HMAC-SHA256(webhook_secret, raw_json_payload)

{
  "event": "webhook.test",
  "timestamp": "2024-01-01T00:00:00Z"
}

{
  "id": "pay_1234567890",
  "event": "payment.completed",
  "amount": "100.00",
  "currency": "USD",
  "status": "completed",
  "customer_id": "cust_1234567890",
  "timestamp": "2024-01-01T00:00:00Z"
}

{
  "subscription": {
    "id": 123,
    "uid": "sub_1234567890",
    "customerId": "cust_1234567890",
    "priceId": "price_1234567890",
    "status": "active",
    "currentPeriodStart": "2024-01-01T00:00:00Z",
    "currentPeriodEnd": "2024-02-01T00:00:00Z",
    "trialStart": null,
    "trialEnd": null,
    "cancelAtPeriodEnd": false,
    "canceledAt": null,
    "createdAt": "2024-01-01T00:00:00Z",
    "updatedAt": "2024-01-01T00:00:00Z"
  }
}

{
  "subscription_invoice": {
    "id": 456,
    "uid": "inv_1234567890",
    "subscriptionId": "sub_1234567890",
    "amount": "29.99",
    "currency": "USD",
    "status": "pending",
    "invoiceId": "invoice_1234567890",
    "periodStart": "2024-01-01T00:00:00Z",
    "periodEnd": "2024-02-01T00:00:00Z",
    "dueDate": "2024-01-08T00:00:00Z",
    "nextPaymentAttempt": "2024-01-01T12:00:00Z",
    "createdAt": "2024-01-01T00:00:00Z",
    "updatedAt": "2024-01-01T00:00:00Z"
  }
}

import express from 'express';
import crypto from 'crypto';

const app = express();
const PORT = process.env.PORT || 3001;
const WEBHOOK_SECRET = process.env.RAYSWAP_WEBHOOK_SECRET || '';

// Capture raw body for HMAC verification
app.use('/webhook', express.raw({ type: 'application/json' }));

function verifySignature(rawBody: Buffer, signatureHeader?: string): boolean {
  if (!signatureHeader || !WEBHOOK_SECRET) return false;
  const [algo, expectedSig] = signatureHeader.split('=');
  if (algo !== 'sha256' || !expectedSig) return false;

  const hmac = crypto.createHmac('sha256', WEBHOOK_SECRET);
  hmac.update(rawBody);
  const digest = hmac.digest('hex');

  // Constant-time comparison
  const a = Buffer.from(digest, 'utf8');
  const b = Buffer.from(expectedSig, 'utf8');
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

// Simple in-memory idempotency store (replace with persistent storage)
const processedDeliveries = new Set<string>();

app.post('/webhook', (req, res) => {
  const rawBody = req.body as Buffer;
  const signature = req.header('X-KuvarPay-Signature');
  const event = req.header('X-KuvarPay-Event');
  const deliveryId = req.header('X-KuvarPay-Delivery') || '';

  if (!verifySignature(rawBody, signature)) {
    return res.status(401).send('Invalid signature');
  }

  if (processedDeliveries.has(deliveryId)) {
    return res.status(200).send('Duplicate delivery');
  }

  let payload: unknown;
  try {
    payload = JSON.parse(rawBody.toString('utf8'));
  } catch (e) {
    return res.status(400).send('Invalid JSON');
  }

  // TODO: handle event types (e.g., payment.completed)
  // route by `event` header or by `payload.event`

  processedDeliveries.add(deliveryId);
  return res.status(200).send('ok');
});

app.get('/health', (_req, res) => res.send('ok'));

app.listen(PORT, () => console.log(`Webhook server listening on ${PORT}`));