import requests
from typing import Optional, Dict, Any, List
 
class PreciumClient:
    def __init__(self, api_key: str, brand_id: str):
        self.api_key = api_key
        self.brand_id = brand_id
        self.base_url = "https://gate.reviopay.com/api/v1"
        self.session = requests.Session()
        self.session.headers.update({
            "Authorization": f"Bearer {api_key}",
            "Content-Type": "application/json"
        })
 
    def _request(self, method: str, endpoint: str, data: Optional[Dict] = None) -> Dict[str, Any]:
        url = f"{self.base_url}{endpoint}"
        response = self.session.request(method, url, json=data)
        response.raise_for_status()
        return response.json() if response.text else {}
 
# Initialize
precium = PreciumClient("your_api_key", "your_brand_id")

const axios = require('axios');
 
class PreciumClient {
  constructor(apiKey, brandId) {
    this.brandId = brandId;
    this.client = axios.create({
      baseURL: 'https://gate.reviopay.com/api/v1',
      headers: {
        'Authorization': `Bearer ${apiKey}`,
        'Content-Type': 'application/json'
      }
    });
  }
 
  async request(method, endpoint, data = null) {
    const response = await this.client.request({ method, url: endpoint, data });
    return response.data;
  }
}
 
const precium = new PreciumClient('your_api_key', 'your_brand_id');
module.exports = precium;

<?php
class PreciumClient {
    private string $apiKey;
    private string $brandId;
    private string $baseUrl = 'https://gate.reviopay.com/api/v1';
 
    public function __construct(string $apiKey, string $brandId) {
        $this->apiKey = $apiKey;
        $this->brandId = $brandId;
    }
 
    public function request(string $method, string $endpoint, ?array $data = null): array {
        $ch = curl_init();
        curl_setopt_array($ch, [
            CURLOPT_URL => $this->baseUrl . $endpoint,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_CUSTOMREQUEST => strtoupper($method),
            CURLOPT_HTTPHEADER => [
                'Authorization: Bearer ' . $this->apiKey,
                'Content-Type: application/json'
            ]
        ]);
        if ($data !== null) {
            curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
        }
        $response = curl_exec($ch);
        curl_close($ch);
        return json_decode($response, true) ?? [];
    }
}
 
$precium = new PreciumClient('your_api_key', 'your_brand_id');

def create_payment_link(email: str, amount_cents: int, product_name: str, reference: str = None) -> Dict:
    data = {
        "client": {"email": email},
        "purchase": {
            "currency": "ZAR",
            "products": [{"name": product_name, "price": amount_cents}]
        },
        "brand_id": precium.brand_id
    }
    if reference:
        data["reference"] = reference
    return precium._request("POST", "/purchases/", data)
 
# Usage
payment = create_payment_link(
    email='customer@example.com',
    amount_cents=150000,
    product_name='Invoice #12345'
)
print(f"Payment link: {payment['checkout_url']}")

async function createPaymentLink(email, amountCents, productName, reference = null) {
  const data = {
    client: { email },
    purchase: {
      currency: 'ZAR',
      products: [{ name: productName, price: amountCents }]
    },
    brand_id: precium.brandId
  };
  if (reference) data.reference = reference;
  return await precium.request('POST', '/purchases/', data);
}
 
// Usage
const payment = await createPaymentLink('customer@example.com', 150000, 'Invoice #12345');
console.log(`Payment link: ${payment.checkout_url}`);

def create_checkout(
    client_id: str,
    products: List[Dict],
    order_id: str,
    success_url: str,
    failure_url: str,
    payment_methods: List[str] = None
) -> Dict:
    data = {
        "client_id": client_id,
        "purchase": {"currency": "ZAR", "products": products},
        "brand_id": precium.brand_id,
        "reference": order_id,
        "success_redirect": success_url,
        "failure_redirect": failure_url
    }
    if payment_methods:
        data["payment_method_whitelist"] = payment_methods
    return precium._request("POST", "/purchases/", data)
 
