import express from 'express'
import crypto from 'crypto'

const app = express()
const SECRET = process.env.TRUEDY_WEBHOOK_SECRET!

// express.raw() preserves the exact bytes needed for HMAC verification
app.post('/webhooks/truedy', express.raw({ type: 'application/json' }), (req, res) => {
  const rawBody = req.body as Buffer
  const timestamp = req.headers['x-truedy-timestamp'] as string
  const signature = req.headers['x-truedy-signature'] as string

  // 1. Verify signature
  const msg = `${timestamp}.${rawBody.toString('utf8')}`
  const expected = crypto.createHmac('sha256', SECRET).update(msg).digest('hex')
  const now = Math.floor(Date.now() / 1000)
  const ts = parseInt(timestamp, 10)

  if (isNaN(ts) || now - ts > 300 || !crypto.timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(signature, 'hex'))) {
    return res.status(401).json({ error: 'Invalid signature' })
  }

  // 2. Parse and handle
  const event = JSON.parse(rawBody.toString('utf8'))
  console.log('Received:', event.event)

  switch (event.event) {
    case 'call.ended':
      // event.data.call.callId, event.data.call.duration, event.data.call.summary
      break
    case 'batch.completed':
      // event.data.batch_id
      break
  }

  res.status(204).send()
})

app.listen(3000)

import hashlib, hmac, json, os, time
from fastapi import FastAPI, Request, HTTPException
from fastapi.responses import Response

app = FastAPI()
SECRET = os.environ["TRUEDY_WEBHOOK_SECRET"]

@app.post("/webhooks/truedy")
async def handle(request: Request):
    raw = await request.body()
    ts = request.headers.get("x-truedy-timestamp", "")
    sig = request.headers.get("x-truedy-signature", "")

    # 1. Verify
    now = int(time.time())
    try:
        t = int(ts)
    except ValueError:
        raise HTTPException(401, "Bad timestamp")
    if now - t > 300:
        raise HTTPException(401, "Stale timestamp")

    expected = hmac.new(SECRET.encode(), f"{ts}.{raw.decode()}".encode(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, sig):
        raise HTTPException(401, "Invalid signature")

    # 2. Handle
    event = json.loads(raw)
    print("Received:", event["event"])

    if event["event"] == "call.ended":
        call = event["data"].get("call", {})
        print(f"  call_id={call.get('callId')} duration={call.get('duration')}s")

    return Response(status_code=204)