Objednávky a události přes API a webhook

curl -sS -X POST "https://www.postarna.cz/api/v1/tenants/$TENANT/orders" \
  -H "Authorization: Bearer $POSTARNA_API_KEY" \
  -H "Content-Type: application/json" \
  --data-binary @- <<'JSON'
{
  "id": "2026001234",
  "shopId": "1",
  "createdAt": "2026-10-01T09:30:00+02:00",
  "email": "jana.novakova@example.cz",
  "status": "Vyřizuje se",
  "currency": "CZK",
  "totalWithVat": "1290.00",
  "totalWithoutVat": "1066.12",
  "items": [
    {"id": "KAVA-1KG", "name": "Káva Kolumbie 1 kg", "quantity": 1,
     "price": {"withVat": "1290.00", "withoutVat": "1066.12", "currency": "CZK"},
     "attributes": {"Category": "Káva", "Brand": "Example"}}
  ]
}
JSON

curl -sS -X POST "https://www.postarna.cz/api/v1/tenants/$TENANT/contacts" \
  -H "Authorization: Bearer $POSTARNA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "petr.svoboda@example.cz", "shopId": "1", "firstName": "Petr", "purposeId": "1", "consentConfirmed": true}'

curl -sS -X POST "https://www.postarna.cz/api/v1/tenants/$TENANT/contact-events" \
  -H "Authorization: Bearer $POSTARNA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type": "cart", "email": "jana.novakova@example.cz", "shopId": "1", "currency": "CZK", "total": "1290.00", "items": [{"code": "KAVA-1KG", "name": "Káva Kolumbie 1 kg", "quantity": 1, "price": "1290.00"}]}'

<?php
// Secret of the WooCommerce webhook and the Poštárna API key come from the environment, never from the code.
$secret = getenv('WOO_WEBHOOK_SECRET');
$raw = file_get_contents('php://input');
$sig = $_SERVER['HTTP_X_WC_WEBHOOK_SIGNATURE'] ?? '';
if (!hash_equals(base64_encode(hash_hmac('sha256', $raw, $secret, true)), $sig)) {
    http_response_code(401);
    exit;
}
$o = json_decode($raw, true);
if (!isset($o['id'])) {            // the ping WooCommerce sends when the webhook is saved
    http_response_code(204);
    exit;
}
$items = [];
foreach ($o['line_items'] as $li) {
    $items[] = [
        'id' => $li['sku'] !== '' ? $li['sku'] : (string) $li['product_id'],
        'name' => $li['name'],
        'quantity' => $li['quantity'],
        'price' => ['withoutVat' => number_format((float) $li['price'], 2, '.', ''), 'currency' => $o['currency']],
    ];
}
$order = [
    'id' => (string) $o['id'],
    'shopId' => getenv('POSTARNA_SHOP_ID'),
    'eshopCode' => (string) $o['number'],
    'createdAt' => $o['date_created_gmt'] . 'Z',
    'paidAt' => $o['date_paid_gmt'] ? $o['date_paid_gmt'] . 'Z' : null,
    'status' => $o['status'],
    'email' => $o['billing']['email'] ?? null,
    'currency' => $o['currency'],
    'totalWithVat' => $o['total'],
    'totalWithoutVat' => number_format((float) $o['total'] - (float) $o['total_tax'], 2, '.', ''),
    'promoCodesUsed' => array_map(fn ($c) => $c['code'], $o['coupon_lines'] ?? []),
    'items' => $items,
];
$ch = curl_init('https://www.postarna.cz/api/v1/tenants/' . getenv('POSTARNA_TENANT') . '/orders');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 20,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . getenv('POSTARNA_API_KEY'), 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => json_encode($order),
]);
curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
// 5xx or 429: answer 500 so WooCommerce delivers the webhook again (the same order is idempotent).
http_response_code($status >= 500 || $status === 429 || $status === 0 ? 500 : 204);

import crypto from 'node:crypto';
import http from 'node:http';

const { SHOPIFY_WEBHOOK_SECRET, POSTARNA_API_KEY, POSTARNA_TENANT, POSTARNA_SHOP_ID } = process.env;

function signed(raw, header) {
  const digest = crypto.createHmac('sha256', SHOPIFY_WEBHOOK_SECRET).update(raw).digest('base64');
  const a = Buffer.from(digest);
  const b = Buffer.from(header ?? '');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

http.createServer((req, res) => {
  const chunks = [];
  req.on('data', (c) => chunks.push(c));
  req.on('end', async () => {
    const raw = Buffer.concat(chunks);
    if (!signed(raw, req.headers['x-shopify-hmac-sha256'])) return res.writeHead(401).end();
    const o = JSON.parse(raw.toString('utf8'));
    const order = {
      id: String(o.id),
      shopId: POSTARNA_SHOP_ID,
      eshopCode: o.name,
      createdAt: o.created_at,
      status: o.cancelled_at ? 'cancelled' : o.financial_status,
      email: o.email || null,
      currency: o.currency,
      totalWithVat: o.total_price,
      totalWithoutVat: (Number(o.total_price) - Number(o.total_tax || 0)).toFixed(2),
      promoCodesUsed: (o.discount_codes || []).map((d) => d.code),
      items: o.line_items.map((li) => ({
        id: li.sku || String(li.variant_id), name: li.title, quantity: li.quantity,
        price: { withVat: li.price, currency: o.currency },
      })),
    };
    const r = await fetch(`https://www.postarna.cz/api/v1/tenants/${POSTARNA_TENANT}/orders`, {
      method: 'POST',
      headers: { Authorization: `Bearer ${POSTARNA_API_KEY}`, 'Content-Type': 'application/json' },
      body: JSON.stringify(order),
    }).catch(() => ({ status: 0 }));
    // 5xx, 429 or no answer: 500 makes Shopify retry; the same order is idempotent
    res.writeHead(r.status >= 500 || r.status === 429 || r.status === 0 ? 500 : 204).end();
  });
}).listen(8080);