Intégrer NaabigaPay en Java / Spring

package com.monsite.pay;

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.util.Map;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class PaiementController {

  private static final String NPAY = "https://api.pay.naabiga.com/api/v1";
  private static final String SECRET = System.getenv("NPAY_SECRET"); // sk_live_...

  private final HttpClient http = HttpClient.newHttpClient();
  private final ObjectMapper json = new ObjectMapper();

  // Votre front appelle CETTE route, jamais NaabigaPay directement.
  @PostMapping("/api/pay")
  public Map<String, String> creerLien(@RequestBody Map<String, Object> corps) throws Exception {
    String commande = corps.get("commande").toString();
    String body = json.writeValueAsString(Map.of(
        "amount", corps.get("amount"),        // entier, en FCFA
        "reference", commande,                // votre numéro de commande
        "description", "Commande " + commande,
        "return_url", "https://monsite.com/merci",
        "single_use", true));

    HttpRequest req = HttpRequest.newBuilder(URI.create(NPAY + "/payment-links"))
        .header("Authorization", "Bearer " + SECRET)
        .header("Content-Type", "application/json")
        .header("Idempotency-Key", "cmd-" + commande) // évite un double lien si retry
        .POST(HttpRequest.BodyPublishers.ofString(body))
        .build();

    HttpResponse<String> res = http.send(req, HttpResponse.BodyHandlers.ofString());
    String url = json.readTree(res.body()).get("url").asText();
    return Map.of("url", url);              // le front ouvre cette URL
  }
}

package com.monsite.pay;

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class WebhookController {

  private static final byte[] WEBHOOK_SECRET =
      System.getenv("NPAY_WEBHOOK_SECRET").getBytes(StandardCharsets.UTF_8);
  private final ObjectMapper json = new ObjectMapper();

  @PostMapping("/webhook")
  public ResponseEntity<String> recevoir(
      @RequestBody byte[] raw,                            // corps BRUT (octets exacts)
      @RequestHeader("X-NPay-Signature") String signature,
      @RequestHeader("X-NPay-Event") String event) throws Exception {

    Mac mac = Mac.getInstance("HmacSHA256");
    mac.init(new SecretKeySpec(WEBHOOK_SECRET, "HmacSHA256"));
    byte[] brut = mac.doFinal(raw);

    StringBuilder hex = new StringBuilder(brut.length * 2);
    for (byte x : brut) hex.append(String.format("%02x", x));
    String attendu = hex.toString();

    // MessageDigest.isEqual : comparaison à temps constant.
    boolean ok = MessageDigest.isEqual(
        attendu.getBytes(StandardCharsets.UTF_8),
        signature.getBytes(StandardCharsets.UTF_8));
    if (!ok) return ResponseEntity.status(400).body("signature invalide");

    if ("payment.succeeded".equals(event)) {
      // data.merchant_reference = VOTRE numéro de commande (la reference du lien).
      String ref = json.readTree(raw).path("data").path("merchant_reference").asText();
      marquerCommandePayee(ref);
    }
    return ResponseEntity.ok("ok");
  }
}