Receive real-time events from Zautic in minutes

// Node.js (Express) - production-safe signature verification
// Install: npm i express
import crypto from "crypto";
import express from "express";

const app = express();

// IMPORTANT: we need raw body to verify the signature.
app.use("/webhooks/zautic", express.raw({ type: "application/json" }));

app.post("/webhooks/zautic", async (req, res) => {
  const secret = process.env.ZAUTIC_WEBHOOK_SECRET; // from Zautic dashboard
  const signatureHeader = String(req.header("X-Zautic-Signature") || "");
  const deliveryId = String(req.header("X-Zautic-Delivery-Id") || "");

  if (!secret) return res.status(500).send("Missing secret");

  // Idempotency: store deliveryId (or event.id) and ignore duplicates.
  // if (await alreadyProcessed(deliveryId)) return res.sendStatus(200);

  const rawBody = req.body.toString("utf8");
  const { t, v1 } = (() => {
    const parts = signatureHeader.split(",").map(p => p.trim());
    const map = Object.fromEntries(parts.map(p => p.split("=")));
    return { t: map.t, v1: map.v1 };
  })();

  if (!t || !v1) return res.status(400).send("Invalid signature header");

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");

  const ok = crypto.timingSafeEqual(Buffer.from(v1, "hex"), Buffer.from(expected, "hex"));
  if (!ok) return res.status(400).send("Signature mismatch");

  const event = JSON.parse(rawBody);

  // Process quickly (enqueue work) and ACK with 2xx.
  switch (event.type) {
    case "message.delivered":
      // enqueueJob("message.delivered", event);
      break;
    case "message.received":
      // enqueueJob("message.received", event);
      break;
    default:
      break;
  }

  // Mark deliveryId as processed (idempotency)
  // await markProcessed(deliveryId);

  return res.sendStatus(200);
});

app.listen(3000, () => console.log("Listening on http://localhost:3000"));