Webhook va idempotency — HMAC imzo tekshiruvi, NestJS'da (8.20-bob)

  POLLING (siz so'rab turasiz):
  Har 10 soniyada → "yangilik bormi?" → ko'pincha "yo'q" (behuda so'rov)
  ❌ Samarasiz (minglab behuda so'rov), kechikish (10 soniyagacha)

  WEBHOOK (tashqi tizim o'zi xabar beradi):
  Hodisa sodir bo'lganda → tashqi tizim SIZNI chaqiradi (POST)
  ✅ Tez (darrov), samarali (faqat kerakda), real-time

  → Tashqi tizim qo'llab-quvvatlasa — har doim webhook (polling — oxirgi chora)

  INBOUND (siz QABUL qilasiz — eng keng):
  Tashqi tizim → POST sizning /webhook → siz ishlaysiz
  Misol: Stripe to'lov, GitHub push, SMS status (8.19, 5.18)

  OUTBOUND (siz YUBORASIZ — sizning API'ngiz bo'lsa):
  Sizning tizim → POST mijoz /webhook → mijoz ishlaydi
  Misol: sizning to'lov tizimingiz mijozga "to'landi" deb xabar berish

@Controller("webhooks")
export class WebhooksController {
  @Post("github")
  @HttpCode(200)                                      // tez 200 qaytarish (2.6)
  async github(@Body() payload: any, @Headers("x-hub-signature-256") sig: string) {
    // 1. Imzo tekshir 2.4-bob → 2. idempotency 2.5-bob → 3. navbatga 2.6-bob → 4. 200
    return { received: true };
  }
}

import { createHmac, timingSafeEqual } from "crypto";

// HMAC-SHA256 imzo tekshirish (Stripe/GitHub/Shopify standart)
function imzoTekshir(rawBody: Buffer, sig: string, secret: string): boolean {
  const kutilgan = createHmac("sha256", secret)        // sirli kalit bilan
    .update(rawBody)                                    // RAW body (2.7)
    .digest("hex");
  const sigBuf = Buffer.from(sig);
  const kutBuf = Buffer.from(`sha256=${kutilgan}`);
  if (sigBuf.length !== kutBuf.length) return false;
  return timingSafeEqual(sigBuf, kutBuf);              // timing-attack himoyasi!
}

// Gateway AT-LEAST-ONCE yetkazadi → bir hodisa bir necha marta kelishi mumkin
@Entity()
export class ProcessedWebhook {
  @PrimaryColumn() eventId: string;                   // UNIQUE (provider event ID)
  @CreateDateColumn() processedAt: Date;
}

async webhookIshla(eventId: string, ish: () => Promise<void>) {
  try {
    await this.repo.insert({ eventId });              // UNIQUE — ikkinchi marta → xato
  } catch (e) {
    if (e.code === "23505") return;                   // allaqachon ishlangan → o'tkazib yubor
    throw e;
  }
  await ish();                                         // birinchi marta → bajar
}

@Post("stripe")
@HttpCode(200)
async stripe(@Req() req: RawBodyRequest<Request>, @Headers("stripe-signature") sig: string) {
  // 1. Imzo tekshir (TEZ — 2.4)
  const event = this.verify(req.rawBody, sig);
  // 2. Navbatga qo'shib, DARROV 200 qaytar (og'ir ish fonda — 8.22)
  await this.webhookQueue.add("process", { event }, { jobId: event.id });   // jobId — idempotency
  return { received: true };                          // 200 darrov (< 10 soniya!)
}
// Worker 8.22-bob fonda ishlaydi (email, DB, fulfillment)

// main.ts — raw body yoqish (imzo RAW body'dan hisoblanadi — 2.4)
const app = await NestFactory.create(AppModule, { rawBody: true });

// Yoki muayyan route uchun (Express)
app.use("/webhooks/stripe", express.raw({ type: "application/json" }));

// Outbound webhook yuborish — ishonchli yetkazish (retry)
async webhookYubor(url: string, payload: any, urinish = 0): Promise<void> {
  try {
    const sig = createHmac("sha256", this.secret).update(JSON.stringify(payload)).digest("hex");
    await axios.post(url, payload, { headers: { "x-signature": `sha256=${sig}` }, timeout: 10000 });
  } catch (e) {
    if (urinish >= 5) {                               // 5 marta urinib bo'ldi
      await this.deadLetterQueue.add(payload);        // dead-letter (2.9)
      return;
    }
    // Exponential backoff + jitter (2.8)
    const kechikish = Math.pow(2, urinish) * 1000 + Math.random() * 1000;   // 1s, 2s, 4s... + tasodif
    await this.queue.add("retry", { url, payload, urinish: urinish + 1 }, { delay: kechikish });
  }
}

