Webhook use cases

const handlers = {
  'fiat.withdrawal.completed': async (data) => {
    const transfer = await sakawave.get(`/v1/transfers/${data.relatedOperation.id}`);
    if (transfer.status !== 'completed') return;      // event was stale; resource wins
    await markPaid(transfer.externalReference, transfer);
  },

  'bills_payment.completed': async (data) => {
    const payment = await sakawave.get(`/v1/bill-payments/${data.relatedOperation.id}`);
    if (payment.tokenData) await deliverToken(payment.tokenData);
  },

  'account.updated': async (data) => {
    // Resource events already carry the object, so no fetch is needed —
    // but read it if the decision is expensive to get wrong.
    if (data.transferReady) await publishFundingInstructions(data.id);
  },
};

// Every five minutes. Cheap, and the only thing that makes the system correct.
async function sweep() {
  const pending = await sakawave.get('/v1/transfers?status=pending&pageSize=100');
  for (const transfer of pending.items) {
    if (olderThan(transfer.createdAt, minutes(30))) await reconcile(transfer);
  }

  const bills = await sakawave.get('/v1/bill-payments?status=pending&pageSize=100');
  for (const bill of bills.items) {
    if (olderThan(bill.createdAt, minutes(15))) await reconcile(bill);
  }
}

function route(type: string, data: unknown) {
  if (type.startsWith('fiat.')) return money.handle(type, data);
  if (type.startsWith('bills_payment.')) return bills.handle(type, data);
  if (type.startsWith('card.transaction.')) return cardSpend.handle(type, data);
  if (type.startsWith('card.')) return cards.handle(type, data);
  if (type.startsWith('account.')) return accounts.handle(type, data);
  if (type.startsWith('customer.')) return customers.handle(type, data);
  if (type === 'endpoint.test') return ok();
  return ok();          // unknown types are normal, not errors
}

// Step 1: deploy a receiver that accepts either secret.
const candidates = [process.env.SAKAWAVE_WEBHOOK_SECRET, process.env.SAKAWAVE_WEBHOOK_SECRET_NEXT]
  .filter(Boolean);

const verified = candidates.some((secret) => matches(secret, id, timestamp, rawBody, signature));

// Step 2: rotate in the dashboard.
// Step 3: promote NEXT to the primary and drop the old one.

CREATE TABLE webhook_events (
  id            text PRIMARY KEY,          -- Sakawave-Webhook-Id
  event         text NOT NULL,
  received_at   timestamptz NOT NULL DEFAULT now(),
  processed_at  timestamptz,
  body_sha256   text NOT NULL
);

// The insert is the lock. A duplicate loses the race and returns 2xx.
const { rowCount } = await db.query(
  'INSERT INTO webhook_events (id, event, body_sha256) VALUES ($1, $2, $3) ON CONFLICT DO NOTHING',
  [id, type, sha256(rawBody)],
);
if (rowCount === 0) return respond204();     // already seen