Handle Webhooks

const express = require("express");
const crypto = require("crypto");

const app = express();
const SIGNING_SECRET = process.env.ANTON_WEBHOOK_SECRET;

// Use raw body for signature verification
app.use("/webhooks/anton", express.raw({ type: "application/json" }));

function verifySignature(payload, header, secret) {
  const parts = Object.fromEntries(
    header.split(",").map((p) => p.split("="))
  );
  const timestamp = parts["t"];
  const signature = parts["v1"];

  // Reject if timestamp is older than 5 minutes
  const age = Math.floor(Date.now() / 1000) - parseInt(timestamp);
  if (age > 300) {
    throw new Error("Webhook timestamp too old");
  }

  const signedPayload = `${timestamp}.${payload}`;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(signedPayload)
    .digest("hex");

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    throw new Error("Invalid webhook signature");
  }
}

app.post("/webhooks/anton", (req, res) => {
  try {
    verifySignature(
      req.body.toString(),
      req.headers["anton-signature"],
      SIGNING_SECRET
    );
  } catch (err) {
    return res.status(401).json({ error: err.message });
  }

  const event = JSON.parse(req.body);

  switch (event.type) {
    case "payout.completed":
      // Mark the invoice as paid in your system
      markInvoicePaid(event.data.reference);
      break;

    case "payout.failed":
      // Alert your team and flag for retry
      notifyPayoutFailed(event.data);
      break;

    case "payout.returned":
      // Credit the funds back in your system
      handlePayoutReturn(event.data);
      break;

    case "payee.created":
      // Sync payee to your system
      syncPayee(event.data);
      break;
  }

  // Always return 200 quickly -- do heavy processing async
  res.status(200).json({ received: true });
});

app.listen(3000);