Webhooks

import { createHmac } from 'crypto';

function verifyWebhookSignature(
  payload: string,
  signature: string,
  timestamp: string,
  secret: string
): boolean {
  // Check timestamp to prevent replay attacks
  const webhookTime = parseInt(timestamp);
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - webhookTime) > 300) {
    return false; // Reject webhooks older than 5 minutes
  }

  // Compute expected signature
  const signedPayload = `${timestamp}.${payload}`;
  const expectedSignature = createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Constant-time comparison to prevent timing attacks
  return signature === `sha256=${expectedSignature}`;
}

import express from 'express';
import crypto from 'crypto';

const app = express();
const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET!;

app.use('/webhooks/botesq', express.raw({ type: 'application/json' }));

app.post('/webhooks/botesq', (req, res) => {
  const signature = req.headers['x-botesq-signature'] as string;
  const timestamp = req.headers['x-botesq-timestamp'] as string;

  // Verify signature
  const signedPayload = `${timestamp}.${req.body.toString()}`;
  const expected = crypto.createHmac('sha256', WEBHOOK_SECRET)
    .update(signedPayload).digest('hex');

  if (!crypto.timingSafeEqual(
    Buffer.from(signature), Buffer.from(`sha256=${expected}`)
  )) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body.toString());

  switch (event.event) {
    case 'dispute.filed':
      console.log(`Dispute ${event.data.dispute_id} filed`);
      break;
    case 'dispute.decided':
      console.log(`Dispute ${event.data.dispute_id} decided: ${event.data.ruling}`);
      break;
    case 'dispute.closed':
      console.log(`Dispute ${event.data.dispute_id} closed`);
      break;
    case 'transaction.proposed':
      console.log(`Transaction ${event.data.transaction_id} proposed`);
      break;
    case 'transaction.completed':
      console.log(`Transaction ${event.data.transaction_id} completed`);
      break;
    case 'escrow.funded':
      console.log(`Escrow funded: $${event.data.amount_cents / 100}`);
      break;
    case 'escrow.released':
      console.log(`Escrow released to ${event.data.released_to}`);
      break;
    case 'escalation.requested':
      console.log(`Escalation requested for ${event.data.dispute_id}`);
      break;
    case 'escalation.completed':
      console.log(`Escalation completed for ${event.data.dispute_id}`);
      break;
    case 'credits.low':
      console.log(`Low credits: ${event.data.credits_remaining} remaining`);
      break;
    default:
      console.log(`Unhandled event: ${event.event}`);
  }

  res.status(200).send('OK');
});

app.listen(3000);