Vendo's OneClick Tool

<?php
/*
CONFIGURATION:
Edit line 28: replace XXX with your shared secret. If you don't know what your shared secret is then
please get in touch with Vendo's Client Services team: clientservices[AT]vendoservices.com

USAGE:
//php code:
include dirname(__FILE__) . '/VendoOneclick.php';//VendoOneclick.php is this file.
$oneclickSignedUrl = VendoOneclick::getUrl(61580186, 16850, 'http://example-site.com/members', 'http://example-site.com/oneclick_failed.php', 'ABC1234_customdata');

//PARAMETERS DETAILS:
// 61580186 is the existing Vendo's subscription ID
// 16850 is the OneClick offer ID
// http://example-site.com/members is the success URL. We'll link to this URL in our confirmation page. It's optional. You can pass NULL.
// http://example-site.com/oneclick_failed.php is the decline URL. We'll redirect the user to this URL if the payment fails. It's optional. You can pass NULL.
// ABC1234_customdata is your custom data, for example you can pass an internal reference to the member or membership. We'll post it  back to your affiliate system. If you don't use NATS then this is optional.
//If you use NATS then you *MUST* pass the offer's refcode.

//you can use the the URL everywhere in your template now:
<a href="<?php echo $oneClickSignedUrl ?>">Click here to get access to example-site.com</a>


*/

class VendoOneclick
{


    protected $_sharedSecret = 'XXX';


    public static function getUrl($subscriptionId, $offerId, $successUrl = null, $declineUrl=null, $customData = null)
    {

        $uri  = 'https://secure.vend-o.com/v/oneclick?' .
                'subscription=' . $subscriptionId .
                '&offer=' . $offerId;

        if ($customData) {
            $uri .= '&ref=' . $customData;
        }

        if ($successUrl) {
            $uri .= '&success_url=' . urlencode($successUrl);
        }

        if ($declineUrl) {
            $uri .= '&decline_url=' . urlencode($declineUrl);
        }

        $instance = new VendoOneclick();
        return $instance->sign($uri);
    }


    /**
     * Signs Vendo's oneclick URL
     *
     * @param string $uri
     * @return string
     */
    public function sign($uri)
    {
        $u = null;
        // If this is a full URL, take it apart
        if (preg_match('/^https?:/', $uri)) {
            $u = parse_url($uri);
            $uri = $u['path'] . '?' . $u['query'];
        }

        $signature = $this->_hmacSha1($uri, $this->_sharedSecret);
        $uri = $uri . '&signature=' . $signature;

        if ($u) {
            $uri = $u['scheme'] . '://' .
                (isset($u['user']) ? $u['user'] . (isset($u['pass']) ? ':' . $u['pass'] : '') .
                    '@' : '') . $u['host'] . (isset($u['port']) ? ':' . $u['port'] :
                    '') . $uri;
        }

        return $uri;
    }

    /**
     * Creates a HMAC-SHA1 signature of the request URI, signed with the shared
     * secret and returns it as a base-64 encoded string with '=' characters
     * removed.
     *
     * @param string $data
     * @param string $key
     * @return string
     */
    protected function _hmacSha1($data, $key) {
        if (strlen($key) > 64) {
            $key = sha1($key, true);
        } else {
            $key = str_pad($key, 64, chr(0));
        }
        $ipad = (substr($key, 0, 64) ^ str_repeat(chr(0x36), 64));
        $opad = (substr($key, 0, 64) ^ str_repeat(chr(0x5C), 64));
        $hash = sha1($opad . sha1($ipad . $data, true), true);
        $hash = $this->_base64UrlEncode($hash);
        return $hash;
    }

    /**
     * Encodes the given data in a URL-compatible Base64 string.  Compared to
     * normal Base64, the URL version removes any = characters and replaces +
     * with - and / with _.
     *
     * Based on description given in http://en.wikipedia.org/wiki/Base64
     *
     * @param string $data  the data to encode
     * @return string
     */
    private function _base64UrlEncode($data) {
        $data = base64_encode($data);

        $data = str_replace('=', '', $data);
        $data = str_replace('+', '-', $data);
        $data = str_replace('/', '_', $data);

        return $data;
    }
}