const crypto  = require('crypto');
const express = require('express');
const app     = express();

// Must be set BEFORE express.json() to capture raw bytes
app.use('/webhooks/fyatu', express.raw({ type: 'application/json' }));

function verifyFyatuSignature(rawBody, signatureHeader, rawSecret) {
  const parts = Object.fromEntries(
    signatureHeader.split(',').map(p => p.split('='))
  );
  const timestamp = parts['t'];
  const v1        = parts['v1'];

  if (!timestamp || !v1) return false;

  // Derive signing key: hex(SHA-256(rawSecret))
  const signingKey = crypto.createHash('sha256')
    .update(rawSecret, 'utf8')
    .digest('hex');

  // Sign: HMAC-SHA256(signingKey, "{timestamp}.{body}")
  const message  = `${timestamp}.${rawBody}`;
  const expected = crypto.createHmac('sha256', signingKey)
    .update(message, 'utf8')
    .digest('hex');

  // Constant-time compare
  return crypto.timingSafeEqual(
    Buffer.from(v1, 'hex'),
    Buffer.from(expected, 'hex')
  );
}

app.post('/webhooks/fyatu', (req, res) => {
  const sigHeader = req.headers['x-fyatu-signature'];
  const rawSecret = process.env.FYATU_WEBHOOK_SECRET;

  if (!sigHeader) return res.status(400).json({ error: 'Missing signature' });

  if (!verifyFyatuSignature(req.body, sigHeader, rawSecret)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const payload   = JSON.parse(req.body);
  const eventId   = req.headers['x-fyatu-event-id'];
  const eventType = payload.event;

  switch (eventType) {
    case 'TRANSACTION_AUTHORIZED':
      // show pending transaction in cardholder's history
      break;
    case 'CARDHOLDER_KYC_APPROVED':
      // unlock card issuance for this cardholder
      break;
    case 'CARD_ISSUED':
      // mark card as ready in your system
      break;
  }

  res.status(200).json({ received: true });
});