sepay_pg_ruby 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 980e4390afecf243f51eb965074c00e391d868dbdd349fec1c046beef294e5e6
-  data.tar.gz: e4599d686032db231c65e6b693dca349df62097555f702c8601bb4281a56e0a2
+  metadata.gz: 285ead0765edfb229619f9f5f8e848ed01f308211a4cc3269227c30002f3695d
+  data.tar.gz: be2e956b3f67fcf001978e5924ae3a6aaecd0e0dc29f3252a734a1023f95d7e3
 SHA512:
-  metadata.gz: 3c70415760129e44bc87be0dfdfd2cebc0b7ac4435d57715e095c4b6c7f977c187c18109c2a4947f3e76a711b47cf3279ebde3177c94eced357874415e14e4d0
-  data.tar.gz: 5313fd157ac12fb915009e47089a2af820cb5cf6b5ac1ab9a92574583e36ef197b01539803299a9c69a640bc92f50ca71bff0c10027f820f543dd0c3b9fe9be1
+  metadata.gz: 399cf3b13d6aeae87f7e034d05ff0e4e18e6f3a1081158792e643d55ffe6b796355a91e5a0223032ecd79716448f0dff6523199ca7872c8e0ec742e5da24c2ee
+  data.tar.gz: ab82528fccc97b2ba63ee8617bac225a737dfe4e964dd0d65171fa7191512f7b7b63736227ecd1709602b1b1d5c881a7e3afab3be4c86b4b282c6fd1d5e66cec

data/lib/sepay_pg_ruby/ipn.rb

@@ -1,30 +1,23 @@
-require 'openssl'
-
 module SepayPgRuby
   module IPN
     module_function
 
-    def verify_signature(payload, secret_key)
-      payload_hash = payload.transform_keys(&:to_s)
-      received_signature = payload_hash['signature']
-      return false if received_signature.nil? || received_signature.empty?
-
-      data_to_verify = payload_hash.reject { |k, _| k == 'signature' }
-      sorted_keys = data_to_verify.keys.select { |k| !data_to_verify[k].nil? }.sort
-      query_string = sorted_keys.map { |key| "#{key}=#{data_to_verify[key]}" }.join('&')
+    # SePay authenticates inbound IPN calls via the `X-Secret-Key` request
+    # header, compared directly against the merchant's configured secret key.
+    # See https://developer.sepay.vn/en/cong-thanh-toan/IPN
+    def verify_secret_key(header_value, secret_key)
+      return false if header_value.nil? || header_value.to_s.empty?
+      return false if secret_key.nil? || secret_key.to_s.empty?
 
-      calculated = OpenSSL::HMAC.hexdigest('sha256', secret_key.to_s, query_string)
-      secure_compare(received_signature, calculated)
-    rescue StandardError
-      false
+      secure_compare(header_value.to_s, secret_key.to_s)
     end
 
-    def secure_compare(a, b)
-      return false unless a.is_a?(String) && b.is_a?(String)
-      return false unless a.bytesize == b.bytesize
+    def secure_compare(header_value, secret_key)
+      return false unless header_value.is_a?(String) && secret_key.is_a?(String)
+      return false unless header_value.bytesize == secret_key.bytesize
 
       result = 0
-      a.bytes.zip(b.bytes) { |x, y| result |= x ^ y }
+      header_value.bytes.zip(secret_key.bytes) { |x, y| result |= x ^ y }
       result.zero?
     end
   end

data/lib/sepay_pg_ruby/version.rb

@@ -1,3 +1,3 @@
 module SepayPgRuby
-  VERSION = '0.0.1'.freeze
+  VERSION = '0.0.2'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sepay_pg_ruby
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Hiun
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-28 00:00:00.000000000 Z
+date: 2026-09-13 00:00:00.000000000 Z
 dependencies: []
 description: Ruby SDK for SePay payment gateway with order and checkout support.
 email: