import time
import json
import hmac
import hashlib
import secrets
import sys
from urllib.parse import urljoin

import requests
import os

BASE_URL   = 'https://api.frillpay.com/'
PATH       = '/v1/deposit/fp-payment.php'
API_KEY    = 'YOUR_API_KEY_HERE'
SECRET_HEX = 'YOUR_SECRET_HEX_HERE'
WANT_JSON  = True
TIMEOUT_S  = 20

BASE_URL   = os.getenv('FP_BASE_URL', BASE_URL)
PATH       = os.getenv('FP_PATH', PATH)
API_KEY    = os.getenv('FP_API_KEY', API_KEY)
SECRET_HEX = os.getenv('FP_SECRET_HEX', SECRET_HEX)

reqId    = '45613'
amount   = 10
currency = 'USD'
email    = 'john@example.com'

body_dict = {
    'requestedId': reqId,
    'amount': amount,
    'currency': currency,
    'email': email,
}
body = json.dumps(body_dict, separators=(',', ':'), ensure_ascii=False)

qs = 'return=json' if WANT_JSON else ''

ts = int(time.time())
nonce = secrets.token_hex(12)
body_hash = hashlib.sha256(body.encode('utf-8')).hexdigest()

canonical = (
    'POST' + '\n' +
    PATH + '\n' +
    qs + '\n' +
    body_hash + '\n' +
    str(ts) + '\n' +
    nonce
)

try:
    secret_bytes = bytes.fromhex(SECRET_HEX)
except ValueError:
    print('Gateway error: SECRET_HEX is not valid hex', file=sys.stderr)
    sys.exit(2)

fp_sig = hmac.new(secret_bytes, canonical.encode('utf-8'), hashlib.sha256).hexdigest()

url = urljoin(BASE_URL.rstrip('/') + '/', PATH.lstrip('/'))
if qs:
    url = f"{url}?{qs}"

headers = {
    'Content-Type': 'application/json',
    'FP-Key': API_KEY,
    'FP-Ts': str(ts),
    'FP-Nonce': nonce,
    'FP-Sig': fp_sig,
}

try:
    resp = requests.post(
        url,
        data=body.encode('utf-8'),
        headers=headers,
        timeout=TIMEOUT_S,
        allow_redirects=False,
    )
except requests.RequestException as e:
    print(f"Gateway error: {e}", file=sys.stderr)
    sys.exit(502)

code = resp.status_code
resp_headers = resp.headers
resp_text = resp.text

if 200 <= code < 300:
    try:
        data = resp.json()
    except ValueError:
        print(resp_text)
        sys.exit(502)

    hosted_url = (data or {}).get('hosted_url', '')
    if not hosted_url:
        print(resp_text)
        sys.exit(502)

    print(data)
    sys.exit(0)

if 300 <= code < 400:
    location = resp_headers.get('Location', '').strip()
    if not location:
        print('Empty Location', file=sys.stderr)
        sys.exit(502)
    print(location)
    sys.exit(0)

print(resp_text)
sys.exit(code if code else 1)

import { createHash, createHmac, randomBytes } from "node:crypto";
import { fileURLToPath } from "node:url";
import path from "node:path";
import { exit } from "node:process";

const BASE_URL   = "https://api.frillpay.com";        
const PATH       = "/v1/deposit/fp-payment.php";
const API_KEY    = "YOUR_API_KEY_HERE";
const SECRET_HEX = "YOUR_SECRET_HEX_HERE";            
const WANT_JSON  = true;
const TIMEOUT_MS = 20000;

const bodyObj = {
  requestedId: "45613",
  amount: 10,
  currency: "USD",
  email: "john@example.com",
};
function buildSignature({ path, qs, body, ts, nonce, secretHex }) {
  const bodyHash = createHash("sha256").update(body).digest("hex");
  const canonical = `POST\n${path.toLowerCase()}\n${qs}\n${bodyHash}\n${ts}\n${nonce}`;
  const key = Buffer.from(secretHex, "hex");
  const fpSig = createHmac("sha256", key).update(canonical).digest("hex");
  return { bodyHash, canonical, fpSig };
}

async function createPayment() {
  const body = JSON.stringify(bodyObj);
  const qs = WANT_JSON ? "return=json" : "";
  const ts = Math.floor(Date.now() / 1000);
  const nonce = randomBytes(12).toString("hex");

  const { fpSig } = buildSignature({ path: PATH, qs, body, ts, nonce, secretHex: SECRET_HEX });

