Webhooks

import crypto from "node:crypto";

function verifyWebhookSignature(body, signatureHeader, secret) {
  const parts = Object.fromEntries(
    signatureHeader.split(",").map((p) => p.split("=", 2))
  );
  const timestamp = parts.t;
  const receivedHmac = parts.v1;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${timestamp}.${body}`)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(receivedHmac),
    Buffer.from(expected)
  );
}

// In your webhook handler:
app.post("/webhooks/contro", (req, res) => {
  const body = JSON.stringify(req.body);
  const signature = req.headers["x-contro-signature"];

  if (!verifyWebhookSignature(body, signature, WEBHOOK_SECRET)) {
    return res.status(401).send("Invalid signature");
  }

  // Process the event — event type is in the X-Contro-Event header
  const eventType = req.headers["x-contro-event"];
  console.log("Event type:", eventType);
  res.status(200).send("OK");
});