<?php
$bol = explode(' / ',$_POST["Card_Expiry"]); $ay=$bol[0]; $yil=$bol[1];
$installment = ($_POST["Installment"] == "") ? 1 : $_POST["Installment"];
// QNBPay API Bilgileri
$app_id = tanim("pay+qnbpay","n1",0);
$app_secret = tanim("pay+qnbpay","n2",0);
$merchant_key = tanim("pay+qnbpay","n3",0);
function generateHashKey($total, $installment, $currency_code, $merchant_key, $invoice_id, $app_secret){
    $data = $total . '|' . $installment . '|' . $currency_code . '|' . $merchant_key . '|' . $invoice_id;
    $iv = substr(sha1(mt_rand()), 0, 16);
    $password = sha1($app_secret);
    $salt = substr(sha1(mt_rand()), 0, 4);
    $saltWithPassword = hash('sha256', $password . $salt);
    $encrypted = openssl_encrypt("$data", 'aes-256-cbc', "$saltWithPassword", null, $iv);
    $msg_encrypted_bundle = "$iv:$salt:$encrypted";
    $msg_encrypted_bundle = str_replace('/', '__', $msg_encrypted_bundle);
    return $msg_encrypted_bundle;
}
	$_SESSION["burl"]=$_POST["burl"];
// Kullanıcıdan gelen ödeme bilgileri (POST ile al)
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $card_name = trim($_POST["Card_Name"] ?? '');
    $card_no = isset($_POST["Card_Number"]) ? str_replace(' ', '', $_POST["Card_Number"]) : '';
    $cvv = trim($_POST["Card_Cvv"] ?? '');
    $total = isset($_POST["Total"]) ? (float)$_POST["Total"] : 0.0;
	$merchant_ok_url=$_POST["aurl"]."/deppo/tools/vpos/fintech/qnbpay/return.php";
	$merchant_fail_url=$_POST["aurl"]."/deppo/tools/vpos/fintech/qnbpay/return.php";
    $invoice_id = $_POST["Oid"];
	$taksit = empty($_POST["Installment"]) ? "1" : ($_POST["Installment"] == "1" ? "" : $_POST["Installment"]);
    // Kart son kullanma tarihini al
    if (!empty($_POST["Card_Expiry"])) {
        $bol = explode(' / ', $_POST["Card_Expiry"]);
        $expiry_month = isset($bol[0]) ? trim($bol[0]) : '';
        $expiry_year = isset($bol[1]) ? trim($bol[1]) : '';
    } else {
        $expiry_month = '';
        $expiry_year = '';
    }
    // Eksik alan kontrolü
    if (empty($card_name) || empty($card_no) || empty($cvv) || empty($expiry_month) || empty($expiry_year) || empty($total)) {
        die("Lütfen tüm ödeme bilgilerini eksiksiz doldurun.");
    }
    // 1. Adım: QNBPay'den Token Al
    $token_url = "https://portal.qnbpay.com.tr/ccpayment/api/token";
    $token_data = json_encode(["app_id" => $app_id, "app_secret" => $app_secret]);
    $ch = curl_init($token_url);
    curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type: application/json"]);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $token_data);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $token_response = json_decode(curl_exec($ch), true);
    curl_close($ch);
    if (!isset($token_response["data"]["token"])) {
        die("Token alınamadı: " . json_encode($token_response));
    }
    $token = $token_response["data"]["token"];
    // 2. Adım: Hash Oluştur
	$hash_key = generateHashKey($total, $installment, "TRY", $merchant_key, $invoice_id, $app_secret );
    // 3. Adım: Ödeme İsteği Gönder
    $payment_url = "https://portal.qnbpay.com.tr/ccpayment/api/paySmart3D";
    $payment_data = json_encode([
		"cc_holder_name" => $card_name,
		"cc_no" => $card_no,
		"expiry_month" => $expiry_month,
		"expiry_year" => $expiry_year,
		"cvv" => $cvv,
		"currency_code" => "TRY",
		"installments_number" => $installment,
		"invoice_id" => $invoice_id,
		"invoice_description" => "Test Ödemesi",
		"total" => $total,
		"merchant_key" => $merchant_key,
		"hash_key" => $hash_key,
		"cancel_url" => $merchant_fail_url,
		"return_url" => $merchant_ok_url,
		"transaction_type" => "Auth",
		"is_comission_from_user" => "2",
		"payment_completed_by" => "app",
		"response_method" => "GET",
		"name" => "Test",
		"surname" => "User",
		"items" => json_encode([
			[
				"name" => "Ürün1",
				"price" => $total, 
				"qnantity" => 1,
				"description" => "açıklaması"
			]
		])
	], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    $ch = curl_init($payment_url);
    curl_setopt($ch, CURLOPT_HTTPHEADER, [
        "Authorization: Bearer $token",
        "Content-Type: application/json"
    ]);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $payment_data);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $payment_response = curl_exec($ch);
    curl_close($ch);
    $payment_result = json_decode($payment_response, true);
	Print_r($payment_response);
}
?>