SDK webhook verification

import type { VerifyWebhookOptions, WebhookEventBase } from '@isnap/sdk'

declare function verifyWebhook(
  rawBody: string,
  headers: Record<string, string | string[] | undefined> | Headers,
  secret: string | readonly string[],
  options?: VerifyWebhookOptions
): WebhookEventBase

declare function parseWebhookEvent(rawBody: string): WebhookEventBase

import {
  isLineEvent,
  isMessageEvent,
  isReactionEvent,
  type WebhookEventBase
} from '@isnap/sdk'

export function summarize(event: WebhookEventBase): string {
  if (isMessageEvent(event)) {
    const { message } = event.data
    // Not in the type: read it as unknown, then check it.
    const chatId = (event.data as Record<string, unknown>).chat_id
    const chat = typeof chatId === 'string' ? ` in ${chatId}` : ''
    return `${event.event_type}: ${message.id} is ${message.status}${chat}`
  }
  if (isReactionEvent(event)) {
    // direction selects the variant: from_handle when inbound, actor_handle when outbound.
    const author = event.data.direction === 'inbound' ? 'the contact' : 'the line'
    return `${event.event_type}: ${event.data.reaction_type} by ${author} on ${event.data.parent_message_id}`
  }
  if (isLineEvent(event)) {
    const lineId = event.data.line_id
    return `${event.event_type}: ${typeof lineId === 'string' ? lineId : 'see data.line'}`
  }
  return `${event.event_type}: not handled`
}

import { createServer } from 'node:http'
import { WebhookSignatureError, verifyWebhook } from '@isnap/sdk'

const secret = process.env.ISNAP_WEBHOOK_SECRET
if (!secret) throw new Error('Set ISNAP_WEBHOOK_SECRET')

const seen = new Set<string>()

createServer((req, res) => {
  const chunks: Buffer[] = []
  req.on('data', (chunk: Buffer) => chunks.push(chunk))
  req.on('end', () => {
    // The body as received: never an object that was parsed and serialized again.
    const rawBody = Buffer.concat(chunks).toString('utf8')
    try {
      const event = verifyWebhook(rawBody, req.headers, secret)
      if (!seen.has(event.event_id)) {
        console.log(event.event_type, event.event_id)
        // Record the event_id only after the work succeeded.
        seen.add(event.event_id)
      }
      res.writeHead(204).end()
    } catch (err) {
      res.writeHead(err instanceof WebhookSignatureError ? 400 : 500).end()
    }
  })
}).listen(3000)

import { WebhookSignatureError, verifyWebhook, type WebhookEventBase } from '@isnap/sdk'

const secret = process.env.ISNAP_WEBHOOK_SECRET
if (!secret) throw new Error('Set ISNAP_WEBHOOK_SECRET')

const seen = new Set<string>()

export const handleWebhook = async (request: Request): Promise<Response> => {
  // Read the body as text. request.json() loses the bytes that were signed.
  const rawBody = await request.text()

  let event: WebhookEventBase
  try {
    event = verifyWebhook(rawBody, request.headers, secret)
  } catch (err) {
    if (err instanceof WebhookSignatureError) return new Response(null, { status: 400 })
    throw err
  }

  if (!seen.has(event.event_id)) {
    console.log(event.event_type, event.event_id)
    // Record the event_id only after the work succeeded.
    seen.add(event.event_id)
  }
  return new Response(null, { status: 204 })
}