const crypto = require('crypto');

// Middleware to verify webhook signatures
function verifyWebhookSignature(req, res, next) {
  const signature = req.headers['x-vouchid-signature'];
  const timestamp = req.headers['x-vouchid-timestamp'];
  const rawBody = req.rawBody; // You need raw body - see note below

  if (!signature || !timestamp) {
    return res.status(401).json({ error: 'Missing signature headers' });
  }

  // 1. Check timestamp is within 5 minutes (replay protection)
  const timestampDate = new Date(timestamp);
  const now = new Date();
  const diffMinutes = Math.abs(now - timestampDate) / (1000 * 60);

  if (diffMinutes > 5) {
    return res.status(401).json({ error: 'Timestamp too old' });
  }

  // 2. Compute expected signature
  const signatureInput = `${timestamp}.${rawBody}`;
  const expectedSignature = 'sha256=' + crypto
    .createHmac('sha256', process.env.VOUCHID_WEBHOOK_SECRET)
    .update(signatureInput)
    .digest('hex');

  // 3. Compare signatures (timing-safe)
  if (!crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  )) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  next();
}

// IMPORTANT: Preserve raw body for signature verification
app.use('/webhooks/vouchid', express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf.toString();
  }
}));

app.post('/webhooks/vouchid', verifyWebhookSignature, (req, res) => {
  const { eventType, eventId, data } = req.body;

  // TODO: Check eventId for deduplication

  switch (eventType) {
    case 'case.created':
      console.log('New compliance case:', data.caseId);
      // Handle case creation
      break;
    case 'vid.fraud_status_changed':
      console.log('Fraud status changed:', data.scopedVid, data.action);
      // Handle fraud status change
      break;
    // ... handle other event types
  }

  // Always return 200 quickly to acknowledge receipt
  res.status(200).json({ received: true });
});