API-ul Qivo

curl https://app.qivo.ro/api/v1/me \
  -H "Authorization: Bearer $QIVO_API_KEY"

curl -X POST https://app.qivo.ro/api/v1/customers \
  -H "Authorization: Bearer $QIVO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: client-ro12345678" \
  -d '{
    "kind": "COMPANY",
    "name": "Client Exemplu SRL",
    "cui": "RO12345678",
    "vatPayer": true,
    "country": "RO",
    "addressLine1": "Str. Exemplu 1",
    "city": "Cluj-Napoca",
    "county": "Cluj",
    "email": "contabilitate@client.ro"
  }'

curl -X POST https://app.qivo.ro/api/v1/invoices \
  -H "Authorization: Bearer $QIVO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: comanda-1042-ciorna" \
  -d '{
    "customerId": "<id client>",
    "dueDate": "2026-12-15",
    "lines": [
      {
        "name": "Abonament lunar",
        "unit": "lună",
        "quantity": "1",
        "unitPrice": "100.00",
        "vatCategoryCode": "S",
        "vatRate": "21"
      }
    ]
  }'

curl -X POST https://app.qivo.ro/api/v1/invoices/<id>/issue \
  -H "Authorization: Bearer $QIVO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: comanda-1042-emitere" \
  -d '{"sendToEfactura": true}'

{
  "error": {
    "code": "validation",
    "message": "Date invalide.",
    "fieldErrors": { "lines.0.unitPrice": "Sumă invalidă" }
  }
}

{
  "id": "…",
  "type": "invoice.issued",
  "createdAt": "2026-11-13T10:15:00.000Z",
  "organizationId": "…",
  "data": {
    "invoiceId": "…",
    "documentType": "INVOICE",
    "fullNumber": "QV-0042",
    "issueDate": "2026-11-13",
    "currency": "RON",
    "total": "121.00",
    "customerId": "…"
  }
}

import crypto from "node:crypto";

/** header = valoarea Qivo-Signature, rawBody = corpul exact, ca text */
export function verifyQivoSignature(header: string, rawBody: string, secret: string) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!parts.v1 || !Number.isFinite(t) || Math.abs(Date.now() / 1000 - t) > 300) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

<?php
function qivo_verify_signature(string $header, string $raw_body, string $secret): bool {
  if (!preg_match('/t=(\d+),v1=([a-f0-9]+)/', $header, $m)) return false;
  if (abs(time() - (int) $m[1]) > 300) return false;
  $expected = hash_hmac('sha256', $m[1] . '.' . $raw_body, $secret);
  return hash_equals($expected, $m[2]);
}

$raw = file_get_contents('php://input');
$ok = qivo_verify_signature($_SERVER['HTTP_QIVO_SIGNATURE'] ?? '', $raw, QIVO_WEBHOOK_SECRET);
http_response_code($ok ? 200 : 401);

// lib/qivo.ts — doar pe server (cheia nu ajunge niciodată în browser)
import "server-only";

const BASE = process.env.QIVO_API_URL ?? "https://app.qivo.ro/api/v1";

export async function qivo<T>(
  method: "GET" | "POST",
  path: string,
  body?: unknown,
  idempotencyKey?: string,
): Promise<T> {
  const res = await fetch(`${BASE}${path}`, {
    method,
    headers: {
      Authorization: `Bearer ${process.env.QIVO_API_KEY}`,
      "Content-Type": "application/json",
      ...(idempotencyKey ? { "Idempotency-Key": idempotencyKey } : {}),
    },
    body: body === undefined ? undefined : JSON.stringify(body),
    cache: "no-store",
  });
  const data = await res.json();
  if (!res.ok) throw new Error(data?.error?.message ?? `Qivo HTTP ${res.status}`);
  return data as T;
}

type Line = {
  name: string;
  quantity: string; // sume și cantități ca text, niciodată number
  unitPrice: string; // fără TVA
  unit?: string; // buc, oră, lună, serviciu…
  vatCategoryCode: "S";
  vatRate: string; // cota care se aplică produsului tău
};

type Buyer = {
  name: string;
  cui?: string; // prezent doar pentru firme
  addressLine1: string;
  city: string;
  county: string;
  email?: string;
};

/** Emite factura unei comenzi; o trimite în SPV dacă cumpărătorul e firmă (B2B). */
export async function invoiceOrder(orderId: string, buyer: Buyer, lines: Line[]) {
  const isCompany = Boolean(buyer.cui);
  let customerId: string | undefined;
  if (isCompany) {
    const found = await qivo<{ data: { id: string }[] }>(
      "GET",
      `/customers?kind=COMPANY&q=${encodeURIComponent(buyer.cui!)}`,
    );
    customerId = found.data[0]?.id;
  }
  if (!customerId) {
    const created = await qivo<{ id: string }>(
      "POST",
      "/customers",
      { kind: isCompany ? "COMPANY" : "INDIVIDUAL", country: "RO", ...buyer },
      `order-${orderId}-customer`,
    );
    customerId = created.id;
  }
  const draft = await qivo<{ id: string }>(
    "POST",
    "/invoices",
    { customerId, lines },
    `order-${orderId}-draft`,
  );
  return qivo<{ id: string; number: string; efactura?: { state: string } }>(
    "POST",
    `/invoices/${draft.id}/issue`,
    { sendToEfactura: isCompany },
    `order-${orderId}-issue`,
  );
}

