Webhooks — Real-Time Notifications

const crypto = require('crypto');

function verifyWebhook(rawBody, receivedSignature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');

  // timingSafeEqual prevents timing attacks.
  // A timing attack is a technique where an attacker measures how long
  // your comparison takes to deduce part of the secret string.
  // timingSafeEqual always takes the same amount of time regardless
  // of whether the strings match — closing that vulnerability.
  return crypto.timingSafeEqual(
    Buffer.from(receivedSignature),
    Buffer.from(expected)
  );
}

// Full Express handler
app.post('/webhooks/ubn', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-signature'];
  const rawBody = req.body; // Buffer — requires express.raw middleware

  if (!signature || !verifyWebhook(rawBody, signature, process.env.UBN_WEBHOOK_SECRET)) {
    console.warn('Rejected webhook: invalid signature');
    return res.status(401).send('Unauthorized');
  }

  const payload = JSON.parse(rawBody);

  // Handle each event type
  switch (payload.event) {
    case 'collection.credit':
      handleCredit(payload.data);
      break;
    case 'collection.reversal':
      handleReversal(payload.data);
      break;
    case 'collection.dispute':
      handleDispute(payload.data);
      break;
    default:
      console.log('Unknown event type, ignoring:', payload.event);
  }

  // Respond immediately — do expensive work asynchronously
  res.status(200).send('OK');
});