Bán vé của hàng trăm điểm đến ngay trên hệ thống của bạn

curl https://theve.vietsoftware.vn/api/v1/partner/products \
  -H "X-API-Key: tvk_demo_mayxanh_travelhub_2026"

{
  "data": {
    "code": "DH260920-7KQ2MX",
    "status": "COMPLETED",
    "payment_method": "AGENT_CREDIT",
    "total": 675000,
    "tickets": [
      {
        "code": "8H3K-9QZP-4MWT",
        "qr": "TV1.eyJrIjoiVC1DNVFN….Sgj6eg5rwb6M34…",
        "product_name": "Vé vào cổng Mây Xanh",
        "audience_label": "Người lớn",
        "valid_from": "2026-09-20T00:00:00+07:00",
        "valid_to": "2026-09-20T23:59:59+07:00",
        "remaining_entries": 1,
        "status": "ACTIVE"
      }
    ]
  }
}

import { createPublicKey, verify } from "node:crypto";

// qr = "TV1.<payload_b64url>.<signature_b64url>"
export function verifyTicketQr(qr, keys /* from GET /public/keys */) {
  const [prefix, payloadB64, sigB64] = qr.split(".");
  if (prefix !== "TV1") return null;
  const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
  const key = keys.find((k) => k.kid === payload.k);
  if (!key) return null;
  const spki = Buffer.concat([
    Buffer.from("302a300506032b6570032100", "hex"), // Ed25519 SPKI header
    Buffer.from(key.public_key, "base64"),
  ]);
  const ok = verify(null, Buffer.from(payloadB64, "ascii"),
    createPublicKey({ key: spki, format: "der", type: "spki" }),
    Buffer.from(sigB64, "base64url"));
  const now = Math.floor(Date.now() / 1000);
  return ok && payload.f <= now && now <= payload.u ? payload : null;
}

POST /theve/webhook
X-TheVe-Event: ticket.used
X-TheVe-Signature: sha256=5d41402abc4b2a76b9719d911017c592…
Content-Type: application/json

{
  "id": "0b0f5c7e-6a52-4f7e-9f63-2c0b8c5c1a90",
  "event": "ticket.used",
  "created_at": "2026-09-20T08:31:12+07:00",
  "tenant_id": "a7664fac-50ed-4013-88a7-bb93dbe2e4ca",
  "data": { "ticket_code": "8H3K-9QZP-4MWT", "gate": "Cổng chính số 1", "direction": "IN" }
}

import crypto from "node:crypto";
import express from "express";

const app = express();
app.post("/theve/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const expected = "sha256=" + crypto
    .createHmac("sha256", process.env.THEVE_WEBHOOK_SECRET)
    .update(req.body)            // raw bytes, không parse trước khi ký
    .digest("hex");
  const got = req.get("X-TheVe-Signature") ?? "";
  if (got.length !== expected.length ||
      !crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected))) {
    return res.status(401).end();
  }
  const event = JSON.parse(req.body.toString("utf8"));
  // event.id là duy nhất – bỏ qua nếu đã xử lý (TheVe có thể gửi lại)
  console.log(event.event, event.data);
  res.status(200).end();
});