callback

<?php
/*
 * Credits Callback - called in the following general order by the Credits backend:
 * 1. method=payments_get_items - return information about given order_info
 * 2. method=payments_status_update, status=placed - update the status to settled
 * 3. method=payments_status_update, status=settled - perform the desired action (ie. give the item to the user)
 */

// determine if we are in Gamestamper
$isGamestamper = isset($_REQUEST['gsapps']);

// assign appropriate app secret

    $appSecret = '[7d6fa5183c71ed9a9da9fc840bbbc6d8]'; // Facebook App Secret

// parse signed data
$request = parse_signed_request($_REQUEST['signed_request'], $appSecret);

if ($request == null) {
    // handle an unauthenticated request here
    exit;
}

$payload = $request['credits'];

// prepare the return data array
$data = array(
    'content' => array(),
    'method' => $_REQUEST['method']
);

// switch based on method
switch ($data['method']) {
    case 'payments_get_items':
        // return info about the item to be purchased
        // TODO: replace with real lookup of product info
        $item = array();
        switch (json_decode($payload['order_info'])) {
          /*  case 'currency.001':
                $item['title'] = 'In-game Currency';
                $item['price'] = 10;
                $item['description'] = 'In-game currency';
                $item['image_url'] = 'http://www.gstestapps.com/php/fbcreditstutorial/coins.png';
                $item['product_url'] = 'http://www.gstestapps.com/php/fbcreditstutorial/coins.png';
                break;*/
            case 'item.001':
                $item['title'] = '1Monat';
                $item['price'] = 1;
                $item['description'] = '1-Monat Packet des Maya Kalendar\'s!';
                $item['image_url'] = 'http://www.gstestapps.com/php/fbcreditstutorial/tractor.jpg';
                $item['product_url'] = 'http://www.gstestapps.com/php/fbcreditstutorial/tractor.jpg';
                break;
            case 'item.002':
                $item['title'] = '3Monate';
                $item['price'] = 1;
                $item['description'] = '3-Monate Packet des Maya Kalendar\'s!';
                $item['image_url'] = 'http://www.gstestapps.com/php/fbcreditstutorial/tractor.jpg';
                $item['product_url'] = 'http://www.gstestapps.com/php/fbcreditstutorial/tractor.jpg';
                break;
            case 'item.003':
                $item['title'] = '6Monate';
                $item['price'] = 1;
                $item['description'] = '6-Monate Packet des Maya Kalendar\'s!';
                $item['image_url'] = 'http://www.gstestapps.com/php/fbcreditstutorial/tractor.jpg';
                $item['product_url'] = 'http://www.gstestapps.com/php/fbcreditstutorial/tractor.jpg';
                break;
            case 'item.004':
                $item['title'] = '12Monate';
                $item['price'] = 1;
                $item['description'] = '12-Monate Packet des Maya Kalendar\'s!';
                $item['image_url'] = 'http://www.gstestapps.com/php/fbcreditstutorial/tractor.jpg';
                $item['product_url'] = 'http://www.gstestapps.com/php/fbcreditstutorial/tractor.jpg';
                break;
        }

        // Put the item details in an array, and return in the 'content' portion of the callback payload.
        $data['content'] = array($item);
        break;

    case 'payments_status_update':
        // write your logic here determine which state you want to move to
        switch ($payload['status']) {
            case 'placed':
                $data['content'] = array('status' => 'settled');
                break;
        }

        // compose returning data
        $data['content']['order_id'] = $payload['order_id'];
        break;
}

// send data back
echo json_encode($data);

// for more details: http://developers.facebook.com/docs/authentication/canvas
function parse_signed_request($signed_request, $secret) {
    list($encoded_sig, $payload) = explode('.', $signed_request, 2);

    // decode the data
    $sig = base64_url_decode($encoded_sig);
    $data = json_decode(base64_url_decode($payload), true);

    if (strtoupper($data['algorithm']) !== 'HMAC-SHA256') {
        error_log('Unknown algorithm. Expected HMAC-SHA256');
        return null;
    }

    // check signature
    $expected_sig = hash_hmac('sha256', $payload, $secret, $raw = true);
    if ($sig !== $expected_sig) {
        error_log('Bad Signed JSON signature!');
        return null;
    }

    return $data;
}

function base64_url_decode($input) {
    return base64_decode(strtr($input, '-_', '+/'));
}