Аутентификация и подпись

// Node.js 18+: встроенный fetch.
import { createHmac } from "node:crypto";

const BASE = "https://api.plativputi.com";
const PREFIX = "/api/partner/v1";
const KEY_ID = process.env.PP_KEY_ID;
const SECRET = process.env.PP_SECRET;

export class PPError extends Error {
  constructor(status, code, body) {
    super(`${status} ${code}`);
    Object.assign(this, { status, code, body });
  }
}

export async function pp(method, path, body, { idempotencyKey } = {}) {
  const fullPath = PREFIX + path;
  const raw = body === undefined ? "" : JSON.stringify(body);
  const ts = Math.floor(Date.now() / 1000).toString();

  const parts = [ts, method, fullPath, raw];
  if (idempotencyKey) parts.push(idempotencyKey);
  const signature = createHmac("sha256", SECRET).update(parts.join("\n")).digest("hex");

  const headers = { "X-Key-Id": KEY_ID, "X-Timestamp": ts, "X-Signature": signature };
  if (raw) headers["Content-Type"] = "application/json";
  if (idempotencyKey) headers["Idempotency-Key"] = idempotencyKey;

  const res = await fetch(BASE + fullPath, { method, headers, body: raw || undefined });
  const data = await res.json().catch(() => null);
  if (!res.ok) {
    // Два формата ошибок — см. раздел «Ошибки».
    const code = data?.error ?? data?.errors?.[0]?.value ?? `http_${res.status}`;
    throw new PPError(res.status, code, data);
  }
  return data;
}

# Python 3.9+, пакет requests.
import hashlib
import hmac
import json
import os
import time

import requests

BASE = "https://api.plativputi.com"
PREFIX = "/api/partner/v1"
KEY_ID = os.environ["PP_KEY_ID"]
SECRET = os.environ["PP_SECRET"].encode()


class PPError(Exception):
    def __init__(self, status, code, body):
        super().__init__(f"{status} {code}")
        self.status, self.code, self.body = status, code, body


def pp(method, path, body=None, idempotency_key=None):
    full_path = PREFIX + path
    raw = "" if body is None else json.dumps(body, separators=(",", ":"), ensure_ascii=False)
    ts = str(int(time.time()))

    parts = [ts, method, full_path, raw]
    if idempotency_key:
        parts.append(idempotency_key)
    signature = hmac.new(SECRET, "\n".join(parts).encode(), hashlib.sha256).hexdigest()

    headers = {"X-Key-Id": KEY_ID, "X-Timestamp": ts, "X-Signature": signature}
    if raw:
        headers["Content-Type"] = "application/json"
    if idempotency_key:
        headers["Idempotency-Key"] = idempotency_key

    r = requests.request(method, BASE + full_path, headers=headers,
                         data=raw.encode() if raw else None, timeout=30)
    data = r.json() if r.content else None
    if not r.ok:
        # Два формата ошибок — см. раздел «Ошибки».
        errors = (data or {}).get("errors") or [{}]
        code = (data or {}).get("error") or errors[0].get("value") or f"http_{r.status_code}"
        raise PPError(r.status_code, code, data)
    return data

<?php
// PHP 8.0+, расширение curl.
const PP_BASE = 'https://api.plativputi.com';
const PP_PREFIX = '/api/partner/v1';

function uuid4(): string
{
    $b = random_bytes(16);
    $b[6] = chr(ord($b[6]) & 0x0f | 0x40);
    $b[8] = chr(ord($b[8]) & 0x3f | 0x80);
    return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($b), 4));
}

function pp(string $method, string $path, ?array $body = null, ?string $idempotencyKey = null): array
{
    $fullPath = PP_PREFIX . $path;
    $raw = $body === null ? '' : json_encode($body, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    $ts = (string) time();

    $parts = [$ts, $method, $fullPath, $raw];
    if ($idempotencyKey !== null) {
        $parts[] = $idempotencyKey;
    }
    $signature = hash_hmac('sha256', implode("\n", $parts), getenv('PP_SECRET'));

    $headers = ['X-Key-Id: ' . getenv('PP_KEY_ID'), "X-Timestamp: $ts", "X-Signature: $signature"];
    if ($raw !== '') {
        $headers[] = 'Content-Type: application/json';
    }
    if ($idempotencyKey !== null) {
        $headers[] = "Idempotency-Key: $idempotencyKey";
    }

    $ch = curl_init(PP_BASE . $fullPath);
    curl_setopt_array($ch, [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_HTTPHEADER => $headers,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 30,
    ]);
    if ($raw !== '') {
        curl_setopt($ch, CURLOPT_POSTFIELDS, $raw);
    }
    $resp = curl_exec($ch);
    if ($resp === false) {
        throw new RuntimeException(curl_error($ch));
    }
    $status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
    $data = json_decode($resp, true) ?? [];
    if ($status >= 400) {
        // Два формата ошибок — см. раздел «Ошибки».
        $code = $data['error'] ?? ($data['errors'][0]['value'] ?? "http_$status");
        throw new RuntimeException("$status $code", $status);
    }
    return $data;
}

# bash и zsh. Использование: pp METHOD PATH [BODY] [IDEMPOTENCY_KEY]
#   pp GET /balance
#   pp POST /cards '{"tariff_id":"…","holder_external_id":"cust-42","amount":"50"}' "$(uuidgen)"
pp() {
  local method=$1 req_path="/api/partner/v1$2" body=${3:-} idem=${4:-}
  local ts sig
  ts=$(date +%s)
  if [ -n "$idem" ]; then
    sig=$(printf '%s\n%s\n%s\n%s\n%s' "$ts" "$method" "$req_path" "$body" "$idem" \
      | openssl dgst -sha256 -hmac "$PP_SECRET" -hex | awk '{print $NF}')
  else
    sig=$(printf '%s\n%s\n%s\n%s' "$ts" "$method" "$req_path" "$body" \
      | openssl dgst -sha256 -hmac "$PP_SECRET" -hex | awk '{print $NF}')
  fi
  local -a extra=()
  [ -n "$idem" ] && extra+=(-H "Idempotency-Key: $idem")
  [ -n "$body" ] && extra+=(-H "Content-Type: application/json" --data-binary "$body")
  curl -sS -X "$method" "https://api.plativputi.com$req_path" \
    -H "X-Key-Id: $PP_KEY_ID" -H "X-Timestamp: $ts" -H "X-Signature: $sig" "${extra[@]}"
}

import { pp } from "./pp.mjs";

console.log(await pp("GET", "/balance"));

from pp import pp

print(pp("GET", "/balance"))

require __DIR__ . '/pp.php';

print_r(pp('GET', '/balance'));

source pp.sh
pp GET /balance