Webhooks

import express from "express";
import crypto from "crypto";

const app = express();
const SECRET = process.env.RCS_WEBHOOK_SECRET;

// Important: verify against the raw body
app.post(
  "/webhooks/rcs",
  express.raw({ type: "application/json" }),
  (req, res) => {
    const signature = String(req.headers["x-sendexa-signature"] || "");
    const expected = crypto
      .createHmac("sha256", SECRET)
      .update(req.body)
      .digest("hex");

    const valid =
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

    if (!valid) {
      return res.status(401).json({ error: "Invalid signature" });
    }

    const payload = JSON.parse(req.body.toString("utf8"));

    // Idempotency: ignore duplicate event ids
    // await db.events.ensureUnique(payload.id)

    switch (payload.event) {
      case "rcs.delivered":
        console.log("Delivered", payload.data.messageId, payload.data.channel);
        break;
      case "rcs.read":
        console.log("Read", payload.data.messageId);
        break;
      case "rcs.failed":
        console.error("Failed", payload.data.messageId, payload.data.error);
        break;
      case "rcs.user_reply":
        console.log("Reply from", payload.data.from, payload.data.text?.body);
        // Route into bot / helpdesk
        break;
      case "rcs.suggestion_click":
        console.log(
          "Click",
          payload.data.suggestion?.type,
          payload.data.suggestion?.postbackData ||
            payload.data.suggestion?.url ||
            payload.data.suggestion?.phoneNumber
        );
        break;
      default:
        console.log("Unhandled", payload.event);
    }

    // Respond quickly — do heavy work async
    res.status(200).json({ received: true });
  }
);

app.listen(3000);