كيف تعمل الـ Webhooks

{
  "id": "evt_9f0c2d7a41b84e6f9c3a5b7d1e2f4a6c",
  "type": "verification.verified",
  "created_at": "2026-10-28T10:01:12.000Z",
  "data": {
    "id": "5d3c1f0e-7a1b-4c55-9a7e-2f1d6b0c9e11",
    "object": "verification",
    "mode": "live",
    "phone": "+9647701234567",
    "status": "verified",
    "channel": "telegram",
    "channels": [
      "whatsapp",
      "telegram",
      "sms"
    ],
    "attempts": 1,
    "max_attempts": 5,
    "attempts_remaining": 4,
    "locale": "ar",
    "metadata": {
      "user_id": 8841
    },
    "expires_at": "2026-10-28T10:05:00.000Z",
    "verified_at": "2026-10-28T10:01:12.000Z",
    "created_at": "2026-10-28T10:00:00.000Z"
  }
}

import crypto from "node:crypto";
import express from "express";

const app = express();
const SECRET = process.env.WATSY_WEBHOOK_SECRET; // whsec_…

// Keep the raw body: the signature covers the exact bytes we sent.
app.post("/watsy/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const raw = req.body.toString("utf8");
  const header = req.get("Watsy-Signature") ?? "";
  const parts = Object.fromEntries(
    header.split(",").map((kv) => {
      const i = kv.indexOf("=");
      return [kv.slice(0, i).trim(), kv.slice(i + 1).trim()];
    }),
  );
  const t = Number(parts.t);
  if (!Number.isInteger(t) || Math.abs(Date.now() / 1000 - t) > 300) return res.sendStatus(400);

  const expected = crypto.createHmac("sha256", SECRET).update(`${t}.${raw}`).digest();
  const given = Buffer.from(parts.v1 ?? "", "hex");
  if (given.length !== expected.length || !crypto.timingSafeEqual(given, expected)) {
    return res.sendStatus(400);
  }

  const event = JSON.parse(raw);
  // Deduplicate by event.id, then handle event.type / event.data.
  res.sendStatus(200);
});