Webhooks

import { createHash, createHmac, timingSafeEqual } from "node:crypto";

const APP_ID = process.env.APTAPAY_APP_ID!;
const OUTBOUND_SECRET = process.env.APTAPAY_OUTBOUND_SECRET!;
// The callback URL you registered with AptaPay — you know it without
// inspecting the request, which is the point.
const CALLBACK_URL = "https://api.yourapp.com/webhooks/aptapay";

export function verifyWebhook(
  rawBody: Buffer,
  headers: Record<string, string>,
): boolean {
  const [version, presented] = (
    headers["x-aptapay-signature"] ?? ""
  ).split("=");
  if (version !== "v1" || !presented) return false;

  const url = new URL(CALLBACK_URL);
  const canonical = [
    "v1",
    APP_ID,
    "outbound",
    url.host.toLowerCase(),
    "POST",
    url.pathname,
    "",
    headers["x-aptapay-timestamp"],
    headers["x-aptapay-nonce"],
    createHash("sha256").update(rawBody).digest("hex"),
  ].join("\n");

  const expected = createHmac("sha256", OUTBOUND_SECRET)
    .update(canonical)
    .digest("hex");

  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(presented, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

// When creating the charge:
await createCharge({ /* ... */, metadata: { order_id: order.id } });

// In the webhook handler:
const orderId = event.data.metadata?.order_id;

app.post(
  "/webhooks/aptapay",
  express.raw({ type: "application/json" }),
  async (req, res) => {
    if (!verifyWebhook(req.body, req.headers as Record<string, string>)) {
      return res.status(401).end();
    }

    const event = JSON.parse(req.body.toString());

    if (await alreadyProcessed(event.event_id)) {
      return res.status(200).end(); // safe no-op
    }

    await enqueueForProcessing(event); // durable, fast
    res.status(200).end();
  },
);