Webhooks

import express, { Request, Response } from 'express';

const app = express();
app.use(express.json());

interface WebhookPayload {
  event: string;
  timestamp: number;
  data: Record<string, unknown>;
  attemptNumber: number;
}

app.post('/webhooks/ticketcord', (req: Request, res: Response) => {
  const { event, data, attemptNumber } = req.body as WebhookPayload;

  console.log(`Received: ${event} (attempt ${attemptNumber})`);

  // TODO: Process event (send to queue, database, etc.)

  // Always respond quickly with 200 to acknowledge receipt
  res.status(200).json({ received: true });
});

app.listen(3000);

import crypto from 'crypto';
import express, { Request, Response } from 'express';

// Extend Express Request to include rawBody
declare global {
  namespace Express {
    interface Request {
      rawBody?: string;
    }
  }
}

const app = express();

// ============================================================
// IMPORTANT: Capture raw body BEFORE JSON parsing
// The signature is computed on the raw string, not parsed JSON
// ============================================================
app.use(express.json({
  verify: (req: Request, _res, buf) => {
    req.rawBody = buf.toString();
  }
}));

// Load your webhook secret from environment variables
const WEBHOOK_SECRET = process.env.TICKETCORD_WEBHOOK_SECRET;

if (!WEBHOOK_SECRET) {
  console.error('ERROR: TICKETCORD_WEBHOOK_SECRET environment variable not set');
  process.exit(1);
}

/**
 * Verify that a webhook request is authentic
 */
function verifySignature(payload: string, timestamp: number, signature: string): boolean {
  // STEP 1: Check timestamp freshness (prevent replay attacks)
  const currentTime = Math.floor(Date.now() / 1000);
  const age = Math.abs(currentTime - timestamp);

  if (age > 300) {
    console.warn(`[Security] Request too old: ${age} seconds`);
    return false;
  }

  // STEP 2: Compute expected signature
  const signatureBase = `v0:${timestamp}:${payload}`;
  const expectedSignature = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(signatureBase)
    .digest('hex');

  // STEP 3: Compare signatures using constant-time comparison
  try {
    return crypto.timingSafeEqual(
      Buffer.from(signature, 'hex'),
      Buffer.from(expectedSignature, 'hex')
    );
  } catch {
    return false;
  }
}

app.post('/webhooks/ticketcord', (req: Request, res: Response) => {
  const signature = req.headers['x-ticketcord-signature'] as string;
  const timestampHeader = req.headers['x-ticketcord-timestamp'] as string;
  const eventType = req.headers['x-ticketcord-event'] as string;

  if (!signature || !timestampHeader) {
    return res.status(401).json({ error: 'Missing signature headers' });
  }

  const timestamp = parseInt(timestampHeader, 10);
  if (isNaN(timestamp)) {
    return res.status(401).json({ error: 'Invalid timestamp' });
  }

  if (!verifySignature(req.rawBody!, timestamp, signature)) {
    console.warn(`[Security] Invalid signature for ${eventType} event`);
    return res.status(401).json({ error: 'Invalid signature' });
  }

  console.log(`[Webhook] Verified ${eventType} event`);

  // Process the event...

  res.status(200).json({ received: true });
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Secure webhook server running on port ${PORT}`);
});