  const url = `${BASE_URL.replace(/\/$/, "")}${PATH}${qs ? `?${qs}` : ""}`;
  const headers = {
    "Content-Type": "application/json",
    "FP-Key": API_KEY,
    "FP-Ts": String(ts),
    "FP-Nonce": nonce,
    "FP-Sig": fpSig,
  };

  const ctrl = new AbortController();
  const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);

  try {
    const res = await fetch(url, { method: "POST", body, headers, redirect: "manual", signal: ctrl.signal });
    clearTimeout(timer);

    const code = res.status;
    const text = await res.text();

    if (code >= 200 && code < 300) {
      let data;
      try { data = JSON.parse(text); } catch {
        return { ok: false, code: 502, error: "Invalid JSON from gateway", raw: text };
      }
      const hosted = (data || {}).hosted_url || "";
      if (!hosted) {
        return { ok: false, code: 502, error: "Missing hosted_url", raw: text };
      }
      return { ok: true, code, hosted_url: hosted };
    }

    if (code >= 300 && code < 400) {
      const loc = (res.headers.get("location") || "").trim();
      if (!loc) return { ok: false, code: 502, error: "Empty Location" };
      return { ok: true, code, location: loc };
    }

    return { ok: false, code: code || 1, raw: text };

  } catch (e) {
    const msg = e?.name === "AbortError" ? "Gateway timeout" : (e?.message || String(e));
    return { ok: false, code: 502, error: `Gateway error: ${msg}` };
  }
}

const __filename = fileURLToPath(import.meta.url);
const isMain = process.argv[1] && path.resolve(process.argv[1]) === __filename;

if (isMain) {
  const out = await createPayment();
  if (out.ok) {
    // console.log(out.hosted_url || out.location);
    console.log(out);
    process.exit(0);
  } else {
    console.error(out.error || out.raw || "Unknown error");
    process.exit(out.code || 1);
  }
}

import 'dart:convert' show utf8, jsonEncode, jsonDecode, JsonEncoder;
import 'dart:math' show Random;
import 'package:http/http.dart' as http;
import 'package:crypto/crypto.dart' show sha256, Hmac, Digest;

class FrillPayClient {
  final String baseUrl;
  final String path;
  final String apiKey;
  final String secretHex;
  final bool wantJson;
  final Duration timeout;

  const FrillPayClient({
    required this.baseUrl,
    required this.path,
    required this.apiKey,
    required this.secretHex,
    this.wantJson = true,
    this.timeout = const Duration(seconds: 20),
  });

  Future<Map<String, dynamic>> createPaymentJson({
    required String requestedId,
    required num amount,
    required String currency,
    required String email,
  }) async {
    final bodyObj = <String, dynamic>{
      'requestedId': requestedId,
      'amount': amount,
      'currency': currency,
      'email': email,
    };
    final body = jsonEncode(bodyObj);
    final qs = wantJson ? 'return=json' : '';
    final ts = (DateTime.now().millisecondsSinceEpoch ~/ 1000).toString();
    final nonce = _randomHex(12);

    final sig = _buildSignature(
      path: path,
      qs: qs,
      body: body,
      ts: ts,
      nonce: nonce,
      secretHex: secretHex,
    );

    final url = '${baseUrl.replaceAll(RegExp(r'\/$'), '')}$path${qs.isNotEmpty ? '?$qs' : ''}';
    final headers = <String, String>{
      'Content-Type': 'application/json',
      'FP-Key': apiKey,
      'FP-Ts': ts,
      'FP-Nonce': nonce,
      'FP-Sig': sig,
    };

    try {
      final resp = await http
          .post(Uri.parse(url), headers: headers, body: body)
          .timeout(timeout);

      final code = resp.statusCode;
      final text = resp.body;

      if (resp.isRedirect || (code >= 300 && code < 400)) {
        final loc = resp.headers['location']?.trim();
        if (loc == null || loc.isEmpty) {
          return {"ok": false, "code": 502, "error": "Empty Location"};
        }
        return {"ok": true, "code": code, "location": loc};
      }

      if (code >= 200 && code < 300) {
        try {
          final data = jsonDecode(text) as Map<String, dynamic>;
          final hosted = (data['hosted_url'] ?? '').toString();
          if (hosted.isEmpty) {
            return {"ok": false, "code": 502, "error": "Missing hosted_url", "raw": text};
          }
          return {"ok": true, "code": code, "hosted_url": hosted, ...data};
        } catch (_) {
          return {"ok": false, "code": 502, "error": "Invalid JSON from gateway", "raw": text};
        }
      }

      return {"ok": false, "code": code == 0 ? 1 : code, "error": "Gateway error", "raw": text};
    } catch (e) {
      return {"ok": false, "code": 502, "error": "Gateway error: $e"};
    }
  }

