Event

const crypto = require('crypto');

function verifyWebhookSignature(
  webhookId,
  payload,
  signature,
  timestamp,
  secret
) {
  const signedPayload = `${webhookId}.${timestamp}.${payload}`;
  const keyBytes = Buffer.from(secret, 'base64url');
  const expectedSignature = crypto
    .createHmac('sha256', keyBytes)
    .update(signedPayload, 'utf8')
    .digest('hex');

  if (signature.length !== expectedSignature.length) {
    return false;
  }

  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );
}

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const webhookId = req.headers['x-webhooks-id'];
  const signatureHeader = req.headers['x-webhooks-signature'];
  const timestamp = req.headers['x-webhooks-timestamp'];

  if (!webhookId || !signatureHeader || !timestamp) {
    return res.status(401).json({ error: 'Missing required headers' });
  }

  const signature = signatureHeader.replace(/^v\d+=/, '');
  const payload = req.body.toString();
  const webhookSecret = process.env.WEBHOOK_SECRET;

  if (
    !webhookSecret ||
    !verifyWebhookSignature(
      webhookId,
      payload,
      signature,
      timestamp,
      webhookSecret
    )
  ) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = JSON.parse(payload);
  // Process the webhook event
  res.status(200).json({ received: true });
});