  DEAD-LETTER QUEUE (DLQ) — barcha retry tugagan hodisalar:
  - 5 marta urinib ham yetkazib bo'lmadi → DLQ'ga saqlanadi (yo'qolmaydi)
  - Sabab tuzatilgach → qayta yuborish (replay)
  - Monitoring (DLQ to'lsa — ogohlantirish)

  ❗ Hodisa YO'QOLMASLIGI kerak (pul/buyurtma — kritik)

  ✓ Imzo (HMAC) HAR webhook'da, timingSafeEqual (2.4, 14)
  ✓ HTTPS majburiy (shifrlangan)
  ✓ Raw body (imzo to'g'ri — 2.7)
  ✓ Timestamp tekshirish (replay-attack — eski webhook qayta yuborilmasin)
  ✓ IP allowlist (agar gateway IP ma'lum bo'lsa — qo'shimcha himoya)
  ✓ Idempotency (takror — 2.5)
  ✓ Rate limiting (DoS — 8.16); sekin emas (10s — 2.6)
  ✓ Sir noto'g'ri → 401 (oshkor qilmasdan)

  QABUL (inbound):
  ✓ Imzo tekshirish (HMAC, timingSafeEqual — 2.4) + raw body 2.7-bob
  ✓ Idempotency (event ID unique — 2.5)
  ✓ Tez 200 + navbatga (fonda — 2.6, 8.22)
  ✓ Xavfsizlik (HTTPS, timestamp, rate limit — 2.10)

  YUBORISH (outbound):
  ✓ Imzo qo'sh (qabul qiluvchi tekshirsin)
  ✓ Retry + exponential backoff + jitter 2.8-bob
  ✓ Dead-letter queue (yo'qolmaslik — 2.9)
  ✓ Timeout (10s); idempotency key (qabul qiluvchi uchun)

  DB (unique constraint — 2.5):
  ✅ Ishonchli (crash'ga chidamli — saqlanadi), audit (kim/qachon)
  ✅ Bepul (mavjud DB), transaction bilan atomik (bir tranzaksiyada ishlov + belgi)
  ❌ Sekinroq (disk yozuv), jadval o'sadi (eski yozuvlarni tozalash kerak)

  REDIS (SET NX + TTL):
  ✅ Tez (xotira), TTL bilan avtomatik tozalanadi (masalan 24 soat)
  ❌ Volatil (Redis o'chsa — belgi yo'qoladi → takror xavfi)
  → Yuqori hajm (soniyada minglab webhook) uchun yaxshi

  → PUL/BUYURTMA (kritik): DB (transaction bilan — yo'qolmasin)
  → Yuqori hajm, "yaxshi bo'lardi" dedup: Redis (tez, TTL)
  → Ikkalasi: Redis (tez tekshir) + DB (ishonchli yozuv)

  MUAMMO: webhook'lar TARTIBSIZ kelishi mumkin (network, retry)
  Misol: "created" dan OLDIN "updated" kelib qolishi mumkin!
  Yoki: eski holat yangi holatdan KEYIN kelib, yangini bosib ketishi

  YECHIMLAR:
  1. Versiya/timestamp taqqoslash — event ichidagi vaqt/versiya bilan
     (eski event kelsa → e'tiborsiz qoldirish)
  2. Holatni webhook'dagi ma'lumotdan EMAS, provider'dan qayta o'qish (fetch)
     (event — faqat "signal"; haqiqiy holat API'dan olinadi)
  3. Idempotent + kommutativ dizayn 2.14-bob — tartibga bog'liq bo'lmaslik

  IDEMPOTENT = bir necha marta bajarilsa ham natija bir xil
  (webhook at-least-once → operatsiyaning O'ZI ham xavfsiz bo'lishi kerak)

  ❌ balans += 100        (har chaqiruvda o'sadi — NOTO'G'RI)
  ✅ status = "paid"      (necha marta yozilsa ham — bir xil natija)
  ✅ UPSERT (bor bo'lsa yangilash, yo'q bo'lsa yaratish — takrorga chidamli)
  ✅ "agar hali paid emas bo'lsa → paid qilish" (shartli — WHERE status != 'paid')

