const crypto = require('crypto');
const express = require('express');
const app = express();

function verifyWebhookSignature(payload, signature, secret, timestamp) {
  // Prevent replay attacks (optional but recommended)
  const tolerance = 300; // 5 minutes
  const currentTime = Math.floor(Date.now() / 1000);
  if (Math.abs(currentTime - timestamp) > tolerance) {
    throw new Error('Webhook timestamp is too old');
  }

  // Create signature
  const signedPayload = `${timestamp}.${JSON.stringify(payload)}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Compare signatures
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// Express.js endpoint example
app.post('/webhooks/unboarder', express.raw({type: 'application/json'}), (req, res) => {
  const signature = req.headers['x-unboarder-signature'];
  const timestamp = req.headers['x-unboarder-timestamp'];
  const secret = process.env.WEBHOOK_SECRET;

  try {
    const payload = JSON.parse(req.body);
    const isValid = verifyWebhookSignature(payload, signature, secret, timestamp);

    if (!isValid) {
      return res.status(401).json({ error: 'Invalid signature' });
    }

    // Process the webhook based on event type
    switch (payload.type) {
      case 'verification.completed':
        console.log('Verification completed:', payload.data.object.id);
        // Update your database, send notifications, etc.
        break;
      case 'verification.failed':
        console.log('Verification failed:', payload.data.object.id);
        break;
      case 'form.submission.created':
        console.log('New form submission:', payload.data.object.id);
        break;
      default:
        console.log('Unhandled event type:', payload.type);
    }

    res.status(200).json({ received: true });
  } catch (error) {
    console.error('Webhook error:', error);
    res.status(400).json({ error: 'Webhook processing failed' });
  }
});

app.listen(3000, () => console.log('Webhook server running on port 3000'));