From b5976d0b2196f3290f51bc2f95625b685956d1e0 Mon Sep 17 00:00:00 2001
From: hexdev <me@killhexdev.ru>
Date: Sun, 31 May 2026 14:25:05 +0700
Subject: [PATCH] fix(pally): align webhook handler with official API spec

---
 api/routes/pally.py         | 42 ++++++++++++++++++-------------------
 tests/send_pally_webhook.py | 12 ++++-------
 2 files changed, 25 insertions(+), 29 deletions(-)

diff --git a/api/routes/pally.py b/api/routes/pally.py
index 3f5655e..6e1805e 100644
--- a/api/routes/pally.py
+++ b/api/routes/pally.py
@@ -22,40 +22,40 @@ logger = logging.getLogger(__name__)
 
 @router.post("/result")
 async def pally_callback(
-    id: str = Form(...),
-    bill_id: str = Form(...),
-    status: str = Form(...),
-    req_amount: str = Form(...),
-    currency: str = Form(...),
-    order_id: str | None = Form(None),
-    signature: str = Form(...),
+    InvId: str = Form(...),
+    OutSum: str = Form(...),
+    Commission: str = Form(...),
+    TrsId: str = Form(...),
+    Status: str = Form(...),
+    CurrencyIn: str = Form(...),
+    custom: str | None = Form(None),
+    SignatureValue: str = Form(...),
     session: AsyncSession = Depends(get_db),
     bot: Bot = Depends(get_bot),
     deps: APIDependenciesDTO = Depends(get_deps),
 ):
-    oid = order_id or ""
-    raw_string = f"{id}{status}{req_amount}{currency}{oid}{settings.pally_token}"
-    md5_hash = hashlib.md5(raw_string.encode("utf-8")).hexdigest()
-    expected_signature = hashlib.sha1(md5_hash.encode("utf-8")).hexdigest()
+    oid = custom or ""
+    raw_string = f"{OutSum}:{InvId}:{settings.pally_token}"
+    expected_signature = hashlib.md5(raw_string.encode("utf-8")).hexdigest().upper()
 
-    if signature != expected_signature:
-        logger.critical("Invalid signature for bill %s", bill_id)
+    if SignatureValue != expected_signature:
+        logger.critical("Invalid signature for TrsId %s", TrsId)
         raise HTTPException(403, detail="Invalid signature.")
 
-    if status != BillStatus.SUCCESS or not req_amount.isdigit():
-        logger.info("Bill %s skipped: status=%s, req_amount=%s", bill_id, status, req_amount)
+    if Status != BillStatus.SUCCESS:
+        logger.info("Bill %s skipped: status=%s", TrsId, Status)
         return "OK"
 
-    logger.info("Received successfully paid bill %s", bill_id)
+    logger.info("Received successfully paid bill %s", TrsId)
 
     if not oid.isdigit():
-        logger.critical("Invalid order_id format for bill %s", bill_id)
+        logger.critical("Invalid custom field format for TrsId %s", TrsId)
         return "OK"
 
     bill = await deps.bills_repository.get_bill_by_id(session, int(oid))
 
     if not bill:
-        logger.critical("Bill %s is not found in db", bill_id)
+        logger.critical("Bill %s is not found in db", TrsId)
         return "OK"
 
     if bill.status != DepositStatus.PENDING:
@@ -63,7 +63,7 @@ async def pally_callback(
         return "OK"
 
     try:
-        amount = int(req_amount)
+        amount = int(float(OutSum))
 
         if bill.amount != amount:
             logger.warning("requested amount for bill=%s is not equal to db entry", bill.id)
@@ -94,8 +94,8 @@ async def pally_callback(
 
     except Exception:
         logger.exception(
-            "Exception caught while processing balances for bill %s (Creator: %s)",
-            bill_id,
+            "Exception caught while processing balances for TrsId %s (Creator: %s)",
+            TrsId,
             bill.creator_id,
         )
 
diff --git a/tests/send_pally_webhook.py b/tests/send_pally_webhook.py
index b452f40..0c19582 100644
--- a/tests/send_pally_webhook.py
+++ b/tests/send_pally_webhook.py
@@ -22,16 +22,12 @@ load_dotenv()
 ENDPOINT = "/pally/result"
 
 def calculate_signature(
-    payment_id: str,
-    status: str,
-    req_amount: str,
-    currency: str,
-    order_id: str,
+    out_sum: str,
+    inv_id: str,
     pally_token: str,
 ) -> str:
-    raw = f"{payment_id}{status}{req_amount}{currency}{order_id}{pally_token}"
-    md5 = hashlib.md5(raw.encode()).hexdigest()
-    return hashlib.sha1(md5.encode()).hexdigest()
+    raw = f"{out_sum}:{inv_id}:{pally_token}"
+    return hashlib.md5(raw.encode()).hexdigest().upper()
 
 
 def main():