Webhooks

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, apiKey) {
  // Create HMAC using your API key
  const hmac = crypto.createHmac('sha256', apiKey);
  
  // Update with the raw JSON body
  hmac.update(payload, 'utf8');
  
  // Generate the expected signature
  const expectedSignature = hmac.digest('hex');
  
  // Compare signatures
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );
}

function generateSignatureFromObject(webhookData, apiKey) {
  // If you need to recreate signature from a JSON object
  // Use the same serialization as EximPe
  const payloadJson = JSON.stringify(webhookData, Object.keys(webhookData).sort());
  
  const hmac = crypto.createHmac('sha256', apiKey);
  hmac.update(payloadJson, 'utf8');
  return hmac.digest('hex');
}

// Usage in Express.js
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const payload = req.body.toString();
  
  if (!verifyWebhookSignature(payload, signature, process.env.API_KEY)) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process webhook
  const webhookData = JSON.parse(payload);
  console.log('Webhook verified:', webhookData);
  
  res.status(200).send('OK');
});