Verify webhook signatures

# Example curl (replace SECRET + URL)
# NOTE: This example uses openssl to compute the HMAC over the raw JSON body.
URL="https://your-domain.com/webhooks/certifylize"
SECRET="YOUR_ENDPOINT_SECRET"

BODY='{"hello":"world"}'

SIG=$(printf "%s" "$BODY" | openssl dgst -sha256 -hmac "$SECRET" | sed 's/^.* //')

curl -i -X POST "$URL" \
  -H "Content-Type: application/json" \
  -H "X-Certifylize-Signature: sha256=$SIG" \
  -H "X-Certifylize-Delivery-Id: dlv_test_123" \
  -H "X-Certifylize-Event-Type: example.test" \
  --data "$BODY"

// server.js (Express)
const express = require("express");
const crypto = require("crypto");

const app = express();

// ✅ Capture RAW body as Buffer (important!)
app.use(
  express.json({
    verify: (req, _res, buf) => {
      req.rawBody = buf; // Buffer
    },
  })
);

function computeHmac(secret, rawBodyBuffer) {
  return crypto.createHmac("sha256", secret).update(rawBodyBuffer).digest("hex");
}

function timingSafeEqualHex(a, b) {
  const aa = Buffer.from(a, "hex");
  const bb = Buffer.from(b, "hex");
  if (aa.length !== bb.length) return false;
  return crypto.timingSafeEqual(aa, bb);
}

app.post("/webhooks/certifylize", (req, res) => {
  const secret = process.env.CERTIFYLIZE_WEBHOOK_SECRET;
  if (!secret) return res.status(500).json({ ok: false, error: "Missing secret" });

  const header = req.get("X-Certifylize-Signature") || "";
  const provided = header.startsWith("sha256=") ? header.slice("sha256=".length) : "";

  if (!provided || !req.rawBody) {
    return res.status(400).json({ ok: false, error: "Missing signature or raw body" });
  }

  const expected = computeHmac(secret, req.rawBody);
  const valid = timingSafeEqualHex(provided, expected);
  if (!valid) return res.status(401).json({ ok: false, error: "Invalid signature" });

  const deliveryId = req.get("X-Certifylize-Delivery-Id");
  const eventType = req.get("X-Certifylize-Event-Type");

  // ✅ Now req.body is trustworthy
  return res.json({ ok: true, deliveryId, eventType });
});

app.listen(3005, () => console.log("Listening on http://localhost:3005"));

// app/api/webhooks/certifylize/route.ts (Next.js App Router)
import crypto from "crypto";
import { NextResponse } from "next/server";

export const runtime = "nodejs";

function hmacSha256(secret: string, raw: string) {
  return crypto.createHmac("sha256", secret).update(raw, "utf8").digest("hex");
}

function timingSafeEqualHex(a: string, b: string) {
  const aa = Buffer.from(a, "hex");
  const bb = Buffer.from(b, "hex");
  if (aa.length !== bb.length) return false;
  return crypto.timingSafeEqual(aa, bb);
}

export async function POST(req: Request) {
  const secret = process.env.CERTIFYLIZE_WEBHOOK_SECRET;
  if (!secret) return NextResponse.json({ ok: false, error: "Missing secret" }, { status: 500 });

  // ✅ RAW body (important)
  const raw = await req.text();

  const sigHeader = req.headers.get("x-certifylize-signature") || "";
  const provided = sigHeader.startsWith("sha256=") ? sigHeader.slice("sha256=".length) : "";
  if (!provided) return NextResponse.json({ ok: false, error: "Missing signature" }, { status: 400 });

  const expected = hmacSha256(secret, raw);
  const valid = timingSafeEqualHex(provided, expected);
  if (!valid) return NextResponse.json({ ok: false, error: "Invalid signature" }, { status: 401 });

  const deliveryId = req.headers.get("x-certifylize-delivery-id");
  const eventType = req.headers.get("x-certifylize-event-type");

  let payload: any = null;
  try { payload = JSON.parse(raw); } catch {}

  return NextResponse.json({ ok: true, deliveryId, eventType, payload });
}