import crypto from 'crypto';
import express from 'express';

const app = express();
// Ensure you capture the raw body string for HMAC calculation
app.use(express.json());

app.post('/webhooks/eznotary', (req, res) => {
  const signature = req.headers['x-eznotary-signature'];
  const event = req.headers['x-eznotary-event'];
  const saltKey = process.env.EZNOTARY_WEBHOOK_SALT_KEY;

  // Calculate HMAC SHA-256
  const expectedSignature = crypto
    .createHmac('sha256', saltKey)
    .update(JSON.stringify(req.body))
    .digest('hex');

  if (signature !== expectedSignature) {
    console.error('Invalid signature! Rejecting payload.');
    return res.status(401).send('Invalid signature');
  }

  console.log(`Received valid event: ${event}`, req.body);
  
  // Handle event
  switch (event) {
    case 'session.completed':
      // Download notarized document or update DB
      break;
    default:
      break;
  }

  // Always return 200 OK within 5 seconds
  res.status(200).json({ received: true });
});