import crypto from 'crypto';

function verifyWebhookSignature(
  payload, // Raw request body as string
  signatureHeader, // X-Monk-Signature header value
  secret, // Your webhook signing secret
  toleranceSeconds = 300
) {
  // Parse the signature header
  const parts = signatureHeader.split(',');
  const timestamp = parseInt(
    parts.find(p => p.startsWith('t='))?.slice(2) || '0'
  );
  const signature = parts.find(p => p.startsWith('v1='))?.slice(3) || '';

  // Check timestamp tolerance (prevent replay attacks)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestamp) > toleranceSeconds) {
    throw new Error('Webhook timestamp outside tolerance window');
  }

  // Compute expected signature
  const signedPayload = `${timestamp}.${payload}`;
  const expected = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Constant-time comparison
  const signatureBuffer = Buffer.from(signature, 'utf8');
  const expectedBuffer = Buffer.from(expected, 'utf8');

  if (signatureBuffer.length !== expectedBuffer.length) {
    return false;
  }

  return crypto.timingSafeEqual(signatureBuffer, expectedBuffer);
}

// Usage with Express.js
app.post(
  '/webhooks/monk',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const payload = req.body.toString();
    const signature = req.headers['x-monk-signature'];

    try {
      if (
        !verifyWebhookSignature(
          payload,
          signature,
          process.env.MONK_WEBHOOK_SECRET
        )
      ) {
        return res.status(401).send('Invalid signature');
      }

      const data = JSON.parse(payload);
      const event = req.headers['x-monk-event'];

      // Process the webhook
      console.log(`Received ${event}:`, data);

      res.status(200).send('OK');
    } catch (err) {
      console.error('Webhook error:', err.message);
      res.status(400).send('Webhook error');
    }
  }
);