// Node.js Example
const crypto = require('crypto');

function verifyWebhookSignature(payload, receivedSignature, secretKey) {
  // Extract signature from payload
  const { signature, ...payloadWithoutSignature } = payload;
  
  // Sort parameters alphabetically
  const sortedKeys = Object.keys(payloadWithoutSignature).sort();
  
  // Create values object
  const values = {};
  for (const key of sortedKeys) {
    values[key] = String(payloadWithoutSignature[key]);
  }
  
  // Create string to sign (URL-encoded key-value pairs)
  const params = new URLSearchParams();
  for (const key of sortedKeys) {
    params.append(key, values[key]);
  }
  const stringToSign = params.toString();
  
  // Generate expected signature
  const expectedSignature = crypto
    .createHmac('sha256', secretKey)
    .update(stringToSign)
    .digest('hex');
  
  // Use constant-time comparison for security
  return crypto.timingSafeEqual(
    Buffer.from(receivedSignature, 'hex'),
    Buffer.from(expectedSignature, 'hex')
  );
}

// Express.js webhook handler example
const express = require('express');
const app = express();

// Middleware to get raw body for signature verification
app.use('/webhook', express.raw({ type: 'application/json' }));

app.post('/webhook', (req, res) => {
  try {
    // Parse the JSON payload
    const payload = JSON.parse(req.body.toString());
    
    // Verify signature
    const secretKey = process.env.FUNDPAY_SECRET_KEY;
    if (!secretKey) {
      return res.status(500).json({ error: 'Secret key not configured' });
    }
    
    const isValid = verifyWebhookSignature(payload, payload.signature, secretKey);
    
    if (!isValid) {
      return res.status(401).json({ error: 'Invalid signature' });
    }
    
    // Process webhook payload
    console.log('Valid webhook received:', payload);
    
    // Update your database based on transaction status
    // await updateTransactionStatus(payload.transaction_id, payload.status);
    
    res.status(200).json({ success: true });
  } catch (error) {
    console.error('Webhook processing error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

app.listen(3000, () => {
  console.log('Webhook server listening on port 3000');
});