Bisakah aplikasi order Dapur Maria memakai WhatsApp API?

{
  "messaging_product": "whatsapp",
  "to": "6281200001234",
  "type": "interactive",
  "interactive": {
    "type": "list",
    "body": { "text": "Jarak ke lokasi Kakak ±6,0 km. Silakan pilih kurir:" },
    "action": {
      "button": "Pilih kurir",
      "sections": [{
        "title": "Pengiriman instan",
        "rows": [
          { "id": "gosend_instant", "title": "GoSend Instant",      "description": "Rp15.000 · tiba ±38 mnt" },
          { "id": "grab_instant",   "title": "GrabExpress Instant", "description": "Rp16.000 · tiba ±40 mnt" }
        ]
      }]
    }
  }
}

{
  "object": "whatsapp_business_account",
  "entry": [{ "changes": [{ "field": "messages", "value": {
    "messages": [{
      "from": "6281200001234",
      "id": "wamid.HBgM...",
      "type": "order",
      "order": {
        "catalog_id": "1234567890",
        "text": "makaroni level sedang",
        "product_items": [
          { "product_retailer_id": "SN03", "quantity": 2, "item_price": 4000,  "currency": "IDR" },
          { "product_retailer_id": "MN04", "quantity": 1, "item_price": 10000, "currency": "IDR" }
        ]
      }
    }]
  }}]}]
}

{
  "messaging_product": "whatsapp",
  "to": "6281200001234",
  "type": "interactive",
  "interactive": {
    "type": "location_request_message",
    "body": { "text": "Pesanan mau diantar ke mana Kak? Bagikan lokasi ya, ongkir dihitung otomatis." },
    "action": { "name": "send_location" }
  }
}

{
  "messaging_product": "whatsapp",
  "to": "6281200001234",
  "type": "interactive",
  "interactive": {
    "type": "cta_url",
    "body": { "text": "Total bayar Rp43.000 untuk pesanan #DM-1028. Berlaku 15 menit." },
    "action": {
      "name": "cta_url",
      "parameters": { "display_text": "Bayar dengan QRIS", "url": "https://pay.contoh-pg.id/qris/7f3a9c..." }
    }
  }
}

{
  "messaging_product": "whatsapp",
  "to": "6281200001234",
  "type": "template",
  "template": {
    "name": "driver_assigned",
    "language": { "code": "id" },
    "components": [{
      "type": "body",
      "parameters": [
        { "type": "text", "text": "DM-1028" },
        { "type": "text", "text": "Hendra W. (B 4418 TJK)" },
        { "type": "text", "text": "https://track.contoh-kurir.id/t/GS-8F2K" }
      ]
    }]
  }
}

<?php
// webhook.php – rahasia dibaca dari environment / secret manager, BUKAN ditulis di kode
$verifyToken = getenv('WA_VERIFY_TOKEN');
$appSecret   = getenv('WA_APP_SECRET');

// 1) Verifikasi saat mendaftarkan URL webhook (hub.mode → hub_mode di PHP)
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
    if (($_GET['hub_mode'] ?? '') === 'subscribe'
        && hash_equals($verifyToken, $_GET['hub_verify_token'] ?? '')) {
        echo $_GET['hub_challenge'];
        exit;
    }
    http_response_code(403); exit;
}

// 2) Validasi tanda tangan setiap event
$raw = file_get_contents('php://input');
$sig = $_SERVER['HTTP_X_HUB_SIGNATURE_256'] ?? '';
if (!hash_equals('sha256=' . hash_hmac('sha256', $raw, $appSecret), $sig)) {
    http_response_code(401); exit;
}

// 3) Balas cepat, proses async (idempoten berdasarkan message id)
http_response_code(200);
$event = json_decode($raw, true);
foreach ($event['entry'] ?? [] as $entry) {
    foreach ($entry['changes'] ?? [] as $change) {
        foreach ($change['value']['messages'] ?? [] as $msg) {
            enqueue_once($msg['id'], $msg);   // order / location / interactive / text
        }
    }
}

POST https://api.xendit.co/qr_codes
Authorization: Basic base64(SECRET_KEY + ":")
api-version: 2022-07-31
Content-Type: application/json

{
  "reference_id": "DM-1028",
  "type": "DYNAMIC",
  "currency": "IDR",
  "amount": 43000,
  "expires_at": "2026-10-17T13:15:00+07:00"
}
→ { "id": "qr_...", "reference_id": "DM-1028", "qr_string": "00020101...", "status": "ACTIVE" }

<?php // callback pembayaran QR
if (!hash_equals(getenv('XENDIT_CALLBACK_TOKEN'), $_SERVER['HTTP_X_CALLBACK_TOKEN'] ?? '')) {
    http_response_code(401); exit;
}
$cb = json_decode(file_get_contents('php://input'), true);
// cocokkan reference_id & amount dengan DB, lalu markPaid() secara idempoten

