Webhooks

import express from 'express';
import { createHmac, timingSafeEqual } from 'node:crypto';

const app = express();

// IMPORTANT: capture raw body BEFORE parsing JSON. The signature is over raw bytes.
app.use(express.raw({ type: 'application/json' }));

const SECRET = process.env.VOREL_WEBHOOK_SECRET!;
const seen = new Set<string>(); // replace with persistent store in prod

app.post('/webhooks/vorel', async (req, res) => {
  const signature = req.header('X-Webhook-Signature');
  const rawBody = req.body as Buffer;

  if (!signature || !verifySignature(rawBody.toString('utf8'), signature, SECRET)) {
    res.status(401).send('invalid signature');
    return;
  }

  const envelope = JSON.parse(rawBody.toString('utf8'));

  if (seen.has(envelope.id)) {
    res.status(200).send('ok (duplicate)');
    return;
  }
  seen.add(envelope.id);

  try {
    await handleEvent(envelope);
    res.status(200).send('ok');
  } catch (err) {
    // 5xx triggers a retry. Use this when the failure is transient (DB
    // hiccup, downstream API down). Use a 4xx if the body is structurally
    // invalid for your processing — Vorel won't retry 4xx.
    res.status(500).send('processing failed');
  }
});

function verifySignature(rawBody: string, header: string, secret: string): boolean {
  const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
  // Buffers must be equal length for timingSafeEqual; the hex digest is always 64 chars.
  if (header.length !== expected.length) return false;
  return timingSafeEqual(Buffer.from(header, 'hex'), Buffer.from(expected, 'hex'));
}

async function handleEvent(envelope: { event: string; data: unknown; tenant_id: string }) {
  switch (envelope.event) {
    case 'lead.qualified':
      await onLeadQualified(envelope.tenant_id, envelope.data);
      break;
    case 'booking.created':
      await onBookingCreated(envelope.tenant_id, envelope.data);
      break;
    // ...the other event types your subscription cares about
  }
}