  // ----- helpers -----
  static String _randomHex(int bytesLen) {
    final r = Random.secure();
    final b = List<int>.generate(bytesLen, (_) => r.nextInt(256));
    return _toHex(b);
  }

  static String _toHex(List<int> bytes) =>
      bytes.map((b) => b.toRadixString(16).padLeft(2, '0')).join();

  static List<int> _hexToBytes(String hex) {
    final h = hex.toLowerCase();
    if (h.length.isOdd) {
      throw ArgumentError('SECRET_HEX must have even length');
    }
    final out = <int>[];
    for (int i = 0; i < h.length; i += 2) {
      out.add(int.parse(h.substring(i, i + 2), radix: 16));
    }
    return out;
  }

  static String _buildSignature({
    required String path,
    required String qs,
    required String body,
    required String ts,
    required String nonce,
    required String secretHex,
  }) {
    final bodyHash = sha256.convert(utf8.encode(body)).toString();
    final canonical = [
      'POST',
      path.toLowerCase(),
      qs,
      bodyHash,
      ts,
      nonce,
    ].join('\n');

    final key = _hexToBytes(secretHex);
    final hmac = Hmac(sha256, key);
    final Digest sig = hmac.convert(utf8.encode(canonical));
    return sig.toString();
  }
}

Future<void> main() async {
  const baseUrl   = 'https://api.frillpay.com';
  const path      = '/v1/deposit/fp-payment.php';
  const apiKey    = 'z5wsovLk95Wv4PcXlu0YvUBefuQzb5y3';
  const secretHex = 'ecad8e4a7355ecbc34949adecb06118c0538326bd14404883fe3ef0f04150a4f';

  final client = FrillPayClient(
    baseUrl: baseUrl,
    path: path,
    apiKey: apiKey,
    secretHex: secretHex,
    wantJson: true,
  );

  final out = await client.createPaymentJson(
    requestedId: '45613',
    amount: 10,
    currency: 'USD',
    email: 'john@example.com',
  );

  print(const JsonEncoder.withIndent('  ').convert(out));
}

import time
import os
import json
import hmac
import hashlib
import requests
import sys

BASE_URL   = 'https://api.frillpay.com/'
PATH       = '/v1/withdraw/fp-withdraw.php'
API_KEY    = 'YOUR_API_KEY_HERE'
SECRET_HEX = 'YOUR_SECRET_HEX_HERE'
WANT_JSON  = True
TIMEOUT_S  = 20

body_dict = {
    "requestedId": "REQ-XYZ-001",
    "amount": 100,
    "email": "cilent@example.com",
}

body = json.dumps(body_dict, ensure_ascii=False, separators=(',', ':'))

qs = 'return=json' if WANT_JSON else ''
ts = int(time.time())
nonce = os.urandom(12).hex()

method = 'POST'
qs_canonical = qs  


body_hash = hashlib.sha256(body.encode('utf-8')).hexdigest()

canonical = (
    method + "\n" +
    PATH + "\n" +
    qs_canonical + "\n" +
    str(ts) + "\n" +
    nonce + "\n" +
    body_hash
)

try:
    secret_bin = bytes.fromhex(SECRET_HEX)
except ValueError:
    raise Exception('Invalid SECRET_HEX')

signature = hmac.new(secret_bin, canonical.encode('utf-8'), hashlib.sha256).hexdigest()

url = BASE_URL + PATH + ('?' + qs if qs else '')

headers = {
    'Content-Type': 'application/json',
    'X-FP-APIKEY': API_KEY,
    'X-FP-TS': str(ts),
    'X-FP-NONCE': nonce,
    'X-FP-SIGNATURE': signature,
}

try:
    resp = requests.post(url, data=body, headers=headers, timeout=TIMEOUT_S)
except requests.RequestException as e:
    sys.exit(f"HTTP request failed: {e}")

print(resp.text)

const crypto = require('crypto');
const axios  = require('axios');

const BASE_URL   = 'https://api.frillpay.com/';
const PATH       = '/v1/withdraw/fp-withdraw.php';
const API_KEY    = 'YOUR_API_KEY_HERE';
const SECRET_HEX = 'YOUR_SECRET_HEX_HERE';
const WANT_JSON  = true;
const TIMEOUT_S  = 20;

