Webhooks

{
  "eventId": "evt_mu1pstuy_63a894ef9100ec4b",
  "eventType": "deposit.completed",
  "data": {
    "transactionId": "44444444-4444-4444-8444-444444444444",
    "status": "success"
  },
  "timestamp": "2026-09-14T20:48:02.222Z"
}

import crypto from 'node:crypto';

export function verifyFossaPayWebhook(body, signature, secret) {
  if (!body || typeof body.data !== 'object' || !secret) return false;

  const expected = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(body.data))
    .digest('hex');

  const received = String(signature || '');
  if (received.length !== expected.length) return false;

  return crypto.timingSafeEqual(
    Buffer.from(received, 'utf8'),
    Buffer.from(expected, 'utf8')
  );
}

app.post('/webhooks/fossapay', async (req, res) => {
  const signature = req.get('x-fossapay-signature');
  if (!verifyFossaPayWebhook(req.body, signature, process.env.FOSSAPAY_WEBHOOK_SECRET)) {
    return res.sendStatus(401);
  }

  const accepted = await insertInboxEventIfNew({
    eventId: req.body.eventId,
    eventType: req.body.eventType,
    data: req.body.data
  });

  res.sendStatus(200);
  if (accepted) await queueWebhookEvent(req.body.eventId);
});