const express = require('express');
const crypto = require('crypto');
const app = express();

app.get('/postback/listener', (req, res) => {
  const { user_id, click_id, payout, points, sig, signature } = req.query;
  const apiSecretKey = 'your_api_secret_key_here';

  if (!user_id || !payout) {
    return res.status(400).json({ status: 'error', message: 'Missing parameters' });
  }

  // Format payout exactly to 4 decimals with dot separator
  const payoutFormatted = parseFloat(payout).toFixed(4);
  let isValid = false;

  if (sig) {
    // Verify using HMAC-SHA256
    const dataString = `${user_id}:${payoutFormatted}`;
    const expectedSig = crypto
      .createHmac('sha256', apiSecretKey)
      .update(dataString)
      .digest('hex');

    if (crypto.timingSafeEqual(Buffer.from(expectedSig), Buffer.from(sig))) {
      isValid = true;
    }
  } else if (signature) {
    // Verify using MD5
    const dataString = `${user_id}${payoutFormatted}${apiSecretKey}`;
    const expectedMd5 = crypto
      .createHash('md5')
      .update(dataString)
      .digest('hex');

    if (expectedMd5 === signature) {
      isValid = true;
    }
  }

  if (isValid) {
    // ----------------------------------------------------
    // TODO: Perform database queries here:
    // 1. Check if unique transaction_id has already been rewarded.
    // 2. Award user_id the designated points for offer_name (offer_id).
    // ----------------------------------------------------
    return res.status(200).json({ status: 'success', message: 'Callback processed' });
  } else {
    return res.status(400).json({ status: 'error', message: 'Signature mismatch' });
  }
});

import hmac
import hashlib
from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route('/postback/listener', methods=['GET'])
def postback_listener():
    user_id = request.args.get('user_id')
    payout = request.args.get('payout')
    points = request.args.get('points')
    offer_id = request.args.get('offer_id')
    offer_name = request.args.get('offer_name')
    transaction_id = request.args.get('transaction_id')
    user_ip = request.args.get('ip')
    received_sig = request.args.get('sig')          # HMAC-SHA256
    received_md5 = request.args.get('signature')    # MD5

    if not user_id or not payout:
        return jsonify({'status': 'error', 'message': 'Missing parameters'}), 400

    api_secret_key = b'your_api_secret_key_here'
    
    # Format payout exactly to 4 decimal places
    payout_formatted = "{:.4f}".format(float(payout))
    is_valid = False

    if received_sig:
        # Verify using HMAC-SHA256
        data_string = f"{user_id}:{payout_formatted}".encode('utf-8')
        expected_sig = hmac.new(api_secret_key, data_string, hashlib.sha256).hexdigest()
        if hmac.compare_digest(expected_sig, received_sig):
            is_valid = True
            
    elif received_md5:
        # Verify using MD5
        raw_key = api_secret_key.decode('utf-8')
        data_string = f"{user_id}{payout_formatted}{raw_key}"
        expected_md5 = hashlib.md5(data_string.encode('utf-8')).hexdigest()
        if hmac.compare_digest(expected_md5, received_md5):
            is_valid = True

    if is_valid:
        # ----------------------------------------------------
        # TODO: Perform database queries here:
        # 1. Log transaction_id to prevent duplicate crediting.
        # 2. Credit the points to the user_id's account for completing offer_name.
        # ----------------------------------------------------
        return jsonify({'status': 'success', 'message': 'Callback processed'}), 200
    else:
        return jsonify({'status': 'error', 'message': 'Signature mismatch'}), 400