Webhooks & Signature Verification

import express from 'express';
import crypto from 'crypto';

const app = express();
// CRITICAL: Read the raw body as a Buffer or string for signature verification
app.use(express.raw({ type: 'application/json' }));

app.post('/api/webhooks/superchat', (req, res) => {
  const signatureHeader = req.headers['x-superchat-signature'];
  const secret = process.env.SUPERCHAT_WEBHOOK_SECRET; // whsec_...
  const rawBody = req.body.toString('utf8');

  // 1. Parse header
  const parts = signatureHeader.split(',');
  const timestamp = parts.find(p => p.startsWith('t='))?.slice(2);
  const signature = parts.find(p => p.startsWith('v1='))?.slice(3);

  // 2. Compute expected HMAC
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  // 3. Timing-safe comparison
  const isValid = crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expected, 'hex')
  );

  if (!isValid) {
    return res.status(400).send('Invalid signature');
  }

  // 4. Process event
  const event = JSON.parse(rawBody);
  if (event.event === 'payment.completed') {
    const payment = event.data;
    console.log('Fulfilling order:', payment.metadata.orderId);
  }

  res.status(200).json({ received: true });
});