<?php
$va     = getenv('IPAYMU_VA');
$apiKey = getenv('IPAYMU_API_KEY');
$body = json_encode([
    'name'           => 'Pelanggan WhatsApp',
    'amount'         => 43000,
    'referenceId'    => 'DM-1028',
    'paymentMethod'  => 'qris',
    'paymentChannel' => 'qris',
    'notifyUrl'      => 'https://api.contoh-toko.id/webhook/ipaymu',
    // + field kontak lain bila diwajibkan (cek dokumentasi)
]);
$stringToSign = 'POST:' . $va . ':' . strtolower(hash('sha256', $body)) . ':' . $apiKey;
$headers = [
    'Content-Type: application/json',
    'va: ' . $va,
    'signature: ' . hash_hmac('sha256', $stringToSign, $apiKey),
    'timestamp: ' . date('YmdHis'),
];
// POST https://sandbox.ipaymu.com/api/v2/payment/direct
// Saat notifyUrl dipanggil: jangan percaya isi callback mentah,
// konfirmasi status ke API cek transaksi iPaymu sebelum markPaid().

<?php
interface PaymentGateway {
    /** @return array{qr_string:string, pay_url:?string, expires_at:string, provider_ref:string} */
    public function createQris(string $orderId, int $amount, int $ttlMinutes): array;
    public function verifyNotification(array $headers, string $rawBody): bool;
    /** @return 'PAID'|'PENDING'|'EXPIRED'|'FAILED' */
    public function fetchStatus(string $orderId): string;
}

final class MidtransGateway implements PaymentGateway { /* ... */ }
final class XenditGateway   implements PaymentGateway { /* ... */ }
final class IpaymuGateway   implements PaymentGateway { /* ... */ }

// Pilih lewat konfigurasi, bukan kode: PAYMENT_PROVIDER=midtrans|xendit|ipaymu
$pg = match (getenv('PAYMENT_PROVIDER')) {
    'xendit' => new XenditGateway(),
    'ipaymu' => new IpaymuGateway(),
    default  => new MidtransGateway(),
};

POST https://api.loyverse.com/v1.0/receipts
Authorization: Bearer {LOYVERSE_ACCESS_TOKEN}
Content-Type: application/json

{
  "store_id": "{STORE_ID}",
  "note": "WhatsApp #DM-1028 · QRIS ref QRLMBZEA7TF4",
  "line_items": [
    { "variant_id": "{VARIANT_SN03}", "quantity": 2 },
    { "variant_id": "{VARIANT_MN04}", "quantity": 1 },
    { "variant_id": "{VARIANT_PK01}", "quantity": 1 }
  ],
  "payments": [
    { "payment_type_id": "{PAYMENT_TYPE_QRIS}", "money_amount": 43000 }
  ]
}

# Stok POS → katalog WA: daftarkan webhook perubahan stok (inventory levels)
# lalu backend memperbarui ketersediaan item di katalog WhatsApp.

<?php
// Dipanggil dari webhook QRIS yang tanda tangannya sudah valid
function onPaymentSettled(PDO $db, string $orderId, array $pay): void {
    $db->beginTransaction();
    $upd = $db->prepare("UPDATE orders SET status='PROCESSING', paid_ref=? WHERE id=? AND status='UNPAID'");
    $upd->execute([$pay['ref'], $orderId]);
    if ($upd->rowCount() === 1) {            // idempoten: webhook ganda diabaikan
        $db->prepare("INSERT INTO pos_outbox (order_id, action, attempts, next_run_at) VALUES (?, 'create_sale', 0, NOW())")
           ->execute([$orderId]);
    }
    $db->commit();
}

// worker.php – dijalankan cron tiap menit
foreach ($db->query("SELECT * FROM pos_outbox WHERE done=0 AND next_run_at <= NOW() LIMIT 20") as $job) {
    try {
        $docId = $posClient->createSale(loadOrder($db, $job['order_id']));   // Accurate / Loyverse / dll.
        $db->prepare("UPDATE orders SET pos_doc_id=? WHERE id=?")->execute([$docId, $job['order_id']]);
        $db->prepare("UPDATE pos_outbox SET done=1 WHERE id=?")->execute([$job['id']]);
    } catch (Throwable $e) {
        $n = $job['attempts'] + 1;                                     // backoff: 1, 2, 4, 8 ... menit
        $db->prepare("UPDATE pos_outbox SET attempts=?, next_run_at=NOW() + INTERVAL ? MINUTE, last_error=? WHERE id=?")
           ->execute([$n, 2 ** min($n, 6), substr($e->getMessage(), 0, 250), $job['id']]);
        if ($n >= 5) notifyOwner("Sinkron POS gagal untuk " . $job['order_id']);
    }
}