Webhook receiver with HMAC verification

// app/api/clientcasa/webhook/route.ts
import { NextRequest, NextResponse } from 'next/server'
import { createHmac, timingSafeEqual } from 'node:crypto'

const SECRET = process.env.CLIENTCASA_WEBHOOK_SECRET!
const MAX_AGE_SECONDS = 300 // reject deliveries older than 5 minutes

export async function POST(req: NextRequest) {
  const body = await req.text() // read RAW body for HMAC
  const sig = req.headers.get('x-signature') ?? ''
  const ts = req.headers.get('x-webhook-timestamp') ?? ''

  // 1. Timestamp freshness
  const tsNum = Number(ts)
  if (!tsNum || Math.abs(Date.now() / 1000 - tsNum) > MAX_AGE_SECONDS) {
    return NextResponse.json({ error: 'stale or invalid timestamp' }, { status: 401 })
  }

  // 2. HMAC verification — use timing-safe compare
  const expected = createHmac('sha256', SECRET).update(`${ts}.${body}`).digest('hex')
  const provided = sig.replace(/^sha256=/, '')
  const expectedBuf = Buffer.from(expected, 'hex')
  const providedBuf = Buffer.from(provided, 'hex')
  if (expectedBuf.length !== providedBuf.length || !timingSafeEqual(expectedBuf, providedBuf)) {
    return NextResponse.json({ error: 'invalid signature' }, { status: 401 })
  }

  // 3. Parse + dispatch
  const payload = JSON.parse(body) as {
    event: string
    timestamp: string
    data: Record<string, unknown>
  }
  await dispatch(payload)

  return NextResponse.json({ ok: true })
}

async function dispatch(payload: { event: string; data: Record<string, unknown> }) {
  switch (payload.event) {
    case 'invoice_paid':       return onInvoicePaid(payload.data)
    case 'proposal_accepted':  return onProposalAccepted(payload.data)
    case 'contract_signed':    return onContractSigned(payload.data)
    default:                   return // unknown event — return 200 so we don't retry forever
  }
}

async function onInvoicePaid(data: Record<string, unknown>) { /* … */ }
async function onProposalAccepted(data: Record<string, unknown>) { /* … */ }
async function onContractSigned(data: Record<string, unknown>) { /* … */ }

import express from 'express'
import { createHmac, timingSafeEqual } from 'node:crypto'

const app = express()
const SECRET = process.env.CLIENTCASA_WEBHOOK_SECRET!
const MAX_AGE_SECONDS = 300

// IMPORTANT: use raw body for /webhook, JSON parser elsewhere
app.post(
  '/api/clientcasa/webhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const body = req.body.toString('utf8')
    const sig = (req.header('x-signature') ?? '').replace(/^sha256=/, '')
    const ts = req.header('x-webhook-timestamp') ?? ''

    const tsNum = Number(ts)
    if (!tsNum || Math.abs(Date.now() / 1000 - tsNum) > MAX_AGE_SECONDS) {
      return res.status(401).json({ error: 'stale timestamp' })
    }

    const expected = createHmac('sha256', SECRET).update(`${ts}.${body}`).digest('hex')
    const a = Buffer.from(expected, 'hex')
    const b = Buffer.from(sig, 'hex')
    if (a.length !== b.length || !timingSafeEqual(a, b)) {
      return res.status(401).json({ error: 'invalid signature' })
    }

    const payload = JSON.parse(body)
    handleEvent(payload).catch(console.error)
    res.json({ ok: true })
  },
)

async function handleEvent(payload: { event: string; data: unknown }) {
  // ... dispatch by event type
}

// Workers don't have node:crypto — use the Web Crypto API instead.
const MAX_AGE_SECONDS = 300

export default {
  async fetch(req: Request, env: { CLIENTCASA_WEBHOOK_SECRET: string }) {
    if (req.method !== 'POST') return new Response('method not allowed', { status: 405 })

    const body = await req.text()
    const sig = (req.headers.get('x-signature') ?? '').replace(/^sha256=/, '')
    const ts = req.headers.get('x-webhook-timestamp') ?? ''

    const tsNum = Number(ts)
    if (!tsNum || Math.abs(Date.now() / 1000 - tsNum) > MAX_AGE_SECONDS) {
      return new Response('stale timestamp', { status: 401 })
    }

    const key = await crypto.subtle.importKey(
      'raw',
      new TextEncoder().encode(env.CLIENTCASA_WEBHOOK_SECRET),
      { name: 'HMAC', hash: 'SHA-256' },
      false,
      ['verify'],
    )
    const sigBuf = Uint8Array.from(sig.match(/../g)!.map((b) => parseInt(b, 16)))
    const ok = await crypto.subtle.verify(
      'HMAC',
      key,
      sigBuf,
      new TextEncoder().encode(`${ts}.${body}`),
    )
    if (!ok) return new Response('invalid signature', { status: 401 })

    const payload = JSON.parse(body)
    // ... handle event
    return new Response(JSON.stringify({ ok: true }), { headers: { 'Content-Type': 'application/json' } })
  },
}