Overview

const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
    
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(`sha256=${expectedSignature}`)
  );
}

// Usage in webhook handler
app.post('/webhooks', express.raw({type: 'application/json'}), (req, res) => {
  const signature = req.headers['x-webhook-signature'];
  const isValid = verifyWebhookSignature(req.body, signature, process.env.WEBHOOK_SECRET);
  
  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }
  
  // Process the webhook event
  const event = JSON.parse(req.body);
  processWebhookEvent(event);
  res.status(200).send('OK');
});

const crypto = require('crypto');

function decryptWebhookPayload(encryptedPayload, key, iv) {
  const decipher = crypto.createDecipherGCM('aes-256-gcm', key);
  decipher.setIV(iv);
  
  let decrypted = decipher.update(encryptedPayload, 'base64', 'utf8');
  decrypted += decipher.final('utf8');
  
  return JSON.parse(decrypted);
}

// Usage with encrypted webhooks
app.post('/webhooks/encrypted', (req, res) => {
  const { encrypted_payload, iv, tag } = req.body;
  
  try {
    const decryptedData = decryptWebhookPayload(
      encrypted_payload, 
      process.env.ENCRYPTION_KEY, 
      iv
    );
    
    processWebhookEvent(decryptedData);
    res.status(200).send('OK');
  } catch (error) {
    console.error('Decryption failed:', error);
    res.status(400).send('Decryption failed');
  }
});

{
  "id": "evt_1234567890abcdef",
  "type": "payment.completed",
  "api_version": "2024-03-01",
  "created": "2024-03-20T15:30:00.000Z",
  "data": {
    "object": {
      "id": "pay_abcdef1234567890",
      "amount": 1000.00,
      "currency": "usdc",
      "status": "completed",
      "customer_id": "cus_1234567890",
      "created_at": "2024-03-20T15:25:00.000Z",
      "completed_at": "2024-03-20T15:30:00.000Z"
    }
  },
  "metadata": {
    "app_id": "app_your_application_id",
    "environment": "production",
    "retry_count": 0
  }
}

class WebhookEventProcessor {
  constructor() {
    this.handlers = new Map();
  }
  
  // Register event handlers
  on(eventType, handler) {
    if (!this.handlers.has(eventType)) {
      this.handlers.set(eventType, []);
    }
    this.handlers.get(eventType).push(handler);
  }
  
  // Process incoming webhook events
  async process(webhookEvent) {
    const { type, data } = webhookEvent;
    const handlers = this.handlers.get(type) || [];
    
    // Execute all handlers for this event type
    await Promise.all(
      handlers.map(handler => handler(data, webhookEvent))
    );
  }
}

// Usage
const processor = new WebhookEventProcessor();

processor.on('payment.completed', async (data) => {
  await updateOrderStatus(data.object.id, 'paid');
  await sendPaymentConfirmation(data.object.customer_id);
});

processor.on('transfer.completed', async (data) => {
  await updateTransferStatus(data.object.id);
  await notifyRecipient(data.object.recipient_id);
});

// In webhook endpoint
app.post('/webhooks', async (req, res) => {
  try {
    await processor.process(req.body);
    res.status(200).send('OK');
  } catch (error) {
    console.error('Webhook processing failed:', error);
    res.status(500).send('Internal Server Error');
  }
});

class PaymentStateMachine {
  constructor() {
    this.states = {
      'created': ['pending', 'failed'],
      'pending': ['completed', 'failed'],
      'completed': ['refunded'],
      'failed': ['pending'],
      'refunded': []
    };
  }
  
  async updateState(paymentId, newState, webhookData) {
    const payment = await this.getPayment(paymentId);
    const validTransitions = this.states[payment.state] || [];
    
    if (!validTransitions.includes(newState)) {
      throw new Error(`Invalid state transition from ${payment.state} to ${newState}`);
    }
    
    await this.updatePayment(paymentId, {
      state: newState,
      updated_at: webhookData.created,
      webhook_event_id: webhookData.id
    });
    
    // Trigger side effects based on state change
    await this.handleStateChange(payment, newState, webhookData);
  }
}

// Webhook handler using state machine
processor.on('payment.*', async (data, webhookEvent) => {
  const stateMachine = new PaymentStateMachine();
  const eventType = webhookEvent.type.split('.')[1]; // Extract state from event type
  
  await stateMachine.updateState(
    data.object.id, 
    eventType, 
    webhookEvent
  );
});