Single-Source Storefront & Store Locator Synchronization

curl -i https://api.omurgasystems.com/v1/locations \
  -H "Authorization: Bearer rfx_live_a8f9d2e1_ornekAnahtarDegeri" \
  -H "Accept: application/json"

# Sonraki periyodik kontrollerde ETag göndererek kotayı koruyun:
curl -i https://api.omurgasystems.com/v1/locations \
  -H "Authorization: Bearer rfx_live_a8f9d2e1_ornekAnahtarDegeri" \
  -H 'If-None-Match: "W/\"rfx-1-9b74c9897bac770ffc029102\""'

{
  "ok": true,
  "meta": {
    "count": 1,
    "active_count": 1,
    "permanently_closed_count": 0,
    "etag": "W/\"rfx-1-9b74c9897bac770ffc029102\"",
    "generated_at": "2026-10-29T02:00:00Z"
  },
  "items": [
    {
      "location_id": "accounts/101/locations/9901",
      "external_code": "104",
      "slug": "alacati-carsi",
      "previous_slugs": [],
      "brand": "Örnek Marka",
      "display_name": "Alaçatı Çarşı",
      "open_status": "OPEN",
      "is_open_for_business": true,
      "is_temporarily_closed": false,
      "is_permanently_closed": false,
      "address": {
        "formatted": "Alaçatı Mah. Kemalpaşa Cad. No:82 Çeşme / İzmir",
        "district": "Çeşme",
        "city": "İzmir",
        "country_code": "TR"
      },
      "coordinates": { "lat": 38.2829, "lng": 26.3765 },
      "contact": {
        "phone": "0232 716 66 00",
        "email": "[email protected]",
        "website_url": "https://ornekmarka.com"
      },
      "google": {
        "place_id": "ChIJ...",
        "maps_url": "https://maps.google.com/?cid=...",
        "rating_average": 4.6,
        "review_count": 1240
      },
      "hours": {
        "timezone": "Europe/Istanbul",
        "display_text": "08:30 - 01:00",
        "weekly": [
          { "day": "MONDAY", "day_tr": "Pazartesi", "is_closed": false, "open": "08:30", "close": "01:00" }
        ],
        "special": []
      },
      "storefront": {
        "venue_category": "street",
        "cover_image_url": "https://api.omurgasystems.com/v1/media/1/branch-9901-a1b2c3d4.webp",
        "action_links": {
          "menu_url": "https://menu.ornekmarka.com",
          "order_url": null,
          "reservation_url": null
        },
        "accepted_payments": ["Multinet", "Pluxee (Sodexo)", "Edenred (Ticket)", "Setcard"],
        "amenities": ["oyun-alani", "wifi", "teras"],
        "custom_fields": {}
      },
      "content_hash": "e3b0c44298fc1c149afbf4c8996fb924",
      "updated_at": "2026-10-29T01:45:00Z"
    }
  ]
}

<?php
$rawBody   = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_REFLEKS_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_REFLEKS_SIGNATURE_256'] ?? '';
$secret    = getenv('REFLEKS_WEBHOOK_SECRET'); // whsec_...

if (abs(time() - (int) $timestamp) > 300) {
    http_response_code(401);
    exit('Expired timestamp');
}

$expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

// İmza doğrulandı: yerel mağaza önbelleğini /v1/locations üzerinden yenileyin
http_response_code(200);
echo json_encode(['received' => true]);

import crypto from 'node:crypto';
import { revalidateTag } from 'next/cache';

export async function POST(req: Request) {
  const rawBody = await req.text();
  const timestamp = req.headers.get('x-refleks-timestamp') ?? '';
  const signature = req.headers.get('x-refleks-signature-256') ?? '';
  const secret = process.env.REFLEKS_WEBHOOK_SECRET!;

  if (Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp)) > 300) {
    return Response.json({ error: 'Expired timestamp' }, { status: 401 });
  }

  const hmac = crypto.createHmac('sha256', secret);
  const expected = 'sha256=' + hmac.update(`${timestamp}.${rawBody}`).digest('hex');
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {
    return Response.json({ error: 'Invalid signature' }, { status: 401 });
  }

  revalidateTag('omurga-storefront-locations');
  return Response.json({ received: true });
}

import hashlib, hmac, os, time
from fastapi import FastAPI, Header, HTTPException, Request

app = FastAPI()
WEBHOOK_SECRET = os.environ["REFLEKS_WEBHOOK_SECRET"]

@app.post("/webhooks/refleks")
async def refleks_webhook(
    request: Request,
    x_refleks_timestamp: str = Header(default=""),
    x_refleks_signature_256: str = Header(default=""),
):
    raw_body = (await request.body()).decode("utf-8")
    if abs(int(time.time()) - int(x_refleks_timestamp or 0)) > 300:
        raise HTTPException(status_code=401, detail="Expired timestamp")
    payload = f"{x_refleks_timestamp}.{raw_body}".encode()
    digest = hmac.new(WEBHOOK_SECRET.encode(), payload, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(f"sha256={digest}", x_refleks_signature_256):
        raise HTTPException(status_code=401, detail="Invalid signature")
    return {"received": True}