const express = require("express");
const crypto = require("crypto");
const app = express();
app.use(express.json());
const SIGNATURE_SECRET = "your-signature-secret";
const ENCRYPTION_SECRET = "your-encryption-secret";
const ENCRYPTION_SALT = "your-encryption-salt";
app.post("/webhook", (req, res) => {
try {
const signature = req.headers["x-signature"];
const timestamp = req.headers["x-timestamp"];
// 1. Verify signature
const expected = generateSignature(req.body, SIGNATURE_SECRET, timestamp);
if (signature !== expected)
return res.status(401).send("Invalid signature");
// 2. Decrypt payload
const { iv, data, tag } = req.body;
const key = crypto.pbkdf2Sync(
Buffer.from(ENCRYPTION_SECRET, "base64"),
ENCRYPTION_SALT,
10000,
32,
"sha256"
);
const decipher = crypto.createDecipheriv(
"aes-256-gcm",
key,
Buffer.from(iv, "base64")
);
decipher.setAuthTag(Buffer.from(tag, "base64"));
const decrypted = Buffer.concat([
decipher.update(Buffer.from(data, "base64")),
decipher.final(),
]).toString("utf8");
const webhook = JSON.parse(decrypted);
console.log("Webhook received:", webhook);
res.sendStatus(200);
} catch (err) {
res.status(500).send(err.message);
}
});
app.listen(5000, () => console.log("Listening on port 5000"));