<?php
/**
 * Plugin Name: Qivo — facturi pentru comenzi WooCommerce (exemplu)
 * În wp-config.php: define('QIVO_API_KEY', 'qv_…');
 */

const QIVO_API = 'https://app.qivo.ro/api/v1';

function qivo_request(string $method, string $path, ?array $body = null, ?string $idem = null) {
  $headers = ['Authorization' => 'Bearer ' . QIVO_API_KEY, 'Content-Type' => 'application/json'];
  if ($idem) $headers['Idempotency-Key'] = $idem;
  $res = wp_remote_request(QIVO_API . $path, [
    'method'  => $method,
    'headers' => $headers,
    'body'    => $body === null ? null : wp_json_encode($body),
    'timeout' => 20,
  ]);
  if (is_wp_error($res)) throw new Exception($res->get_error_message());
  $data = json_decode(wp_remote_retrieve_body($res), true);
  $code = wp_remote_retrieve_response_code($res);
  if ($code >= 400) throw new Exception($data['error']['message'] ?? "Qivo HTTP $code");
  return $data;
}

add_action('woocommerce_order_status_completed', function ($order_id) {
  $order = wc_get_order($order_id);
  if (!$order || $order->get_meta('_qivo_invoice_id')) return; // deja facturată

  try {
    // CUI-ul vine dintr-un câmp de checkout adăugat de tine (ex. „CUI firmă”).
    $cui = trim((string) $order->get_meta('_billing_cui'));
    $is_company = $cui !== '';

    $customer_id = null;
    if ($is_company) {
      $found = qivo_request('GET', '/customers?kind=COMPANY&q=' . rawurlencode($cui));
      $customer_id = $found['data'][0]['id'] ?? null;
    }
    if (!$customer_id) {
      $customer = qivo_request('POST', '/customers', [
        'kind'         => $is_company ? 'COMPANY' : 'INDIVIDUAL',
        'name'         => $is_company ? $order->get_billing_company()
                                      : $order->get_formatted_billing_full_name(),
        'cui'          => $is_company ? $cui : null,
        'country'      => $order->get_billing_country() ?: 'RO',
        'addressLine1' => $order->get_billing_address_1(),
        'city'         => $order->get_billing_city(),
        'county'       => $order->get_billing_state(),
        'email'        => $order->get_billing_email(),
      ], "wc-$order_id-customer");
      $customer_id = $customer['id'];
    }

    $lines = [];
    foreach ($order->get_items() as $item) {
      $lines[] = [
        'name'            => $item->get_name(),
        'unit'            => 'buc',
        'quantity'        => (string) $item->get_quantity(),
        'unitPrice'       => wc_format_decimal($order->get_item_total($item, false, false), 4),
        'vatCategoryCode' => 'S',
        'vatRate'         => '21', // cota care se aplică produselor tale
      ];
    }

    $draft = qivo_request('POST', '/invoices',
      ['customerId' => $customer_id, 'lines' => $lines], "wc-$order_id-draft");
    $issued = qivo_request('POST', '/invoices/' . $draft['id'] . '/issue',
      ['sendToEfactura' => $is_company], "wc-$order_id-issue");

    $order->update_meta_data('_qivo_invoice_id', $issued['id']);
    $order->save();
    $order->add_order_note('Factura Qivo ' . $issued['number'] . ' a fost emisă.');
  } catch (Exception $e) {
    $order->add_order_note('Qivo: factura nu a fost emisă — ' . $e->getMessage());
  }
});

// app/api/shopify/orders-paid/route.ts (Next.js) — webhook Shopify „orders/paid”
import crypto from "node:crypto";
import Decimal from "decimal.js";
import { invoiceOrder } from "@/lib/qivo";

export async function POST(req: Request) {
  const raw = await req.text();
  const digest = crypto
    .createHmac("sha256", process.env.SHOPIFY_WEBHOOK_SECRET!)
    .update(raw, "utf8")
    .digest("base64");
  const received = req.headers.get("x-shopify-hmac-sha256") ?? "";
  if (
    received.length !== digest.length ||
    !crypto.timingSafeEqual(Buffer.from(received), Buffer.from(digest))
  ) {
    return new Response("invalid signature", { status: 401 });
  }

  const order = JSON.parse(raw);
  // CUI-ul: de exemplu un atribut de comandă „CUI” completat la checkout.
  const cui = order.note_attributes?.find((a: { name: string }) => a.name === "CUI")?.value;
  const vat = "21"; // cota care se aplică produselor tale
  const lines = order.line_items.map((li: { title: string; quantity: number; price: string }) => ({
    name: li.title,
    unit: "buc",
    quantity: String(li.quantity),
    // Prețurile Shopify includ de obicei TVA: Qivo primește prețul fără TVA.
    unitPrice: order.taxes_included
      ? new Decimal(li.price).div(new Decimal(vat).div(100).plus(1)).toDecimalPlaces(4).toString()
      : li.price,
    vatCategoryCode: "S" as const,
    vatRate: vat,
  }));
  const b = order.billing_address ?? {};
  await invoiceOrder(
    String(order.id),
    {
      name: cui ? b.company : b.name,
      cui,
      addressLine1: b.address1,
      city: b.city,
      county: b.province,
      email: order.email,
    },
    lines,
  );
  return new Response(null, { status: 200 });
}