Consulta el estado real de una transacción

const crypto = require('crypto');

async function consultarTransaccion(reference){
  const body = JSON.stringify({ reference });
  const ts = String(Date.now());
  const firma = crypto.createHmac('sha256', process.env.PAYEFY_SECRET)
    .update(`${ts}.${body}`).digest('hex');

  const res = await fetch('https://sandbox-panel.payefy.me/api/partner/v1/transactions/status', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'X-Api-Key': process.env.PAYEFY_API_KEY,
      'X-Timestamp': ts,
      'X-Signature': firma,
    },
    body,                             // enviar EXACTAMENTE la cadena firmada
    signal: AbortSignal.timeout(15000),
  });
  return res.json();                  // { found, transaction? }
}

function consultarTransaccion(string $reference): array {
  $body = json_encode(['reference' => $reference]);
  $ts   = (string) round(microtime(true) * 1000);
  $sig  = hash_hmac('sha256', $ts . '.' . $body, getenv('PAYEFY_SECRET'));

  $ch = curl_init('https://sandbox-panel.payefy.me/api/partner/v1/transactions/status');
  curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $body,      // enviar EXACTAMENTE la cadena firmada
    CURLOPT_HTTPHEADER => [
      'Content-Type: application/json',
      'X-Api-Key: ' . getenv('PAYEFY_API_KEY'),
      'X-Timestamp: ' . $ts,
      'X-Signature: ' . $sig,
    ],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 15,
  ]);
  $res = curl_exec($ch); curl_close($ch);
  return json_decode($res, true);
}

import hashlib, hmac, json, os, time
import requests

def consultar_transaccion(reference: str) -> dict:
    body = json.dumps({"reference": reference}, separators=(",", ":"))
    ts = str(int(time.time() * 1000))
    firma = hmac.new(os.environ["PAYEFY_SECRET"].encode(),
                      f"{ts}.{body}".encode(), hashlib.sha256).hexdigest()

    r = requests.post(
        "https://sandbox-panel.payefy.me/api/partner/v1/transactions/status",
        data=body,                     # enviar EXACTAMENTE la cadena firmada
        headers={"Content-Type": "application/json",
                 "X-Api-Key": os.environ["PAYEFY_API_KEY"],
                 "X-Timestamp": ts, "X-Signature": firma},
        timeout=15)
    return r.json()