Webhooks & Events

const crypto = require("crypto");

function verifyWebhookSignature(payload, signature, secret) {
  const parts = signature.split(",");
  const timestamp = parts[0].split("=")[1];
  const signatureHash = parts[1].split("=")[1];

  // Check timestamp (prevent replay attacks)
  const now = Math.floor(Date.now() / 1000);
  if (Math.abs(now - timestamp) > 300) {
    // 5 minutes
    throw new Error("Webhook timestamp too old");
  }

  // Compute expected signature
  const signedPayload = `${timestamp}.${JSON.stringify(payload)}`;
  const expectedHash = crypto
    .createHmac("sha256", secret)
    .update(signedPayload)
    .digest("hex");

  // Compare signatures (constant-time comparison)
  if (
    !crypto.timingSafeEqual(
      Buffer.from(signatureHash, "hex"),
      Buffer.from(expectedHash, "hex")
    )
  ) {
    throw new Error("Invalid webhook signature");
  }

  return true;
}

// Express.js example
app.post("/webhooks/quub", express.json(), (req, res) => {
  const signature = req.headers["x-quub-signature"];
  const secret = process.env.WEBHOOK_SECRET;

  try {
    verifyWebhookSignature(req.body, signature, secret);

    // Process webhook
    const { eventType, data } = req.body;
    handleWebhookEvent(eventType, data);

    res.status(200).json({ received: true });
  } catch (error) {
    console.error("Webhook verification failed:", error);
    res.status(400).json({ error: "Invalid signature" });
  }
});

app.post("/webhooks/quub", async (req, res) => {
  // Immediately acknowledge receipt
  res.status(200).json({ received: true });

  // Process asynchronously
  processWebhookAsync(req.body);
});

const processedEvents = new Set();

async function processWebhook(event) {
  // Check if already processed
  if (processedEvents.has(event.eventId)) {
    console.log("Event already processed:", event.eventId);
    return;
  }

  // Process event
  await handleEvent(event);

  // Mark as processed
  processedEvents.add(event.eventId);
}

async function handleWebhookEvent(eventType, data) {
  try {
    switch (eventType) {
      case "order.filled":
        await handleOrderFilled(data);
        break;
      case "deposit.completed":
        await handleDepositCompleted(data);
        break;
      default:
        console.log("Unhandled event type:", eventType);
    }
  } catch (error) {
    console.error("Error processing webhook:", error);
    // Log to monitoring service
    await logError(error);
  }
}

const ws = new WebSocket("wss://api.quub.exchange/events/v1/stream");

ws.onopen = () => {
  // Authenticate
  ws.send(
    JSON.stringify({
      type: "auth",
      token: "YOUR_ACCESS_TOKEN",
      orgId: "org_456",
    })
  );

  // Subscribe to events
  ws.send(
    JSON.stringify({
      type: "subscribe",
      events: ["order.filled", "trade.executed"],
    })
  );
};

ws.onmessage = (event) => {
  const data = JSON.parse(event.data);
  console.log("Event received:", data);
};