Webhooks

{
  "event": "payment.completed",
  "timestamp": "2024-01-15T12:05:30.000Z",
  "data": {
    "transactionId": "TX000007272",
    "status": "completed",
    "amount": 10000,
    "currency": "XOF",
    "fees": 150,
    "netAmount": 9850,
    "provider": "wave",
    "providerReference": "WAVE-TXN-123456",
    "externalReference": "COMMANDE-12345",
    "customerPhone": "+221771234567",
    "customerName": "Amadou Diallo",
    "paidAt": "2024-01-15T12:05:30.000Z",
    "metadata": {
      "orderId": "12345"
    }
  }
}

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// Dans votre handler Express
app.post('/webhooks/cauris', (req, res) => {
  const signature = req.headers['x-cauris-signature'];
  const isValid = verifyWebhook(
    JSON.stringify(req.body),
    signature,
    process.env.WEBHOOK_SECRET
  );

  if (!isValid) {
    return res.status(401).send('Invalid signature');
  }

  // Répondre immédiatement
  res.status(200).send('OK');

  // Traiter en arrière-plan
  processWebhook(req.body);
});