Webhooks Quick Start

const crypto = require('crypto');
const express = require('express');
const { isLosslessNumber, parse: parseLossless } = require('lossless-json');
const app = express();
 
const callbackTypes = new Set([
  'apm-payment', 'card-payment', 'card-payout', 'card-refund', 'apm-payout'
]);
 
app.post('/webhooks/:callbackType', express.text({ type: 'application/json' }), async (req, res) => {
  // 1. Respond 200 immediately — prevents Exirom from retrying
  res.status(200).send('OK');
 
  // 2. Verify signature
  const received = req.headers['x-checksum'];
  const { callbackType } = req.params;
  if (!callbackTypes.has(callbackType)) return;
 
  const p = JSON.parse(req.body);
  const checksumPayload = callbackType === 'apm-payment'
    ? parseLossless(req.body)
    : p;
  const checksumField = value => isLosslessNumber(value) ? value.toString() : value;
 
  const fields = callbackType === 'apm-payment'
    ? [
        checksumPayload.accountId,
        checksumPayload.orderAmount,
        checksumPayload.orderCurrency,
        checksumPayload.transactionId,
      ].map(checksumField)
    : [p.transactionId, p.requestId, p.transactionStatus];
  const raw = fields.join('|');
 
  const expected = crypto
    .createHmac('sha256', process.env.MERCHANT_SECRET)
    .update(raw)
    .digest('base64');
  const expectedBytes = Buffer.from(expected);
  const receivedBytes = Buffer.from(received || '');
 
  if (expectedBytes.length !== receivedBytes.length
      || !crypto.timingSafeEqual(expectedBytes, receivedBytes)) {
    console.error('Invalid signature — ignoring callback');
    return;
  }
 
  // 3. Deduplicate
  const callbackIdentity = callbackType === 'card-refund'
    ? `${p.transactionId}:${p.requestId}`
    : p.transactionId;
  const key = `${callbackIdentity}:${p.transactionStatus}`;
  const exists = await db.webhookLog.findUnique({ where: { key } });
  if (exists) return;
  await db.webhookLog.create({ data: { key } });
 
  // 4. Dispatch to flow-specific business logic
  await enqueueVerifiedCallback({ callbackType, payload: p });
});