一次接入，多链稳定币收款

curl -X POST https://api.cnixpay.com/api/v2/orders \
  -H "Authorization: Bearer $CNIXPAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "merchantOrderNo": "ORDER_10086",
  "amount": "100.00",
  "paymentOptions": [
    { "chain": "tron", "token": "USDT" },
    { "chain": "bsc",  "token": "USDC" }
  ],
  "callbackUrl": "https://shop.example.com/notify"
}'

{
  "code": 0,
  "message": "success",
  "data": {
    "orderNo": "20261017105142a1b2c3d4e5f6",
    "status": "pending",
    "amount": "100.00",
    "currency": "USD",
    "paymentOptions": [
      { "chain": "tron", "token": "USDT", "address": "TR7NHq...", "amount": "100.00" },
      { "chain": "bsc",  "token": "USDC", "address": "0x55d3...", "amount": "100.00" }
    ],
    "cashierUrl": "https://pay.cnixpay.com/pay/20261017105142a1b2c3d4e5f6",
    "expireTime": 1760670400
  },
  "requestId": "req_1c9e..."
}

POST /notify HTTP/1.1
Content-Type: application/json
X-Webhook-Id: evt_7f3c9a...
X-Webhook-Timestamp: 1760670205
X-Webhook-Signature: v2=5b1f0e...

{
  "id": "evt_7f3c9a...",
  "event": "order.paid",
  "createTime": 1760670200,
  "data": { "orderNo": "20261017105142a1b2c3d4e5f6", "status": "paid", "version": 3, "...": "..." }
}

import crypto from 'node:crypto'

// rawBody 必须是原始请求体（Buffer），不要先解析成 JSON 再序列化
export function verifyWebhook(rawBody, headers, apiSecret) {
  const timestamp = headers['x-webhook-timestamp']
  const signature = headers['x-webhook-signature'] ?? ''
  if (!/^\d+$/.test(timestamp ?? '') || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false
  const expected =
    'v2=' + crypto.createHmac('sha256', apiSecret).update(`${timestamp}.`).update(rawBody).digest('hex')
  const a = Buffer.from(expected)
  const b = Buffer.from(signature)
  return a.length === b.length && crypto.timingSafeEqual(a, b)
}

// Express: app.post('/notify', express.raw({ type: 'application/json' }), handler)