Webhooks Documentation

const crypto = require('crypto');
const express = require('express');
const app = express();

// Use raw body for signature verification
app.use('/webhooks/trickl', express.raw({ type: 'application/json' }));

const WEBHOOK_SECRET = process.env.TRICKL_WEBHOOK_SECRET;

function verifySignature(payload, timestamp, signature) {
  const signaturePayload = `${timestamp}.${payload}`;
  const expectedSignature = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(signaturePayload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

function isTimestampValid(timestamp) {
  const now = Math.floor(Date.now() / 1000);
  return Math.abs(now - timestamp) <= 300; // 5 minute tolerance
}

app.post('/webhooks/trickl', (req, res) => {
  const signature = req.headers['x-trickl-signature'];
  const timestamp = parseInt(req.headers['x-trickl-timestamp']);
  const payload = req.body.toString();

  // Verify timestamp (replay protection)
  if (!isTimestampValid(timestamp)) {
    return res.status(400).json({ error: 'Timestamp expired' });
  }

  // Verify signature
  if (!verifySignature(payload, timestamp, signature)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Parse and process the event
  const event = JSON.parse(payload);
  console.log(`Received ${event.type} webhook`);

  switch (event.type) {
    case 'payment.completed':
      // Handle payment completed
      break;
    case 'subscription.created':
      // Handle new subscription
      break;
    case 'subscription.cancelled':
      // Handle cancellation
      break;
    case 'goal.completed':
      // One-time goal funded — grant product access
      break;
    case 'goal.subscription_created':
      // Recurring subscription confirmed — grant access
      break;
    case 'goal.cycle_paid':
      // Billing cycle paid — renew access
      break;
    case 'goal.cancelled':
      // Goal or subscription cancelled — revoke access
      break;
  }

  res.status(200).json({ received: true });
});

app.listen(3000);