B2B API Integration Guide

<?php
// Inbound callback route (listen at your registered callback URL)
header('Content-Type: application/json');

$input = file_get_contents('php://input');
$data = json_decode($input, true);

// 1. Basic validation
if (!$data || !isset($data['serial_number']) || !isset($data['member_account'])) {
    echo json_encode(['success' => false, 'message' => 'Malformed payload']);
    exit;
}

$apiKey = $data['api_key'];
$memberAccount = $data['member_account'];
$betAmount = (float)$data['bet_amount'];
$winAmount = (float)$data['win_amount'];
$serialNumber = $data['serial_number'];

// 2. Validate API Key
$myApiKey = "YOUR_API_KEY"; // Set your API key here
if ($apiKey !== $myApiKey) {
    echo json_encode(['success' => false, 'message' => 'Unauthorized']);
    exit;
}

// Connect to Database
$db = new PDO('mysql:host=localhost;dbname=casino', 'db_user', 'db_pass');

try {
    $db->beginTransaction();

    // 3. Idempotency Check
    $stmt = $db->prepare("SELECT 1 FROM processed_txs WHERE serial_number = ? FOR UPDATE");
    $stmt->execute([$serialNumber]);
    if ($stmt->fetch()) {
        $db->rollBack();
        echo json_encode(['success' => true, 'message' => 'Duplicate transaction']);
        exit;
    }

    // Extract player ID from secure token (p_{clientId}_{username})
    $parts = explode('_', $memberAccount);
    $playerUsername = end($parts);

    // Lock player balance row
    $userStmt = $db->prepare("SELECT balance FROM users WHERE username = ? FOR UPDATE");
    $userStmt->execute([$playerUsername]);
    $user = $userStmt->fetch(PDO::FETCH_ASSOC);

    if (!$user) {
        $db->rollBack();
        echo json_encode(['success' => false, 'message' => 'Player not found']);
        exit;
    }

    $currentBalance = (float)$user['balance'];
    $newBalance = $currentBalance - $betAmount + $winAmount;

    if ($newBalance < 0) {
        $db->rollBack();
        echo json_encode(['success' => false, 'message' => 'Insufficient funds']);
        exit;
    }

    // Update player balance
    $updateStmt = $db->prepare("UPDATE users SET balance = ? WHERE username = ?");
    $updateStmt->execute([$newBalance, $playerUsername]);

    // Record serial number to prevent replay attacks
    $logStmt = $db->prepare("INSERT INTO processed_txs (serial_number, amount) VALUES (?, ?)");
    $logStmt->execute([$serialNumber, $winAmount - $betAmount]);

    $db->commit();
    echo json_encode(['success' => true, 'message' => 'Callback processed successfully']);

} catch (Exception $e) {
    $db->rollBack();
    echo json_encode(['success' => false, 'message' => 'Database transaction failed: ' . $e->getMessage()]);
}

const express = require('express');
const router = express.Router();
const { Pool } = require('pg');

const pool = new Pool({
  connectionString: 'postgresql://db_user:db_pass@localhost:5432/casino'
});

router.post('/callback', async (req, res) => {
  const { bet_amount, win_amount, member_account, api_key, serial_number } = req.body;

  // 1. Verify API credentials
  if (api_key !== 'YOUR_API_KEY') {
    return res.status(200).json({ success: false, message: 'Unauthorized API Key' });
  }

  const dbClient = await pool.connect();
  try {
    await dbClient.query('BEGIN');

    // 2. Idempotency Check
    const duplicateRes = await dbClient.query(
      'SELECT 1 FROM processed_txs WHERE serial_number = $1 FOR UPDATE',
      [serial_number]
    );

    if (duplicateRes.rows.length > 0) {
      await dbClient.query('ROLLBACK');
      return res.status(200).json({ success: true, message: 'Duplicate transaction skipped' });
    }

    // Extract player ID from secure token
    const playerParts = member_account.split('_');
    const playerUsername = playerParts[playerParts.length - 1];

    // Lock user row
    const userRes = await dbClient.query(
      'SELECT balance FROM users WHERE username = $1 FOR UPDATE',
      [playerUsername]
    );

    if (userRes.rows.length === 0) {
      await dbClient.query('ROLLBACK');
      return res.status(200).json({ success: false, message: 'Player not found' });
    }

    const currentBalance = parseFloat(userRes.rows[0].balance);
    const newBalance = currentBalance - parseFloat(bet_amount) + parseFloat(win_amount);

    if (newBalance < 0) {
      await dbClient.query('ROLLBACK');
      return res.status(200).json({ success: false, message: 'Insufficient balance' });
    }

    // Update user balance
    await dbClient.query(
      'UPDATE users SET balance = $1 WHERE username = $2',
      [newBalance, playerUsername]
    );

    // Record serial number
    await dbClient.query(
      'INSERT INTO processed_txs (serial_number, processed_at) VALUES ($1, NOW())',
      [serial_number]
    );

    await dbClient.query('COMMIT');
    return res.status(200).json({ success: true, message: 'Callback processed successfully' });

  } catch (err) {
    await dbClient.query('ROLLBACK');
    return res.status(200).json({ success: false, message: 'Internal transaction error: ' + err.message });
  } finally {
    dbClient.release();
  }
});