Universal Webhooks Engine

// Node.js (Express)
import express from 'express';
import crypto from 'crypto';

const app = express();
const WEBHOOK_SECRET = process.env.TALK2SITE_WEBHOOK_SECRET; // e.g. "whsec_..."

// Capture raw body buffer for signature verification
app.post('/api/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-talk2site-signature'];
  if (!signature) {
    return res.status(401).send('Missing X-Talk2Site-Signature header');
  }

  // Compute expected HMAC-SHA256
  const hmac = crypto.createHmac('sha256', WEBHOOK_SECRET);
  const digest = 'sha256=' + hmac.update(req.body).digest('hex');

  // Secure constant-time comparison to prevent timing attacks
  const isValid = crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(digest)
  );

  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }

  const payload = JSON.parse(req.body.toString('utf8'));
  console.log('Verified Talk2Site event:', payload.event);

  if (payload.event === 'lead.created') {
    const lead = payload.data;
    console.log('New lead captured:', lead.name, lead.email);
    // Forward to CRM (HubSpot, Salesforce, Slack, etc.)
  }

  res.status(200).json({ received: true });
});

app.listen(3000, () => console.log('Webhook receiver running on port 3000'));