const bodyObj = {
  requestedId: 'REQ-XYZ-001',
  amount: 100,
  email: 'cilent@example.com',
};

const body = JSON.stringify(bodyObj);

const qs = WANT_JSON ? 'return=json' : '';
const ts = Math.floor(Date.now() / 1000);
const nonce = crypto.randomBytes(12).toString('hex');

const method = 'POST';
const qsCanonical = qs;

const bodyHash = crypto
  .createHash('sha256')
  .update(body, 'utf8')
  .digest('hex');

const canonical =
  method + '\n' +
  PATH + '\n' +
  qsCanonical + '\n' +
  ts + '\n' +
  nonce + '\n' +
  bodyHash;

let secretBin;
try {
  secretBin = Buffer.from(SECRET_HEX, 'hex');
} catch (e) {
  throw new Error('Invalid SECRET_HEX');
}

const signature = crypto
  .createHmac('sha256', secretBin)
  .update(canonical, 'utf8')
  .digest('hex');

const url = BASE_URL + PATH + (qs ? ('?' + qs) : '');

const headers = {
  'Content-Type': 'application/json',
  'X-FP-APIKEY': API_KEY,
  'X-FP-TS': String(ts),
  'X-FP-NONCE': nonce,
  'X-FP-SIGNATURE': signature,
};

(async () => {
  try {
    const response = await axios.post(url, body, {
      headers,
      timeout: TIMEOUT_S * 1000,
      validateStatus: () => true,
    });

    console.log(response.data);
  } catch (err) {
    console.error('HTTP request failed:', err.message || err);
    process.exit(1);
  }
})();

import 'dart:convert';
import 'dart:math';
import 'dart:typed_data';

import 'package:crypto/crypto.dart';
import 'package:http/http.dart' as http;

const String BASE_URL = 'https://api.frillpay.com/';
const String PATH = '/v1/withdraw/fp-withdraw.php';
const String API_KEY = 'YOUR_API_KEY_HERE';
const String SECRET_HEX = 'YOUR_SECRET_HEX_HERE';
const bool WANT_JSON = true;
const Duration TIMEOUT = Duration(seconds: 20);

void main() async {
  final Map<String, dynamic> bodyMap = {
    "requestedId": "REQ-XYZ-001",
    "amount": 100,
    "email": "cilent@example.com",
  };

  final String body = jsonEncode(bodyMap);

  final String qs = WANT_JSON ? 'return=json' : '';
  final int ts = DateTime.now().millisecondsSinceEpoch ~/ 1000; 
  final String nonce = _randomHex(12); 

  final String method = 'POST';
  final String qsCanonical = qs;

  final String bodyHash =
      sha256.convert(utf8.encode(body)).toString(); 

  final String canonical = [
    method,
    PATH,
    qsCanonical,
    ts.toString(),
    nonce,
    bodyHash,
  ].join('\n');

  final Uint8List secretBin = _hexToBytes(SECRET_HEX);

  final String signature =
      Hmac(sha256, secretBin).convert(utf8.encode(canonical)).toString();

  final String url =
      BASE_URL + PATH + (qs.isNotEmpty ? '?$qs' : '');

  final Map<String, String> headers = {
    'Content-Type': 'application/json',
    'X-FP-APIKEY': API_KEY,
    'X-FP-TS': ts.toString(),
    'X-FP-NONCE': nonce,
    'X-FP-SIGNATURE': signature,
  };

  try {
    final response = await http
        .post(Uri.parse(url), headers: headers, body: body)
        .timeout(TIMEOUT);

    print('HTTP ${response.statusCode}');
    print(response.body);
  } catch (e) {
    print('HTTP request failed: $e');
  }
}

String _randomHex(int bytesLength) {
  final rand = Random.secure();
  final bytes = List<int>.generate(bytesLength, (_) => rand.nextInt(256));
  final StringBuffer sb = StringBuffer();
  for (final b in bytes) {
    sb.write(b.toRadixString(16).padLeft(2, '0'));
  }
  return sb.toString();
}

Uint8List _hexToBytes(String hex) {
  final sanitized = hex.trim();
  if (sanitized.length % 2 != 0) {
    throw FormatException('Invalid SECRET_HEX length');
  }
  final bytes = <int>[];
  for (int i = 0; i < sanitized.length; i += 2) {
    final byteStr = sanitized.substring(i, i + 2);
    final value = int.parse(byteStr, radix: 16);
    bytes.add(value);
  }
  return Uint8List.fromList(bytes);
}