import express from "express";
import crypto from "node:crypto";

const WEBHOOK_SECRET = process.env.BRAINSTORMER_WEBHOOK_SECRET!;
const app = express();

// IMPORTANT: capture the RAW body — HMAC must be computed over exact bytes.
app.use(
  "/api/hook",
  express.raw({ type: "application/json" }),
);

function verify(rawBody: Buffer, signatureHeader: string | undefined): boolean {
  if (!signatureHeader?.startsWith("sha256=")) return false;
  const expected = crypto
    .createHmac("sha256", WEBHOOK_SECRET)
    .update(rawBody)
    .digest("hex");
  const provided = signatureHeader.slice("sha256=".length);
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(provided, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

app.post("/api/hook", (req, res) => {
  const raw = req.body as Buffer; // Buffer from express.raw
  if (!verify(raw, req.header("X-Brainstormer-Signature"))) {
    return res.status(401).send("invalid signature");
  }

  const event = JSON.parse(raw.toString("utf8"));
  if (event.status === "ready") {
    // e.g. email the user a link to chat at event.agentSlug
    console.log("Agent ready:", event.agentSlug);
  } else if (event.status === "failed") {
    console.error("Build failed:", event.error?.code, event.error?.message);
  }

  res.status(200).send("ok"); // ack fast; non-2xx triggers a retry
});

app.listen(3000);

BODY='{"buildId":"bld_test","status":"ready"}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "$BRAINSTORMER_WEBHOOK_SECRET" | sed 's/^.* //')

curl -X POST https://yourapp.com/api/hook \
  -H "Content-Type: application/json" \
  -H "X-Brainstormer-Event: ready" \
  -H "X-Brainstormer-Signature: sha256=$SIG" \
  -d "$BODY"