Webhook setup

import crypto from 'node:crypto';
import express from 'express';
import { saveInboxOnce } from './webhook-inbox.js';

const secret = process.env.SHIELDLABS_WEBHOOK_SECRET;
if (!secret) throw new Error('SHIELDLABS_WEBHOOK_SECRET is required');
const app = express();

// Register before any global express.json() middleware.
app.post('/webhooks/shieldlabs', express.raw({ type: 'application/json' }), async (req, res) => {
  if (!Buffer.isBuffer(req.body)) return res.sendStatus(400);
  const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(req.body).digest('hex');
  const received = req.get('X-Shield-Signature') ?? '';
  const a = Buffer.from(expected);
  const b = Buffer.from(received);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) return res.sendStatus(401);

  let event;
  try { event = JSON.parse(req.body.toString('utf8')); }
  catch { return res.sendStatus(400); }
  if (event.event_type === 'webhook.ping') return res.sendStatus(204);
  if (!['identification.scored', 'hre.multi_account.changed'].includes(event.event_type)) {
    return res.sendStatus(204);
  }
  const id = event.event_id ?? (
    event.event_type === 'identification.scored' && event.data?.identification_id
      ? `${event.data.domain}:${event.event_type}:${event.data.identification_id}` : null
  );
  if (!id) return res.sendStatus(400);
  try {
    await saveInboxOnce(id, event); // unique ID + payload committed atomically
    return res.sendStatus(204);
  } catch {
    return res.sendStatus(503); // no acknowledgment before durable storage
  }
});
app.listen(3000);