Webhook Integration

# Example
Partner ID: yourpartner
Webhook URL: https://api.yourapp.com/webhooks/parchment

{
  "partner_id": "demo",
  "webhook_url": "https://api.yourapp.com/webhooks/parchment",
  "webhook_secret": "whsec_a1b2c3d4e5f6...",
  "message": "Webhook registered successfully. Store this secret securely - it will not be shown again."
}

import express from 'express';
import crypto from 'crypto';

const app = express();

// Retrieve from your secrets manager (e.g. AWS Secrets Manager, HashiCorp Vault)
let WEBHOOK_SECRET: string;

async function start() {
  WEBHOOK_SECRET = await getSecret('parchment-webhook-secret');
  app.listen(3000);
}

app.post('/webhooks/parchment',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-webhook-signature'] as string;
    const payload = req.body.toString('utf8');

    // Step 1: Verify the signature
    const result = verifyWebhook(payload, signature, WEBHOOK_SECRET);
    if (!result.valid) {
      console.error('Signature verification failed:', result.error);
      return res.status(400).json({ error: 'Invalid signature' });
    }

    // Step 2: Parse and route by event type
    const event = JSON.parse(payload);

    switch (event.event_type) {
      case 'prescription.created':
        handlePrescriptionCreated(event);
        break;
      default:
        console.log('Unhandled event type:', event.event_type);
    }

    // Step 3: Acknowledge receipt
    res.status(200).json({ received: true });
  }
);

function verifyWebhook(
  payload: string,
  signatureHeader: string,
  secret: string,
  toleranceSeconds = 300
): { valid: boolean; error?: string } {
  const parts = signatureHeader.split(',');
  let timestamp: number | null = null;
  let signature: string | null = null;

  for (const part of parts) {
    const [key, value] = part.split('=');
    if (key === 't') timestamp = parseInt(value, 10);
    else if (key === 'v1') signature = value;
  }

  if (!timestamp || !signature || isNaN(timestamp)) {
    return { valid: false, error: 'Invalid signature header format' };
  }

  // Check timestamp tolerance (prevents replay attacks)
  if (Math.abs(Math.floor(Date.now() / 1000) - timestamp) > toleranceSeconds) {
    return { valid: false, error: 'Timestamp expired' };
  }

  // Compute expected signature
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${payload}`)
    .digest('hex');

  // Timing-safe comparison
  const isValid = crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );

  return isValid ? { valid: true } : { valid: false, error: 'Signature mismatch' };
}

function handlePrescriptionCreated(event: any) {
  console.log('New prescription:', event.data.scid);
  // Fetch full details via API using the SCID
}

start();