timestamp + METHOD + path + body
  METHOD = POST | GET (uppercase)
  path   = full path incl. /api and any query, e.g. /api/p2p/provider/payout
  body   = "" for GET or an empty body, otherwise JSON.stringify(body)
signature = hex( HMAC_SHA256(apiSecret, string to sign) )

const crypto = require('node:crypto');
const BASE = 'https://autop2p.tech';
const ACCOUNT_ID = process.env.P2P_ACCOUNT_ID;   // x-account-id
const API_SECRET = process.env.P2P_API_SECRET;   // from the partner portal

async function p2p(method, path, body) {
  const raw = body === undefined ? '' : JSON.stringify(body); // build once, sign and send the same string
  const ts = String(Date.now());
  const signature = crypto.createHmac('sha256', API_SECRET)
    .update(ts + method.toUpperCase() + path + raw).digest('hex');
  const res = await fetch(BASE + path, {
    method, body: raw || undefined, redirect: 'error', signal: AbortSignal.timeout(15000),
    headers: { 'content-type': 'application/json', 'x-account-id': ACCOUNT_ID, 'x-timestamp': ts, 'x-signature': signature },
  });
  const text = await res.text();
  let json = null; try { json = text ? JSON.parse(text) : null; } catch {}
  return { status: res.status, body: json };
}

// await p2p('GET', '/api/p2p/provider/health');  // 200 = connected

{
  "ref": "P2PW-9ef83b1bdb15d0fc52c4592d6b931e68",
  "expiresAt": "2026-09-29T10:15:00.000Z",
  "receiveUrl": "https://autop2p.tech/receive/<token>",
  "lane": "SMALL",
  "acceptance": "ACCEPTED",
  "contractVersion": 1
}

{
  "ref": "P2PM-7d7c576c9c2fce92f618a45352b5acb2",
  "transferAmount": 500.37,
  "payUrl": "https://autop2p.tech/pay/P2PM-7d7c576c9c2fce92f618a45352b5acb2",
  "expiresAt": "2026-09-29T10:15:00.000Z",
  "matched": true,
  "acceptance": "ACCEPTED",
  "contractVersion": 1
}

{ "matched": false, "acceptance": "REJECTED", "reason": "no liquidity in withdraw queue", "contractVersion": 1 }

{
  "status": "PENDING",
  "engineStatus": "QUEUED",
  "requestId": "WD-20260929-0001",
  "remaining": "600",
  "completedAmount": "400",
  "expiresAt": "2026-09-29T10:15:00.000Z",
  "terminalEvent": null
}

{
  "event": "p2p.match", "type": "PAYIN",
  "eventId": "6f1c2d9e-8a41-4a3b-9c0e-2b7d5e1f0a11", "contractVersion": 1,
  "client_id": "<ACCOUNT_ID>", "gateway_account_ref": "<GATEWAY_ACCOUNT_REF>",
  "ref": "P2PM-7d7c576c9c2fce92f618a45352b5acb2", "reference_id": "DP-20260929-0001",
  "status": "COMPLETED", "amount": "500.00", "transfer_amount": "500.37",
  "slip_ref": null, "withdraw_ref": "P2PW-9ef83b1bdb15d0fc52c4592d6b931e68",
  "currency": "THB", "occurredAt": "2026-09-29T10:05:12.345Z"
}

{
  "event": "p2p.withdraw", "type": "PAYOUT",
  "eventId": "0b9e7a52-3d1f-4c8e-a6b2-91f4c7d8e203", "contractVersion": 1,
  "client_id": "<ACCOUNT_ID>", "gateway_account_ref": "<GATEWAY_ACCOUNT_REF>",
  "ref": "P2PW-9ef83b1bdb15d0fc52c4592d6b931e68", "reference_id": "WD-20260929-0001",
  "status": "COMPLETED", "amount": "1000.00", "completed_amount": "1000.00",
  "hold_reference": "WD-20260929-0001", "currency": "THB", "occurredAt": "2026-09-29T10:20:44.012Z"
}

// Express: read the RAW body; do not use express.json() before verifying
app.post('/p2p/callback', express.raw({ type: 'application/json' }), async (req, res) => {
  const expected = crypto.createHmac('sha256', process.env.P2P_CALLBACK_SECRET).update(req.body).digest('hex');
  const got = String(req.get('x-p2p-signature') || '');
  if (got.length !== 64 || !crypto.timingSafeEqual(Buffer.from(got), Buffer.from(expected)))
    return res.status(401).end();
  const e = JSON.parse(req.body.toString('utf8'));
  // check contractVersion / client_id / gateway_account_ref / reference_id / ref / amount
  const status = await db.transaction(async (tx) => {
    const r = await tx.query('INSERT INTO p2p_callback_receipts (event_id, payload) VALUES ($1,$2) ON CONFLICT DO NOTHING', [e.eventId, e]);
    if (r.rowCount === 0) return 'duplicate';          // already handled: no second money movement
    await applyTerminalResult(tx, e);                   // status + ledger, once per order
    return 'processed';
  });
  res.status(200).json({ eventId: e.eventId, status });
});

{ "eventId": "6f1c2d9e-8a41-4a3b-9c0e-2b7d5e1f0a11", "status": "processed" }