Accept Crypto Payments

import express from "express";
import crypto from "crypto";

const app = express();

// Use raw body for signature verification
app.use(
  "/webhooks/yativo",
  express.raw({ type: "application/json" }),
  async (req, res) => {
    // 1. Verify signature immediately
    const signature = req.headers["x-webhook-signature"] as string;
    const secret = process.env.YATIVO_WEBHOOK_SECRET!;
    const expectedSig = crypto
      .createHmac("sha256", secret)
      .update(req.body)
      .digest("hex");

    if (
      !signature ||
      !crypto.timingSafeEqual(
        Buffer.from(signature),
        Buffer.from(expectedSig)
      )
    ) {
      return res.status(401).json({ error: "Invalid signature" });
    }

    // 2. Parse event
    const event = JSON.parse(req.body.toString());

    // 3. Return 200 immediately — process async
    res.sendStatus(200);

    // 4. Process asynchronously
    setImmediate(async () => {
      try {
        await processEvent(event);
      } catch (err) {
        console.error("Failed to process event", event.eventId, err);
      }
    });
  }
);

async function processEvent(event: any) {
  // Idempotency: skip already-processed events
  const alreadyProcessed = await db.events.exists(event.eventId);
  if (alreadyProcessed) return;

  switch (event.type) {
    case "deposit.detected":
      // Optionally notify user of pending deposit — don't credit yet
      await notifyUserPendingDeposit(event.data);
      break;

    case "deposit.confirmed":
      const { accountId, amount, asset, chain, txHash } = event.data;

      // Look up the user by accountId
      const user = await db.users.findByYativoAccountId(accountId);
      if (!user) {
        console.warn("No user found for accountId", accountId);
        return;
      }

      // Credit the user
      await db.balances.credit(user.id, asset, amount);
      await db.transactions.record({
        userId: user.id,
        type: "deposit",
        asset,
        chain,
        amount,
        txHash,
        yativoEventId: event.eventId,
      });

      await notifyUserDepositConfirmed(user, amount, asset);
      break;
  }

  // Mark event as processed
  await db.events.markProcessed(event.eventId);
}