const KEY = process.env.MAKOR_API_KEY;        // mk_live_… or mk_test_…
const BUSINESS = process.env.MAKOR_BUSINESS_ID;

// The key prefix and the base URL must always agree.
const BASE_URL = KEY.startsWith("mk_test_")
  ? "https://sandbox.makor.all-good.co.il/api/v1"
  : "https://makor.all-good.co.il/api/v1";

const res = await fetch(
  `${BASE_URL}/businesses/${BUSINESS}/documents?issue=true`,
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${KEY}`,
      "Content-Type": "application/json",
      "Idempotency-Key": crypto.randomUUID(),
    },
    body: JSON.stringify({
      doc_type: 320,
      issue_date: new Date().toISOString().slice(0, 10),
      customer_name: "לקוח לדוגמה",
      lines: [{ description: "מנוי חודשי", quantity: 1, unit_price_agorot: 19900 }],
      payments: [{ method: "card", amount_agorot: 23482, card_brand: "Visa" }],
    }),
  }
);

if (res.status === 202) {
  const held = await res.json();
  console.log(held.rejection_code, held.decisions);
} else if (!res.ok) {
  const problem = await res.json();
  throw new Error(`${problem.code}: ${problem.detail}`);
}

import os, uuid, httpx

KEY = os.environ["MAKOR_API_KEY"]
BUSINESS = os.environ["MAKOR_BUSINESS_ID"]

# The key prefix and the base URL must always agree.
BASE_URL = (
    "https://sandbox.makor.all-good.co.il/api/v1" if KEY.startswith("mk_test_") else "https://makor.all-good.co.il/api/v1"
)

with httpx.Client(
    base_url=BASE_URL,
    headers={"Authorization": f"Bearer {KEY}"},
    timeout=30,
) as client:
    r = client.post(
        f"/businesses/{BUSINESS}/documents",
        params={"issue": True},
        headers={"Idempotency-Key": str(uuid.uuid4())},
        json={
            "doc_type": 305,
            "issue_date": "2026-08-07",
            "customer_tax_id": "123456782",
            "customer_name": "לקוח לדוגמה",
            "lines": [
                {"description": "ייעוץ", "quantity": 1, "unit_price_agorot": 600000}
            ],
        },
    )

    if r.status_code == 202:
        held = r.json()
        client.post(
            f"/businesses/{BUSINESS}/documents/{held['id']}/allocation-decision",
            json={"choice": "continue"},
        )
    else:
        r.raise_for_status()

import crypto from "node:crypto";

export function verify(rawBody, header, secret, toleranceSec = 300) {
  const parts = Object.fromEntries(
    header.split(",").map((kv) => kv.split("=").map((s) => s.trim()))
  );
  const timestamp = Number(parts.t);
  if (!Number.isFinite(timestamp)) return false;
  if (Math.abs(Date.now() / 1000 - timestamp) > toleranceSec) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${parts.t}.${rawBody}`)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(parts.v1, "hex")
  );
}

import hmac, hashlib, time

def verify(raw_body: bytes, header: str, secret: str, tolerance: int = 300) -> bool:
    parts = dict(kv.split("=", 1) for kv in header.split(","))
    ts = int(parts["t"])
    if abs(time.time() - ts) > tolerance:
        return False
    expected = hmac.new(
        secret.encode(),
        f"{ts}.".encode() + raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(expected, parts["v1"])