  → Idempotency belgisi 2.5-bob + idempotent operatsiya = ikki qatlam himoya

// Imzo 2.4-bob: createHmac("sha256", secret).update(rawBody).digest("hex") + timingSafeEqual
// Raw body 2.7-bob: NestFactory.create(AppModule, { rawBody: true })
// Idempotency 2.5-bob: insert unique eventId → 23505 → skip
// Tez javob 2.6-bob: imzo → queue.add(..., { jobId: eventId }) → return 200
// Retry 2.8-bob: delay = 2^urinish * 1000 + Math.random()*1000
// Redis dedup 2.12-bob: redis.set(`wh:${eventId}`, "1", "NX", "EX", 259200) → null = takror
// Ordering 2.13-bob: if (event.created < saqlangan.updatedAt) return; // eski event
// Idempotent op 2.14-bob: UPDATE ... SET status='paid' WHERE id=? AND status!='paid'

// webhook-signature.guard.ts
@Injectable()
export class WebhookSignatureGuard implements CanActivate {
  constructor(private config: ConfigService) {}

  canActivate(context: ExecutionContext): boolean {
    const req = context.switchToHttp().getRequest<RawBodyRequest<Request>>();
    const sig = req.headers["x-signature-256"] as string;
    if (!sig || !req.rawBody) throw new UnauthorizedException("Imzo yo'q");

    const kutilgan = "sha256=" + createHmac("sha256", this.config.get("WEBHOOK_SECRET"))
      .update(req.rawBody).digest("hex");

    const a = Buffer.from(sig), b = Buffer.from(kutilgan);
    if (a.length !== b.length || !timingSafeEqual(a, b)) {   // timing-safe (14)
      throw new UnauthorizedException("Imzo noto'g'ri");
    }
    return true;
  }
}

@Injectable()
export class WebhookIdempotencyService {
  constructor(@InjectRepository(ProcessedWebhook) private repo: Repository<ProcessedWebhook>) {}

  // true = birinchi marta (ishla); false = takror (o'tkazib yubor)
  async birinchiMartami(eventId: string): Promise<boolean> {
    try {
      await this.repo.insert({ eventId });            // UNIQUE — atomik (race-safe)
      return true;
    } catch (e) {
      if (e.code === "23505" || e.code === "ER_DUP_ENTRY") return false;   // takror
      throw e;
    }
  }
}

@Controller("webhooks")
export class WebhooksController {
  constructor(
    private idempotency: WebhookIdempotencyService,
    @InjectQueue("webhooks") private queue: Queue,
  ) {}

  @Post("stripe")
  @HttpCode(200)
  @UseGuards(WebhookSignatureGuard)                  // 1. IMZO (2.4)
  async stripe(@Body() event: any) {
    // 2. IDEMPOTENCY (2.5)
    if (!(await this.idempotency.birinchiMartami(event.id))) {
      return { received: true, duplicate: true };    // takror → o'tkazib yubor
    }
    // 3. NAVBATGA (fonda — 2.6)
    await this.queue.add("stripe-event", event, { jobId: event.id });
    // 4. TEZ 200 (2.6)
    return { received: true };
  }
}

@Processor("webhooks")
export class WebhookProcessor extends WorkerHost {
  constructor(private ordersService: OrdersService, private mailService: MailService) {
    super();
  }

  async process(job: Job) {
    const event = job.data;
    switch (event.type) {
      case "payment_intent.succeeded":
        await this.ordersService.tolovTasdiqla(event.data.object.metadata.orderId);   // (8.19)
        await this.mailService.chekYubor(event.data.object.metadata.orderId);
        break;
      case "charge.refunded":
        await this.ordersService.refundQayta(event.data.object.metadata.orderId);
        break;
    }
    // Xato bo'lsa → BullMQ avtomatik retry 8.22-bob → tugasa failed (DLQ — 2.9)
  }
}

