Authentication

import axios from "axios";
import crypto from "node:crypto";

const API_KEY    = process.env.FINHAY_API_KEY!;
const API_SECRET = process.env.FINHAY_API_SECRET!;
const BASE_URL   = process.env.FINHAY_BASE_URL ?? "https://open-api.fhsc.com.vn";

const API_KEY_ONLY: RegExp[] = [
  /^\/market\/.*$/,
  /^\/trading\/market\/.*$/,
  /^\/trading\/securities\/.*$/,
  /^\/fund-trading\/public\/.*$/,
];

const isApiKeyOnly = (method: string, path: string): boolean =>
  method === "GET" && API_KEY_ONLY.some((re) => re.test(path));

export const client = axios.create({ baseURL: BASE_URL });

client.interceptors.request.use((config) => {
  const method = (config.method ?? "get").toUpperCase();
  const url    = new URL(config.url ?? "", BASE_URL);
  const path   = url.pathname;

  // Luôn gửi API key.
  config.headers.set("X-FH-APIKEY", API_KEY);

  // Tier 1: market read — dừng ở đây.
  if (isApiKeyOnly(method, path)) return config;

  // Tier 2: HMAC sign request.
  const timestamp = Date.now().toString();
  const nonce     = crypto.randomUUID();
  const query     = url.search.slice(1); // bỏ leading '?'
  const body      = typeof config.data === "string"
    ? config.data
    : config.data != null
      ? JSON.stringify(config.data)
      : "";
  const bodyHash  = body
    ? crypto.createHash("sha256").update(body).digest("hex")
    : "";

  let payload = `${timestamp}\n${method}\n${path}`;
  if (query)    payload += `?${query}`;
  payload += "\n";
  if (bodyHash) payload += bodyHash;

  const signature = crypto
    .createHmac("sha256", API_SECRET)
    .update(payload)
    .digest("hex");

  config.headers.set("X-FH-TIMESTAMP", timestamp);
  config.headers.set("X-FH-NONCE",     nonce);
  config.headers.set("X-FH-SIGNATURE", signature);
  if (bodyHash) config.headers.set("X-FH-BODYHASH", bodyHash);

  // Preview: write ops dưới /trading/oa/** cần thêm 2FA token.
  if (/^\/trading\/oa\//.test(path)) {
    const token = process.env.FINHAY_2FA_TOKEN;
    if (!token) throw new Error("Missing FINHAY_2FA_TOKEN — run OTP flow first");
    config.headers.set("X-FH-2FA-TOKEN", token);
  }

  return config;
});

import hashlib
import hmac
import json
import os
import re
import time
import uuid
from urllib.parse import urlsplit

import requests

API_KEY    = os.environ["FINHAY_API_KEY"]
API_SECRET = os.environ["FINHAY_API_SECRET"].encode()
BASE_URL   = os.environ.get("FINHAY_BASE_URL", "https://open-api.fhsc.com.vn")

API_KEY_ONLY = [
    re.compile(r"^/market/.*$"),
    re.compile(r"^/trading/market/.*$"),
    re.compile(r"^/trading/securities/.*$"),
    re.compile(r"^/fund-trading/public/.*$"),
]

def is_api_key_only(method: str, path: str) -> bool:
    return method == "GET" and any(p.match(path) for p in API_KEY_ONLY)

def signed_request(method: str, path: str, *, params=None, data=None):
    method = method.upper()
    parts  = urlsplit(BASE_URL + path)
    headers = {"X-FH-APIKEY": API_KEY}

    if is_api_key_only(method, parts.path):
        return requests.request(method, BASE_URL + path, params=params, headers=headers)

    body = ""
    if data is not None:
        body = data if isinstance(data, str) else json.dumps(data, separators=(",", ":"))
    body_hash = hashlib.sha256(body.encode()).hexdigest() if body else ""

    # Build canonical query string from params (preserve insertion order).
    query = "&".join(f"{k}={v}" for k, v in (params or {}).items())

    timestamp = str(int(time.time() * 1000))
    nonce     = str(uuid.uuid4())

    payload = f"{timestamp}\n{method}\n{parts.path}"
    if query:     payload += f"?{query}"
    payload += "\n"
    if body_hash: payload += body_hash

    signature = hmac.new(API_SECRET, payload.encode(), hashlib.sha256).hexdigest()

    headers.update({
        "X-FH-TIMESTAMP": timestamp,
        "X-FH-NONCE":     nonce,
        "X-FH-SIGNATURE": signature,
    })
    if body_hash:
        headers["X-FH-BODYHASH"] = body_hash
        headers.setdefault("Content-Type", "application/json")

    # Preview: write ops dưới /trading/oa/** cần thêm 2FA token.
    if parts.path.startswith("/trading/oa/"):
        token = os.environ.get("FINHAY_2FA_TOKEN")
        if not token:
            raise RuntimeError("Missing FINHAY_2FA_TOKEN — run OTP flow first")
        headers["X-FH-2FA-TOKEN"] = token

    return requests.request(
        method, BASE_URL + path,
        params=params, data=body or None, headers=headers,
    )