Documentation Webhooks

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload, 'utf8')
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// Express.js example
app.post('/webhooks/hisab', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-hisab-signature'];
  const timestamp = req.headers['x-hisab-timestamp'];
  const payload = req.body.toString();

  // Verify timestamp is recent (within 5 minutes)
  const timestampAge = Date.now() - parseInt(timestamp);
  if (timestampAge > 300000) {
    return res.status(400).send('Timestamp too old');
  }

  // Verify signature
  const signedPayload = `${timestamp}.${payload}`;
  if (!verifyWebhookSignature(signedPayload, signature, process.env.WEBHOOK_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(payload);

  // Handle the event
  switch (event.type) {
    case 'invoice.finalized':
      handleInvoiceFinalized(event.data);
      break;
    case 'invoice.paid':
      handleInvoicePaid(event.data);
      break;
    // ... handle other events
  }

  res.status(200).send('OK');
});