Webhooks

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.MEGA_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 5 * 60;

// Capture the RAW body — signature is over the exact bytes we received.
app.post(
  "/hooks/mega-leads",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.get("X-Mega-Signature") || "";
    const timestamp = req.get("X-Mega-Timestamp") || "";
    const rawBody = req.body.toString("utf8");

    // Replay guard: reject stale timestamps.
    const age = Math.abs(Math.floor(Date.now() / 1000) - Number(timestamp));
    if (!timestamp || Number.isNaN(age) || age > TOLERANCE_SECONDS) {
      return res.status(400).send("stale or missing timestamp");
    }

    const expected =
      "sha256=" +
      crypto
        .createHmac("sha256", SECRET)
        .update(`${timestamp}.${rawBody}`)
        .digest("hex");

    const ok =
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
    if (!ok) return res.status(401).send("bad signature");

    const event = JSON.parse(rawBody);
    // TODO: de-dupe on req.get("X-Mega-Delivery"), then process event.lead
    res.status(200).send("ok");
  }
);