1/payment/{id}/
|
|
"""
|
|
logger.info('PayPear get_payment', payment_id=payment_id)
|
|
|
|
try:
|
|
session = await self._get_session()
|
|
async with session.get(
|
|
f'{API_BASE_URL}/payment/{payment_id}/',
|
|
headers={
|
|
'Authorization': self._basic_auth_header(),
|
|
},
|
|
) as response:
|
|
data = await response.json(content_type=None)
|
|
|
|
if response.status == 200 and data.get('success') is True:
|
|
return data.get('result', {})
|
|
|
|
error_msg = data.get('message') or data.get('error') or str(data)
|
|
logger.error(
|
|
'PayPear get_payment error',
|
|
status_code=response.status,
|
|
error_msg=error_msg,
|
|
)
|
|
raise PayPearAPIError(response.status, error_msg)
|
|
|
|
except aiohttp.ClientError as e:
|
|
logger.exception('PayPear API connection error', error=e)
|
|
raise
|
|
|
|
async def get_payment_by_order_id(self, order_id: str) -> dict[str, Any]:
|
|
"""
|
|
Получает информацию о платеже по order_id.
|
|
GET /v1/payment/order/{order_id}/
|
|
"""
|
|
logger.info('PayPear get_payment_by_order_id', order_id=order_id)
|
|
|
|
try:
|
|
session = await self._get_session()
|
|
async with session.get(
|
|
f'{API_BASE_URL}/payment/order/{order_id}/',
|
|
headers={
|
|
'Authorization': self._basic_auth_header(),
|
|
},
|
|
) as response:
|
|
data = await response.json(content_type=None)
|
|
|
|
if response.status == 200 and data.get('success') is True:
|
|
return data.get('result', {})
|
|
|
|
error_msg = data.get('message') or data.get('error') or str(data)
|
|
logger.error(
|
|
'PayPear get_payment_by_order_id error',
|
|
status_code=response.status,
|
|
error_msg=error_msg,
|
|
)
|
|
raise PayPearAPIError(response.status, error_msg)
|
|
|
|
except aiohttp.ClientError as e:
|
|
logger.exception('PayPear API connection error', error=e)
|
|
raise
|
|
|
|
# PayPear documented webhook source IPs
|
|
WEBHOOK_ALLOWED_IPS: set[str] = {'158.160.85.101'}
|
|
|
|
def verify_webhook_signature(self, raw_body: bytes, received_signature: str, client_ip: str | None = None) -> bool:
|
|
"""Верификация webhook PayPear.
|
|
|
|
PayPear documentation does not specify the exact signature algorithm.
|
|
We try HMAC-SHA256(secret_key, body_without_signature_field) — the most common pattern.
|
|
If signature verification fails, fall back to IP allowlist check (recommended by PayPear docs).
|
|
"""
|
|
import json as json_mod
|
|
|
|
# Try signature verification (body without 'signature' field, sorted keys, compact separators)
|
|
if received_signature and self.secret_key:
|
|
try:
|
|
payload = json_mod.loads(raw_body)
|
|
payload_without_sig = {k: v for k, v in payload.items() if k != 'signature'}
|
|
body_to_sign = json_mod.dumps(payload_without_sig, separators=(',', ':'), sort_keys=True).encode(
|
|
'utf-8'
|
|
)
|
|
|
|
expected = hmac.new(
|
|
self.secret_key.encode('utf-8'),
|
|
body_to_sign,
|
|
hashlib.sha256,
|
|
).hexdigest()
|
|
|
|
if hmac.compare_digest(expected, received_signature):
|
|
return True
|
|
|
|
# Try without sort_keys (original key order)
|
|
body_to_sign_unsorted = json_mod.dumps(payload_without_sig, separators=(',', ':')).encode('utf-8')
|
|
expected_unsorted = hmac.new(
|
|
self.secret_key.encode('utf-8'),
|
|
body_to_sign_unsorted,
|
|
hashlib.sha256,
|
|
).hexdigest()
|
|
|
|
if hmac.compare_digest(expected_unsorted, received_signature):
|
|
return True
|
|
|
|
logger.debug('PayPear signature mismatch, falling back to IP check')
|
|
except Exception as e:
|
|
logger.debug('PayPear signature verify error, falling back to IP check', error=e)
|
|
|
|
# Fallback: IP allowlist (recommended by PayPear docs)
|
|
if client_ip and client_ip in self.WEBHOOK_ALLOWED_IPS:
|
|
return True
|
|
|
|
logger.warning('PayPear webhook: signature mismatch and IP not in allowlist', client_ip=client_ip)
|
|
return False
|
|
|
|
|
|
# Singleton instance
|
|
paypear_service = PayPearService()
|