# Usage
checkout = create_checkout(
    client_id='client-uuid',
    products=[
        {"name": "Widget", "price": 5000, "quantity": "2"},
        {"name": "Shipping", "price": 5000}
    ],
    order_id='ORD-2026-0001',
    success_url='https://shop.com/success',
    failure_url='https://shop.com/failure',
    payment_methods=["visa", "mastercard", "ozow"]
)

async function createCheckout(clientId, products, orderId, successUrl, failureUrl, paymentMethods = null) {
  const data = {
    client_id: clientId,
    purchase: { currency: 'ZAR', products },
    brand_id: precium.brandId,
    reference: orderId,
    success_redirect: successUrl,
    failure_redirect: failureUrl
  };
  if (paymentMethods) data.payment_method_whitelist = paymentMethods;
  return await precium.request('POST', '/purchases/', data);
}

def refund_full(purchase_id: str) -> Dict:
    return precium._request("POST", f"/purchases/{purchase_id}/refund/", {})
 
def refund_partial(purchase_id: str, amount_cents: int) -> Dict:
    return precium._request("POST", f"/purchases/{purchase_id}/refund/", {"amount": amount_cents})

async function refund(purchaseId, amountCents = null) {
  const data = amountCents ? { amount: amountCents } : {};
  return await precium.request('POST', `/purchases/${purchaseId}/refund/`, data);
}

const crypto = require('crypto');
 
// Callbacks are signed with ASYMMETRIC RSA — there is no shared secret.
// X-Signature = base64( RSA PKCS#1 v1.5 over the SHA-256 digest of the raw body )
// Key source: public_key on the webhook object, or GET /public_key/ for a
// per-purchase success_callback. Store the PEM, do not fetch it per request.
const PUBLIC_KEY_PEM = process.env.PRECIUM_WEBHOOK_PUBLIC_KEY;
 
function verifySignature(rawBody, signatureB64) {
  const verifier = crypto.createVerify('RSA-SHA256');
  verifier.update(rawBody);            // raw Buffer, not a re-serialised object
  verifier.end();
  return verifier.verify(PUBLIC_KEY_PEM, Buffer.from(signatureB64, 'base64'));
}
 
// express.raw is essential: JSON.parse then re-stringify breaks the signature.
app.post('/webhooks/precium', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-signature'];
 
  if (!signature || !verifySignature(req.body, signature)) {
    return res.status(401).send('Invalid signature');
  }
 
  const event = JSON.parse(req.body.toString());
 
  // Deliveries can repeat even after a 200, so make this idempotent.
  switch (event.event_type) {
    case 'purchase.paid':
      handlePaymentSuccess(event.data);
      break;
    case 'purchase.payment_failure':
      handlePaymentFailure(event.data);
      break;
    case 'payment.refunded':
      handleRefund(event.data);
      break;
  }
 
  res.status(200).send('OK');   // respond within 5 seconds; queue the work
});

import base64
import os
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.exceptions import InvalidSignature
from flask import Flask, request
 
app = Flask(__name__)
 
# Callbacks are signed with ASYMMETRIC RSA — there is no shared secret.
# X-Signature = base64( RSA PKCS#1 v1.5 over the SHA-256 digest of the raw body )
# Key source: public_key on the webhook object, or GET /public_key/ for a
# per-purchase success_callback.
PUBLIC_KEY = serialization.load_pem_public_key(
    os.environ["PRECIUM_WEBHOOK_PUBLIC_KEY"].encode()
)
 
def verify_signature(raw_body: bytes, signature_b64: str) -> bool:
    try:
        PUBLIC_KEY.verify(
            base64.b64decode(signature_b64),
            raw_body,                 # raw bytes, never request.get_json()
            padding.PKCS1v15(),
            hashes.SHA256(),
        )
        return True
    except (InvalidSignature, ValueError):
        return False
 
@app.route('/webhooks/precium', methods=['POST'])
def handle_webhook():
    signature = request.headers.get('X-Signature', '')
    raw_body = request.get_data()          # bytes, before any parsing
 
    if not verify_signature(raw_body, signature):
        return 'Invalid signature', 401
 
    event = request.get_json()
 
    # Deliveries can repeat even after a 200, so make this idempotent.
    if event['event_type'] == 'purchase.paid':
        handle_payment_success(event['data'])
    elif event['event_type'] == 'purchase.payment_failure':
        handle_payment_failure(event['data'])
    elif event['event_type'] == 'payment.refunded':
        handle_refund(event['data'])
 
    return 'OK', 200                       # respond within 5 seconds