Get started with webhooks

export SAKAWAVE_WEBHOOK_SECRET='whsec_replace_with_your_secret'

import { createHmac, timingSafeEqual } from 'node:crypto';
import express from 'express';

const app = express();
const secret = process.env.SAKAWAVE_WEBHOOK_SECRET!;

// The raw-body route must be registered before any global express.json().
app.post('/webhooks/sakawave', express.raw({ type: 'application/json' }), async (req, res) => {
  const id = req.get('Sakawave-Webhook-Id');
  const timestamp = req.get('Sakawave-Webhook-Timestamp');
  const signature = req.get('Sakawave-Webhook-Signature');

  // 1. Headers must be present and well formed.
  if (!id || !timestamp || !signature?.startsWith('v1=')) return res.status(400).end();

  // 2. Reject anything outside a narrow window, before spending time on HMAC.
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!Number.isFinite(age) || age > 300) return res.status(400).end();

  // 3. Verify over the exact bytes received. Never re-serialise first.
  const expected = createHmac('sha256', secret)
    .update(`${id}.${timestamp}.`)
    .update(req.body)
    .digest('hex');
  const received = Buffer.from(signature.slice(3), 'hex');
  const digest = Buffer.from(expected, 'hex');
  if (digest.length !== received.length || !timingSafeEqual(digest, received)) {
    return res.status(401).end();
  }

  // 4. Deduplicate on the header id, atomically with recording receipt.
  const event = JSON.parse(req.body.toString('utf8'));
  const fresh = await recordOnce(id, event.event);   // unique index on id
  if (!fresh) return res.sendStatus(204);            // already seen; still 2xx

  // 5. Queue, then acknowledge. Do the work outside the request.
  await enqueue({ id, type: event.event, data: event.data });
  return res.sendStatus(204);
});

async function handle(event: { id: string; type: string; data: any }) {
  switch (event.type) {
    case 'fiat.withdrawal.completed': {
      // The event says look; the resource says what is true.
      const transfer = await sakawave.get(`/v1/transfers/${event.data.relatedOperation.id}`);
      return settle(transfer);
    }
    case 'account.updated':
      return syncAccount(event.data);          // resource events carry the object
    case 'bills_payment.completed':
      return deliverToken(event.data.relatedOperation.tokenData);
    default:
      return;                                  // unknown events are normal
  }
}

// The webhook is the fast path. This is the correct one.
setInterval(async () => {
  const pending = await sakawave.get('/v1/transfers?status=pending&pageSize=100');
  for (const transfer of pending.items) {
    if (olderThan(transfer.createdAt, minutes(30))) await reconcile(transfer);
  }
}, minutes(5));