KYB pre e-shopy v troch volaniach

<?php
/**
 * Entyrix webhook receiver (signature v2).
 * Read the RAW body — a parsed/re-encoded body will not match the signature.
 */
$rawBody   = file_get_contents('php://input');
$timestamp = $_SERVER['HTTP_X_ENTYRIX_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_ENTYRIX_SIGNATURE'] ?? '';
$secret    = getenv('ENTYRIX_WEBHOOK_SECRET'); // shown ONCE, at subscribe time

function entyrix_verify_webhook(
    string $rawBody,
    string $timestamp,
    string $signature,
    string $secret
): bool {
    if (!preg_match('/^\d+$/', $timestamp)) {
        return false;
    }
    $nowMs = (int) round(microtime(true) * 1000);
    if (abs($nowMs - (int) $timestamp) > 300000) {
        return false; // outside the 5-minute replay window
    }
    $expected = 'sha256=' . hash_hmac('sha256', $timestamp . '.' . $rawBody, $secret);
    return hash_equals($expected, $signature); // constant-time
}

if (!entyrix_verify_webhook($rawBody, $timestamp, $signature, $secret)) {
    http_response_code(401);
    exit;
}

$event = json_decode($rawBody, true);
// Deduplicate on $event['eventId'] — a retry re-sends the same id.
// $event['eventType'] is the stable code; never branch on the Slovak summary.
if ($event['eventType'] === 'bankruptcy_change') {
    // e.g. flip the customer to prepay-only
}
http_response_code(200); // anything outside 2xx is retried

<?php
/**
 * Entyrix KYB — server-side B2B registration check.
 * Drop into modules/yourmodule/src/EntyrixKyb.php (PrestaShop) or any PSR-4 tree.
 * Runs on your server ONLY. The sk_ key must never reach the browser.
 */
final class EntyrixKyb
{
    private const BASE = 'https://entyrix.com/api/v1';

    public function __construct(private string $apiKey) {}

    /** Low-level call. Retries once on 429/5xx, honouring Retry-After. */
    private function call(string $path, array $query = []): array
    {
        $url = self::BASE . $path . ($query ? '?' . http_build_query($query) : '');

        for ($attempt = 0; $attempt < 2; $attempt++) {
            $retryAfter = 0;
            $ch = curl_init($url);
            curl_setopt_array($ch, [
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_CONNECTTIMEOUT => 3,
                CURLOPT_TIMEOUT        => 8,
                CURLOPT_HTTPHEADER     => [
                    'Authorization: Bearer ' . $this->apiKey,
                    'Accept: application/json',
                ],
                CURLOPT_HEADERFUNCTION => function ($ch, $header) use (&$retryAfter) {
                    if (stripos($header, 'retry-after:') === 0) {
                        $retryAfter = (int) trim(substr($header, 12));
                    }
                    return strlen($header);
                },
            ]);
            $raw    = curl_exec($ch);
            $status = (int) curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
            $err    = curl_error($ch);
            curl_close($ch);

            if ($raw === false) {
                return ['status' => 0, 'body' => null, 'error' => $err];
            }
            if (($status === 429 || $status >= 500) && $attempt === 0) {
                sleep(max(1, min($retryAfter, 5)));
                continue;
            }
            return ['status' => $status, 'body' => json_decode($raw, true), 'error' => null];
        }
        return ['status' => 0, 'body' => null, 'error' => 'unreachable'];
    }

    /** Step 1 — IČO autocomplete for the registration form. */
    public function suggest(string $q, int $limit = 8): array
    {
        if (mb_strlen(trim($q)) < 2) {
            return [];
        }
        $r = $this->call('/companies/autocomplete', ['q' => $q, 'limit' => $limit]);
        return $r['status'] === 200 ? ($r['body']['data'] ?? []) : [];
    }

    /** Step 2 — autofill + VIES. null when absent, terminated-unknown or FO-gated. */
    public function profile(string $ico): ?array
    {
        $detail = $this->call('/companies/' . rawurlencode($ico));
        // 404 also covers sole traders: error.code = FO_GATED_NO_DPA.
        if ($detail['status'] !== 200) {
            return null;
        }
        $c = $detail['body']['data'];

        $comp = $this->call('/companies/' . rawurlencode($ico) . '/compliance');
        $vies = $comp['status'] === 200
            ? ($comp['body']['data']['signals']['tax']['viesValid'] ?? null)
            : null;

        return [
            'name'       => $c['name'],
            'street'     => $c['street'],
            'city'       => $c['municipality'],
            'postcode'   => $c['postalCode'],
            'country'    => $c['country'],
            'vat_id'     => $c['vatId'],
            'dic'        => $c['dic'],
            'status'     => $c['status'],
            'vies_valid' => $vies,
        ];
    }

    /** Step 3 — credit gate. */
    public function creditGate(string $ico): array
    {
        $r = $this->call('/companies/' . rawurlencode($ico) . '/credit-score');
        if ($r['status'] !== 200) {
            // Fail OPEN to manual review — never silently approve on an outage.
            return ['decision' => 'review', 'reason' => 'score_unavailable'];
        }
        $d = $r['body']['data'];

        if (!empty($d['hardStop'])) {
            return ['decision' => 'block', 'reason' => $d['hardStop'], 'grade' => $d['grade']];
        }
        if ((int) $d['score'] < 40) {
            return ['decision' => 'prepay', 'reason' => 'low_score', 'grade' => $d['grade']];
        }
        return ['decision' => 'invoice', 'grade' => $d['grade'], 'score' => $d['score']];
    }
}