Webhooks

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret, timestamp) {
  // Reconstruct the signed payload
  const signedPayload = `${timestamp}.${payload}`;

  // Compute the expected signature
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Extract the signature from the header (format: sha256=hex_signature)
  const receivedSignature = signature.replace('sha256=', '');

  // Compare signatures using constant-time comparison
  return crypto.timingSafeEqual(
    Buffer.from(expectedSignature),
    Buffer.from(receivedSignature)
  );
}

// Example usage in Express.js
app.post('/webhooks/sweetspot', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const timestamp = req.headers['x-webhook-timestamp'];
  const eventType = req.headers['x-webhook-event-type'];
  const eventId = req.headers['x-webhook-event-id'];

  const webhookSecret = process.env.WEBHOOK_SECRET;

  if (!verifyWebhookSignature(req.body, signature, webhookSecret, timestamp)) {
    return res.status(401).send('Invalid signature');
  }

  // Check timestamp to prevent replay attacks (recommended)
  const currentTime = Math.floor(Date.now() / 1000);
  const requestTime = parseInt(timestamp);
  if (Math.abs(currentTime - requestTime) > 300) { // 5 minutes tolerance
    return res.status(401).send('Request timestamp too old');
  }

  const event = JSON.parse(req.body);

  // Process the webhook event
  console.log('Received event:', eventType, eventId);

  res.status(200).send('OK');
});