Tracking API

const crypto = require('crypto');

/**
 * Build auth headers for a Saviliate API request.
 * @param {string} secretKey - Your brand secret key
 * @param {string} jsonBody  - The exact JSON string being sent
 */
function saviliateHeaders(secretKey, jsonBody) {
    const timestamp = String(Math.floor(Date.now() / 1000));

    const signature = crypto
        .createHmac('sha256', secretKey)
        .update(timestamp + jsonBody)  // concatenate — no separator
        .digest('hex');

    return {
        'Authorization': `Bearer ${secretKey}`,
        'X-TIMESTAMP':   timestamp,
        'X-SIGNATURE':   signature,
        'Content-Type':  'application/json',
    };
}

// Usage with fetch:
const body = JSON.stringify({
    ref:              ref,
    external_user_id: String(order.userId),
    order_id:         String(order.id),
    order_amount:     order.subtotal,
});

await fetch('https://saviliate.com/api/v1/track/commission', {
    method:  'POST',
    headers: saviliateHeaders(process.env.SAVILIATE_SECRET_KEY, body),
    body,
});

import hashlib, hmac, json, time, requests, os

def saviliate_headers(secret_key: str, json_body: str) -> dict:
    """Build auth headers for a Saviliate API request."""
    timestamp = str(int(time.time()))

    sig = hmac.new(
        secret_key.encode(),
        (timestamp + json_body).encode(),  # concatenate — no separator
        hashlib.sha256
    ).hexdigest()

    return {
        'Authorization': f'Bearer {secret_key}',
        'X-TIMESTAMP':   timestamp,
        'X-SIGNATURE':   sig,
        'Content-Type':  'application/json',
    }

# Usage:
body = json.dumps({
    'ref':              ref,
    'external_user_id': str(order.user_id),
    'order_id':         str(order.id),
    'order_amount':     order.subtotal,
}, separators=(',', ':'))  # compact JSON — no extra whitespace

requests.post(
    'https://saviliate.com/api/v1/track/commission',
    data=body,
    headers=saviliate_headers(os.environ['SAVILIATE_SECRET_KEY'], body),
)

require 'openssl'
require 'json'
require 'net/http'

def saviliate_headers(secret_key, json_body)
    timestamp = Time.now.to_i.to_s

    sig = OpenSSL::HMAC.hexdigest(
        'SHA256',
        secret_key,
        timestamp + json_body  # concatenate — no separator
    )

    {
        'Authorization' => "Bearer #{secret_key}",
        'X-TIMESTAMP'   => timestamp,
        'X-SIGNATURE'   => sig,
        'Content-Type'  => 'application/json',
    }
end

# Usage:
body = { ref: ref, external_user_id: order.user_id.to_s,
         order_id: order.id.to_s, order_amount: order.subtotal }.to_json

uri  = URI('https://saviliate.com/api/v1/track/commission')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

req      = Net::HTTP::Post.new(uri)
saviliate_headers(ENV['SAVILIATE_SECRET_KEY'], body).each { |k,v| req[k] = v }
req.body = body

http.request(req)

# Shell helper — generate headers and fire a commission request

SECRET_KEY="your_secret_key_here"
BODY='{"ref":"9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d","external_user_id":"user_1042","order_id":"ord_8801","order_amount":49.00}'
TS=$(date +%s)
SIG=$(echo -n "${TS}${BODY}" | openssl dgst -sha256 -hmac "${SECRET_KEY}" | awk '{print $2}')

curl -X POST https://saviliate.com/api/v1/track/commission \
  -H "Authorization: Bearer ${SECRET_KEY}" \
  -H "X-TIMESTAMP: ${TS}" \
  -H "X-SIGNATURE: ${SIG}" \
  -H "Content-Type: application/json" \
  -d "${BODY}"

// middleware/captureSaviliateRef.js

const UUID_RE = /^[a-f0-9\-]{36}$/i;

function captureSaviliateRef(req, res, next) {
    const uuid = req.query.saviliate;

    if (uuid && UUID_RE.test(uuid)) {
        res.cookie('sv_ref', uuid, {
            maxAge:   30 * 24 * 60 * 60 * 1000,
            httpOnly: true,
            secure:   process.env.NODE_ENV === 'production',
            sameSite: 'lax',
        });
    }

    next();
}

module.exports = captureSaviliateRef;

// Register in app.js:  app.use(captureSaviliateRef);

# saviliate/middleware.py

import re

UUID_RE = re.compile(r'^[a-f0-9\-]{36}$', re.IGNORECASE)

class CaptureSaviliateRef:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)

        uuid = request.GET.get('saviliate')
        if uuid and UUID_RE.match(uuid):
            response.set_cookie(
                'sv_ref', uuid,
                max_age  = 30 * 24 * 60 * 60,
                httponly = True,
                secure   = True,
                samesite = 'Lax',
            )

        return response

# settings.py MIDDLEWARE list: 'saviliate.middleware.CaptureSaviliateRef'

# app/controllers/concerns/saviliate_tracking.rb

module SaviliateTracking
  extend ActiveSupport::Concern

  UUID_RE = /\A[a-f0-9\-]{36}\z/i

  included do
    before_action :capture_saviliate_ref
  end

  private

  def capture_saviliate_ref
    uuid = params[:saviliate]
    return unless uuid&.match?(UUID_RE)

    cookies[:sv_ref] = {
      value:     uuid,
      expires:   30.days,
      httponly:  true,
      secure:    Rails.env.production?,
      same_site: :lax,
    }
  end
end

