Webhook reconciliation

import { createHmac, timingSafeEqual } from "node:crypto";
import express from "express";

const app = express();
const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET!;

app.post(
  "/webhooks/request-network",
  express.raw({ type: "application/json" }),
  async (req, res) => {
    const signature = req.headers["x-request-network-signature"] as string;
    const deliveryId = req.headers["x-request-network-delivery"] as string;

    if (!signature || !deliveryId) {
      return res.status(400).send("missing headers");
    }

    // 1. Verify signature against the RAW body — never re-stringify
    const expected = createHmac("sha256", WEBHOOK_SECRET)
      .update(req.body)
      .digest("hex");

    const sigBuf = Buffer.from(signature, "hex");
    const expBuf = Buffer.from(expected, "hex");

    if (
      sigBuf.length !== expBuf.length ||
      !timingSafeEqual(sigBuf, expBuf)
    ) {
      return res.status(401).send("invalid signature");
    }

    try {
      // 2. Parse and route. Each business operation uses deliveryId as an
      // idempotency key in its own durable store.
      const event = JSON.parse(req.body.toString("utf8"));

      // Test deliveries verify reachability and signature handling only.
      // Do not let placeholder test data change application state.
      if (req.headers["x-request-network-test"] === "true") {
        return res.status(200).send("test received");
      }

      await handleEvent(event, deliveryId);
      return res.status(200).send("ok");
    } catch (err) {
      console.error("handler failed", err);
      return res.status(500).send("handler error");
    }
  },
);

async function handleEvent(event: any, deliveryId: string) {
  switch (event.event) {
    case "payment.confirmed":
      await markOrderPaid(event.requestId, event.txHash, deliveryId);
      break;

    case "client_id.linked":
      await recordLinkedPlatform(
        event.clientId,
        event.destinationId,
        event.linkId,
        event.intentId,
        deliveryId,
      );
      break;

    case "kyt.screening.completed":
      await recordScreeningResult(
        event.paymentToken,
        event.status,
        event.provider,
        deliveryId,
      );
      break;

    case "payment.failed":
      await flagFailedPayment(event.requestId, deliveryId);
      break;

    // Payer-funnel telemetry from the Secure Payment Page. Never reconcile
    // money off this — a payer can approve in their wallet and still have the
    // transaction fail on-chain. Wait for payment.confirmed for settlement.
    case "secure_payment.user_event":
      await recordFunnelStep(
        event.securePaymentToken,
        event.userEvent,
        deliveryId,
      );
      break;

    // A payer-wallet allowlist rejection. This is useful for monitoring and
    // audit history, but it does not change the payment's settlement state.
    case "secure_payment.access_rejected":
      await recordPayerWalletRejection(
        event.requestId,
        event.attemptedPayerWalletAddress,
        deliveryId,
      );
      break;

    // ... others
  }
}

async function markOrderPaid(
  requestId: string,
  txHash: string,
  deliveryId: string,
) {
  await db.transaction(async (tx) => {
    const order = await tx.orders.findOne({ where: { requestId } });
    if (!order) return; // not ours

    const claim = await tx.execute(
      `INSERT INTO webhook_deliveries (delivery_id)
       VALUES ($1)
       ON CONFLICT (delivery_id) DO NOTHING`,
      [deliveryId],
    );
    if (claim.rowCount === 0) return; // already applied

    await tx.orders.update({
      where: { id: order.id },
      data: { paidAt: new Date(), txHash },
    });
  });
}

case "payment.failed":
  await fetch(SLACK_WEBHOOK, {
    method: "POST",
    body: JSON.stringify({
      text: `:warning: Payment failed for request ${event.requestId}`,
    }),
  });
  break;

ngrok http 3000
# Pass the https://xxxxx.ngrok-free.app URL to POST /v1/webhook (above)