Webhooks

// Node.js 18 or later with Express. Read the raw body: the signature covers the exact bytes.
import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.VISAFLOW_WEBHOOK_SECRET; // whsec_REPLACE_WITH_YOUR_ENDPOINT_SECRET
const TOLERANCE_SECONDS = 300; // reject requests older than 5 minutes

export function verifySignature(rawBody, header, secret, now = Math.floor(Date.now() / 1000)) {
  const parts = String(header || "").split(",").map((p) => p.trim().split("="));
  const timestamp = parts.find(([k]) => k === "t")?.[1];
  const signatures = parts.filter(([k]) => k === "v1").map(([, v]) => v);
  if (!timestamp || signatures.length === 0) return false;
  if (Math.abs(now - Number(timestamp)) > TOLERANCE_SECONDS) return false;
  const expected = crypto.createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  // During a secret rotation there are two v1 values. Accept the request if either matches.
  return signatures.some(
    (sig) => sig.length === expected.length && crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)),
  );
}

const app = express();
app.post("/webhooks/visaflow", express.raw({ type: "application/json" }), (req, res) => {
  const raw = req.body.toString("utf8");
  if (!verifySignature(raw, req.get("X-VisaFlow-Signature"), SECRET)) {
    return res.status(400).send("Invalid signature");
  }
  const event = JSON.parse(raw);
  // event.id is the same on every retry and resend: skip ids you already handled.
  console.log(event.event, event.data.id);
  res.sendStatus(200); // answer 2xx within 10 seconds, do slow work afterwards
});
app.listen(8080);