ElitePartner

<?php
// 1. Allow CORS for all hosts
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type');
header('Content-Type: application/json');

// Handle preflight OPTIONS request
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit();
}

// 2. Include config file to get DOMAIN and log_api_data()
require_once __DIR__ . '/../lib/config.php';

// 3. Get JSON input
$input = json_decode(file_get_contents('php://input'), true);

$orderId = $input['order_id'] ?? null;
$amount = $input['amount'] ?? null;

// Log and exit if inputs are missing
if (!$orderId || !$amount) {
    log_api_data('Validation Error', ['error' => 'Missing order_id or amount', 'input' => $input], 'bondpay_error');
    
    http_response_code(400);
    echo json_encode(['error' => 'Missing order_id or amount']);
    exit();
}

// ==========================================
// 4. BondPay Gateway Credentials
// ==========================================
$merchant_id = '100888384'; 
$api_key = 'acfa1ae3bb626add8b42578505838367';

$callback_url = DOMAIN . '/webhook/bondpay.php';
$amountStr = (string)$amount;

// ==========================================
// 5. Generate MD5 Signature
// ==========================================
$stringToHash = $merchant_id . $amountStr . $orderId . $api_key . $callback_url;
$signature = md5($stringToHash);

// 6. Prepare Payload
$payload = [
    "merchant_id" => $merchant_id,
    "api_key" => $api_key,
    "amount" => $amountStr,
    "merchant_order_no" => $orderId,
    "callback_url" => $callback_url,
    "extra" => 0,
    "signature" => $signature
];

// Log Outgoing Request
log_api_data('BondPay Order Request', $payload, 'bondpay_order');

// 7. Send Request via cURL
$ch = curl_init('https://api.bond-payss.com/v1/create');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

// Handle cURL errors
if (curl_errno($ch)) {
    $curlError = curl_error($ch);
    log_api_data('cURL Error', ['error' => $curlError], 'bondpay_error');
}
curl_close($ch);

// 8. Handle Response and Log Errors
if ($response) {
    $gwData = json_decode($response, true);
    
    // Log Incoming Gateway Response
    log_api_data('BondPay Order Response', $gwData, 'bondpay_order');
    
    if (isset($gwData['success']) && $gwData['success'] === true && !empty($gwData['payment_url'])) {
        // Success
        echo json_encode(['payment_url' => $gwData['payment_url']]);
    } else {
        // Gateway declined or sent an error
        log_api_data('Gateway Rejection Error', ['http_code' => $httpCode, 'response' => $gwData], 'bondpay_error');
        
        http_response_code(500);
        echo json_encode([
            'error' => 'Gateway error',
            'message' => $gwData['message'] ?? 'Unknown error from gateway'
        ]);
    }
} else {
    // API did not respond
    log_api_data('API Down Error', ['http_code' => $httpCode, 'message' => 'No response from BondPay'], 'bondpay_error');
    
    http_response_code(500);
    echo json_encode(['error' => 'Payment gateway is temporarily down.']);
}

Editing: /order/bondpay.php