Event Types

const crypto = require("crypto");

function verifyWebhookSignature(req, privateKey) {
  const signature = req.headers["x-webhook-signature"];
  const timestamp = req.headers["x-webhook-timestamp"];

  if (!signature || !timestamp) {
    throw new Error("Missing webhook signature headers");
  }

  // Reject requests older than 5 minutes to prevent replay attacks
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - parseInt(timestamp)) > 300) {
    throw new Error("Webhook timestamp is too old");
  }

  // Reconstruct the signed string: "{timestamp}.{rawPayload}"
  const rawBody = JSON.stringify(req.body);
  const dataToSign = `${timestamp}.${rawBody}`;

  const expectedSignature = crypto
    .createHmac("sha256", privateKey)
    .update(dataToSign)
    .digest("hex");

  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  )) {
    throw new Error("Invalid webhook signature");
  }

  return true;
}

// Express handler example
app.post("/webhooks/tagpay", express.json(), (req, res) => {
  try {
    verifyWebhookSignature(req, process.env.TAGPAY_PRIVATE_KEY);
  } catch (err) {
    return res.status(401).json({ error: err.message });
  }

  const { event, data } = req.body;

  switch (event) {
    case "transaction.success":
      // handle successful transaction
      break;
    case "wallet.credit":
      // handle wallet credit
      break;
    default:
      // log unhandled event type
  }

  // Always respond with 2xx to acknowledge receipt
  res.status(200).json({ received: true });
});

const crypto = require("crypto");

function verifyLegacySignature(req, privateKey) {
  const signature = req.headers["x-glide-signature"];

  if (!signature) {
    throw new Error("Missing x-glide-signature header");
  }

  const rawBody = JSON.stringify(req.body);

  const expectedSignature = crypto
    .createHmac("sha512", privateKey)
    .update(rawBody)
    .digest("hex");

  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  )) {
    throw new Error("Invalid webhook signature");
  }

  return true;
}