Webhook Delivery

import crypto from 'crypto';
import express from 'express';

const app = express();

// IMPORTANTE: Use raw body para verificação
app.post('/webhooks/chargefy', express.raw({ type: 'application/json' }), (req, res) => {
  const webhookId = req.headers['webhook-id'] as string;
  const timestamp = req.headers['webhook-timestamp'] as string;
  const signature = req.headers['webhook-signature'] as string;

  const secret = process.env.CHARGEFY_WEBHOOK_SECRET!;

  // Verificar timestamp (tolerância de 5 minutos)
  const now = Math.floor(Date.now() / 1000);
  const webhookTimestamp = parseInt(timestamp, 10);
  if (Math.abs(now - webhookTimestamp) > 300) {
    return res.status(401).json({ error: 'Timestamp expired' });
  }

  // Calcular assinatura esperada
  const payload = req.body.toString();
  const signedContent = `${webhookId}.${timestamp}.${payload}`;

  // O secret pode ter prefixo "whsec_" que deve ser removido
  const secretBytes = Buffer.from(
    secret.startsWith('whsec_') ? secret.slice(6) : secret,
    'base64'
  );

  const expectedSignature = crypto
    .createHmac('sha256', secretBytes)
    .update(signedContent)
    .digest('base64');

  // Comparação segura contra timing attacks
  const signatures = signature.split(' ');
  const isValid = signatures.some(sig => {
    const sigValue = sig.startsWith('v1,') ? sig.slice(3) : sig;
    return crypto.timingSafeEqual(
      Buffer.from(expectedSignature),
      Buffer.from(sigValue)
    );
  });

  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Assinatura válida — processar evento
  const event = JSON.parse(payload);
  console.log(`Evento recebido: ${event.type}`);

  switch (event.type) {
    case 'subscription.active':
      // Liberar acesso, enviar email, etc.
      handleSubscriptionActive(event.data);
      break;
    case 'subscription.canceled':
      // Revogar acessos
      handleSubscriptionCanceled(event.data);
      break;
    // ... outros eventos
  }

  // Responder com 200 rapidamente
  res.status(200).json({ received: true });
});

# Instalar ngrok
npm install -g ngrok

# Expor porta local
ngrok http 3000

# Use a URL gerada (https://abc123.ngrok.io) como URL do webhook