import crypto from 'crypto'
import express, { Request, Response } from 'express'

const app = express()

// IMPORTANT: use express.raw() to preserve the exact body bytes for HMAC
app.post('/webhooks/truedy', express.raw({ type: 'application/json' }), (req: Request, res: Response) => {
  const rawBody = req.body as Buffer
  const timestamp = req.headers['x-truedy-timestamp'] as string
  const signature = req.headers['x-truedy-signature'] as string
  const secret = process.env.TRUEDY_WEBHOOK_SECRET!

  if (!verifyTruedyWebhook(rawBody, timestamp, signature, secret)) {
    return res.status(401).json({ error: 'Invalid signature' })
  }

  const event = JSON.parse(rawBody.toString('utf8'))
  console.log('Event received:', event.event)

  // Acknowledge quickly — do heavy work in a background job
  res.status(204).send()

  // Process asynchronously
  processWebhookAsync(event).catch(console.error)
})

function verifyTruedyWebhook(
  rawBody: Buffer,
  timestamp: string,
  signature: string,
  secret: string
): boolean {
  // 1. Replay protection: reject timestamps older than 5 minutes
  const now = Math.floor(Date.now() / 1000)
  const ts = parseInt(timestamp, 10)
  if (isNaN(ts) || now - ts > 300 || ts > now + 60) {
    return false
  }

  // 2. Compute expected HMAC
  const message = `${timestamp}.${rawBody.toString('utf8')}`
  const expected = crypto
    .createHmac('sha256', secret)
    .update(message)
    .digest('hex')

  // 3. Constant-time comparison (prevents timing attacks)
  if (expected.length !== signature.length) return false
  return crypto.timingSafeEqual(
    Buffer.from(expected, 'hex'),
    Buffer.from(signature, 'hex')
  )
}

async function processWebhookAsync(event: Record<string, unknown>) {
  switch (event.event) {
    case 'call.ended':
      // update CRM, store transcript, etc.
      break
    case 'batch.completed':
      // finalize campaign reporting
      break
    default:
      console.log('Unhandled event type:', event.event)
  }
}