Local Development

# Install globally
npm install -g localtunnel

# Start your local server
npm run dev  # Running on port 3000

# Create a tunnel with a custom subdomain
lt --port 3000 --subdomain my-webhook-test

# Your URL will be:
# https://my-webhook-test.loca.lt

# Note: First request may show a landing page with a button to continue.
# This can interfere with webhook delivery. Use --print-requests to debug.

# macOS
brew install cloudflared

# Linux
wget -q https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared-linux-amd64.deb

# Quick tunnel (no account required, temporary URL)
cloudflared tunnel --url http://localhost:3000

# Output:
# Your quick Tunnel has been created! Visit it at:
# https://random-words-123.trycloudflare.com

# Start your local server
npm run dev  # Running on port 3000

# Create tunnel via SSH
ssh -R 80:localhost:3000 serveo.net

# Output will show your public URL:
# Forwarding HTTP traffic from https://random123.serveo.net

# For a custom subdomain (may not always be available):
ssh -R myapp:80:localhost:3000 serveo.net

// server.js
const express = require('express');
const crypto = require('crypto');

const app = express();
app.use(express.json());

const WEBHOOK_SECRET = process.env.HOOKMESH_WEBHOOK_SECRET || 'whsec_dev_secret';

// Middleware: Verify webhook signature
function verifySignature(req, res, next) {
  const signature = req.headers['webhook-signature'];

  if (!signature) {
    console.error('[Webhook] Missing signature');
    return res.status(401).json({ error: 'Missing signature' });
  }

  // Extract webhook ID, timestamp, and signature from headers
  const webhookId = req.headers['webhook-id'];
  const timestamp = req.headers['webhook-timestamp'];

  if (!webhookId || !timestamp || !signature) {
    console.error('[Webhook] Missing required headers');
    return res.status(401).json({ error: 'Missing required headers' });
  }

  // Extract signature (format: "v1,<signature>")
  const parts = signature.split(',');
  if (parts[0] !== 'v1') {
    console.error('[Webhook] Invalid signature version');
    return res.status(401).json({ error: 'Invalid signature version' });
  }
  const expectedSignature = parts[1];

  // Construct signed content: {webhookId}.{timestamp}.{jsonPayload}
  const body = JSON.stringify(req.body);
  const signedContent = `${webhookId}.${timestamp}.${body}`;

  // Compute HMAC-SHA256 and encode as base64
  const hmac = crypto.createHmac('sha256', WEBHOOK_SECRET);
  hmac.update(signedContent);
  const computedSignature = hmac.digest('base64');

  // Compare signatures (timing-safe)
  if (!crypto.timingSafeEqual(
    Buffer.from(expectedSignature),
    Buffer.from(computedSignature)
  )) {
    console.error('[Webhook] Invalid signature');
    return res.status(401).json({ error: 'Invalid signature' });
  }

  console.log('[Webhook] Signature verified ✓');
  next();
}

// Webhook endpoint
app.post('/webhooks/hookmesh', verifySignature, async (req, res) => {
  const { event_id, event_type, payload, timestamp } = req.body;

  console.log(`[Webhook] Received: ${event_type}`, {
    event_id,
    timestamp,
    payload,
  });

  try {
    // Handle different event types
    switch (event_type) {
      case 'user.created':
        console.log(`[Webhook] New user: ${payload.email}`);
        // Process user creation
        await createUser(payload);
        break;

      case 'user.updated':
        console.log(`[Webhook] Updated user: ${payload.user_id}`);
        // Process user update
        await updateUser(payload);
        break;

      case 'payment.succeeded':
        console.log(`[Webhook] Payment succeeded: ${payload.payment_id}`);
        // Process payment
        await recordPayment(payload);
        break;

      default:
        console.warn(`[Webhook] Unknown event type: ${event_type}`);
    }

    // Return 200 to acknowledge receipt
    res.status(200).json({
      status: 'processed',
      event_id,
    });
  } catch (error) {
    console.error('[Webhook] Processing error:', error);
    // Return 500 to trigger retry
    res.status(500).json({
      error: 'Processing failed',
    });
  }
});

// Health check endpoint
app.get('/health', (req, res) => {
  res.json({ status: 'ok' });
});

// Dummy processing functions (replace with your logic)
async function createUser(payload) {
  // Simulate async database operation
  await new Promise(resolve => setTimeout(resolve, 100));
  console.log(`Created user in database: ${payload.user_id}`);
}

async function updateUser(payload) {
  await new Promise(resolve => setTimeout(resolve, 100));
  console.log(`Updated user in database: ${payload.user_id}`);
}

async function recordPayment(payload) {
  await new Promise(resolve => setTimeout(resolve, 100));
  console.log(`Recorded payment in database: ${payload.payment_id}`);
}

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`\nServer running on http://localhost:${PORT}`);
  console.log(`Webhook endpoint: http://localhost:${PORT}/webhooks/hookmesh`);
  console.log(`\nTo expose this server:`);
  console.log(`  ngrok http ${PORT}`);
  console.log(`  lt --port ${PORT}`);
  console.log(`  cloudflared tunnel --url http://localhost:${PORT}\n`);
});