Webhook Setup

import express from "express";
import crypto from "crypto";

const app = express();
app.use(express.json());

// Webhook endpoint
app.post("/webhooks/settlement", (req, res) => {
  const signature = req.headers["x-webhook-signature"];
  const payload = req.body;

  // 1. Verify signature FIRST
  if (!verifySignature(payload, signature)) {
    console.error("Invalid webhook signature");
    return res.status(401).json({ error: "Invalid signature" });
  }

  // 2. Acknowledge receipt immediately
  res.status(200).json({ received: true });

  // 3. Process webhook asynchronously
  processWebhook(payload).catch(console.error);
});

function verifySignature(payload, signature) {
  // Get from environment
  const secret = process.env.WEBHOOK_SECRET;

  // Serialize payload (same way 0xmeta.ai does)
  const payloadStr = JSON.stringify(payload, Object.keys(payload).sort());

  // Compute expected signature
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payloadStr)
    .digest("hex");

  // Constant-time comparison
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

async function processWebhook(payload) {
  const { event_type, settlement_id, status, data } = payload;

  if (event_type === "settlement.completed" && status === "settled") {
    // Update order in database
    await db.orders.update({
      where: { settlement_id },
      data: {
        status: "completed",
        settlement_tx_hash: data.settlement_tx_hash,
        settled_at: new Date(),
      },
    });

    // Send confirmation email
    await sendConfirmationEmail(settlement_id);

    console.log("Settlement completed:", settlement_id);
  }
}

app.listen(3000);