Receive real-time event notifications via webhooks

import crypto from "crypto";

function verifyDubuSignature(rawBody, signatureHeader, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");

  const received = signatureHeader.replace("sha256=", "");

  // Pad to equal length before comparing to avoid length-based timing leaks
  const expectedBuf = Buffer.from(expected, "hex");
  const receivedBuf = Buffer.from(received, "hex");

  if (expectedBuf.length !== receivedBuf.length) {
    return false;
  }

  return crypto.timingSafeEqual(expectedBuf, receivedBuf);
}

// Express example
app.post(
  "/webhooks/dubu",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = req.headers["x-dubu-signature"];
    const secret = process.env.DUBU_WEBHOOK_SECRET;

    if (!verifyDubuSignature(req.body, signature, secret)) {
      return res.status(401).json({ error: "Invalid signature" });
    }

    const event = JSON.parse(req.body.toString());

    // Respond quickly — process asynchronously if needed
    res.status(200).json({ received: true });

    handleEvent(event);
  }
);

function handleEvent(event) {
  switch (event.event) {
    case "deposit.settled":
      fulfillOrder(event.data);
      break;
    case "deposit.failed":
      notifyCustomerOfFailure(event.data);
      break;
    case "checkout.payment.completed":
      activateSubscription(event.data.invoice_id);
      break;
    case "withdrawal.completed":
      updateWithdrawalRecord(event.data);
      break;
    default:
      console.log("Unhandled event:", event.event);
  }
}