POST a charge.Get a webhook.Get a webhook.

import crypto from "crypto";

const SKEW_SECONDS = 300;

function verifyWebhook(rawBody, headers, secret) {
  const ts = headers["x-webhook-timestamp"];
  const sig = headers["x-webhook-signature"];
  if (!ts || !sig) return false;

  const drift = Math.abs(Math.floor(Date.now() / 1000) - parseInt(ts, 10));
  if (drift > SKEW_SECONDS) return false;

  const expected = "v1=" + crypto
    .createHmac("sha256", secret)
    .update(`${ts}.${rawBody}`)
    .digest("hex");

  const a = Buffer.from(sig);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const rawBody = req.body.toString("utf8");
  if (!verifyWebhook(rawBody, req.headers, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send("Invalid signature");
  }

  const eventType = req.headers["x-webhook-event"];
  const deliveryId = req.headers["x-webhook-delivery-id"];
  const body = JSON.parse(rawBody);

  if (alreadyProcessed(deliveryId)) return res.status(200).send("OK");

  switch (eventType) {
    case "PAYMENT_PAID":
      console.log(body.txId, body.amount, body.payer?.document ?? null);
      break;
    case "WITHDRAWAL_SENT":
      console.log(body.txId, body.recipient?.document ?? null);
      break;
    case "WITHDRAWAL_FAILED":
      console.log(body.txId, body.failureReason);
      break;
  }

  res.status(200).send("OK");
});