Receive verification events without continuously polling.

import express from 'express';
import crypto from 'node:crypto';

const app = express();
const WEBHOOK_SECRET = process.env.PHONEVERIFLO_WEBHOOK_SECRET;

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-phoneveriflo-signature'];
  const timestamp = req.headers['x-phoneveriflo-timestamp'];
  const rawBody = req.body.toString('utf8');

  // Verify HMAC-SHA256 signature
  const expectedSig = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSig))) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(rawBody);
  console.log(`Received event: ${event.type} for job: ${event.data.jobId}`);
  res.status(200).json({ received: true });
});