Webhooks

// webhook-verifier.js - Place this in your utils folder
const crypto = require('crypto');

/**
 * Verify TxProof webhook signature
 * @param {string} rawBody - Raw request body as string (MUST be raw, not parsed)
 * @param {string} signatureHeader - Value of X-TxProof-Signature header
 * @param {string} secret - Your webhook signing secret
 * @param {number} toleranceSeconds - Timestamp tolerance (default: 300)
 * @returns {{valid: boolean, error?: string, payload?: object}}
 */
function verifyTxProofWebhook(rawBody, signatureHeader, secret, toleranceSeconds = 300) {
  try {
    // 1. Parse signature header
    const parts = signatureHeader.split(',');
    const timestampPart = parts.find(p => p.startsWith('t='));
    const signaturePart = parts.find(p => p.startsWith('v1='));

    if (!timestampPart || !signaturePart) {
      return { valid: false, error: 'Invalid signature header format' };
    }

    const timestamp = parseInt(timestampPart.split('=')[1]);
    const receivedSignature = signaturePart.split('=')[1];

    // 2. Check timestamp freshness
    const now = Math.floor(Date.now() / 1000);
    if (Math.abs(now - timestamp) > toleranceSeconds) {
      return { valid: false, error: 'Timestamp expired (possible replay attack)' };
    }

    // 3. Compute expected signature
    const signedContent = `${timestamp}.${rawBody}`;
    const computedSignature = crypto
      .createHmac('sha256', secret)
      .update(signedContent)
      .digest('hex');

    // 4. Constant-time comparison
    if (!crypto.timingSafeEqual(
      Buffer.from(receivedSignature),
      Buffer.from(computedSignature)
    )) {
      return { valid: false, error: 'Signature mismatch' };
    }

    // 5. Parse and return payload
    const payload = JSON.parse(rawBody);
    return { valid: true, payload };

  } catch (error) {
    return { valid: false, error: error.message };
  }
}

module.exports = { verifyTxProofWebhook };

// --- USAGE EXAMPLE ---
// const express = require('express');
// const { verifyTxProofWebhook } = require('./utils/webhook-verifier');
//
// app.post('/webhook',
//   express.raw({ type: 'application/json' }),
//   (req, res) => {
//     const result = verifyTxProofWebhook(
//       req.body.toString('utf8'),
//       req.headers['x-txproof-signature'],
//       process.env.TXPROOF_WEBHOOK_SECRET
//     );
//
//     if (!result.valid) {
//       return res.status(401).json({ error: result.error });
//     }
//
//     // ✅ Verified! Process the webhook
//     console.log('Event:', result.payload.event_type);
//     res.json({ received: true });
//   }
// );

// pages/api/webhook.js (Pages Router)
// OR app/api/webhook/route.js (App Router)

import crypto from 'crypto';

export const config = {
  api: {
    bodyParser: false, // CRITICAL: Disable automatic parsing
  },
};

export default async function handler(req, res) {
  if (req.method !== 'POST') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  // Read raw body
  const rawBody = await new Promise((resolve) => {
    let data = '';
    req.on('data', chunk => { data += chunk; });
    req.on('end', () => { resolve(data); });
  });

  const signatureHeader = req.headers['x-txproof-signature'];
  const secret = process.env.TXPROOF_WEBHOOK_SECRET;

  // Parse signature header
  const parts = signatureHeader.split(',');
  const timestamp = parts.find(p => p.startsWith('t=')).split('=')[1];
  const receivedSignature = parts.find(p => p.startsWith('v1=')).split('=')[1];

  // Verify timestamp
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    return res.status(401).json({ error: 'Timestamp expired' });
  }

  // Verify signature
  const signedContent = `${timestamp}.${rawBody}`;
  const computedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedContent)
    .digest('hex');

  if (!crypto.timingSafeEqual(
    Buffer.from(receivedSignature),
    Buffer.from(computedSignature)
  )) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Parse JSON after verification
  const payload = JSON.parse(rawBody);

  // Process webhook...
  console.log('Event received:', payload.event_type);

  res.json({ received: true });
}