expected = HMAC-SHA256(webhook_secret, "{timestamp}.{rawBody}").digest("hex")

import crypto from 'crypto';
import express from 'express';

function verifyWakapayWebhook({ rawBody, timestamp, signature, secret }) {
  if (!timestamp || !signature) return false;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');
  const a = Buffer.from(signature, 'hex');
  const b = Buffer.from(expected, 'hex');
  if (a.length !== b.length) return false;
  if (!crypto.timingSafeEqual(a, b)) return false;
  return Math.abs(Date.now() - Number(timestamp)) < 5 * 60 * 1000;
}

app.post(
  '/webhooks/wakapay',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const ok = verifyWakapayWebhook({
      rawBody: req.body,
      timestamp: req.get('X-Wakapay-Timestamp'),
      signature: req.get('X-Wakapay-Signature'),
      secret: process.env.WAKAPAY_WEBHOOK_SECRET,
    });
    if (!ok) return res.status(401).json({ detail: 'Invalid signature' });
    const payload = JSON.parse(req.body.toString('utf8'));
    // handle payload.event — e.g. mark the order paid on payment.paid
    res.status(200).json({ status: 'ok' });
  },
);