# ApplicationController: include SaviliateTracking

// Call early in your request bootstrap / front controller

function saviliate_capture_ref(): void
{
    $uuid = $_GET['saviliate'] ?? null;

    if (!$uuid || !preg_match('/^[a-f0-9\-]{36}$/i', $uuid)) {
        return;
    }

    setcookie('sv_ref', $uuid, [
        'expires'  => time() + (30 * 86400),
        'path'     => '/',
        'secure'   => true,
        'httponly' => true,
        'samesite' => 'Lax',
    ]);
}

saviliate_capture_ref();

const ref = req.cookies['sv_ref'] ?? null; // requires cookie-parser

ref = request.COOKIES.get('sv_ref')  # None if not present

ref = cookies[:sv_ref]  # nil if not present

$ref = $_COOKIE['sv_ref'] ?? null;

const crypto = require('crypto');

async function reportCommission(ref, externalUserId, orderId, orderAmount) {
    const secret    = process.env.SAVILIATE_SECRET_KEY;
    const timestamp = String(Math.floor(Date.now() / 1000));
    const body      = JSON.stringify({ ref, external_user_id: externalUserId, order_id: orderId, order_amount: orderAmount });
    const sig       = crypto.createHmac('sha256', secret).update(timestamp + body).digest('hex');

    try {
        await fetch('https://saviliate.com/api/v1/track/commission', {
            method: 'POST',
            headers: {
                'Authorization': `Bearer ${secret}`,
                'X-TIMESTAMP':   timestamp,
                'X-SIGNATURE':   sig,
                'Content-Type':  'application/json',
            },
            body,
        });
    } catch (err) {
        // Log but never throw — don't block the user's purchase
        console.error('Saviliate report failed:', err.message);
    }
}

// In your order confirmation handler:
const ref = req.cookies['sv_ref'];  // or from user record in DB
if (ref) await reportCommission(ref, order.userId, order.id, order.subtotal);

import hashlib, hmac, json, time, requests, os

def report_commission(ref: str, external_user_id: str, order_id: str, order_amount: float):
    secret    = os.environ['SAVILIATE_SECRET_KEY']
    timestamp = str(int(time.time()))
    body      = json.dumps({
        'ref': ref, 'external_user_id': external_user_id,
        'order_id': order_id, 'order_amount': order_amount,
    }, separators=(',', ':'))

    sig = hmac.new(
        secret.encode(), (timestamp + body).encode(), hashlib.sha256
    ).hexdigest()

    try:
        requests.post(
            'https://saviliate.com/api/v1/track/commission',
            data=body,
            headers={
                'Authorization': f'Bearer {secret}',
                'X-TIMESTAMP':   timestamp,
                'X-SIGNATURE':   sig,
                'Content-Type':  'application/json',
            },
            timeout=10,
        )
    except Exception as e:
        print(f'Saviliate report failed: {e}')  # log and continue

# In your payment confirmed view:
ref = request.COOKIES.get('sv_ref')  # or from user record in DB
if ref:
    report_commission(ref, str(order.user_id), str(order.id), order.subtotal)

require 'openssl', 'json', 'net/http'

def report_commission(ref:, external_user_id:, order_id:, order_amount:)
    secret    = ENV['SAVILIATE_SECRET_KEY']
    timestamp = Time.now.to_i.to_s
    body      = { ref: ref, external_user_id: external_user_id,
                  order_id: order_id, order_amount: order_amount }.to_json

    sig = OpenSSL::HMAC.hexdigest('SHA256', secret, timestamp + body)

    uri  = URI('https://saviliate.com/api/v1/track/commission')
    http = Net::HTTP.new(uri.host, uri.port)
    http.use_ssl = true

    req                  = Net::HTTP::Post.new(uri)
    req['Authorization'] = "Bearer #{secret}"
    req['X-TIMESTAMP']   = timestamp
    req['X-SIGNATURE']   = sig
    req['Content-Type']  = 'application/json'
    req.body             = body

    http.request(req)
rescue => e
    Rails.logger.error("Saviliate report failed: #{e.message}")
end

# In your orders controller:
ref = cookies[:sv_ref]  # or @user.saviliate_ref from DB
report_commission(ref: ref, external_user_id: @order.user_id.to_s,
                  order_id: @order.id.to_s, order_amount: @order.subtotal) if ref

# Full working example — generates the HMAC signature inline

SECRET="your_secret_key_here"
BODY='{"ref":"9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d","external_user_id":"user_1042","order_id":"ord_8801","order_amount":49.00}'
TS=$(date +%s)
SIG=$(echo -n "${TS}${BODY}" | openssl dgst -sha256 -hmac "${SECRET}" | awk '{print $2}')

curl -X POST https://saviliate.com/api/v1/track/commission \
  -H "Authorization: Bearer ${SECRET}" \
  -H "X-TIMESTAMP: ${TS}" \
  -H "X-SIGNATURE: ${SIG}" \
  -H "Content-Type: application/json" \
  -d "${BODY}"