@Post("github")
@HttpCode(200)
async github(
  @Req() req: RawBodyRequest<Request>,
  @Headers("x-hub-signature-256") sig: string,
  @Headers("x-github-event") event: string,
) {
  // GitHub HMAC-SHA256 (2.4)
  const kutilgan = "sha256=" + createHmac("sha256", this.config.get("GITHUB_WEBHOOK_SECRET"))
    .update(req.rawBody).digest("hex");
  if (!timingSafeEqual(Buffer.from(sig), Buffer.from(kutilgan))) {
    throw new UnauthorizedException();
  }
  if (event === "push") {
    await this.ciQueue.add("deploy", { repo: req.body.repository.name });   // CI/CD (10)
  }
  return { ok: true };
}

// Stripe uslubi — timestamp + imzo (eski webhook qayta yuborilmasin)
function verifyWithTimestamp(rawBody: Buffer, sigHeader: string, secret: string): boolean {
  // sigHeader: "t=1614556800,v1=abc123..."
  const parts = Object.fromEntries(sigHeader.split(",").map((p) => p.split("=")));
  const timestamp = Number(parts.t);

  // Replay himoyasi — 5 daqiqadan eski webhook rad (2.10)
  if (Math.abs(Date.now() / 1000 - timestamp) > 300) {
    throw new UnauthorizedException("Webhook muddati o'tgan (replay?)");
  }
  const kutilgan = createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  return timingSafeEqual(Buffer.from(parts.v1), Buffer.from(kutilgan));
}

@Injectable()
export class OutboundWebhookService {
  constructor(@InjectQueue("outbound-webhooks") private queue: Queue) {}

  // Mijozlarga hodisa yuborish (sizning platforma)
  async hodisaYubor(hodisa: string, data: any) {
    const obunalar = await this.repo.find({ where: { hodisa, faol: true } });
    for (const obuna of obunalar) {
      await this.queue.add("send", { url: obuna.url, secret: obuna.secret, hodisa, data }, {
        attempts: 5,                                  // 5 marta (2.8)
        backoff: { type: "exponential", delay: 1000 },   // 1s, 2s, 4s... (BullMQ avtomatik)
      });
    }
  }
}

@Processor("outbound-webhooks")
export class OutboundProcessor extends WorkerHost {
  async process(job: Job) {
    const { url, secret, hodisa, data } = job.data;
    const payload = { hodisa, data, timestamp: Date.now() };
    const sig = "sha256=" + createHmac("sha256", secret).update(JSON.stringify(payload)).digest("hex");
    await axios.post(url, payload, {
      headers: { "x-webhook-signature": sig },
      timeout: 10000,                                 // 10s (2.6)
    });
    // Xato → BullMQ retry (backoff); 5 marta tugasa → failed (DLQ — 2.9)
  }
}

// Mijozlar webhook URL ro'yxatdan o'tkazadi (sizning API)
@Entity()
export class WebhookSubscription {
  @PrimaryGeneratedColumn("uuid") id: string;
  @Column() userId: string;
  @Column() url: string;                              // mijoz endpoint
  @Column() hodisa: string;                           // qaysi hodisaga obuna
  @Column() secret: string;                           // imzo uchun (mijozga beriladi)
  @Column({ default: true }) faol: boolean;
}

@Controller("webhook-subscriptions")
@UseGuards(JwtAuthGuard)
export class WebhookSubController {
  @Post()
  yarat(@Body() dto: CreateWebhookDto, @CurrentUser() user) {
    const secret = randomBytes(32).toString("hex");  // mijozga beriladi (imzo tekshirish uchun)
    return this.service.yarat({ ...dto, userId: user.id, secret });
  }
}

// Har webhook'ni log qilish (debug, audit, replay)
@Entity()
export class WebhookLog {
  @PrimaryGeneratedColumn("uuid") id: string;
  @Column() provider: string;
  @Column() eventId: string;
  @Column("jsonb") payload: any;
  @Column() status: "received" | "processed" | "failed";
  @Column({ nullable: true }) xato: string;
  @CreateDateColumn() createdAt: Date;
}
// → muammo bo'lsa: log'dan ko'rish, replay qilish (qayta ishlov)
// → DLQ monitoring: failed status'larni kuzatish (8.15)

// Webhook'ni lokal test (ngrok — lokal URL public)
// terminal: ngrok http 3000 → https://abc.ngrok.io → gateway'ga shu URL

