Webhooks

import crypto from 'crypto';
import express from 'express';

const app = express();
// Important: verify against the raw body
app.post(
  '/webhooks/sendexa-video',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const secret = process.env.SENDEXA_WEBHOOK_SECRET;
    const signature = req.get('X-Sendexa-Signature') || '';
    const raw = req.body; // Buffer

    const expected =
      'sha256=' +
      crypto.createHmac('sha256', secret).update(raw).digest('hex');

    const ok =
      signature.length === expected.length &&
      crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

    if (!ok) {
      return res.status(401).send('invalid signature');
    }

    const event = JSON.parse(raw.toString('utf8'));

    // Idempotency: skip if event.id already processed
    switch (event.type) {
      case 'video.room.started':
        // mark session live
        break;
      case 'video.room.ended':
        // close ticket timer
        break;
      case 'video.participant.joined':
      case 'video.participant.left':
        // attendance
        break;
      case 'video.recording.ready':
        // enqueue download of event.data.url
        break;
      default:
        break;
    }

    // Respond fast — heavy work goes to a queue
    res.status(200).json({ received: true });
  }
);