Set up webhooks for real-time payment notifications

import { verifyWebhookSignature } from "@coin-voyage/paykit/server";

const webhookSecret = process.env.COIN_VOYAGE_WEBHOOK_SECRET;

type CoinVoyageWebhookEvent = {
  event: string;
  delivered_at: string;
  order: {
    id: string;
    status: string;
    metadata?: Record<string, unknown>;
  };
};

export const POST = async (req: Request) => {
  const rawBody = await req.text();

  const result = verifyWebhookSignature(rawBody, req.headers, webhookSecret);
  if (!result.valid) {
    console.warn("Rejected webhook:", result.error.code);
    return new Response("Unauthorized", { status: 401 });
  }

  // Stable across retries of the same event: skip IDs you have already processed.
  const eventId = req.headers.get("X-Event-ID");
  const event = JSON.parse(rawBody) as CoinVoyageWebhookEvent;

  switch (event.event) {
    case "ORDER_COMPLETED":
      console.log("Order completed", eventId, event.order.id);
      break;
    case "ORDER_REFUNDED":
      console.log("Order refunded", eventId, event.order.id);
      break;
    case "ORDER_EXPIRED":
      console.log("Order expired", eventId, event.order.id);
      break;
    default:
      console.log("Unhandled webhook", event.event, event.order.id);
  }

  return new Response("Webhook received", { status: 200 });
};

import { createHmac, timingSafeEqual } from "node:crypto";
import { createServer } from "node:http";

const webhookSecret = process.env.COIN_VOYAGE_WEBHOOK_SECRET;
const TOLERANCE_SECONDS = 300;

function isValidWebhook(rawBody, headers) {
  const timestamp = headers["coinvoyage-webhook-timestamp"];
  const signature = headers["coinvoyage-webhook-signature-v2"];
  if (typeof timestamp !== "string" || !/^\d+$/.test(timestamp)) return false;
  if (typeof signature !== "string") return false;

  // Reject attempts sent more than 5 minutes before or after the current time.
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - Number(timestamp)) > TOLERANCE_SECONDS) return false;

  const expected = createHmac("sha256", webhookSecret)
    .update(`${timestamp}.`)
    .update(rawBody)
    .digest();
  const received = Buffer.from(signature, "base64");

  return received.length === expected.length && timingSafeEqual(received, expected);
}

createServer((req, res) => {
  const chunks = [];
  req.on("data", (chunk) => chunks.push(chunk));
  req.on("end", () => {
    const rawBody = Buffer.concat(chunks); // the exact bytes that were signed

    if (!isValidWebhook(rawBody, req.headers)) {
      res.writeHead(401).end("Unauthorized");
      return;
    }

    const eventId = req.headers["x-event-id"];
    const event = JSON.parse(rawBody.toString("utf8"));
    console.log(event.event, eventId, event.order.id);

    res.writeHead(200).end("Webhook received");
  });
}).listen(3000);