// Unit test — imzo (8.11)
describe("WebhookSignatureGuard", () => {
  it("to'g'ri imzo o'tadi", () => {
    const body = Buffer.from(JSON.stringify({ event: "test" }));
    const sig = "sha256=" + createHmac("sha256", "secret").update(body).digest("hex");
    const ctx = mockContext({ rawBody: body, headers: { "x-signature-256": sig } });
    expect(guard.canActivate(ctx)).toBe(true);
  });
  it("noto'g'ri imzo rad", () => {
    const ctx = mockContext({ rawBody: Buffer.from("{}"), headers: { "x-signature-256": "sha256=xato" } });
    expect(() => guard.canActivate(ctx)).toThrow(UnauthorizedException);
  });
});

@Injectable()
export class RedisIdempotencyService {
  constructor(@InjectRedis() private redis: Redis) {}   // ioredis (8.22)

  // true = birinchi marta (ishla); false = takror (o'tkazib yubor)
  async birinchiMartami(eventId: string): Promise<boolean> {
    // SET key "1" NX EX ttl → agar mavjud bo'lmasa qo'yadi va "OK" qaytaradi;
    // mavjud bo'lsa → null (ya'ni takror). Atomik (race-safe — bitta buyruq).
    const natija = await this.redis.set(
      `webhook:dedup:${eventId}`,
      "1",
      "NX",                                             // faqat mavjud bo'lmasa
      "EX",
      3 * 24 * 60 * 60,                                 // TTL 3 kun (provider retry oynasidan uzun — 2.12)
    );
    return natija === "OK";                             // "OK" = yangi; null = takror
  }
}
// ❗ Kritik (pul) uchun: DB unique (Misol 2) — Redis o'chsa belgi yo'qolmasin (2.12)

// Webhook payload'ida versiya/timestamp bor (Stripe: event.created; boshqalarda: updated_at)
async holatYangila(event: any) {
  const buyurtma = await this.repo.findOne({ where: { id: event.data.orderId } });

  // ❗ ORDERING himoyasi — bu event saqlangandan ESKI bo'lsa → e'tiborsiz qoldir (2.13)
  //    (masalan "succeeded" dan keyin kechikkan "processing" kelib qolsa — bosmasin)
  if (buyurtma && event.created * 1000 <= buyurtma.holatVaqti.getTime()) {
    return;                                             // eski hodisa — o'tkazib yubor
  }

  // Yoki — payload'ga ishonmay, haqiqiy holatni provider'dan QAYTA O'QISH (ishonchli — 2.13):
  // const haqiqiy = await this.stripe.paymentIntents.retrieve(event.data.object.id);

  await this.repo.update(event.data.orderId, {
    holat: event.data.holat,
    holatVaqti: new Date(event.created * 1000),         // eng oxirgi hodisa vaqtini saqlash
  });
}

async tolovTasdiqla(orderId: string) {
  // ❌ NOTO'G'RI (idempotent emas — har takrorda balans o'sadi):
  //    user.balans += order.summa; await this.userRepo.save(user);

  // ✅ TO'G'RI — shartli yangilash: faqat hali 'paid' bo'lmagan bo'lsa o'zgartiradi.
  //    Ikkinchi marta kelsa — affected = 0 (hech narsa o'zgarmaydi — takrorga chidamli — 2.14)
  const natija = await this.orderRepo
    .createQueryBuilder()
    .update(Order)
    .set({ status: "paid", paidAt: () => "NOW()" })
    .where("id = :id AND status != :paid", { id: orderId, paid: "paid" })
    .execute();

  if (natija.affected === 0) return;                    // allaqachon paid → yon ta'sir yo'q (email qayta ketmaydi)

  // Faqat haqiqatan holat o'zgargandagina yon ta'sir (email, fulfillment — 2.6)
  await this.mailService.chekYubor(orderId);
}

❌ webhook keldi → ishonish (soxta — 2.4)
✅ HMAC + timingSafeEqual

❌ webhook'da og'ir ish → 10s o'tadi → gateway retry 2.6-bob
✅ navbatga + tez 200 (fonda)

❌ takror webhook → ikki marta ishlov 2.5-bob
✅ event ID unique

❌ json() → raw yo'q → imzo doim xato 2.7-bob
✅ rawBody: true

❌ sig === kutilgan (timing-attack — 14)
✅ timingSafeEqual

❌ webhook holatini to'g'ridan yozish → eski event yangisini bosadi 2.13-bob
✅ versiya/timestamp taqqoslash yoki provider'dan qayta o'qish

❌ balans += summa (takrorda o'sadi — 2.14)
✅ shartli yangilash (WHERE status != 'paid') / holat o'rnatish